patrakov

In a general context, not limited to vulnerability reports, I would disagree with the "slop is gone" statement. The frontier models got much better, and that's what good security researchers use. But bosses have contractual obligations resulting from GDPR-like laws and data processing agreements, and therefore they have to force onto their employees the use of local AI, which is still shitty. Not everyone has the hardware to run, for example, GLM 5.3 locally, and not everyone knows the correct harness setup that grounds the model in the truth that your organization has. And I have to deal with this.

Bad question - backups are the ultimate protection against accidental deletion, whether by your AI agent or by yourself. Did you mean "so that it can't exfiltrate sensitive stuff"?

And this is a real concern. Claude Code did run a "find" command going into a completely unexpected folder a few times and wasted time on some files it found. So my answer is: use the built-in VM-based protection in Claude Desktop instead of Claude Code.

This will also catch a SIM card in roaming, which is not a VPN.

We need strict liability on this front. Companies behind websites that embed ads that they didn't verify (and don't control) are complicit.

And that's a good wake-up call. The next thing "escaping" might be a sufficiently advanced model in a country already historically involved in manual cyberattacks.

RapidRaw is too much AI-focused, with the typical drawback that you cannot tell the AI that it is wrong. You want to remove something from the photo by inpainting something else over it, and the only way to do it in RapidRaw is to brush over what you want to remove and pray that the object is removed cleanly by AI. But often, the AI leaves even worse artifacts, and the low-tech solution, that is, manually selecting what you want to copy over, is not available.

Another issue is that the overblown highlight reconstruction is much worse than in DarkTable.

Even though I am not a Debian project member, let me express my dissatisfaction with Proposal A. The proposed addition to the Social Contract (i.e., the LLM contribution ban), by itself, is well-worded and acceptable, but the rationale quoted to justify it is not OK.

1. The copyright argument, even if true, is inconsistent with the permission to package third-party LLM-assisted software into Debian.

2. It is no longer the case that LLMs merely produce syntactically likely combinations of the training data. The best practice is to give LLMs access to a knowledge base (i.e., implement RAG) and instruct them to use that knowledge base.

3. The failure of the new packager to understand the best practices should be attributed to the lack of proper mentorship, not to their use of LLMs. A phrase "you can do better than this LLM" is expected to work better than a formal LLM ban.

4. I am not qualified to comment on LLM ethics and the load caused by collecting datasets for their training, so I will refrain from accepting or dismissing this piece of the rationale.

Try a gaming monitor, Gigabyte AORUS FV43U.

I was one of those initiators of a rewrite. And I was facing a real problem: the codebase was in C, all C developers except me left, I was going to leave too, and both our HR department and an external consulting firm failed to find a competent C developer to replace me.

So I said: screw performance, we are rewriting this thing into Go, as that's what our existing developers were willing to work with - with the intention of leaving when this would be done.

And the day I finally submitted my resignation letter, a competent C developer was found, and later I heard that the Go rewrite was scrapped.

I do have a DNS server in my LAN, with some records served to internal clients only. But the _acme-challenge record needs to be public for the DNS-01 validation to succeed.

The point was that you can obtain a certificate for a domain name without creating any records other than the _acme-challenge TXT record. I.e., that the domain might be completely empty all the time except for this record.

I am not a lawyer, but, as a Russian citizen, let me warn you. The very fact that your comment criticizing the EU regime, that you yourself admit could send you to jail, is online and not deleted by Thursday, makes it a "lasting crime". For lasting crimes, it does not matter that the regulation criminalizing the action or state of affairs was not in force when they started. What matters is that the condition defined as illegal (comment existing) is true when the regulation outlawing it is in force - i.e., that you did not cease and desist. Yes, this is a creative way authorities circumvent the ban on ex post facto laws - they say "it is not ex post facto".

Commented on Tuesday, deleted the comment on Wednesday, the regulation is enacted on Thursday => OK.

Commented on Tuesday, did not delete before Thursday => jail (and it does not matter that you can't delete it anymore because it has a reply).

Sarcasm of course, as Russian laws do not apply here.