- please stop spamming this - but anyone who deploys thousands of lines of vibe-coded C that implements a transforming HTTP proxy from scratch instead of a patch (hey, it “might even be safer than the patch”!) deserves…
So was “months” a typo for “4 days” or what?
Which companies? The earliest claim of an exploit attempt in the wild I had heard was October 17th, and that was “extant”, not “rampant”. I don’t suppose you’re thinking of when the issue was discovered? That was August…
Linking a reasonable way to create a necessary RAM disk rootlessly with namespaces to kernel exploits that involve namespaces seems like a massive reach.
Any comment now that it’s been done? Under somewhat more difficult conditions than many real-world deployments, with only a chance at $2k at stake, within about 4 hours (https://news.ycombinator.com/item?id=50233841) of…
It’d be redundant for me to write up the whole explanation here, but the short version is that every process has its own memory space, and pointers between different memory spaces are unrelated. Keywords you can use to…
I forget making the claim that JavaScript was a well-thought-out language. But yes, I can see how discussing programming language and library design/implementation, as or with the type of person who trots out trite…
> or if it's some address that's truly free and could be picked up by another process This isn’t a thing; virtual memory (https://en.wikipedia.org/wiki/Virtual_memory) is very old, and Linux has never not used it. It…
Blog post from a week ago with no “CRITICAL”, any reason to expect it not to look like the last one (https://nodejs.org/en/blog/vulnerability/july-2026-security-...)?
Much of Node’s standard library is written in JavaScript, which can’t go on to exploit V8 vulnerabilities even given similar types of bugs, so I wouldn’t say it’s in a similar place. Not as familiar with Java, but I…
Yes? How did you think Cloudflare and other WAFs worked?
> PHP doesn’t have any more than others. Yeah it does. Part of it is being a popular starter language before people know what they’re doing, but a lot of it is legitimately terrible language[1] and API design,…
Package versions released on npm are immutable, so no, they can’t. If you have unpinned transitive dependencies: that’s why I mentioned npm-shrinkwrap.json a couple of times. And again, npm is also an example of “a…
You’d be getting the supply chain put together by the software author in either case. It’s common to do both badly, but if you care about doing it well, that’s easier with npm (e.g. shrinkwrap, as mentioned) and can be…
To compare it to just one other option: when you run `npx foo`, you know* that you’re getting the same public artifact that anyone else running it at the same time would get. (If you have a `min-release-age` configured,…
cat >> ~/.bashrc <<'EOF' sudo() { sudo install-drivers-without-your-permission command sudo "$@" } EOF (this is not an endorsement of curl | sh, just an indictment of the state of software)
I tried both options, and both options visibly* degraded quality while failing to remove my hidden message. Consider that good schemes are already designed to be resilient in the face of lossy image compression, which…
Stop, stop, he’s already dead! You guys are getting straw everywhere.
I haven’t looked into the history, but my understanding from the comments is that it exists to preserve `x == y -> hash(x) == hash(y)` for `x` and `y` with different numeric types (int, float, decimal) – which seems…
> it's mostly "AI is bad because, full stop" anyhow Ooh, the rare* double straw man. Since you look like you could use the exercise in intellectual honesty, I’ll pose the question directly: can you think of any reason…
The partial comment you’re quoting is - not even a position - not something you were remotely “prescient” about
I think that constraint is about not being able to scale down the entire quilt (by a factor ≠1 common to all side lengths in it) to a smaller quilt.
Couldn’t wait more than 3 minutes for someone’s actual position before setting up that straw man to take down?
Actual title: “Vectorized and performance-portable Quicksort” (2022). Actual sense in which it’s first: > Happily, modern instruction sets (Arm SVE, RISC-V V, x86 AVX-512) include a special instruction suitable for…
> gradio is needed only for the demo. The model itself never needs it. The “Usage” section doesn’t involve installing any dependencies, for example: https://github.com/GraafHenk/numberwang#usage
- please stop spamming this - but anyone who deploys thousands of lines of vibe-coded C that implements a transforming HTTP proxy from scratch instead of a patch (hey, it “might even be safer than the patch”!) deserves…
So was “months” a typo for “4 days” or what?
Which companies? The earliest claim of an exploit attempt in the wild I had heard was October 17th, and that was “extant”, not “rampant”. I don’t suppose you’re thinking of when the issue was discovered? That was August…
Linking a reasonable way to create a necessary RAM disk rootlessly with namespaces to kernel exploits that involve namespaces seems like a massive reach.
Any comment now that it’s been done? Under somewhat more difficult conditions than many real-world deployments, with only a chance at $2k at stake, within about 4 hours (https://news.ycombinator.com/item?id=50233841) of…
It’d be redundant for me to write up the whole explanation here, but the short version is that every process has its own memory space, and pointers between different memory spaces are unrelated. Keywords you can use to…
I forget making the claim that JavaScript was a well-thought-out language. But yes, I can see how discussing programming language and library design/implementation, as or with the type of person who trots out trite…
> or if it's some address that's truly free and could be picked up by another process This isn’t a thing; virtual memory (https://en.wikipedia.org/wiki/Virtual_memory) is very old, and Linux has never not used it. It…
Blog post from a week ago with no “CRITICAL”, any reason to expect it not to look like the last one (https://nodejs.org/en/blog/vulnerability/july-2026-security-...)?
Much of Node’s standard library is written in JavaScript, which can’t go on to exploit V8 vulnerabilities even given similar types of bugs, so I wouldn’t say it’s in a similar place. Not as familiar with Java, but I…
Yes? How did you think Cloudflare and other WAFs worked?
> PHP doesn’t have any more than others. Yeah it does. Part of it is being a popular starter language before people know what they’re doing, but a lot of it is legitimately terrible language[1] and API design,…
Package versions released on npm are immutable, so no, they can’t. If you have unpinned transitive dependencies: that’s why I mentioned npm-shrinkwrap.json a couple of times. And again, npm is also an example of “a…
You’d be getting the supply chain put together by the software author in either case. It’s common to do both badly, but if you care about doing it well, that’s easier with npm (e.g. shrinkwrap, as mentioned) and can be…
To compare it to just one other option: when you run `npx foo`, you know* that you’re getting the same public artifact that anyone else running it at the same time would get. (If you have a `min-release-age` configured,…
cat >> ~/.bashrc <<'EOF' sudo() { sudo install-drivers-without-your-permission command sudo "$@" } EOF (this is not an endorsement of curl | sh, just an indictment of the state of software)
I tried both options, and both options visibly* degraded quality while failing to remove my hidden message. Consider that good schemes are already designed to be resilient in the face of lossy image compression, which…
Stop, stop, he’s already dead! You guys are getting straw everywhere.
I haven’t looked into the history, but my understanding from the comments is that it exists to preserve `x == y -> hash(x) == hash(y)` for `x` and `y` with different numeric types (int, float, decimal) – which seems…
> it's mostly "AI is bad because, full stop" anyhow Ooh, the rare* double straw man. Since you look like you could use the exercise in intellectual honesty, I’ll pose the question directly: can you think of any reason…
The partial comment you’re quoting is - not even a position - not something you were remotely “prescient” about
I think that constraint is about not being able to scale down the entire quilt (by a factor ≠1 common to all side lengths in it) to a smaller quilt.
Couldn’t wait more than 3 minutes for someone’s actual position before setting up that straw man to take down?
Actual title: “Vectorized and performance-portable Quicksort” (2022). Actual sense in which it’s first: > Happily, modern instruction sets (Arm SVE, RISC-V V, x86 AVX-512) include a special instruction suitable for…
> gradio is needed only for the demo. The model itself never needs it. The “Usage” section doesn’t involve installing any dependencies, for example: https://github.com/GraafHenk/numberwang#usage