This is not working. The number of #hackerone report submissions for #curl in 2025 is going through the roof, while the quality is going through the floor.
Even if you subtract the 35 likely slop submissions the trend stays the same, though. So, is the slop count an underestimation, or are there different root causes?
it's very hard to assess what is slop. I suspect a large amount of people get tricked by AIs but submit the report "in a human way" so that the AI's involvement is invisible. But that's just one theory.
Alas, I see the same on those security contact aliases I'm still on.
The highlight of the week was someone sending a several pages long report on an "exposed" Grafana instance, with API traces, screenshots, etc pp. Oh no, confidential data leakage! Asked for a bounty and urged to turn off anonymous access.
Yes, my bro, that is the *public* telemetry dashboard.
There's zero amount of thinking happening before they send those out. Asymmetric warfare.
in a few months time (yes new year's prediction) the industry will have a financial correction of indeterminate size ... after that it will be easier to reason with folks. As with any tech surge, there are a few things that are useful and a lot of speculation ... the scale (and speed) of all this is daunting mostly due to uncontrolled outcomes. Calm heads prevail.
similar experience on yeswehack. To be fair the platform owners are trying really hard to put a stop to it, but it's like trying to stop a tsunami with a portable umbrella. I'm beginning to think these platforms need to start charging a deposit for any submitted report...
If you get yelled at for calling the wrong number, you've just struck gold, because if they're allowed to yell at you, they have access to the internal corporate phone directory and can get you the person you actually want.
People underestimate the power of calling random numbers unrelated to their case (investor relations, press inquiries, legal and so on), and saying "sorry, Chat GPT told me to call this number when the main customer support hotline couldn't help me, can you give me the number for office x instead?"
Those people are usually a lot more empowered to actually help you than some outsourced third-world-country customer support contractor with no access to internal company systems beyond what's required to complete 90% of the most common inquiries.
I've moved pretty much all my daily driver stuff (except web browsing) from Windows to Mac, in preparation for my up-coming trip. I don't want to drag two laptops with me, so I'm using as much as I can on Mac OS, and have a Windows 11 virtual machine for the rest of it.
I stepped away from using Mac OS for a few years, and am now once again at the point where using it doesn't feel completely odd. So, that's exciting, I suppose.
I don't really talk to many Mac users. I know @FreakyFwoof uses it for music but am not sure whether that's all. I know someone else who basically abandoned the OS after more than a decade. Are there any fun hacks or just useful things you do to get it to play nice? Is terminal still as intolerable as ever? I feel like native apps are at least a little more common there, there's a lot of nice audio stuff, and I should enjoy it. But I feel like some quirk or bug always pushes me away from it and I end up back on Windows. My MacBook Air has spent entire months turned off.
@simon @FreakyFwoof I still hate Terminal with Voiceover. So, TDSR exists, and I use that instead. You can make Terminal behave a little better by changing the type of terminal being emulated and some other things, but TDSR still wins.
@simon @FreakyFwoof I haven’t touched windows since 2010 I do remember the terminal not working well in the past, but it seems to better for me now. And if I miss something I can just review the screen with VO.
@simon Yeah, that'd be great, but I'm less than hopeful, given all the crud going around, and being jammed inside a metal tube with a bunch of people for a few hours. We'll see, I guess.
Krásné páteční #dobréRáno přátelé #fediverse Dopoledne to vidím na lenošení a odpoledne do posilovny. Dnes to bude pohodovka den a zítra do kina na Avatar Fire and Ash 🤩
The USA's continuing attrition against Venezuelan small boats in the Caribbean has now reached a death toll of over a hundred.
Noam Chomsky always used to point out: if you want to understand how power works in international relations, in a case like this reverse the protagonists & ask what would then be happening?
So, if Venezuelan armed forces had attacked a number of small US boats in the Caribbean, killing their crew, how would that now being playing out?
> I still don't know how to solve those problems. But I still have a parser that solves those problems better than the reference implementation html5lib. Power of AI! :)
Oh yeah? Well can your AI cry in a quarterly performance review meeting? CHECKMATE
oye, pareciera que os encanta perder tiempo con chorradas a todos, yo ya tuve el desayuno de mi dirección, la comida de mi servicio, y aún falta la fiesta de la dirección general que será en enero. Y un "reflection workshop" de mi unidad (no, no es lo mismo que mi servicio) en Luxemburgo, pero por suerte a ese no tengo que ir.
fuimos a una pizzería bastante sin más, pero bueno, ya sabes, a caballo regalado...y como éramos 8 o así no pude evitar sentarme enfrente de la superioridad, pero bueno.
Nosotros ayer seríamos unos 25 o así. La superioridad se sentó en una mesa redonda, como el SXT y asesores llegaron algo más tarde, se pudo evitar caer en ella.
a la comida invitó el jefe de servicio, pero al desayuno y a la fiesta esperan que lleves tu propia comida, lo digo para que te vayas preparando por si lo hacen ahí también, ahora la modernidad es eso. Y hombre, estuvo curiosa la experiencia de que cada uno llevase lo que le gustase, pero queda un poco bastante rácano. Pero bueno, como siempre, para lo importante no hay presupuesto, y luego se gasta una pasta en gilipolleces.
Jaja, que fuerte. A ese nivel no hemos llegado. Lo que sí era el caso con el anterior conselleiro era que el pincho lo pagábamos los funcionarios de Secretaría, pero se traía de fuera. Desde que cambió el gobierno nos invita la consellería.
So, Takealot remains significantly better than Amazon South Africa, but it has still gotten consistently worse in one specific area:
Delivery times are becoming more and more meaningless.
Order something as a Christmas gift. For reasons of being an actual human being with a budget and having to wait till salaries arrive before ordering, we ordered the same month we expected it.
We paid extra for next-day delivery.
Three days later, "Your order has not been processed yet, we'll message you when it gets put in a box"
@FreakyFwoof Oh, takealot? Yeah, very familiar with that one. Didn’t see the name of the site in the post in which I was mentioned LOL. Bought all my studio gear on there, and I have to buy a 3 kW inverter from them any day now to deal with load shedding 😬.
At the very least it would be nice if they had a proper cloud streaming option for PC where you can access those older titles. You can do that on the PS5, but only on the PS5.
The only offering they have is less cloud and more akin to Steam Remote Play - you need to have a PS5 of your own connected to the internet and have the games installed
except with the PlayStation Portal now, which is interesting. It's basically Stadia: paid subscription for a library of games, plus you can digitally buy games and then stream them to the Portal. You can do that without ever owning a PS5. It makes me think they will open it up to other Remote Play platforms, but idk.
Krásné dobré ráno mastodonští! 🙋♀️🐶🐈 Už téměř měsíc se potýkám s bolestmi zad. Někde se mi uskřípl safraportský nervík a nejde to uvolnit. Cvičením, protahováním, léky. Šéfová to dobře ví. A hádejte co. Včera mě poslala za holkama na výrobnu, kde se netopí. Dělat vánoční svícny na hroby. 😂 Asi abych to rozehnala mrazem. No, obávám se, že dneska tam budu znovu. Teplé vybavení mám. Ale po sedmi hodinách už vám mrzne úplně všechno. Aspoň že je tam s holkama sranda. Jen se obávám, že v pondělí oznámím, že si vybírám dovolenou do konce roku. 😂😂😂 A vy si pamatujte, ne nutně všechno, co se zdá být špatné, je pro vás skutečně špatné. 😇 #dobre_rano #dobréRáno
@archos Volno je za rohem! 😊 A já jsem nabalená jako tučňák a mířím za rozesmátýma holkama, co mají pořád dobrou náladu. Lepší být v zimě s nimi, než v teple s (v poslední době stále) nenaladěnou šéfovou. Jenom se holt budu pohybovat jako osmdesátník s artrózou. 😁 (Tučňák s artritidou.... 🤣🤣🤣) Užívej volna a krásný den Archosi! 😊👋
Things are so broken here that, when you see a headline like "New audio emerges of Trump directing Republicans on how to overturn election results", you think "Oh, that's probably going to be buried tomorrow and not even make most news outlets, because of all the even worse things that have happened, and that are about to. But those things won't either, because it's all just broken." Yeah. Welcome to the United States of Disrepute.
Anyway, how's that 25th amendment doing? Not that it would help all that much at this point.
jj, s bidou den, a to ho nijak extremne nevyuzivam 🙇 Ale koukam, ze s temi grafy to hude slozitejsi. Toto je z druheho profilu. Ten ale evidentne nezaznamenal ctvrtecni nabiti, ani pouzivani 😕 Edit: nemas nahodou srovnani se spotrebou, kdyz tam je ten os od googlu?
Když nejede displej a data, tak na 6a dva dny dám. Data mi přijdou jako největší žrout, subjektivně víc než to bylo na CalyxOS s MicroG. U tebe zda se, to jsou taky data. Když nad tím přemýšlím, mohlo by to souviset - bez Google Play fungují notifikace u některých aplikací jinak, u tebe to bude třeba Signal, tedy pokud nepoužíváš Unified Push. FairEmail bude záviset na mailserveru a podpoře push notifikací, tam to systém myslím neovlivní.
@def díky. Unified push asi nepoužívám. Sice jsem si nainstaloval ntfy, ale nepřišel jsem na to, jak se nastavuje, tak jsem ho zase smazal 🤷 je na to nějaká kuchařka? Jsem čistokrevná lama 😉 FairMail tahám z gmailu. Mám raději používat nativní aplikaci Graphenu?
@def jestli potřebuje pomoc s ntfy docs.oscloud.cz/apps/ntfy/ a protokol připojení nastavit na websocket, ale na signalu stejně bez Google play notifikace nebudou fungovat.
Jinak teda spíš než prostory bych řešil, jak odejít od Gmailu a podobných Google aplikací. Mít Google Play v owner profilu je podle mě privátnější než používat Gmail, Google Kalendář apod. Místo aplikace Signal stačí Molly, je ve store Accrescent.@def
@archos na vlastníkovi žádné Google aplikace nemám (zatím tedy ani Google play). Kalendář, kontakty (synchronizace přes DAVx5), e-maily (Gmail přijímaný přes FairMail) atd. používám buď ty předinstalované, nebo fossify. Asi si nezvyknu na to přepínání profilů, tak přemýšlím, že nechám jen 2 (vlastník a banky) a smířím se s tím sandboxovým Googlem. Musím udělat inventuru toho, co mi chodí na Gmail, nechat ho jako zombie a začít využívat jako hlavní můj protonmail..nebo vymyslet něco jiného.
Já s profily taky bojuju, vždy to vyzkouším a pak je vymažu. Prostě to není komfort. Já vydržím tři týdny a pak si řeknu, že to sraní mi za to nestojí 😀😀 Hlavně Google play je v Sandboxu, to ze Google ví co mám za aplikace je myslím úplně jedno. Jinak s tím gmail atd chapu, jasný chce to všechno postupně 👍👍 Proton je super, mně teda vadí jak je to přeplácaný a cena, ale jinak super
A while ago, I made a deal with myself. If my music streaming service found me a song I really enjoyed--I played it a lot, felt happy when it came on--I'd buy the song. If the album were cheap enough and I like two or three songs on it, I'd buy the whole album. In the last couple days, I've spent around $35 on music from two artists I only just discovered, and I don't regret it at all. The artists got a little bit of actual money, and I own the music as unencrypted files not tied to streaming.
I have a few projects for this holiday break, most of my time will be spent hanging out with my wife, friends, playing Pokemon, and sleeping a lot, but around that I'll also record a lot of music and try to convert Akira to Gtk4
The US TikTok sale has been signed. The company will be controlled by a joint venture including Oracle, Silver Lake, Andreessen Horowitz, Abu Dhabi-based MGX. Adding a UAE company really makes it clear that this was never about national security concerns.
The designers of the MicroSD card format should be required to reimburse me 2x for every card I have lost, plus compensation for the time I've spent looking for them and the aggravation, with treble damages for intent.
You thought you could go through all of #Thursday without a headache, didn't you? Oh hahaha, my sweet summer child. Now that it's 10:32 PM, let us show you what you've been missing all day.
It was about this time on this day in 1997 when a defective candle set our living room on fire. We had to replace all the furniture, the carpets, and repaint the walls and ceiling. Good times, good times.
Found out today that my son and pretty much all there family is sick, again, so who gets screwed, again? Yep, me. Christmas will suck, again this year. That is all.
A quick reminder of a few things Mozilla/Firefox have done in the last *checks notes* ~year that I hope highlights that this is not a case of bad messaging but a consistent pattern of hostility:
- "Mozilla is going to be more active in digital advertising."
- "privacy preserving" Advertising telemetry enabled by default
- New T&C demanding a worldwide license (rolled back) & weakened privacy policy to support the above expansion (active)
- ""[Firefox] will evolve into a modern AI browser"
The leaders of an organization keep making announcements like "we are building the torment nexus", "we are a torment nexus company"
How much do you really weight a follow up PR statement on a smaller dev channel along the lines of: "we promise to give you a kill switch for the torment nexus that will probably be opt-in for some definition of opt-in....we can reasonably agree that opt-in is a vague term right?"
Opt-in means that the person needs to perform an explicit action in order to do something. Ideally it means that they do that action of their own accord, without being harassed. They do that because the software/features/whatever is exciting and/or solves a real problem they have.
Something so good you don't have to trick them into turning it on.
You know, like that time 20+ years ago when people actively sought out and downloaded Firefox because it was simply the better option.
The guy managing the account that posted about the kill switch and is confused about what opt-in is used to work at Google on Chrome. That explains why he's not really up to date about the meaning of opt-in...
🤔 TinyCorp, a small AI startup, succeeded in getting #Nvidia GPUs to operate for AI workloads on a #MacBook with #Apple Silicon through USB4 and Thunderbolt 4 conections. techradar.com/pro/security/app…
To spell this out clearly, the reason RAM has quadrupled in price is that a huge quantity of RAM that hasn't been produced yet has been bought with money that doesn't exist to populate GPUs that also haven't been produced to go in datacenters that haven't been built powered by infrastructure that may never exist to meet a demand that doesn't exist at all to make profit margins that mathematically can't exist while economists talk about this thing they call the "rational markets hypothesis".
Found what looks like an #NVDA bug, or possibly #notepad++ bug. An & followed by a space will read a fake command key suggestion when changing focus to the notepad++ window.
NVDA: 2025.3.2. Notepad++: 8.8.8.
Minimum reproduction:
Open notepad++, if a file is open use ctrl-n for new. Type the following string in the file: "& ". Alt-tab in and out. On the focus, NVDA will announce "alt+space".
Are there any book clubs on Mastodon? The in-person ones around me keep petering out or are hard to get to, and the ones I’ve seen online are toooo big for my tastes. I have a slight preference for fantasy/sci-fi, but any genre is good. I just want to talk about books! #bookstodon #books #reading
What’s been on my mind is how we respond when someone we care deeply about chooses to sit at tables, or stay in rooms, where we are not welcome.
I don’t think there’s one universally right answer. Context matters. Capacity matters. History matters.
That said, Tito and I were talking about this last week, and I asked him a simple question: “If you were invited to a party but told I wasn’t welcome, what would you do?”
He didn’t hesitate. “I wouldn’t go.”
I asked why. “Because we’re a team.”
That answer made me love him more.
I’ve come to understand loyalty less as a grand gesture and more as a pattern of choices. Loyalty is what happens when someone realizes you’re not welcome somewhere—and they feel that exclusion as misaligned with their values. Not because they’re told to, not out of obligation, but because proximity to you matters more than access to the room. That doesn’t make anyone else wrong. But it does tell me who I can build closely with.
Earlier this year, I found myself in several situations where people didn’t mind if close friends of mine were around—but there were others in the room who were uncomfortable with me, didn’t trust me, or simply didn’t like me. I watched who stayed anyway.
And I realized something uncomfortable: I couldn’t think of those friendships in the same way afterward. (1/3)
That doesn’t mean I stopped caring. It doesn’t mean they didn’t care about me. But it did clarify something important. There are people in my life who wouldn’t stay in a room where I wasn’t welcome. And that represents a level of loyalty I’ve learned I need—and deserve—in my closest relationships.
If someone doesn’t know or love me enough to feel moved to leave a space when they realize I’m excluded, that’s okay. Truly. But it tells me where we stand.
Because when people spend time around others who don’t like us, they begin—often without realizing it—to see us through those lenses. Resentment, distrust, and unspoken narratives bleed into perception. That’s why I choose, deliberately, to stay out of rooms where people are constantly speaking negatively about others. I’ve learned that it costs too much. That’s a personal boundary, not a moral judgment.
Earlier this year, I fell into a bout of depression when I realized I was prioritizing certain friendships more than I was being prioritized in return. But rather than let those thoughts fester, I shifted my focus.
I thought about who spoke up for me when I wasn’t there. Who warned me when they could have stayed silent. Who opened their homes. Who gave their time—hours, days—without keeping score.
And I remembered: I am deeply cared for.
Care just doesn’t always come from the places we expect. (2/3)
Not everyone has the emotional bandwidth to show care in the same way. Some people are overwhelmed. Some are stretched thin. And still—people make time for what matters most to them.
At the end of the day, I trust my gut. If something feels right, I go with it. If it doesn’t, I don’t. (3/3)
My heart goes out to all my compadres with anxiety. I don’t regularly have it, but am *very* anxious when it comes to the dentist. I finished my cleaning and was absolutely exhausted. Got me to thinking how much y’all have to do despite that anxiety every damned day, and you’re just frickin’ superheroes.
Wow, Chatterbox-Turbo is pretty good! As a quick test, I let two local LLMs ramble about random topics of their choice and generated audio using zero-shot voice cloning with Chatterbox-Turbo. resemble.ai/chatterbox-turbo/ #TTS #LLM #AI #ML @ZBennoui
@vick21 haha The text is from Gemini-3-27b. Yes, Chatterbox is open weight. It does not work on Mac out of the box, but I asked Gemini3 to modify it to use MPS and it worked. lol In the past, LLMs would not have been able to handle this kind of task, but they now seem to have enough knowledge of ML libraries. So far, I have also managed to get a few other CUDA-only models running on MPS with just vibe coding.
@vick21 In deed! I had a another TTS model which was not only developed for Cuda, but also used a dependency for speech codec that only worked for Cuda. Gemini cli not only modified the inference code for the model itself but also looked up the dependency library inside virtual environment and provided monkey patch so it can work with MPS. These frontier models are truely getting better! :)
@vick21 Yeah, definitely try gemini-cli or codex-cli if you have sub to one of those plans. I know Northeastern students have access to Claude, but it seems like they did not enable claude code. Maybe for obvious reason? lol Agentic coding is pretty wild, especially in --yolo for Gemini-cli (or --dangerously-bypass-approvals-and-sandbox for codex). lol
@vick21 Lol yeah I'm not sure if we have access to Claude code, I'll have to check. I can get Gemini CLI though, I'll take a look at that this weekend. Would be amazing if it could be used to just setup all these models without me having to jump through tons of hoops to make them work properly. Right now I'm scared to install anything so I just play with most of these through the hugging face demos lol.
There is a particular CUDA model I hear about that allows you to use your voice to sing anything. Do you know what I may be talking about? Would be awesome to have that running on Mac OS!
@vick21 I'm not sure, but are you talking about RVC? If so, you can already run that on Mac, but it's just extremely slow to train. You can just use Colab for it.
@vick21 I haven't followed with them for a while. Last time I tried like 2 years ago, they had v2. Also if you search, they have bunch of finetuned models for famous musicians. lol
@vick21 Zach, do you know any newer better singing voice models? It seems like the latest commit for RVC is from last November, and the v2 model is still the latest. Their main readme is in Chinese, but here's Readme in English. github.com/RVC-Project/Retriev…
@vick21 I'm honestly not sure about open source options, I know theres like Synthesizer V which is really good, but I don't think we can use it. Damn I wish I wasn't blind sometimes lol.
@vick21 If I produce a simple melody with piano accompanyment and provide the track with lyrics to Suno, I wonder if it can generate vocal part correctly. You won't have fine control like synth-v, but it might do the job. It might even sound more natural.
Clemens
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Clemens • • •Stefan Eissing
in reply to daniel:// stenberg:// • • •Oliver Schönrock
in reply to daniel:// stenberg:// • • •Maddening.
And there is probably more than the "indentified slop", as the growth is much higher than that?
daniel:// stenberg://
in reply to Oliver Schönrock • • •saxnot @ 39C3
in reply to daniel:// stenberg:// • • •your auntifa liza 🇵🇷 🦛 🦦
in reply to daniel:// stenberg:// • • •Lars Marowsky-Brée 😷
in reply to daniel:// stenberg:// • • •Alas, I see the same on those security contact aliases I'm still on.
The highlight of the week was someone sending a several pages long report on an "exposed" Grafana instance, with API traces, screenshots, etc pp. Oh no, confidential data leakage! Asked for a bounty and urged to turn off anonymous access.
Yes, my bro, that is the *public* telemetry dashboard.
There's zero amount of thinking happening before they send those out. Asymmetric warfare.
Jim Fuller
in reply to daniel:// stenberg:// • • •bluca
in reply to daniel:// stenberg:// • • •