Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the GRUB2, U-Boot, and Barebox open-source bootloaders.
If you want to listen to some guy demo Siri and talk about TTS for four minutes and eleven seconds, here you go lmao.
I talk about Siri's new TTS improvements in iOS 18.4, and try unsuccessfully to get info about places in California. Amazingly, I have much better luck with getting answers about machine learning and what it's used for. What a time to be alive, or something.
@Peiress Oh yeah I know what you're talking about. Wonder if the voice actor who recorded the data for this is precluded from doing any more work because her voice would be recognizable now. I haven't heard her on anything other than Siri and Apple adjacent things. Funnily enough, I did hear the VO artist who did Siri's TTS when iOS 7 was released in a AAA commercial.
This PR introduces two new changes.
A Go Library
systemd is an important set of libraries and utilities on modern Linux systems. The need to remove C in favour of memory-safe alternative is of peak...
In the Linux world, your choice of shell can significantly enhance your command-line experience. While Bash is the default shell on most Linux distributions…
Golf ball-sized hail pummeled Kerrville in South Central Texas on Sunday, March 23, causing damage to homes. This video, shared on Facebook by Terry Giles, s...
Apple updates all its operating systems, brings Apple Intelligence to Vision Pro Updates bring new emoji, Mail organization for Macs, easier Mac setup, and more. arstechnica.com/gadgets/2025/0…
let's spray my terrarium, water the South American tropicals and...... omg omg omg look at this look at the N. rubrifolia, they do that??? omg she must like the terrarium she loves me
Apple has today released iOS 18.4 and iPadOS 18.4 to the public; bringing new functionality for VoiceOver and braille users; several enhancements to Apple Intelligence, including priority notifications and expanded language support; as well as new em…
Qualcomm's 6G blueprint—Evolving the network, revolutionizing the experience "...Where 5G relied heavily on simulation and statistical modeling, 6G will be built and optimized using real-time, high-fidelity digital twins. Qualcomm’s vision involves creating precise, 3D models of the network and physical environment—tools that go far beyond planning exercises to become part of the network’s operational fabric. " rcrwireless.com/20250331/6g/qu…
ich soll eine #Managed #nextcloud von #ionos zu #Hostsharing migrieren. jetzt im Ernst? ionos.de/hilfe/datenschutz/ser… "Beachten Sie, dass die Datenbank bei Managed Nextcloud-Installationen nicht exportiert werden kann." Wenn ich wenigstens die App User Migration installieren könnte, aber die ist nicht in der Liste der zugelassenen Apps. bei #ossaas und bei #hostsharing gehören dir deine Daten wirklich, du kannst alle Apps installieren, und du kannst damit hingehen wo du willst!
Sie verwenden die Managed Nextcloud von IONOS und möchten Ihre Daten gemäß Art. 20 der DSGVO (Recht auf Datenübertragbarkeit) exportieren. Dieser Artikel erklärt Ihnen, wie Sie dafür vorgehen.
How much of your code do you feel like entrusting to Microsoft? How about American data centers? Here's an easy way to jump ship and maintain operations.
@muminpappa Indeed! I'm with them since the early days, when they were still named TeaHub (almost became a founding member then). And I'm of course a full member now
@mttaggart great write-up, thanks a lot! 🤩 Can you elaborate a little on using SSH to sign commits? Is that meanwhile possible without allowing the same key for auth as well? I so far only found this article on it in connection to Codeberg: bytes.zone/posts/signing-commi… (which mentioned that "handicap").
You can add as many SSH keys as you want to Codeberg, and as long as they're verified, you can use them for auth and signing. I do not believe there's a requirement that they be the same. You can configure a global signing key option, but like all Git configs, you can also do that per-repo.
(ssh-agent is going to be very useful here for managing multiple auth keys.)
Thanks! My concern was, as in the article I've linked, that I might want to use an SSH key for signing while not permitting it for login (hard to revoke it if it should get lost; removing it from my Codeberg account then would also mean all those commits showing up unverified, while a GPG key cannot be used for login, and it can be revoked when compromised).
Apologies if my question sounds "stupid", but I've heard about SSH signing only today, from your article 😉
@IzzyOnDroid Right so that is where ssh-agent comes in. Don't add the key in question to ssh-agent, and you won't use it for auth. It's not a hard "no," but you can still configure Git to use it for signing.
I would contend though that if you have any reason to "revoke" a key, it should not be conditional.
Oh, it's less about me accidentally using it to log in. But you're correct: as my GPG key, the SSH key should have a proper passphrase set – so even if someone "finds" the private key, it would be useless to them 🤷♂️ Guess I've let myself be carried-away a little by that article. But Brian has a point there: not being configured for auth makes it not usable for auth. Well, the term "military grade" was "signaled" out recently I've heard 🙊 💨
There's a new product that has been gaining some buzz in the blind community, a Windows app called Guide that uses AI to perform tasks on your computer. It's pitched as a way to get around web accessibility problems in particular. I won't link to the thing itself, because I don't want to give it that validation, but I'll link to a previous discussion thread about it: fed.interfree.ca/notes/a5wf4ys…
I've spent some time taking this app apart. The level of shoddy work here is deeply disgusting. 1/?
Final update: The developer is now on Mastodon via @andrew_guide.
Update: The developer has removed the ability to download Guide until the security issues mentioned in the linked thread are fixed.
Update: this product contains some code flaws that are concerning from a security perspective, beyond just giving control of your computer to an LLM. You might want to read this thread before installing the product: toot.cafe/@matt/114258349401221651
Update: I've exchanged some long emails with Andrew, the lead developer. He's open to dialogue, and moving the project in the right direction: well-scoped single tasks, more granular controls and permissions, etc. He doesn't strike me as an #AI maximalist can and should do everything all the time kind of guy. He's also investigating deeper screen reader interaction, to let AI just do the things we can't do that it's best at. I stand by my thoughts that the project isn't yet ready for prime time. But as someone else in the thread said, I don't think it should be written off entirely as yet another "AI will save us from inaccessibility" hype train. There is, in fact, something here if it gets polished and scoped a bit more.
Just tried guide for fun. It's supposed to be an app to use #AI to help #blind folks get things done. I asked "Where are the best liver and onions in Ottawa?" It: 1. Decided it needed to search the web. 2. Thought that the "stardew access" icon on my desktop was a kind of web browser, so clicked it. 3. Imagined an "accept cookies" dialogue it needed to accept. 4. Decided that didn't work, so looked for Google Chrome (I don't have chrome installed on that machine) 5. Finally opened edge from the start menu. By the way, it just...left Stardew open and running. Because apparently having Stardew Valley running in the background is a vital part of finding liver and onions in Ottawa. 6. Opened a random extension from my edge toolbar (goodlinks). 7. Clicked the address bar and loaded google.com, instead of just doing the search right from the address bar. 8. Got blocked because it couldn't sign into my Google account, even though it could have also searched from the Google homepage.
To be fair to AI, that was the kind of open-ended task AI is terrible at. If I had asked it to check an inaccessible checkbox, or read a screenshot, or something, I'm sure it would have been fine.
Anyway, I'm still better at using a computer than an AI. So is my 87 year old grandfather, for that matter. www.guideinteraction.com
With Guide, inaccessible doesn't have to mean undoable. Guide is a Windows AI assistant that helps people with low vision or blindness navigate the digital world.
First, it's an Electron+Python monstrosity. Specifically, the Python backend runs as a web server on the local machine, and the Electron frontend connects to that local web server. Along with the size of Electron itself, the frontend app is about 27 MB, mostly a node_modules tree with no hint of tree-shaking / dead code elimination. The front-end JavaScript code is not minified at all, so once you extract the .asar file, it's easy to look at it. 2/?
The frontend being fully unobfuscated would of course be a good thing if this were supposed to be open source, but it's not. And that frontend seems to be the only part of the program that validates that you have the license/subscription. That's just begging to be cracked. 3/?
But now let's talk about the Python backend. The first obvious question, of course, is what AI model it's using, and whether the inference is done locally or remotely. It's using Claude 3.7 Sonnet with its computer use feature. But here's the really crappy part: the connection to Claude, and to other services like Azure Speech and ElevenLabs (yes, both), is happening on the user's machine, using API keys embedded inside the application. 4/?
To spell it out, the problem with directly connecting to third-party services using API keys inside an application running on a user's machine is that you're just begging to have someone steal those keys and run up your bills. Without having your own server in the mix, there's no hope of reining in that usage of third-party services and tying it to some kind of authorization system. They do have an API server (on Azure) for the license/subscription, but as I said, that's easily circumvented. 5/?
The Python backend is packaged using pyinstaller. There's 30 MB (compressed) of Python bytecode in the executable, and then there's also an "_internal" directory with tons of dependencies, adding up to about 200 MB (uncompressed), again with no apparent attempt at eliminating dead code in the package. I readily admit that I'm perhaps overly obsessed with trying to make non-bloated software, but come on. 6/?
It wouldn't be right for me to knock the product for the bloat alone. But taken together with the direct use of third-party services in the app on the user's machine, and the actual functionality problems detailed in the thread I linked to, the whole thing smells of something hastily cobbled together to catch a ride on the AI hype train. If this is the accelerated future of software development that businesses want, then as I said, it's deeply disgusting, and kind of scary. 7/7
Perhaps I need to more explicitly call out what is actually the scariest part here: if you use this product, you're letting an application take control of your computer, using the output of a large language model as input. I know better than to describe an LLM as "just" a next-word predictor, because we've all seen how surprisingly powerful that can be. But still, it's all too common for LLMs to output things that don't make sense, especially when venturing outside their training.
From a web developer's perspective, its a web form that takes whatever for input with no sanitization, no validation, and feeds it directly into a database running as root. LOL.
Those who use Guide are installing a poorly optimized, not-well-coded program. This program then lets a large language model connect to their computer, acting as a keyboard and mouse which the user can't validate or control.
Yeah, I think I'll wait for this concept to be iterated on a few times. When the LLM can at least tell me what it's about to do, that'll be something. Better will be when it can take my keystrokes and map them onto an inaccessible UI. Oh, and I want all this to run locally, or at least on a server on the local network.
@alexhall Right? People are already getting utility from tools that can suggest shell commands, allow the user to verify them, and then run them. This app feels quite lazy in comparison.
How about something which tells me what has keyboard focus when my screen reader doesn't know, but otherwise lets me interact with the application myself? Integration via an NVDA add-on to auto-label controls? Local macros based on initial LLM integration? @matt
And yes, some of my early work as a young programmer could have been skewered like this. Admittedly I'm saying this from the safe distance of 20 years or so, but honestly, it should have been. College certainly didn't properly slaughter my ego as it should have, as @bcantrill discussed in his "Coming of Age" talk (youtube.com/watch?v=VzdVSMRu16…). As long as we don't sink to personal attacks and focus on substantive problems, I think healthy public criticism of publicly released work is OK.
Once upon a time, an investor proposed a "college replacement" by gathering up 18 year olds in order to give them money in exchange for future earnings. It w...
Having exchanged emails with Andrew, GUide’s developer, I really don’t think this is a cash grab. He strikes me as well intentioned. I was unaware of the coding issues, or that it runs an unsecured web server on the users machine. From what you can see, is there anything to stop another rogue app from connecting to the web server and telling Claude to execute stuff on the user’s machine? I was only really evaluating this from a functionality perspective. Though I was somewhat surprised that some of the changes I proposed in my email weren’t things he’d thought about previously. This feels to me like good ideas that didn’t get enough time in the oven, combined with lack of experience and good intentions. The telling thing, to me, will be what happens over the coming weeks. Will this go back in the oven for more cooking? Will we see the changes in safety and security that are needed?
Indeed. Things that are quite important to mention I think: 1. its paid, currently $8 per month, but its going to be more in the future as soon as it gets established (and seriously, the VI community currently takes all that is labeled with AI and aimed towards them) and 2. I don't want to know how much of this was actually developed by AI instead of a real dev thinking about consequences.
I don't mind the combination of Python plus web view so much. But there's now a pretty easy way via Toga/Briefcase to distribute Python apps that use the platform's webview runtime rather than shipping all of Electron.
What do you think of VOCR and TypeAhead? They seem like much better implementations of a similar concept. VOCR uses OCR and other (non-LLM) techniques to make an inaccessible application navigable, using its own commands to move between and activate controls. In my experience its definitely better than screen recognition on iOS. You can use an LLM to ask questions about an image or about the screen, or you can have an LLM divide the screen into areas and describe them separately, but these are just additional features. TypeAhead can use an LLM to move the VoiceOver focus to a specific element, no matter where it is in the application, and it can also directly perform tasks on your computer. However, for multi-step tasks, it always says what it is doing before it does it, and you can cancel it if it starts doing something you don't want. There are privacy concerns, because it uses GPT 3.5 or GPT 4, so I wish it supported ollama or lmstudio, but overall I like it. You can also record your own macros and tell it to execute them. It has a free plan, with GPT 3.5, and a $15 a month plan with GPT 4. Both of these applications only support MacOS currently though.
Hey Matt, developer of Guide here. Thanks for taking the time to dive deep into Guide and share your analysis. You're right to call out the security issues. Right now, my main priority is tightening security, particularly around restricting local server connections, and I've temporarily pulled download links until these fixes are fully implemented. Expect an update in the next few days addressing this specifically.
J'ai installé la dernière version de @thunderbird (la version 136.0, canal release). Le module conversations a été désactivé car il n'est pas encore mis à jour... 😭 addons.thunderbird.net/fr/thun…
Cette extension vous sert sur un plateau une vue en conversation pour Thunderbird, avec les infobulles des contacts, des vignettes pour les fichiers joints, la réponse rapide, l'intégration avec les autres modules, et bien d'autres astuces encore.
Sorry you encountered this - we have instructions on how to safely go back to 128 so you can have Conversations working again: blog.thunderbird.net/2025/03/t…
Zeman: Do lahví pro prezidenty jsme přelévali slivovici, co nám zbyla Že by prázdná lahev na slivovici mohla stát tři tisíce korun, nechtěl uvěřit ani známý lihovarník Martin Žufánek. „To by musela být ručně foukaná někde v Moseru,“ uvedl. seznamzpravy.cz/clanek/domaci-…
Bývalý prezident Miloš Zeman jako hlava státu rozdával zahraničním státníkům lahve se slivovicí neznámého původu. Policii na výslechu řekl, že šlo o alkohol, který na Hradě dostali a pak ho přelévali do dárkových lahví.
Eine blitzeblanke, 12jährige Jura Impressa J9 wartet hier in München auf ein Selbstabholeri, der uns dafür noch ein brauchbares Angebot machen kann. Voll funktionstüchtig, muss aber sicher bald wieder zur "Pflege" (Geräuschkulisse deutet baldigen Brüheinheit-Streichelbedarf an).
Hinweis: Das ist noch eines der Modelle, die mit "unverchipten" Filtern arbeiten, welche man im 4er-Pack für ~20 Euro bekommt.
OK, noch ein Versuch: will wirklich niemand diesen blitzeblanken Kaffeevollautomaten von Tante Jura haben? Details am Anfang des Threads. Selbstabholer in München, da sollte doch was gehen!
@BrauchC Ja, ich habe auch gerade überlegt, welcher deutsche Ort sich wohl 900 km südlich von München befinden mag. Aber da gibt es ja noch immer Österreich und die Schweiz 😜 @nocci
Interesting article about tensions in software development practices that have been brought to the surface by the increasing adoption of Rust and, perhaps to a lesser extent, Go: octet-stream.net/b/scb/2025-03… It unfortunately doesn't mention the Swift solution to ABI-stable dylibs in a modern language: faultlore.com/blah/swift-abi/ Of course, Swift unfortunately hasn't caught on much outside the Apple world.
it feels like a lot of discussion of these things just assume that distro style dynamic libraries actually... work. In practice I don't think it's even remotely true outside of very foundational things. Mostly it is functional on Linux because people recompile everything for version bumps anyway.
How to block ads in Gmail is getting more complex as new Gmail advertisement is more intrusive than ever, in your mailbox, in your Gmail app, everywhere. But we've got a solution!
I switched to Tuta so I don’t get ads! It costs less per month ($4) to use than whatever Google made per month showing me ads and harvesting my email data. If you’re looking for an email provider that isn’t evil, definitely check Tuta out.
Dutch public transport under the supervision of Amsterdam, Rotterdam and The Hague operated by RET, GVB, HTM, EBS and Connexxion will stop for 110 seconds on Wednesday 2 April 14:00 as a protest against a € 110 million budget cut.
The Document Foundation (TDF) has received two different proposals for the organisation of the LibreOffice Conference 2025. TDF Members will receive an email asking them to cast a vote and decide which will be the final venue.
#fediMarket #fediFlohmarkt #fediGive #marktplatz #biete
Drew Davidson
in reply to Zach Bennoui • • •Martin
in reply to Zach Bennoui • • •Martin
in reply to Zach Bennoui • • •Zach Bennoui
Unknown parent • • •