a great sneer found in the wild:

the one titled “interesting” (archive) also smells

idly, I do wonder how well an ocr-only clodjeepeetea would work. every time I look in on all these “agent session” tools they appear to be a very mech turk thing of a phenomenal bit of hidden state, and a tiny little bit of visible distraction. feels like ocr-only might break a bunch of the usual tricks that are used to build on for the shiny demo

the networking part is fine (I do a looooot of networking), but the software quality and choices (esp with containers) is just extremely meh

re the gapping, eh, there are ways. just off the top of my head: rig up the serial console, screen+camera and usb keyboard signalling (which you can data diode on transmission later via usbnet). and that’s before you go for esoteric side channels and utter silliness

but “I turned off spectre and friends mitigation” is just some extremely funny shit

commitment to the bit

I’d seen that link and didn’t even go looking, but wow this is way worse that I would’ve expected

it’s been a while since I last looked (I usually just deploy whatever network I need) but iirc even the typical desktop config distributions of qemu-kvm are a macvtap or link+nat setup

It then detected I run my host kernel with mitigations=off

I wonder if this person even thought to run a nessus/openvas/whatever scan against the same machine

also, quite seriously, what fucking clowning is this to have this be some “I slapped together a test on my desktop” rather than having a lab bench? is it too hard and costly for trail of bits employees to afford a 1u they can pxeboot for experiments? wild

The standard approach for QEMU is to either wire up a TUN/TAP interface or to use passt.

(e: adding)

The standard approach for QEMU is to either wire up a TUN/TAP interface or to use passt.

other typical modes are bridged (e.g. having various vlans available as bridges and then managing vm exposure to vlan by interface attachment), direct interface assignment (hw offload to the guest)

passt is also commonly used for podman, and it’s moooostly userspace[0] IP and no real good l2 options

1. I had an absolute rager[2] of a time figuring out how to make n-many podman containers[3] spin up into an assortment of vlans for realtime multi-vlan testing
2. of the graaaargh kind
3. don’t do containers, kids. they’re bad for your health

(I’m only half joking. it’s stunning how badly container-management software and tooling all suck)

brava 👏

just wanna re-up one from last week’s stub

@o7___o7 said:

We need a word for “my condolences for that cool person you liked becoming a milkshake duck”

my proposal: “autorowling”

I propose: “autorowling”

Anthropic also said that in testing, auto mode proved safer than manual review — in a study with 1,053 paid testers, auto mode caught 89% of harmful actions, while human review only caught 13.6%. (Perhaps that’s because “manual review can become habitual: users approve 97% of permission prompts in Claude Code.”)

having just yesterday had the displeasure of reading a PR (just shy of 2000 lines) made by Fable 5 (which the promptfondler felt it was most necessary to be specific about), a definite real other problem is simply the literal fucking overwhelm resulting from the slop tsunami

also “harmful” actions sure is doing a lot of legwork there

probably he’s running gas town now instead

from the kind of corporate sentiment shared there, it might be tear gas town

it started out container-flavoured easier APIs and then grew a bit from there, still relatively liked for its ease of dynamic shittery. seconding @dgerard’s position on apache httpd as ssl terminator. it’s also got some other cases where it’s just a worse performer and/or a nuisance to deal with (in comparison)

I’m also interested in answers to this; I don’t really follow youtube types in general (and even less other of the pop names) so I didn’t even know this name until it showed up here this week

it uses the fedi semantics, @user@example.com. but I have found some clients to be iffy on completion and addition of href (eg my mobile client doesn’t do it most times unless I hit a specific thing. the jank is a feature!)

It was called fucking Pearl AI? god these people suck so fucking bad

saw it here, and adrianna’s got an idea on possible likely chain

I saw some speculation (from some people in the region) that shillrinavan wasn’t satisfactorily greasing palms, but I don’t know whether hard info is out yet

https://docs.farcaster.xyz/learn

Farcaster is a sufficiently decentralized social network built on Ethereum.

didn’t even read further

idle pondering: anyone seen much more happening to shillrinavan’s network school after they fucked it in malaysia and decided they’ll move to kazakhstan?

(also, if you hadn’t seen, yes: that’s a thing)

yup. and I bet in a couple of weeks/months there will be some pearl clutching as the “agent” once again replies something like this once that “memory” blows past its context window

Weekend’s are for the chatbot running the bill so high the account owner can throw a fit on twitter and demand to speak to the manager