One last example:
The first LLM code example that really made my eyes pop was early after the release of GPT, when somebody got it to combine Breakout with Conway’s Game of Life (a truly delightful idea). It worked!
Funny thing: the Breakout code and the Life code had a •completely• different style and flavor. Red flag. In about 15 minutes of web searching, I was able to find one of the projects (can’t remember if it was the Breakout or the Life half) which it had copied wholesale, with just a few variable renames. And the other half? It was in Python, but it used dictionaries where it really should have used objects — tons of `thing["prop"]` where it should have said `thing.prop`, and lots of other un-Pythonic stuff besides. It was a machine translate of code from another language, very likely Javascript.
The entire thing was a plagiarized Breakout and a plagiarized Game of Life, one transpiled, and all stuck together in a single run loop. To be fair, figuring out how to (1) run both halves of the logic from a single loop and (2) count the Life cells as Breakout bricks is work I'd cheer on from a second-semester intro CS student! It's not, however, quite what's being sold by these companies.
6/
Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing
Jianjia Yu, Zhengyu Liu, Ziyang Li, Yu Sun, Yinzhi Cao
https://arxiv.org/abs/2607.20698 https://arxiv.org/pdf/2607.20698 https://arxiv.org/html/2607.20698
arXiv:2607.20698v1 Announce Type: new
Abstract: Electron is a popular framework for building cross-platform desktop applications using web technologies. Such applications consist of multiple processes with different privilege levels that communicate via message passing. When inter-process messages carry attacker-controlled inputs, they can propagate across processes and reach privileged APIs, e.g., command execution. Such a message propagation behavior is characterized as Message Progression Vulnerabilities (MPVs). The exploitation of MPVs is challenging because it often requires multiple steps, e.g., first arbitrary code execution in one process via message passing, and then command injection in another process using another message crafted in the first process. To our knowledge, existing works on Electron security only study unsafe configurations and malicious Document Object Model (DOM) content, i.e., they cannot detect or exploit these vulnerabilities that need to be triggered by complex cross-process exploits via message passing. We present Proton, a segmented directed fuzzing framework for detecting MPVs. Our key insight is to decompose end-to-end fuzzing into per-process segments along message-passing boundaries, where the goals of fuzzing each segment are either: (i) reaching a sink in the current process or (ii) propagating the payload to the next process, to enable the exploration of another process. In the second case, the messages seed the corpus of the next segment. Finally, Proton synthesizes crash inputs from each process to validate end-to-end exploits. We evaluate Proton against 589 real-world Electron applications, resulting in 23 zero-day MPVs. Among them, 22 lead to OS command execution, including projects with over 50k GitHub stars. We responsibly disclosed all findings. To date, we have received 13 acknowledgments, 11 fixes, and 11 CVEs, including a bug bounty from Vercel.
toXiv_bot_toot
Man, the ACM website -- the Association for Computing Machinery's site -- is so confusing with all the usernames and accounts.
I am trying to subscribe to one of their mailing lists and it's asking me for an email address and a password. As an ACM member, I have an @acm.org email; my account also knows about my Macalester email, and my newer St. Olaf email. I have tried all of those, and all the various passwords in my password manager. None work.
If only, somehow, someo…
Applications for the Secure Program Synthesis Fellowship by Apart Research are now open; you have 10 days to apply. I've listed two of my projects here; one more is heavily based on my work; and the rest are all fun too! Please feel free to share.
https://apartresearch.com/fellowships/
https://www.kickstarter.com/projects/feliciaday/watchtheguild
Looks like Felicia Day is starting on a new movie to continue The Guild; they're doing a kickstarter and are live streaming on Twitch all day for it.
The introduction my next book, the Generative Unconscious, on the dread AI creates among artists (and other people as well), also has a link to the PDF of an early draft of the whole thing. https://varnelis.net/works_and_projects/the-generative-unconscious-introduc…
The state of #Python ecosystem right now: almost everything is slop. Some projects are complete vibe-coded slop (autobahn, chardet, cryptography). Some projects are disguised slop ("Coding agents shouldn't co-author themselves.")
There is only a handful of human projects left (Flask being one bright example). And they're being killed. They're being killed by the neverending slew of slop pull requests. They're being killed by all their dependencies becoming slop. They're being killed because this whole ecosystem has became such a complete cesspit that you have zero motivation to do anything.
EDIT: and honestly, this is only going to get worse. When you kill the incentive to work on projects, you only get more slop. Maintainers give in, and more projects become slop. Or they give up, and projects get forked unto slop.
#NoAI #NoLLM
PSA: Not that it was ambiguous beforehand, but these are times for stating things more clearly...
All #ThingUmbrella package readme files are now clearly stating that these projects are "LLM-free, human-made and cared for software, maintained as part of the https://…
Der Washingtoner Generalstaatsanwalt und mehrere Bundesstaaten gewinnen den Rechtsstreit gegen Trumps Anordnung, alle Genehmigungsverfahren für Windenergieprojekte auszusetzen.
„Windenergie ist eine unverzichtbare Option, um Arbeitsplätze im Bereich der sauberen Energie zu schaffen und den Einwohnern Washingtons günstigere und sauberere Energie zu liefern, während wir den Übergang von schmutzigeren und teureren Brennstoffen vollziehen“
For a quarter century, the U.S. only saw measles outbreaks when infected travelers brought the virus in from abroad.
The resulting waves of measles didn’t last more than a year.
Those days are gone.
Measles began tearing through the dusty plains of West Texas in January last year,
and since then, all but a handful of states have seen cases.
Two unvaccinated Texas girls and an adult across the border in New Mexico died before the West Texas outbreak seemed to …
Tell the city administrator that infrastructure co-ordination is NOT optional and there will be one group responsible, no discussion, no debate, here is your order. That group checks with the departments, province and utilities on what is coming up for the next 12 to 18 months. Also, if there is an emergency they are consulted so that ALL parties are informed.
I've been talking before why money won't solve the burnout problem. But let's for a minute assume that you really wanted to help people maintaining #FreeSoftware by paying them. The problem is that:
1. You have to pay them a living wage.
While all monetary help is appreciated by developers, they need a living wage. Not "that should prevent you from starving to death" but the kind of money that can support a honest (but not lavish) lifestyle: pay the bills, feed your family, cover other living costs such as repairs, clothes, appliances, and let you save enough for future emergencies.
It's simple as that. If you can't do that, they're going to need a dayjob. If they're lucky, it won't collide with their #FLOSS work. If they're not, it will kill them. Or they'll fall somewhere in the middle, slowly burning out until they can neither maintain their projects, nor work.
2. You need to guarantee that the payouts will continue.
People need security. They're not going to stay unemployed, let alone quit their job or turn down a job offer, unless they either have good guaranties or substantial savings (or they're in a really bad shape and wouldn't be able to handle the job anyway). The job market is hell, and people just know that when the payments stop, they may not be able to find a job soon, let alone a good job. Even "passively" looking for a job can burn you out.
So yeah, one-off payments and pinky swears won't do. And it isn't even a matter of whether we can trust you; it's a matter if you'll actually be able to continue paying us. And honestly, I don't really know how to solve that. Perhaps by paying up front, but for how long? Finding a job may take more than a year, finding a good job may be once-in-a-lifetime opportunity.
3. It can't end up being a job.
Perhaps most difficult of all, these payments can't really come with explicit obligations. I mean, that's the whole point: you want to support FLOSS, not turn it into a corporate project. You want the maintainer to remain free and enjoy the work. That is unlikely to happen if their livelihood is now dependent on your satisfaction. And even if it isn't, I for example would still feel indebted to whoever's paying me to do FLOSS, even if they really didn't expect anything in return, and would fall into a spiral of guilt-inflicted burnout if I failed to maintain the software satisfactorily.
#OpenSource
HEY HEY HEY all you CONCEPT ARTISTS!!! Submit your art from all those gorgeous game projects here to the annual Concept Art Awards. All international human-made projects are welcome: https://www.conceptartassociation.com/caa-2026
It’s ok, it’s not like we’re all going to die or anything (only billions, not everyone). @… https://slrpnk.net/post/39707961
<rant> AI bros need to stop fucking saying they used AI to create something "from scratch", it's never from scratch, that isn't how LLMs work
during the few days when fable was out some claude fans said they used to recreate Minecraft "from scratch", except:
1. Claude's training data includes all open source projects on Github
2. there are several open source Minecraft clones on Github
yeah I too could create Minecraft "from s…
Three big pumped storage projects agreed. All in Scotland.
First hydropower projects in Great Britain in 40 years given go-ahead | Hydropower | The Guardian
https://www.theguardian.com/environment/2026/jun/26/firs…
Can I just say I hate that "Canada Strong" has gone from political pitch to clumsy two-worded adjective?
Quoteth the Prime Minister:
""If you have a bit of extra money, we'll make it easy for you to invest in the fund to help build Canada strong for all,".
Aaauuuggghhh
Just use regular words.
Also, naming your Sovereign Wealth Fund after your own partisan nomenclature is a great way to ensure it doesn't live past the current political party in power.
Not everything has to be a slogan!
#CanPoli #CdnPoli
I wonder if most OSS projects adopt vibe coding, will all of them eventually try do be an everything app?
Because the gospel that AI enthusiasts preach is essentially that there’s no technical debt anymore, so why not fuck scopes and make all software do everything?
"So instead of eliminating (opens in new tab) 118.3 million permits (opens in new tab), the Air Resources Board will distribute them for free to companies on the condition that they pledge to invest in clean energy projects."
So how will the pledges be enforced, I wonder? I've seen over 30 years of "Here's how we will go green" "commitments" from companies like BP (remember Beyond Petroleum), Shell, BHP Biliton, etc - all reneged
So how wil…
"So instead of eliminating (opens in new tab) 118.3 million permits (opens in new tab), the Air Resources Board will distribute them for free to companies on the condition that they pledge to invest in clean energy projects."
So how will the pledges be enforced, I wonder? I've seen over 30 years of "Here's how we will go green" "commitments" from companies like BP (remember Beyond Petroleum), Shell, BHP Biliton, etc - all reneged
So how wil…
Interested in all of the many "PNT" (Positioning, Navigation and Timing) projects the government is investing in. They're also bringing back eLoran, as a hedge against GNSS disruption, which they basically abandoned a decade ago - but it's a different world now.
https://www.
Content warning: Fundraising for Open Source work & maintenance
I don't do these often (only once or twice a year, if at all), but since I just lost the main sponsor of my open source work (forever grateful for their long & major support!), I urgently need to reach out to other people (especially users) for financial help with the continued development, documentation and maintenance efforts (incl. hosting costs) of the primarily 215 TypeScript libraries and 185 example projects in
Trump has blamed everything
– from “national security”issues, the deaths of birdsand whales, and cancer
– in his decades-long campaign against windfarms.
But as the Trump administration continues to undermine the industry, what worries workers most are their jobs.
Since taking office for a second term, Trump has issued an executive order aiming to halt all wind-energy leases and permits,
attempted to issue stop-work orders on wind projects under construction,
I've been working on a theory that my biggest issue at work is the demarc. When I was in telecom, we all knew just where the demarc was and who was responsible for what before and after. Now it seems every project has demarcs between departments or persons, and they all disagree on where that is. I keep getting sucked into projects that need me only to move a file from A-B because person A thinks is not their job to give the file but B doesn't think its their job to go get the file.…
Android transparency logs (https://developers.google.com/android/binary_transparency/overview) now include 1st Party Apps and Mainline Modules:
Sources: Google told Meta around March it couldn't offer all the Gemini capacity Meta wanted to buy, disrupting and delaying some of Meta's internal AI projects (Financial Times)
https://www.ft.com/content/c5d52f72-71ef-40bc-bad3-61afdba8b378
I no longer think E-Methanol is a good idea ⚡⚗️
I am not saying this lightly. But it's hard to argue with thermodynamics, and making energy-rich molecules from nothing but CO₂, water🌊, electricity⚡ faces some hard truths.
Recently, a significant project developers for E-Methanol⚡⚗️, Liquid Wind💧💨, filed for bankruptcy.
E-Methanol⚡⚗️ & other CCU/E-Fuels/PtX/PtL processes all have one problem: they need so much clean electricity that it's questionable if this is pl…
@… thanks.
Logically: anyone who chooses to reject FreeBSD on that basis may also choose to reject all projects that use OpenZFS. I can not recommend such sweeping rejections.
Two of the three commits:
― range_tree: use zfs_panic_recover() for partial-overlap remove · openzfs/zfs@6495daf — <
Thank you very much to all the #freesoftware projects that allowed me to do, what I do now.
Thank you for educating me, giving me tools to work with, giving me the opportunity to give back, to feel validated, thank you.
#opensource
Content warning: Gnome, genAI/LLMs, RedHat
Uhhhhh so GNOME will no longer accept security reports for its own projects that don't allow LLM usage???
What kind of self-boycotting bullshit is this?
Is this FashHat RedHat using their control over the security team to try to force all GNOME (sub)projects to accept "AI"?
If I'm getting this correctly, if you have a project there that doesn't allow LLMs it might be a good time to fork it away from under GNOMEs wings?
Source: https://www.phoronix.com/news/GNOME-Security-Changes-2026
This seems way more sensible (I think the calculation is a bit off because of the really long start time), but now that it got going it seems reasonably fast.
These are all git projects, so TONS of tiny files.
Content warning: LLM, negative, loss of trust
Some people think that #LLM usage costs rising will start undoing some of the harm caused by the #AI hype. I don't think that's really going to help that much.
I'm not even talking about all the projects that were ensloppified and enshittified already. I'm not talking about all the technical debt. I'm not talking about all the forks that will have to be maintained forever. I'm not talking of all the projects that were abandoned because of burnout, or because they were only hype-oriented. And I'm not talking about all the corporations that will continue submitting slop.
I'm talking about the loss of trust. After all, we're not talking of people who realized they were wrong and are sorry. We're not talking of people realizing that it was wrong to forfeit ethics and morals in the name of "productivity". We're talking of people who are jumping ships because their previous approach turned out not to be profitable anymore. We're talking of gamblers who left the casino because they went broke. They aren't sorry that they gambled; they are sorry that they've lost. And they'd be happy to do it again at the nearest opportunity.
So, I'm sorry to say, but #FreeSoftware is never going to be the same again. A lot of people have shown their true colors, and I won't forget that.
#NoAI #NoLLM #OpenSource #FLOSS
Sometimes I do wonder if the only ethical thing let to do is to delete all your projects, and do your best to have them disappear from public space. Of course, that won't stop people from making your complicit in their acts of planetary destruction entirely, but at least you're trying…
And that's coming from me, a person who considers destroying knowledge and craft an unthinkable crime.
#NoAI #NoLLM
@inthehands@hachyderm.io
