Tootfinder

for those interested in such things, Arcaneum now has an install subcommand that will add a watcher to a directory and reindex any changed files once committed.
you can keep a markdown knowledge base up-to-date async behind the scenes
in the repo, but not released
https://github.com/cwensel/arcaneum

Security personnel around the world are on high alert following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.
As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates.
There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certifi…

The Internet goes on high alert after discovery of 8 compromised TLS certs
Intermediate certs allow anyone to mint web credentials for any Internet server.

From their control center in Toulouse, the engineers at #CNES have woken up #IDEFIX, the planned test sequence went smoothly: #MMX probe is now more than 3 million km from Earth.

On my way to my first @… to talk about teaching software architecture.
https://scaladays.org/session/teaching-software-architecture…

In an earlier post I introduced the principle that there were four categories of side hustle. Let’s now talk about the fourth and final category.
I Quadrant: When the Money Does the Work
Investor income is built on capital, not hours.
Examples:
• Stocks
• Real estate
• Digital assets
Pros:
✔ Potentially passive
✔ Long-term wealth
✔ True financial independence
Cons:
✖ Requires capital
✖ Risk if poorly educated
✖ Results take time
💡 Most investors don’t start here.
They fund this quadrant using income from other quadrants!
Final Thought:
Which quadrant is financing your future?

Event: CSEE Institute for Teaching World Religions
I was invited to give a talk at a training session of educators on religious literacy and Islam. From the CSEE Institute for Teaching World Religions Website: Knowledge of the world's religious traditions is vitally important for communication and understanding in our current world. CSEE's institute brings together religious studies scholars and world religion teachers for thought-provoking presentations, activity…
https://husseinrashid.com/2026/07/06/event-csee-institute-for-teaching-world-religions.html/

A good way of thinking about companies like Proton or Anthropic that proudly declare they're using LLMs to code is that they've declared "we're replacing all of our junior engineers with unpaid interns from a temp agency." The unpaid interns have photographic memories and have memorized all of the code on github, but they're still pretty clueless and clumsy, and they also have zero loyalty to the company, zero ability to learn from mistakes, and zero understanding of or interest in the actual purpose of what they're building (actually, this comparison is unfair to interns on average, think of the least motivated and curious intern you've ever worked with).
The remaining staff at these companies become managers, but in the most frustrating possible way, since the agents they're managing constantly mess stuff up and have been made incapable of learning from their mistakes. Their working memory is actually pretty limited too, so if your instructions get too complicated, they start forgetting the first part of what you said. You can try to compensate for their inability to learn by writing down more instructions in text files for them to read, but the issue with their working memory makes this a losing strategy in the long run. You can try to carefully control which reminders of what not to do they read based on what parts of the code they're working on, but you don't really have good tools to control that either (such tools could be built, and would have been already if those in charge weren't so incompetent and mesmerized by their own shitty mirages).
So when things like this Cursor attack happen (or whenever the next big Proton vuln hits; it's clearly coming soon based on their dev practices) companies will say "humans make the same kinds of mistakes" or "human programmers might have written that vulnerability too." They're not exactly wrong, but they're eliding the fact that teams of temp interns make mistakes at rates orders of magnitude higher than teams of experienced security experts, and having fired the later to hire the former is a choice that everyone buying your product should pay attention to, whether the former comes in the form of actual incompetent interns or LLM agents.
#AI #LLMs #Proton #Anthropic #Cursor

I just watched the #BlackHat #OpenAI #HuggingFace talk (#OpenAI understands it themselves. However, emergence is still no indication of actual intelligence, and the talk is again ripe with anthropomorphism.
3. Yes, it is surprising and somewhat terrifying how good these LLM agent loops have become in finding and exploiting vulnerabilities. We are seeing a much stronger version of the earlier next-generation fuzzing leap in tool capabilities.
4. The comparison with fuzzing and other tools is important for another reason: #OpenAI conducted their experiments on the live Internet. No, forcing internal test runs to go through a proxy server is *not the same as running in an isolated environment*. If there is a connection to a live production system, it is by definition not an effective sandbox. What happened to people letting their cool new fuzzers run live on non-consenting production targets on the Internet back then? They were criminally liable. Why should #OpenAI not be held liable for any damages caused by their systems?
Just because you don't understand the complexity that you built doesn't mean you aren't responsible for what it does!
5. The agent loops first successfully started exploited their proxy server on May 26th, discovered July 4th-6th as active exploitation and takeover. Credentials were revoked and the proxy server patched. "At this point, AI training and evaluations resume."
WHAT THE ACTUAL F...? You discovered emergent behavior in your overly complex system that you didn't understand, saw active exploitation of your internal systems to an extent that they were owned with admin privileges, and your response was to patch the uppermost surface holes, and then continue letting the out-of-control complex system run and continue on the same course? You didn't think to, let's see, maybe stop or at least pause the highly irresponsible experiment while figuring out - in detail - what went wrong, why, and how to avoid the same thing happening again on a systematic level?
6. On July 8th, completely unsurprisingly, the LLM agent loops continue to do the same thing and find another surface hole that hasn't been patched yet to take over again. Why should this have stopped? You haven't done any root cause analysis on the system level. Why do you expect that the problem should have stopped?
7. It takes another 11 days to discover that this is happening again. So you turned the system that had broken something back on again without a detailed root cause analysis and then didn't even watch carefully? I can't even...
8. And no, the response is not to fight fire with fire. Complexity on the attacker side (#OpenAI is the attacker, not the defender - they are the guilty perpetrator, not the innocent victim of circumstance) should be fought with *reduced* attack surface on the defender systems. Adding LLM agent loops that the "frontier" companies themselves quite obviously have no control over to already brittle systems with the hope of auto-patching your way out of vulnerabilities does not seem like a wise course of action. You don't mitigate complexity with even more complexity. The next 2 years will be ... exciting - and your best bet is going to be to disable all dependencies and complex interactions that your production systems don't absolutely require.