WA wine industry warns of impact of Containers for Change expansion
A newly formed West Australian wine group warns that bottles of wine produced in the state could increase by $1.25 if the expansion of the Containers for Change scheme goes ahead. â Read more
6.1.168: longterm
Version:6.1.168 (longterm)Released:2026-04-11Source:linux-6.1.168.tar.xzPGP Signature:linux-6.1.168.tar.signPatch:full ( incremental)ChangeLog:ChangeLog-6.1.168 â Read more
Major fire destroys huge toilet paper supply warehouse in California
An unexpected disaster has managed to destroy a 1.2 million-square-foot toilet roll storage facility. Eyebrows were raised along the West Coast this w⊠â Read more
When I discover pagination starts at 0 on the backend and 1 on the frontend â Read more
6.1.167: longterm
Version:6.1.167 (longterm)Released:2026-03-25Source:linux-6.1.167.tar.xzPGP Signature:linux-6.1.167.tar.signPatch:full ( incremental)ChangeLog:ChangeLog-6.1.167 â Read more
Astronomers discover completely new category of extrasolar planet
This distant world, known as L98-59d, offers a literal interpretation of the phrase âthe floor is lavaâ. At approximately 1.6 times the size of the E⊠â Read more
Woman spends 70 days counting out loud to reach 1,070,000
A woman from Nigeria has achieved a new Guinness World Record by counting out loud for several weeks straight. Imagine doing nothing at all with your ⊠â Read more
6.1.166: longterm
Version:6.1.166 (longterm)Released:2026-03-05Source:linux-6.1.166.tar.xzPGP Signature:linux-6.1.166.tar.signPatch:full ( incremental)ChangeLog:ChangeLog-6.1.166 â Read more
ăç„ăăïŒJPCERT/CC EyesăJSAC2026 éćŹăŹăăŒăïœDAY 1ïœă â Read more
Undersea cables could serve as a tsunami early warning system
There are roughly 1.5 million kilometers of cables currently stretching across the worldâs ocean floors. Marc-Andre Gutscher: Forecasting earthquakes ⊠â Read more
6.19.2: stable
Version:6.19.2 (stable)Released:2026-02-16Source:linux-6.19.2.tar.xzPGP Signature:linux-6.19.2.tar.signPatch:full ( incremental)ChangeLog:ChangeLog-6.19.2 â Read more
6.19.1: stable
Version:6.19.1 (stable)Released:2026-02-16Source:linux-6.19.1.tar.xzPGP Signature:linux-6.19.1.tar.signPatch:fullChangeLog:ChangeLog-6.19.1 â Read more
** Snakes snakes snakes, a week note **
Iâve been working on an ill advised project. This project will have to be done in many parts. Part one of many is done, and Iâm debating if I should share it, or if I should wait to get the whole thing done. But now, a smash cutâŠI started this post off as a normal post, but now that it is an RSS sickos only postâŠ
Check this shit out! I recently read about the $1 unistroke recognizer, and predictably, had to try to [implement my ⊠â Read more
ăç„ăăïŒJPCERT/CC EyesăWindowsăźă€ăăłăăă°ćæăăŹăŒăăłă°çšăłăłăăłăăźć Źéă â Read more
SpaceX proposes orbital data center made up of 1 million satellites
Elon Muskâs space firm is seeking regularity approval to develop a satellite constellation of unprecedented scale. If you thought the current array of⊠â Read more
6.1.161: longterm
Version:6.1.161 (longterm)Released:2026-01-17Source:linux-6.1.161.tar.xzPGP Signature:linux-6.1.161.tar.signPatch:full ( incremental)ChangeLog:ChangeLog-6.1.161 â Read more
Long-running SETI project hones in on final 100 âsignals of interestâ
A crowd-sourced effort to analyze astronomical data for signs of intelligent alien civilizations is nearing completion. Launched all the way back in 1⊠â Read more
AmanhĂŁ vou rolar uma demo de Tidalcycles no primeiro meetup de livecoding do Porto :szterminal:
Iâm trying to implement configurable key bindings in tt. Boy, is parsing the key names into tcell.EventKeys a horrible thing. This type consists of three information:
- maybe a predefined compound key sequence, like Ctrl+A
- maybe some modifiers, such as Shift, Ctrl, etc.
- maybe a rune if neither modifiers are present nor a predefined compound key exists
Itâs hardcoded usage results in code like this:
func (t *TreeView[T]) InputHandler() func(event *tcell.EventKey, setFocus func(p tview.Primitive)) {
return t.WrapInputHandler(func(event *tcell.EventKey, setFocus func(p tview.Primitive)) {
switch event.Key() {
case tcell.KeyUp:
t.moveUp()
case tcell.KeyDown:
t.moveDown()
case tcell.KeyHome:
t.moveTop()
case tcell.KeyEnd:
t.moveBottom()
case tcell.KeyCtrlE:
t.moveScrollOffsetDown()
case tcell.KeyCtrlY:
t.moveScrollOffsetUp()
case tcell.KeyTab, tcell.KeyBacktab:
if t.finished != nil {
t.finished(event.Key())
}
case tcell.KeyRune:
if event.Modifiers() == tcell.ModNone {
switch event.Rune() {
case 'k':
t.moveUp()
case 'j':
t.moveDown()
case 'g':
t.moveTop()
case 'G':
t.moveBottom()
}
}
}
})
}
This data structure is just awful to handle and especially initialize in my opinion. Some compound tcell.Keys are mapped to human-readable names in tcell.KeyNames. However, these names always use - to join modifiers, e.g. resulting in Ctrl-A, whereas tcell.EventKey.Name() produces +-delimited strings, e.g. Ctrl+A. Gnaarf, why this asymmetry!? O_o
I just checked k9s and theyâre extending tcell.KeyNames with their own tcell.Key definitions like crazy: https://github.com/derailed/k9s/blob/master/internal/ui/key.go Then, they convert an original tcell.EventKey to tcell.Key: https://github.com/derailed/k9s/blob/b53f3091ca2d9ab963913b0d5e59376aea3f3e51/internal/ui/app.go#L287 This must be used when actually handling keyboard input: https://github.com/derailed/k9s/blob/e55083ba271eed6fc4014674890f70c5ed6c70e0/internal/ui/tree.go#L101
This seems to be much nicer to use. However, I fear this will break eventually. And itâs more fragile in general, because itâs rather easy to forget the conversion or one can get confused whether a certain key at hand is now an original tcell.Key coming from the library or an âextendedâ one.
I will see if I can find some other programs that provide configurable tcell key bindings.
@eldersnake@we.loveprivacy.club
Steps to world domination:
- âInventâ âAIâ (by using other peopleâs data).
- Get people hyped about it and ideally hooked on it.
- Only provide it as a cloud service. But hey, if you want to, you can run it locally!
- Buy all hardware available on the market, so that nobody but you can build more systems.
- All PCs of consumers and competitors are too weak now and canât be upgraded anymore.
- Everybody depends on your cloud service! Win!
All of that is possible because corporations donât have a âconscienceâ in capitalism. Nobody forces the RAM manufacturers to sell all their stuff to just one or two buyers, but since the only goal of that manufacturer is to make money, they do it.
Nice! đ Here are the startup latencies for the simplest Mu (”) program. println("Hello World"):
- Interpreter: ~5ms
- Native Code: ~1.5ms
Hmmm đ€
Excluding merges, 1 author has pushed 171 commits to main and 175 commits to all branches. On main, 294 files have changed and there have been 52880 additions and 18269 deletions.
From the Mu (”) Gitea Activity Tab
@movq@www.uninformativ.de Well, just a very limited subset thereof:
- inline and multiline code blocks using single/double/triple backticks (but no code blocks with just indentation)
- markdown links using using
[text](url)
- markdown media links using

And thatâs it. No bold, italics, lists, quotes, headlines, etc.
Just like mentions, plain URLs, markdown links and markdown media URLs are highlighted and available in the URLs View. Theyâre also colored differently, similarly to code segments.
I definitely should write some documentation and provide screenshots.
I assume you made the thing load quickly, didnât you?
Thatâs the problem with Python. If you have a couple of files to import, it will take time.
I want this to be reasonably fast on my old Intel NUC from 2016 (Celeron N3050 @ 1.60GHz) and I already notice that the program startup takes about 95 ms (or 125 ms when there are no .pyc files yet). Thatâs still fine, but it shows that Iâll have to be careful and keep this thing very small âŠ
Python 3.14 will bring lazy imports, maybe that can help in some cases.
The tt URLs View now automatically selects the first URL that I probably are going to open. In decreasing order, the URL types are:
- markdown media URLs (images, videos, etc.)
- markdown or plaintext URLs
- subjects
- mentions
I might differentiate between mentions of subscribed and unsubscribed feeds in the future. The odds of opening a new feed over an already existing one are higher.
Whoo! I fixed one of the hardest bugs in mu (”) I think Iâve had to figure out. Took me several days in fact to figure it out. The basic problem was, println(1, 2) was bring printed as 1 2 in the bytecode VM and 1 nil when natively compiled to machine code on macOS. In the end it turned out the machine code being generated / emitted meant that the list pointers for the rest... of the variadic arguments was being slot into a register that was being clobbered by the mu_retain and mu_release calls and effectively getting freed up on first use by the RC (reference counting) garbage collector đ€Šââïž
6.18.2: stable
Version:6.18.2 (stable)Released:2025-12-18Source:linux-6.18.2.tar.xzPGP Signature:linux-6.18.2.tar.signPatch:full ( incremental)ChangeLog:ChangeLog-6.18.2 â Read more
I rewrote all my solutions in Rust (except for day 10 part 2) and these are the runtimes on my i7-3770 from 2013 (this measures CLOCK_PROCESS_CPUTIME_ID, not wallclock):
day01/1 [ 00.000501311] Result: 1066
day01/2 [ 00.000400298] Result: 6223
day02/1 [ 00.000358848] Result: 12586854255
day02/2 [ 00.000750711] Result: 17298174201
day03/1 [ 00.000106537] Result: 17405
day03/2 [ 00.000404632] Result: 171990312704598
day04/1 [ 00.000257517] Result: 1626
day04/2 [ 00.007495342] Result: 9173
day05/1 [ 00.000237212] Result: 505
day05/2 [ 00.000142731] Result: 344423158480189
day06/1 [ 00.000229629] Result: 4076006202939
day06/2 [ 00.000279552] Result: 7903168391557
day07/1 [ 00.000204422] Result: 1622
day07/2 [ 00.000283816] Result: 10357305916520
day08/1 [ 00.029427421] Result: 84968
day08/2 [ 00.028089859] Result: 8663467782
day09/1 [ 00.000310304] Result: 4764078684
day09/2 [ 00.015512554] Result: 1652344888
day10/1 [ 00.000796663] Result: 375
day10/2 [ --.---------] Result: 15377 (Z3)
day11/1 [ 00.000416804] Result: 753
day11/2 [ 00.000660528] Result: 450854305019580
day12/1 [ 00.000336081] Result: 577
day12/2 [ 00.000000695] Result: no part 2
A little under 90 ms total.
On my Samsung NC10 netbook from 2011 with its Intel Atom N455 at 1.6 GHz:
day01/1 [ 00.003771326] Result: 1066
day01/2 [ 00.003267317] Result: 6223
day02/1 [ 00.003902698] Result: 12586854255
day02/2 [ 00.006659479] Result: 17298174201
day03/1 [ 00.000747544] Result: 17405
day03/2 [ 00.002737587] Result: 171990312704598
day04/1 [ 00.001263892] Result: 1626
day04/2 [ 00.044985301] Result: 9173
day05/1 [ 00.001696761] Result: 505
day05/2 [ 00.000978962] Result: 344423158480189
day06/1 [ 00.001387660] Result: 4076006202939
day06/2 [ 00.001734248] Result: 7903168391557
day07/1 [ 00.001295528] Result: 1622
day07/2 [ 00.001809659] Result: 10357305916520
day08/1 [ 00.277251443] Result: 84968
day08/2 [ 00.284359332] Result: 8663467782
day09/1 [ 00.003152407] Result: 4764078684
day09/2 [ 00.071123459] Result: 1652344888
day10/1 [ 00.005279527] Result: 375
day10/2 [ --.---------] Result: 15377 (Z3)
day11/1 [ 00.003273342] Result: 753
day11/2 [ 00.005139719] Result: 450854305019580
day12/1 [ 00.002857552] Result: 577
day12/2 [ 00.000004421] Result: no part 2
A little over 700 ms total.
I like this. You get performance thatâs more or less in the ballpark of C, but without the footguns.
If your very popular project with lots of stars on GitHub is over 10 years old, and youâre still at a pre-1.0 version because youâre using SemVer and a 1.0 would mean making some kind of commitment and thatâs somehow not desirable for you, then I think youâre doing something wrong. đ€
I cleaned up all my of AoC (Advent of Code) 2025 solutions, refactored many of the utilities I had to write as reusable libraries, re-tested Day 1 (but nothing else). here it is if youâre curious! This is written in mu, my own language I built as a self-hosted minimal compiler/vm with very few types and builtins.
Iâm having to write my own functions like this in mu just to solve AoC puzzles :D
fn pow10(k) {
p := 1
i := 0
while i < k {
p = p * 10
i = i + 1
}
return p
}
I just completed âSecret Entranceâ - Day 1 - Advent of Code 2025 #AdventOfCode https://adventofcode.com/2025/day/1 â However I did it in my own toy programming language called mu, which I had to build first đ€Ł
Come back from my trip, run my AoC 2025 Day 1 solution in my own language (mu) and find it didnât run correctly đ€Ł Ooops!
$ ./bin/mu examples/aoc2025/day1.mu
closure[0x140001544e0]
Alright, Advent of Code is over:
https://www.uninformativ.de/blog/postings/2025-12-12/0/POSTING-en.html
Itâs been quite the time sink, especially with the DOS games on top, but it was fun. đ„ł
In case youâre wondering: All puzzles (except for part 2 of day 10) were doable in Python 1 on SuSE Linux 6.4 and ran in a finite time on the Pentium 133. Puzzle 10/2 might have been doable as well if I had better education. đ€Ł
6.18.1: stable
Version:6.18.1 (stable)Released:2025-12-12Source:linux-6.18.1.tar.xzPGP Signature:linux-6.18.1.tar.signPatch:fullChangeLog:ChangeLog-6.18.1 â Read more
@prologic@twtxt.net No beak, no feathers, ⊠looks suspicious! Thatâs probably a weird mammal!!1! đ đ€Ł
Gootosocial to a Pleroma one. While GTS is kinda cute (lightweight and easy to manage) of a software, the inability to fetch/scroll through people's past toots when visiting a profile or having access to a federated timeline and a proper search functionality ...etc felt like handicap for the past N months.
@bender@twtxt.net yeah, Iâve been reading through the documentation last night and it felt overwhelming for a minute⊠+1 point goes to GTSâs docs. but hey, Iâll be taking the easy route: podman-compose up -d they provide both a container image and an example compose file in a separate git repo but Iâm wondering why that is not mentioned anywhere in the docs, (unless it is and I havenât seen it yet)
Day 2 was pretty tough on my old hardware. Part 1 originally took 16 minutes, then I got it down to 9 seconds â only to realize later that my solution abused some properties of my particular input. A correct solution will probably take about 30 seconds. đ«€
Part 2 took 29 minutes this morning. I wrote an optimized version but havenât tested it yet. I hope itâll be under a minute.
Python 1 feels really slow, even compared to Java 1. And these first puzzles werenât even computationally intensive. Weâll see how far Iâll make it âŠ
AoC Day #1 solution (mu): https://gist.mills.io/prologic/d3c22bcbc22949939b715a850fe63131
Thinking about doing Advent of Code in my own tiny language mu this year.
mu is:
- Dynamically typed
- Lexically scoped with closures
- Has a Go-like curly-brace syntax
- Built around lists, maps, and first-class functions
Key syntax:
- Functions use
fnand braces:
fn add(a, b) {
return a + b
}
- Variables use
:=for declaration and=for assignment:
x := 10
x = x + 1
- Control flow includes
if/elseandwhile:
if x > 5 {
println("big")
} else {
println("small")
}
while x < 10 {
x = x + 1
}
- Lists and maps:
nums := [1, 2, 3]
nums[1] = 42
ages := {"alice": 30, "bob": 25}
ages["bob"] = ages["bob"] + 1
Supported types:
int
bool
string
list
map
fn
nil
mu feels like a tiny little Go-ish, Python-ish language â curious to see how far I can get with it for Advent of Code this year. đ
Day 1 was surprisingly finnicky. A lot of people got it wrong, apparently. Me too. đ€Ł
Advent of Code 2025 starts tomorrow. đ„łđ
This year, Iâm going to use Python 1 on SuSE Linux 6.4, writing the code on my trusty old Pentium 133 with its 64 MB of RAM. No idea if that old version of Python will be fast enough for later puzzles. Weâll see.
@lyse@lyse.isobeef.org Damn. That was stupid of me. I should have posted examples using 2026-03-01 as cutoff date. đ
In my actual test suite, everything uses 2027-01-01 and then I have this, hoping that thatâs good enough. đ„Ž
def test_rollover():
d = jenny.HASHV2_CUTOFF_DATE
assert len(jenny.make_twt_hash(URL, d - timedelta(days=7), TEXT)) == 7
assert len(jenny.make_twt_hash(URL, d - timedelta(seconds=3), TEXT)) == 7
assert len(jenny.make_twt_hash(URL, d - timedelta(seconds=2), TEXT)) == 7
assert len(jenny.make_twt_hash(URL, d - timedelta(seconds=1), TEXT)) == 7
assert len(jenny.make_twt_hash(URL, d, TEXT)) == 12
assert len(jenny.make_twt_hash(URL, d + timedelta(seconds=1), TEXT)) == 12
assert len(jenny.make_twt_hash(URL, d + timedelta(seconds=2), TEXT)) == 12
assert len(jenny.make_twt_hash(URL, d + timedelta(seconds=3), TEXT)) == 12
assert len(jenny.make_twt_hash(URL, d + timedelta(days=7), TEXT)) == 12
(In other words, I donât care as long as itâs before 2027-01-01. đđ )
Avi Loeb accepts skepticâs $1,000 wager over alien visitation by 2030
The Harvard astronomer is so sure that we will find evidence of aliens that he has decided to stake money on it. Loeb, who seems adamant that there is⊠â Read more
@prologic@twtxt.net Your gitea thinks the LICENSE file in the yarn repository is SSPL-1.0 instead of GNU AGPL 3.0,
and I canât help but giggle at that
Tired to re-enable the Ege route to git.mills.io today (after finishing work) and this is what I found đ€Ż Tehse asshole/cunts are still at it !!! đ€Ź â So letâs instead see if this works:
$ host git.mills.io 1.1.1.1
Using domain server:
Name: 1.1.1.1
Address: 1.1.1.1#53
Aliases:
git.mills.io is an alias for fuckoff.mills.io.
fuckoff.mills.io has address 127.0.0.1


PS: Would anyone be interested if I started a massive global class action suit against companies that do this kind of abusive web crawling behavior, violate/disregards robots.txt and whatever else standards that are set in stone by the W3C? đ€
This caveman is getting too old for the Internet⊠đ It took me 1 hrs and 50 mins to catch up with whatâs been going on my feed.
@lyse@lyse.isobeef.org Probably wouldnât help, since almost every request comes from a different IP address. These are the hits on those weird /projects URLs since Sunday:
1 IP has 5 hits
1 IP has 4 hits
13 IPs have 3 hits
280 IPs have 2 hits
25543 IPs have 1 hit
The total number of hits has decreased now. Maybe the botnet has moved on âŠ
Fark me đ€Šââïž I woke up quite late today (after a long night helping/assisting with a Mainframe migration last night fork work) to abusive traffic and my alerts going off. The impact? My pod (twtxt.net) was being hammered by something at a request rate of 30 req/s (there are global rate limits in place, but stillâŠ). The culprit? Turned out to be a particular IP 43.134.51.191 and after looking into who own s that IP I discovered it was yet-another-bad-customer-or-whatever from Tencent, so that entire network (ASN) is now blocked from my Edge:
+# Who: Tentcent
+# Why: Bad Bots
+132203
Total damage?
$ caddy-log-formatter twtxt.net.log | cut -f 1 -d ' ' | sort | uniq -c | sort -r -n -k 1 | head -n 5
61371 43.134.51.191
402 159.196.9.199
121 45.77.238.240
8 106.200.1.116
6 104.250.53.138
61k reqs over an hour or so (before I noticed), bunch of CPU time burned, and useless waste of my fucking time.
And regarding those broken URLs: I once speculated that these bots operate on an old dataset, because I thought that my redirect rules actually were broken once and produced loops. But a) I cannot reproduce this today, and b) I cannot find anything related to that in my Git history, either. But itâs hard to tell, because I switched operating systems and webservers since then âŠ
But the thing is that Iâm seeing new URLs constructed in this pattern. So this canât just be an old crawling dataset.
I am now wondering if those broken URLs are bot bugs as well.
They look like this (zalgo is a new project):
https://www.uninformativ.de/projects/slinp/zalgo/scksums/bevelbar/
When you request that URL, you get redirected to /git/:
$ curl -sI https://www.uninformativ.de/projects/slinp/zalgo/scksums/bevelbar/
HTTP/1.0 301 Moved Permanently
Date: Sat, 22 Nov 2025 06:13:51 GMT
Server: OpenBSD httpd
Connection: close
Content-Type: text/html
Content-Length: 510
Location: /git/
And on /git/, there are links to my repos. So if a broken client requests https://www.uninformativ.de/projects/slinp/zalgo/scksums/bevelbar/, then sees a bunch of links and simply appends them, youâll end up with an infinite loop.
Is that whatâs going on here or are my redirects actually still broken ⊠?
I just noticed this pattern:
uninformativ.de 201.218.xxx.xxx - - [22/Nov/2025:06:53:27 +0100] "GET /projects/lariza/multipass/xiate/padme/gophcatch HTTP/1.1" 301 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"
www.uninformativ.de 103.10.xxx.xxx - - [22/Nov/2025:06:53:28 +0100] "GET http://uninformativ.de/projects/lariza/multipass/xiate/padme/gophcatch HTTP/1.1" 400 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"
Let me add some spaces to make it more clear:
uninformativ.de 201.218.xxx.xxx - - [22/Nov/2025:06:53:27 +0100] "GET /projects/lariza/multipass/xiate/padme/gophcatch HTTP/1.1" 301 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"
www.uninformativ.de 103.10.xxx.xxx - - [22/Nov/2025:06:53:28 +0100] "GET http://uninformativ.de/projects/lariza/multipass/xiate/padme/gophcatch HTTP/1.1" 400 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"
Some IP (from Brazil) requests some (non-existing, completely broken) URL from my webserver. But they use the hostname uninformativ.de, so they get redirected to www.uninformativ.de.
In the next step, just a second later, some other IP (from Nepal) issues an HTTP proxy request for the same URL.
Clearly, someone has no idea how HTTP redirects work. And clearly, theyâre running their broken code on some kind of botnet all over the world.
Python Launches DEI Marketing Campaign
First Python refused to stop discriminatory policies & turned down $1.5 Million from the US Government. â Read more
Testing 1 2 3
Testing 1 2 3
FTR, I see one (two) issues with PyQt6, sadly:
- The PyQt6 docs appear to be mostly auto-generated from the C++ docs. And they contain many errors or broken examples (due to the auto-conversion). I found this relatively unpleasent to work with.
- (Until Python finally gets rid of the Global Interpreter Lock properly, itâs not really suited for GUI programs anyway â in my opinion. You canât offload anything to a second thread, because the whole program is still single-threaded. This would have made my fractal rendering program impossible, for example.)
Hello World! Testing 1 2 3
** SQL Injection: Listing Database Contents on Non-Oracle Databases**
UNION-based SQL injection used to enumerate database tables, extract credential columns, dump usernames and passwords, and log in as theâŠ
[Continue reading on I ⊠â Read more
Testing 1 2 3 @manton@twtxt.net
For those curious, the new Twtxt <-> ActivityPub bridge Iâm building (bidirectional) simply requires three things:
- You register your Twtxt feed to the bridge: https://bridge.twtxt.net
- You verify that you in fact own/control the feed by putting the verification code somewhere on/in your feed (doesnât matter where or how)
- You proxy/forward requests for
/.well-known/webfingerto the Bridgebridge.twtxt.net.
Iâm still testing through and ironing out bugs đ Please be patient! đ
CORS Vulnerability with Trusted Null Origin
Discover how a simple CORS misconfiguration can leak sensitive data across origins.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/cors-vulnerability-with-trusted-null-origin-0f9593bd7674?source= ⊠â Read more
How I Cleared the CISSP and CISM in 6 MonthsâââA Realistic Strategy That Actually Works
The Opening: Why This Matters
[Continue reading on InfoSec Write-ups »](https://infosecwri ⊠â Read more
CORS Vulnerability with Trusted Insecure Protocols
Understanding how insecure CORS configurations can expose sensitive data across subdomains.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/cors-vulnerability-with-trusted-in ⊠â Read more
How to Find P1 Bugs using Google in your Targetâââ(Part-2)
Earn rewards with this simple method.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-to-find-p1-bugs-using-google-in-your-target-part-2-d37a9bb0b2e7?sour ⊠â Read more
A single unsanitized parameter is all an attacker needs
My goodness, a new level of stupidity.
The bots are now doing things like this:
GET http://uninformativ.de/projects/lariza/feednotify/datenstrahler/slinp/countty HTTP/1.1
- That URL does not exist.
- By including
http://uninformativ.dein that request, this instructs the webserver to do an HTTP proxy request. Of course, this isnât allowed on my webserver (and shouldnât by allowed on any normal webserver), resulting in HTTP 400. And even if it were, the target would be the exact same server, making a proxy request unnecessary.
And of course, itâs not just 50 hits like this or 100 or 1â000 or 10â000. No, itâs over 150â000 in the last 2 days. All from vastly different IP ranges of different cloud hosters.
This almost looks like a DDoS attack, but itâs just completely stupid. This feels more like some idiot vibe coded a crawler.
ProcessOne: On Signal Protocol and Post-Quantum Ratchets
Signal improved its protocol to prepare encrypted messaging for the quantum era.
They call the improvement âTriple Ratchetâ (or SPQR = Signal Post-Quantum Ratchet).
[Signal Protocol and Post-Quantum Ratchets\âš\âšWe are excited to announce a significant advancement in the security ⊠â Read more
**How I Used AI to Become Someone Else (And Why Your Face Is No Longer Your Password) **
Free Link đ
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-used-ai-to-b ⊠â Read more
**The Authorization Circus: Where Security Was the Main Clown **
Free Link đ
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-authorization-circus-where-security-was-the-main-clown-f4b84ca9356f?source=rssâ-7b ⊠â Read more
Over 1,400 Africans fighting for Russia in Ukraine, warns Ukrainian Foreign Minister Andrii Sybiha â Read more
@prologic@twtxt.net Letâs go through it one by one. Hereâs a wall of text that took me over 1.5 hours to write.
The criticism of AI as untrustworthy is a problem of misapplication, not capability.This section says AI should not be treated as an authority. This is actually just what I said, except the AI phrased/framed it like it was a counter-argument.
The AI also said that users must develop âAI literacyâ, again phrasing/framing it like a counter-argument. Well, that is also just what I said. I said you should treat AI output like a random blog and you should verify the sources, yadda yadda. That is âAI literacyâ, isnât it?
My text went one step further, though: I said that when you take this requirement of âAI literacyâ into account, you basically end up with a fancy search engine, with extra overhead that costs time. The AI missed/ignored this in its reply.
Okay, so, the AI also said that you should use AI tools just for drafting and brainstorming. Granted, a very rough draft of something will probably be doable. But then you have to diligently verify every little detail of this draft â okay, fine, a draft is a draft, itâs fine if it contains errors. The thing is, though, that you really must do this verification. And I claim that many people will not do it, because AI outputs look sooooo convincing, they donât feel like a draft that needs editing.
Can you, as an expert, still use an AI draft as a basis/foundation? Yeah, probably. But hereâs the kicker: You did not create that draft. You were not involved in the âthought processâ behind it. When you, a human being, make a draft, you often think something like: âOkay, I want to draw a picture of a landscape and thereâs going to be a little house, but for now, Iâll just put in a rough sketch of the house and add the details later.â You are aware of what you left out. When the AI did the draft, you are not aware of whatâs missing â even more so when every AI output already looks like a final product. For me, personally, this makes it much harder and slower to verify such a draft, and I mentioned this in my text.
Skill Erosion vs. Skill EvolutionYou, @prologic@twtxt.net, also mentioned this in your car tyre example.
In my text, I gave two analogies: The gym analogy and the Google Translate analogy. Your car tyre example falls in the same category, but Geminiâs calculator example is different (and, again, gaslight-y, see below).
What I meant in my text: A person wants to be a programmer. To me, a programmer is a person who writes code, understands code, maintains code, writes documentation, and so on. In your example, a person who changes a car tyre would be a mechanic. Now, if you use AI to write the code and documentation for you, are you still a programmer? If you have no understanding of said code, are you a programmer? A person who does not know how to change a car tyre, is that still a mechanic?
No, youâre something else. You should not be hired as a programmer or a mechanic.
Yes, that is âskill evolutionâ â which is pretty much my point! But the AI framed it like a counter-argument. It didnât understand my text.
(But what if thatâs our future? What if all programming will look like that in some years? I claim: Itâs not possible. If you donât know how to program, then you donât know how to read/understand code written by an AI. You are something else, but youâre not a programmer. It might be valid to be something else â but that wasnât my point, my point was that youâre not a bloody programmer.)
Geminiâs calculator example is garbage, I think. Crunching numbers and doing mathematics (i.e., âcomplex problem-solvingâ) are two different things. Just because you now have a calculator, doesnât mean itâll free you up to do mathematical proofs or whatever.
What would have worked is this: Letâs say youâre an accountant and you sum up spendings. Without a calculator, this takes a lot of time and is error prone. But when you have one, you can work faster. But once again, thereâs a little gaslight-y detail: A calculator is correct. Yes, it could have âbugsâ (hello Intel FDIV), but its design actually properly calculates numbers. AI, on the other hand, does not understand a thing (our current AI, that is), itâs just a statistical model. So, this modified example (âaccountant with a calculatorâ) would actually have to be phrased like this: Suppose thereâs an accountant and you give her a magic box that spits out the correct result in, what, I donât know, 70-90% of the time. The accountant couldnât rely on this box now, could she? Sheâd either have to double-check everything or accept possibly wrong results. And that is how I feel like when I work with AI tools.
Gemini has no idea that its calculator example doesnât make sense. It just spits out some generic âargumentâ that it picked up on some website.
3. The Technical and Legal Perspective (Scraping and Copyright)The AI makes two points here. The first one, I might actually agree with (âbad bot behavior is not the fault of AI itselfâ).
The second point is, once again, gaslighting, because it is phrased/framed like a counter-argument. It implies that I said something which I didnât. Like the AI, I said that you would have to adjust the copyright law! At the same time, the AI answer didnât even question whether itâs okay to break the current law or not. It just said âlol yeah, change the lawsâ. (I wonder in what way the laws would have to be changed in the AIâs âopinionâ, because some of these changes could kill some business opportunities â or the laws would have to have special AI clauses that only benefit the AI techbros. But I digress, that wasnât part of Geminiâs answer.)
tl;drExcept for one point, I donât accept any of Geminiâs âcriticismâ. It didnât pick up on lots of details, ignored arguments, and I can just instinctively tell that this thing does not understand anything it wrote (which is correct, itâs just a statistical model).
And it framed everything like a counter-argument, while actually repeating what I said. Thatâs gaslighting: When Alice says âthe sky is blueâ and Bob replies with âwhy do you say the sky is purple?!â
But it sure looks convincing, doesnât it?
Never againThis took so much of my time. I wonât do this again. đ
@movq@www.uninformativ.de this I find more worrisome, and saw no mention of it on your text: Right-Wing Chatbots Turbocharge Americaâs Political and Cultural Wars (gift article).
Enoch, one of the newer chatbots powered by artificial intelligence, promises âto âmind wipeâ the pro-pharma biasâ from its answers. Another, Arya, produces content based on instructions that tell it to be an âunapologetic right-wing nationalist Christian A.I. model.â
@movq@www.uninformativ.de Gemini liked your opinion very much. Here is how it countered:
1. The User Perspective (Untrustworthiness)The criticism of AI as untrustworthy is a problem of misapplication, not capability.
- AI as a Force Multiplier: AI should be treated as a high-speed drafting and brainstorming tool, not an authority. For experts, it offers an immense speed gain, shifting the work from slow manual creation to fast critical editing and verification.
- The Rise of AI Literacy: Users must develop a new skillâAI literacyâto critically evaluate and verify AIâs probabilistic output. This skill, along with improving citation features in AI tools, mitigates the âgaslightingâ effect.
The fear of skill loss is based on a misunderstanding of how technology changes the nature of work; itâs skill evolution, not erosion.
- Shifting Focus to High-Level Skills: Just as the calculator shifted focus from manual math to complex problem-solving, AI shifts the focus from writing boilerplate code to architectural design and prompt engineering. It handles repetitive tasks, freeing humans for creative and complex challenges.
- Accessibility and Empowerment: AI serves as a powerful democratizing tool, offering personalized tutoring and automation to people who lack deep expertise. While dependency is a risk, this accessibility empowers a wider segment of the population previously limited by skill barriers.
The legal and technical flaws are issues of governance and ethical practice, not reasons to reject the core technology.
- Need for Better Bot Governance: Destructive scraping is a failure of ethical web behavior and can be solved with better bot identification, rate limits, and protocols (like enhanced
robots.txt). The solution is to demand digital citizenship from AI companies, not to stop AI development.
Python Software Foundation Running Out of Money
After turning down $1.5 Million from the US Government as an act of DEI Virtue Signalling, the Python Software Foundation reveals that they have a $1.4 Million deficit, with only 6 months of money left. â Read more
Iâm building a service that lets you:
create and manage disposable, brandable email aliases so you can track leaks, forward important messages, and keep your real inbox clean.
Iâve just finishing building it for the most part, and have cut a v0.1.0 release. Itâs currently closed source (to be decided later) and now open to beta testers. cc @bender@twtxt.net đ I fully intend to monetize and offer this as a paid service in teh coming weeks/months, but beta/invite-only testers and early adopters/users first đ€
Norwayâs mega wealth fund to reject Elon Muskâs $1 trillion Tesla pay package â Read more
Thematic Book Series: Too Much Combustion, Too Little Fire
Image: Book cover.
- Buy the print edition.
- Buy the epub edition.
For most of history ⊠â Read more
**How I Used Sequential IDs to Download an Entire Companyâs User Database (And The Joker Helped) **
Hey there!đ
[Continue reading on InfoSec Write-ups »](https://infosec ⊠â Read more
**The Great Tenant Mix-Up: How I Accidentally Became Every Companyâs Employee **
Free Link đ
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-great-tenant-mix-up-how-i-accidentally ⊠â Read more
(2025 Halloween Special) Pages 1 - 8 [AnyaArt] â Read more
Specimen 1: A caveman marking his territory:
Everyone Wants to HackâââNo One Wants to Think
Everyone chases exploits. Few chase understanding.
#4 RFI: From an External URL Into your Application
Understanding RFI isnât just about finding a bug; itâs about recognizing a critical design flaw that, if exploited, hands an attacker theâŠ
[Continue reading on InfoSec Write-ups »](https://infosecwrit ⊠â Read more
A little experiment with scrollbars: https://merveilles.town/@akkartik/115467327464136159 (audio/video; 1 minute)
**How I Made ChatGPT My Personal Hacking Assistant (And Broke Their âAI-Poweredâ Security) **
Free Link đ
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-m ⊠â Read more
**How I Hacked JWT Tokens and Became Everyone on the Internet (Temporarily) **
Hey there!đ
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-hacked-jwt-tokens-and-became-everyone-on-t ⊠â Read more
Exposed API Keys and Secrets with AI
Quick Disclosure of API Key and Secret to guess parameter value
1,000s of litres of drug chemicals from China seized by Canadian border officers â Read more
#Compoética #Compoética2025
Encontro Brasileiro de #ProgramaçãoCriativa
Vai ser agora sĂĄbado e domingo, 1 e 2 de novembro:
https://compoetica.github.io/hotsite/?evento=EV_2025
Domingo tem atividades no
#GaroaHackerClube #Algorave