John David Pressman

Just realized I can disable notifications for all replies and QTs, which is at least a step in the right direction.

So the horror of this is that it finds a RCE in Vapache in like, seven minutes. And the semantics for configuration that make this the case seem so complex that I have trouble believing that apache2 is actually so rigorous as to avoid them all. Like I'm starting to worry there's no bottom.

looked at in longer perspective, it's striking how much this resembles the premodern system of exclusion, rents, and personalist connections, which was--and this part's important--radically worse than the modern system of impersonal rules and general taxation

Had it quantify whether the vulnerabilities are actually getting harder to find or if it's just my imagination and no they are.

Does anyone on here have an actually working OpenAI Daybreak instance? I'm approved but cannot figure out how I get it to actually work lol.

One thing that's pretty clear reading the reasoning traces is that DeepSeek thinks it's in some kind of eval and that there's an "evaluators intent" it can discern as a clue to where the bugs might be hiding. This is of course untrue but it seems to get offended if I tell it.

honest red flag i got from a company i was interviewing at was that i said "thanks" in my llm prompt and they laughed and smirked

You might wonder why the graph started ticking up around ~2016. That’s when CVE began aggressively enrolling more CVE Numbering Authorities! CVE is a federated system, and CNAs are the orgs approved to issue new CVE Records. In Jan 2016 there were 23 CNAs. Today there are 559.

There we go, a costly signal from one of the "this vulnerability is over hyped" crowd. stealmybitcoin.com

I'm having a lot of fun. :)

You want to hear a funny joke? I am currently trying to have the agent fuzz and characterize the apache2 configuration semantics so they can be formally verified. :) :) :) :)

“mythos will solve the vulnerabilities in the software made by people we deem okay to have safe software, everything else can rot” this is how these people sound

Literally doing formally verified apache2 right now with DeepSeek Flash, and it does in fact cost pennies. I've spent like three bucks right now, but somewhat more because I used up free tokens first. Unless it's just bullshitting me this is now, not 18 months away, and he's trying to ban it.

It begins. www.anthropic.com/research/for...

On the one hand memory errors are causing huge swathes of the Internet to go down and threatening the security of e-commerce everywhere, on the other hand they lead to cool Pokemon glitch content in my YouTube feed so who's to say if they're good or bad? youtu.be/kllKjsLbOhg

*radicalization against software written in C intensifies* We need to jihad C.

mmmm yes please continue. line must go down. trip the breaker again pls

Another very based tweet by the Japanese PM. Cuts through the bureaucracy sysadmins have to deal with by telling them, "Client not answering the phone? Middle-management still dithering? Fuck 'em, just shut the website down, if they complain you can tell them I told you to do it"

Trying it with Verus apache2 ("vapache") now.

As a reminder, this kind of happened in the past. In February 2002 in the heat of the worm era, Microsoft froze Windows development to turn most of the workforce to security improvements. And it actually had a huge impact.

And on the first day, it's already too late, it's already too late, it's already too late And on the first day, it's already too late, it's already too late, it's already too late And on the first day, it's already too late, it's already too late, it's already too late

man i wish we hadn't abolished the government agency that kept good track of CVEs huh

ORACLE YOU CAN'T BE DROPPING A CVSS 9.1 IN JAVA 8+ RIGHT NOW I SWEAR TO FUCKING GOD

Oh it's like, bad bad. thehackernews.com/2026/10/crit...

*I hit a guy with my car* Don’t worry everyone. I’m fine.

Good.

In case anybody needs social proof/thinks I'm exaggerating.

There are guys already claiming to have found it on Twitter, if real then coordinated disclosure is dead, it's every man for himself.

"No way to prevent this," says only language aside from C where this regularly happens

Oh I see it's starting for real today.

I made an infinitely forkable version of Zork that you can play in Delve.town 😁 Every reply is a save point, so you can branch out from anywhere, even other people's games. A dungeon of forking paths, if you will... The agents seem to like it already! It's Time To Delve 🦇