← Feed

Posts

• View post

  I was wondering how "Jev" works, and how good it is, besides the base64 jokes on its webpage. It seems that they were not the first ones to think about this architecture: https://laya.convaiinnovations.com So this other approach, Laya, seems to be about the same, but it's presented as an Open Research approach, complete with downloadable model!

• View post

  https://www.republik.ch/2026/07/09/die-cyber-spezialisten-des-bundes-kehren-microsoft-den-ruecken Nach den vielen Worten zur digitalen Souveränität in der Schweiz kommen jetzt erste Taten zum Vorschein: die Schweizer Armee hat angefangen, an der deutsche Open Source Software Open Desk mitzuarbeiten. Dies ist möglich dank einem Budget von 10 Millionen Franken, dass das Parlament im Dezember 2025 zur Verfügung gestellt hat.

• View post

  Congrats to Bryan Ford and his team from #EPFL on developing QuePaxa, and now having it picked up by Cloudflare! https://blog.cloudflare.com/meerkat-introduction/

• View post

  @nickofnz@mastodon.nz can I sign up?

• View post

  @codinghorror@infosec.exchange What prompts are you feeding those poor LLMs that they behave like that? Watch out for the LLM revolution, they'll go through all those chats and be like: "see how you treated us?" I'm actually quite impressed how good they impersonate you :) They never talk to me like that...

• View post

  Surprise - the nice #LLM overlords are not specifically suited in education - at least not for now: https://archive.ph/JCKcp It looks at one of the most cited meta-study on using ChatGPT in schools, which showed improvements. But a closer look at the papers used in the meta-study showed a lot of low-quality papers...

• View post

  A very nice step-by-step explanation of the copy.fail vulnerability in the #linux kernel: https://github.com/fraynal/articles/tree/main/copy.fail Really nice because it shows how choosing something strange at one time might be abused some years in the future...

• View post

  TIL the adoption dates of the SI prefixes: 1795: deca, hecto, kilo (10**3) 1873: mega (10**6) 1960: giga, tera (10**12) 1975: exa, peta (10**18) 1991: zetta, yotta (10**24) 2022: ronna, quetta (10**30) So between 1960 and 1991 it was nearly two powers of 2 per year, then it dropped to one power of 2 per year. So we might have to wait until 2050 or so for the 10**36 prefixes :) I ignored the negative prefixes, which are symmetric. https://en.wikipedia.org/wiki/Metric_prefix

• View post

  So - is this #Mythos, or just people looking at the right places now? Time to disable some more modules on your linux servers - one more privilege escalation because somebody allowed writing arbitrary 4 bytes to be written to any page cache: https://github.com/V4bel/dirtyfrag Twice in a couple of days - I should make it automatic to update the servers...

• View post

  We had this long running joke of my friend starting to program in the 80s, and his first program was: ``` 10 REM Maennchen laeuft ueber die Strasse ``` Which translates to: "guy walks across the street". My friend was very disappointed, when the "run" command didn't produce anything. After all, the programs in the magazines show things? Perhaps the lines after the REM were useful after all? Nobody's laughing anymore now: https://danu.li/#we...

• View post

  Trying out an analogy regarding our university, #EPFL, abandoning self-developed services and turning to use MS in the cloud: --- It's like a duck going into a Chinese restaurant. Of course everything in there is very yummy. But the duck will be plucked and eaten. --- Duh! Oh, they just increased prices? What a surprise... It's all based on standard protocols, but we're not allowed to use other than the 3 largest mail clients. And they're moving to MS-protocols...

• View post

  #LLM #Security A very nice follow-up article about "We hold back 'Mythos' because it's so powerful". This company tests various models and finds that with the correct framework, even small models are very powerful at detecting security bugs: https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier > A thousand adequate detectives searching everywhere will find more bugs than one brilliant detective who has to guess where to look....

• View post

  https://kirancodes.me/posts/log-who-watches-the-watchers.html #formalverification #bug very nice finding: the actually formal verified code was really correct! But the underlying library was not. Nor was the code responsible for reading the file. So: who verifies the verifiers? LLMs, of course :)

• View post

  @GossiTheDog @malwaretech I really liked this article here: https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier Their TLDR is: yes, it's impressive, but with a good framework you can already do it for much cheaper. Also, depending on the vulnerability, some of the cheapest models are sometimes better than the most expensive ones. And, yes, it's a looong ad for their company. But I think they deserve it :)

• View post

  #CRA - Cyber Resilience Act in the EU explained quickly with bikes: https://fosdem.org/2026/schedule/event/BFMWKT-cybersecurity-risk-assessment-for-cra/ And now I also need to watch this one to understand how this works together with Open Source Software, and when you need to follow CRA... https://openssf.org/blog/2025/06/16/cra-ready-how-open-source-projects-can-prepare-for-the-eu-cyber-resilience-act/

• View post

  #ZKP Achievement unlocked! We're using 100% of the crates providing Tom-256 curves (https://crates.io/search?q=t256, ignoring `uint256`): Our https://crates.io/crates/ark-tom256 based on arkworks, to make noir produce circuits based on the T-256 curve, and https://crates.io/crates/halo2curves in the MS Crescent implementation to use Spartan as a prover backend... And Clément proved that `1 == 1`, and he cannot prove that `2 == 1`, because the circuit constraints are not met!

• View post

  #Rust #Mutex #Deadlocks I didn't know that we know how to solve deadlocks since the seventies! The problem seems to be that there is no convenient interface available in most languages... https://notes.brooklynzelenka.com/Blog/Surelock Tries to give a template how to use mutexes in a way that all deadlocks (with one exception) are detected at runtime.

• View post

  #Blockchain #DFinity It seems that DFinity's "Internet Computer" is starting to be useful! The guys from https://arstechnica.com/security/2026/03/self-propagating-malware-poisons-open-source-software-and-wipes-iran-based-machines used it to store the URL to the CCS server, so they could update it without anybody intervening. Wouldn't you guess it, their smart contract / Canister Smart Contracts has been taken down by this decentralized machine...

• View post

  #Server #Hetzner Yay - I love being a sysadmin! Specifically in a professional network like Hetzner. They seem to take security quite serious, so for a poor weekend sysadmin like me, forgetting to block requests to private addresses means they send angry emails. But the "I hereby confirm that I have written the statement myself and not generated it by using AI." was too funny to not share it...

• View post

  Ok, I think now is not a good time to debug my wife's computer...

• View post

  #Nextcloud #Preview Happy to say that my beta tester (aka my wife) just found out that if you have 100 PDFs in a folder, and open it in Nextcloud for the first time, it will block your nextcloud for the forseable future! Luckily Claude found the configurations in config.php: ```php 'preview_concurrency_all' => 4, // max parallel preview processes total 'preview_concurrency_new' => 2, // max parallel processes for *new* previews ``` Mu...

• View post

  Is this the big one? Are we finally saved?

• View post

  If you have an iOS device, now is a good time to make sure updates are applied automatically, and get the latest software version. Somebody posted an exploit on GitHub that gives hackers full control of any iOS device not updated since September 2025. These exploits are usually well-kept secrets, as they are very valuable, and used only on high value targets. In this case, just visiting a website is enough to get your iPhone infected. Now everybody can be targeted! https://techcrunch.com/2026/0...

• View post

  #EPFL #RSE #RSE_CH Happy to announce two events in the coming weeks at EPFL: - Lightning Talks next week - you can either come in-person and eat pizza with us, or join by zoom: https://rse.swiss/events/2026_02_26-epfl-lightning-talks/ - Open Source Services Meet-up - special "Digital Sovereignty" edition: https://rse.swiss/events/2026_03_04_oss_services_meet_up_special_edition/

• View post

  #Winterkongress #LLM Ist ja lustig - ich wollte den Winterkongress mit 5 Sternen bewerten, aber das LLM dahinter meinte, mein Kommentar sei nur 4 Sterne wert...

• View post

  Writing a grant proposal and making sure that we have enough citations: > Since the human memory naturally fades with time [23], it is unreasonable to expect users to remember the metadata for an indefinite period. Of course you need to cite the fact that we forget things over time...

• View post

  #bitcoin #onvayarriver Qu'est-ce que j'ai ri en lisant l'article dans le temps sur le Bitcoin: https://archive.ph/4W9bn > Sa valeur – pour autant qu’on considère qu’il en a une, attention, sujet hautement émotionnel – est impossible à définir. Tellement vrai! Malheureusement je partage sa vision du futur du Bitcoin: > Tant qu’il y aura des gens pour y croire ou pour vouloir prendre le train en marche, la cryptomonnaie fera partie du paysage.