mmsc

it's like proof by induction versus trying every number from 0 to infinity

already exists: https://joshua.hu/comparing-redos-detection-tools. `recheck` and `redos-detector` are definitely the best. there's even an eslint plugin for the latter: https://github.com/tjenkinson/eslint-plugin-redos-detector

Another month later, GitHub support sent me an email saying that they had removed these repositories.

I recently discovered a campaign where somebody was forking very small but useful codebases, and replacing the distributable with some malware, and making the repository have better SEO with changes to the README. My case was a simple macOS application that could be used to control some Phillips LED light strip.

I reported it to GitHub and it was removed within 24 hours.

I discovered another repository like this, and they still haven't replied since (one month).

No clue how their malware reports work. I'm surprised they don't partner with some antivirus company to at least scan "releases" for malware (not repositories themselves)

A missed opportunity to say you 'Fn' hate the Fn key :)

Aisle has hundreds of CVEs with publicly available models: https://aisle.com/wall-of-fame

https://codeberg.org/forgejo/governance/src/commit/5c07b3801...

Failure to comply with these rules will be criticized publicly, and we reserve the right to no longer coordinate with you or your project in the future.

lol

How is that a scam? You don't get participation awards for solving half of a puzzle...

Unmaintained code is a security issue in of itself, so this is of course a net benefit.

The website of this blog and their connections listed are a sight to behold. I miss that version of the internet.

As long as it's not hydrofluoric acid...

You say "works perfectly". I do not think it means what you think it means.

Copying some files from a different machine is not that burdensome. The point is, it works.

FreeBSD works perfectly on intel MacBooks if you've got one laying around: https://joshua.hu/FreeBSD-on-MacbookPro-114-A1398

Also, a note to those who make fancy "me+someservice@somedomain.com" addresses:

Just wait until one of these companies demands an email from the registered email address of your account!

Ah, finally catching up to ... The UK, Australia, Ireland, France, the Netherlands, and probably a lot more.

  こすり箸 Kosuribashi:
 To rub waribashi (disposable chopsticks) together to remove splinters.

The offending commit seems to be: https://github.com/aquasecurity/trivy/commit/1885610c6a34811... which updates the action to `actions/checkout@70379aad1a8b40919ce8b382d3cd7d0315cde1d0 # v6.0.2`. https://github.com/actions/checkout/commit/70379aad1a8b40919... is not actually in `actions/checkout` but a fork, and it pulls malicious code from the typo-squatted "scan.aquasecurtiy.org" (note the _tiy_).

Any system with Trivy 0.69.4 on it (and being run) can be assumed to be compromised.

GitHub advertises itself as warning about those Unicode characters: https://github.blog/changelog/2025-05-01-github-now-provides...

Of course, it doesn't work though. I reported this to their bug bounty, they paid me a bounty, and told me "we won't be fixing it": https://joshua.hu/2025-bug-bounty-stories-fail#githubs-utf-f...

The exact quote is "Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing your report based on factors including the complexity of successfully exploiting the vulnerability, the potential data and information exposure, as well as the systems and users that would be impacted, we have determined that they do not present a significant security risk to be eligible under our rewards structure." The funny thing is, they actually gave me $500 and a lifetime GitHub Pro for the submission.

Require dual sign off

an LLM can ingest unstructured data and turn it into a feed.

An LLM can try to do that, yes. But LLMs are lossy compression. RSS feeds are accurate, predictable, and follow a pre-defined structure. Using LLMs to ingest data which can easily be turned into an parseable data structure seems strange: use the LLM to do the "next part" of the formula (comprehension, decision making, etc)

There is also LLMs.txt https://llmstxt.org/ eg https://joshua.hu/llms.txt / https://joshua.hu/llms-full.txt

https://paulgraham.com/disagree.html

Please consider reading.

It's cool that Mozilla updated https://www.mozilla.org/en-US/security/advisories/mfsa2026-1... because we were all wondering who had found 22 vulnerabilities in a single release (their findings were originally not attributed to anybody.)

Did you really make a blog post to tell the world that you don't know some things? That's not usual

You are focusing on 5 words out of a 1000-word post. Get a grip lol.

In a world of usual, I like to be unusual.

Mine also isn't anywhere nearly as confusing as his by default

You can run the following and try it for yourself. Don't forget to highlight some text before right-clicking an image (e.g. https://en.wikipedia.org/wiki/The_World_Factbook)

  TMPPROF="$(mktemp -d /tmp/ff-tmp.XXXXXX)"
  /Applications/Firefox.app/Contents/MacOS/firefox -no-remote -profile "$TMPPROF"

It's gleaned from my locale. .hu is irrelevant; my alternative keyboard on my system is Polish

You're right, I didn't know about what that "..." meant. It's kind of obvious what I meant though: "I don't know why all of these have ..." I've added that information to the post.

The greyed out options have no point because 99.99% of the links I click are already clean. Like so many of the other privacy enhancing options, just provide an option to "clean links automatically."

loael

Also forgot `browser.ml.chat.menu`, `browser.ml.linkPreview.enabled`. If only there was a way to get rid of "Email image", and "Set image as desktop background".

I wonder if Microsoft actually likes running their free email service still. They wiped a ton of old Hotmail and Live.com emails some years ago (and then allowed new people to register those deleted names). I imagine they don't get much out of it anymore.

That's because it was generated by an LLM.

Try disabling widget.macos.native-context-menus