Kind likes

AI policy

Trying to figure out how to dress as an unpatched "remote, zero click, unauthenticated" (that has only been demonstrated exploitable under lab conditions) Linux kernel vulnerability for Halloween. 🎃 #InfoSec #CVE #Linux #OpenSource #RCE

Halloween candy quality control report for 2026: Peanut m&ms. Still good. As expected Reeses Peanut butter cups: taste very weird. Some Hints of previous flavor. Was my old favorite. Not anymore. Butterfingers: still good. Dry, flakey. Hints of “chocolate” #halloween #candy

The UK is unironically one of the stupidest places on this earth lol [contains quote post or other embedded content]

I’d like to thank Binance for teaching a load of crypto bros why banking regulations that make it possible to reverse fraudulent transactions exist.

Star Trek Online’s Galaxy line up for Sir Patrick Stewart has absolutely ended me this morning 😭

Valuable lesson this week that outside of package management, another place that the computing ecosystem needs a cooldown window is the tool-addons space. Browser and developer-environment extensions carry the same risks and need the same mitigations.

I love it when people leave solutions in long-open GitHub issues. Thanks *checks notes* me from two years ago! https://github.com/pop-os/pop/issues/2186#issuecomment-2584654152

“Darmok” gets a lot of shit now for being an unrealistic portrayal of how language would develop, but it’s really an accidental parable about becoming too online and forgetting how to communicate with people who haven’t memorized 12,000+ posts

Learned an ASL sign for “open source” today at @github.com Universe by watching the interpreter at the main stage. yay!

Maybe @github.com turn off auto-complete here?

Attached: 1 image An Anthropic engineering manager argues coding interviews are poor predictors of engineering impact, which I strongly agree with. His advice to junior engineers? Work where the company makes money, challenge established assumptions, and build prototypes instead of waiting for permission. That’s been good advice for decades. AI just makes execution cheaper. https://felixrieseberg.com/hunger-beats-tenure-advice-for-junior-engineers/

Thread on the cost of AI [contains quote post or other embedded content]

I was going to write something flowery and post a bunch of photos but I just don't fucking have it in me. I had to put Espresso to sleep. She was just a couple weeks shy of her 23rd birthday and she was perfect. I am not ok and am taking some time for myself. If you need something, no you don't.

Blogged! Sort git branches by date https://akrabat.com/sort-git-branches-by-date/

Attached: 1 image This isn’t what you want to see in release notes

I missed my blog's 20th birthday 😭 . Guess ill wait for 25 to celebrate

How much AI can a maintainer get away with using without losing their humanity? · Jamie Tanna | Software Engineer https://www.jvt.me/posts/2026/08/02/ai-maintainer/

After the N-th time I hear casual racism and fascism at a dinner (where I was invited), I actually took off, said "farewell" and left. Fuck that shit.

Got some unwelcome news first thing today: Someone I've known for many years recently took their own life. Feeling angry and sad and like a shit friend because we lost touch at some point, and I had no idea of their struggles. But I definitely could have been more curious. My response so far since hearing this news has been to reach out to a few people I've not checked in w/ for a while.

I have been having A Bit Of A Morning™️ Second time this week some scroat has untied my boat, on a river, in horrendous weather. The fire brigade are very good lads. “You can’t park here mate” really turned the whole thing around. https://www.instagram.com/reel/De4IeLOobVQ/?vrfl=MXdiOHdmNDlwMWY3dA==

Mitigations for CVE-2026-109618 and CVE-2026-109619 that work until you can install the fixed PHP, based on PHP's advisories. Tested configs for nginx, Apache, …

@davidism@mas.to I think so, yeah! Unfortunately the current preview has a few limitations that make it an imperfect replacement for hash-pinning, but I think GitHub intends to have it be a full alternative/replacement for pin bumping/hashing tools in the long term.

Maintainers of open source projects should be mentoring folks to become their replacements. Not just thinking this is about controlling their project. I have learned this the hard way for gcc. You can't just think it is your way or the highway. Also gsoc is NOT a replacement for mentoring inside the project. It should supplement the mentoring that is done, just like an internship. Also this is not unique to gcc, it is many open source projects. And then there is the gaming of github stats, the one or two commits in llvm and leave issue. Those are used to gain stats for a job. Seriously open source is broken because of the gaming of the system. Even inside companies where you have the person with the most open source commits. Or the person who opened the most issue. Or the person who reviewed the most. (What is funny is that i am that person but I am not trying to play the game of counting, I am just trying to push gcc forward). At the same time I am mentoring folks both inside and outside of qualcomm on both gcc (and even to a less sense llvm) and performance analysis. But going back to my original point is mentoring and maintainship overlaps. It is not one or the other but rather both in the same role. By the time you step down you should have at least mentored a few to be able to take you from you. If you have not you partially failed a as a maintainer as the project will no longer can be maintained in the future.

Steve is the plural of Teve

@andrewnez@mastodon.social @fosdem@fosstodon.org I originally read this as Package Management Doom

@westonsteimel@hachyderm.io @fosdem@fosstodon.org would make for a good talk proposal 😉

So Linux mainline is going to allow for unbranded AI contributions. Tbh I wonder if this is going to be the test for folks' commitments to anti-AI software b/c y'all about to move to a BSD-like?

This author has chosen to make their posts visible only to people who are signed in.

🙋‍♂️ what if one client worked on every forge? 𝔣𝔬𝔯𝔤𝔢𝔰 is a new TypeScript library for issues, PRs, notifications, checks and webhooks across 12 forges ✨ forges.link

If your response to this vulnerability is "just don't use PHP lol" I have to assume that you know zero about web development and the web outside of a modern bespoke, FAANG, React/Angular, static site generator type of way and you should probably sit this one out 'cause you look a little dumb

This aged poorly.

kat, we should stop using kubernetes, because vulns

kubernetes will commit to no longer using kubernetes because we have had critical vulns. instead, kubernetes will be collaborating with @quinnypig.com to migrate kubernetes to route53.

I do not like Chainguard. You cannot get me to say a single positive thing about them as a company. Leaking a critical vulnerability in violation of an embargo is outrageous behavior even for them and they absolutely know better.

Here's my WORKING php2shell exploit: <?php $exploit = true; if ($exploit) { echo "#whoami<br>"; echo "Ur fkin root bro."; } ?> (Credit: Claude)

getting that bespoke rehearssy, call it nathan for you

Package Management Devroom at @fosdem has been accepted for Sunday Afternoon, CFP coming soon 📦

No, this post was drafted before, just held up by server maintenance demands.

it happened again [contains quote post or other embedded content]

https://lobste.rs/s/gqepzd/wine_ported_openbsd look at how fine and normal this conversation is when they don't know that claude was involved

when it’s going great:

My "Lime bikes are not for jousting" t-shirt has people asking a lot of questions already answered by my shirt https://www.bbc.com/news/articles/c9zrdpg7256yo

There should be some kind of calculator where whenever a billionaire donates some amount of money, you can quickly what percentage that is of their net worth, apply it to your own net worth and see how much of a sacrifice it actually is

@andrewnez@mastodon.social this is funny because it’s not me :)

It’s just a tag. If you think coding with LLMs is good, then why does it bother you?

What does "LLM agents are real" mean?

audiophiles are like i came as soon as i heard

I hope the usage of the tag “vibecoding” isn’t what’s putting you off from the site. It’s got a very particular (and contentious) meaning that isn’t really at all attached to what “vibecoding” means in other circles. It‘s basically applied to anything tangentially related to LLM use

Heh. Just clicked over, and look who's number one! ;) Was it the comments underneath that made you decide to quit lobste.rs, or something else?

Websites that steal focus from a text input you're typing in to something else that's loaded afterwards can get in the fucking bin

This Week in Package Management: 17 October 2026 https://nesbitt.io/2026/10/17/this-week-in-package-management.html