Media is too big
VIEW IN TELEGRAM
source - @sbrugnadlbot
labs.google/ProjectGenie
Step inside Project Genie: our experimental research prototype that lets you create, edit, and explore virtual worlds. 🌎
labs.google/ProjectGenie
https://en.wikipedia.org/wiki/Bus_factor
The "bus factor" is the minimum number of team members that have to suddenly disappear from a project before the project stalls due to lack of knowledgeable or competent personnel.
For instance, say a team of 30 people produces bread in three necessary steps: mixing ingredients, kneading the dough, and baking. 10 people know how to mix ingredients, all 30 people know how to knead the dough, and 5 people know how to bake. If all 5 people who know how to bake disappear, then the team cannot produce bread, so the team's bus factor is 5. A bus factor of one is a single point of failure.
https://en.wikipedia.org/wiki/Single_point_of_failure
A single point of failure (SPOF) is a part of a system that would stop the entire system from working if it were to fail.
The "bus factor" is the minimum number of team members that have to suddenly disappear from a project before the project stalls due to lack of knowledgeable or competent personnel.
For instance, say a team of 30 people produces bread in three necessary steps: mixing ingredients, kneading the dough, and baking. 10 people know how to mix ingredients, all 30 people know how to knead the dough, and 5 people know how to bake. If all 5 people who know how to bake disappear, then the team cannot produce bread, so the team's bus factor is 5. A bus factor of one is a single point of failure.
https://en.wikipedia.org/wiki/Single_point_of_failure
A single point of failure (SPOF) is a part of a system that would stop the entire system from working if it were to fail.
Exposed Moltbook Database Let Anyone Take Control of Any AI Agent on the Site
https://www.404media.co/exposed-moltbook-database-let-anyone-take-control-of-any-ai-agent-on-the-site
also:
1-Click RCE to steal your Moltbot data and keys
Article, Comments
https://www.404media.co/exposed-moltbook-database-let-anyone-take-control-of-any-ai-agent-on-the-site
also:
1-Click RCE to steal your Moltbot data and keys
Article, Comments
Forwarded from vx-underground
Non-malware schizos asking about why the Notepad++ malware payload was so interesting.
Okay, we'll discuss it without getting too schizo.
First, Rapid7 (and other various Cyber Threat Intelligence vendors) seem to generally attribute the Notepad++ compromise to Chinese APT group "Lotus Bloom". They attribute it to Lotus Blossom because they tend to recycle code segments to save time. Basically, fingerprints.
Lotus Blossom is the invented name intelligence organizations have assigned to a group of Chinese government sponsored hackers. Their true identity is unknown, but speculative. It is not one person, it is likely a group of unknown size, it could two people, it could 15 people.
Lotus Blossom has been active since 2009 (or so they speculate). Lotus Blossom are not noobs who do hacker noob stuff. Lotus Blossom is assigned high-profile tasks. Lotus Blossom does extremely specific targets, most notably they are instructed by the Chinese government to hack government institutions, telecom companies, aviation companies, and critical infrastructure (nuclear power plants, electrical power grids, hydroelectric dams, etc) in Southeast Asia and Central America.
When Lotus Blossom targeted Notepad++, and users in specific regions (presumably Southeast Asia and Central America) attempted to do an update it delivered "Chrysalis Backdoor". Chrysalis Backdoor is the name intelligence companies invented and now call this malware.
Chrysalis Backdoor used a lot of really common malware techniques which truthfully I won't go too much into (API hashing, custom implementations of GetProcAddress, malware nerd stuff). However, what makes this malware very special is it's usage of Microsoft Warbird.
Microsoft Warbird is a proprietary technology which is rarely discussed. It is an internal library Microsoft uses to obfuscate it's instruction set in-memory. In other words, it's Microsoft really fancy custom way of preventing people from reverse engineering what Windows is doing when it's running.
Unknown to me personally (and a lot of people apparently), in the past few years (2023) some security researchers have discovered ways to discretely use Microsoft Warbird and use it as a weapon. Basically, you can use undocumented APIs in Windows to use Warbird for your malware. This provides a way to hide what your malicious code is doing while it's running without needing any external tooling or custom implementations. They're weaponizing Microsoft's anti-tampering and/or anti-reverse engineering technology for malicious purposes. This is extremely impressive because it shows:
1. Lotus Blossom pays close attention to really talented security researchers or...
2. Lotus Blossom has really good security researchers on payroll
Both are totally possible.
The remainder of the Lotus Blossom tooling is fairly generic malware stuff and isn't too terribly impressive. Lotus Blossom (unironically) did a very good job hijacking Notepad++ update infrastructure and weaponizing Microsoft's anti-tampering technology (Warbird).
Okay, we'll discuss it without getting too schizo.
First, Rapid7 (and other various Cyber Threat Intelligence vendors) seem to generally attribute the Notepad++ compromise to Chinese APT group "Lotus Bloom". They attribute it to Lotus Blossom because they tend to recycle code segments to save time. Basically, fingerprints.
Lotus Blossom is the invented name intelligence organizations have assigned to a group of Chinese government sponsored hackers. Their true identity is unknown, but speculative. It is not one person, it is likely a group of unknown size, it could two people, it could 15 people.
Lotus Blossom has been active since 2009 (or so they speculate). Lotus Blossom are not noobs who do hacker noob stuff. Lotus Blossom is assigned high-profile tasks. Lotus Blossom does extremely specific targets, most notably they are instructed by the Chinese government to hack government institutions, telecom companies, aviation companies, and critical infrastructure (nuclear power plants, electrical power grids, hydroelectric dams, etc) in Southeast Asia and Central America.
When Lotus Blossom targeted Notepad++, and users in specific regions (presumably Southeast Asia and Central America) attempted to do an update it delivered "Chrysalis Backdoor". Chrysalis Backdoor is the name intelligence companies invented and now call this malware.
Chrysalis Backdoor used a lot of really common malware techniques which truthfully I won't go too much into (API hashing, custom implementations of GetProcAddress, malware nerd stuff). However, what makes this malware very special is it's usage of Microsoft Warbird.
Microsoft Warbird is a proprietary technology which is rarely discussed. It is an internal library Microsoft uses to obfuscate it's instruction set in-memory. In other words, it's Microsoft really fancy custom way of preventing people from reverse engineering what Windows is doing when it's running.
Unknown to me personally (and a lot of people apparently), in the past few years (2023) some security researchers have discovered ways to discretely use Microsoft Warbird and use it as a weapon. Basically, you can use undocumented APIs in Windows to use Warbird for your malware. This provides a way to hide what your malicious code is doing while it's running without needing any external tooling or custom implementations. They're weaponizing Microsoft's anti-tampering and/or anti-reverse engineering technology for malicious purposes. This is extremely impressive because it shows:
1. Lotus Blossom pays close attention to really talented security researchers or...
2. Lotus Blossom has really good security researchers on payroll
Both are totally possible.
The remainder of the Lotus Blossom tooling is fairly generic malware stuff and isn't too terribly impressive. Lotus Blossom (unironically) did a very good job hijacking Notepad++ update infrastructure and weaponizing Microsoft's anti-tampering technology (Warbird).
Nine-slice (also known as 9-patch or 9-slice scaling) is a classic technique for drawing resizable UI elements (buttons, panels, dialog boxes, etc.) from a single small sprite.
The idea is to divide a sprite into 9 regions:
- 4 corners — drawn as-is, never stretched or tiled
- 4 edges — tiled/stretched in one direction to fill the needed width or height
- 1 center — tiled/stretched in both directions
This lets you render a UI element at any size while keeping the corners crisp and undistorted.
What the code does specifically:
1. Saves the current clip, gets the sprite dimensions.
2. Draws the 4 corners — top-left, top-right, bottom-left, bottom-right — by setting clip regions of cornerWidth × cornerHeight at each corner and drawing the sprite frame there.
3. Computes i = width - cornerWidth * 2 (the horizontal space between corners that needs filling) and iMin (the tile size from the sprite's middle section).
4. The while loop tiles the top and bottom edges horizontally — it steps across in increments of iMin, clipping each tile to avoid overdraw.
The image is cut off, but there's almost certainly similar code below for tiling the left/right edges vertically and filling the center.
This is very typical of old J2ME / mobile game UI code where you'd have a single sprite for a button or window frame and needed to draw it at various sizes
The idea is to divide a sprite into 9 regions:
[1 corner][2 edge][3 corner]
[4 edge ][5 fill][6 edge ]
[7 corner][8 edge][9 corner]
- 4 corners — drawn as-is, never stretched or tiled
- 4 edges — tiled/stretched in one direction to fill the needed width or height
- 1 center — tiled/stretched in both directions
This lets you render a UI element at any size while keeping the corners crisp and undistorted.
What the code does specifically:
1. Saves the current clip, gets the sprite dimensions.
2. Draws the 4 corners — top-left, top-right, bottom-left, bottom-right — by setting clip regions of cornerWidth × cornerHeight at each corner and drawing the sprite frame there.
3. Computes i = width - cornerWidth * 2 (the horizontal space between corners that needs filling) and iMin (the tile size from the sprite's middle section).
4. The while loop tiles the top and bottom edges horizontally — it steps across in increments of iMin, clipping each tile to avoid overdraw.
The image is cut off, but there's almost certainly similar code below for tiling the left/right edges vertically and filling the center.
This is very typical of old J2ME / mobile game UI code where you'd have a single sprite for a button or window frame and needed to draw it at various sizes
source
StackOverflow post from official staff about how the website hasn't been killed by AI.... is AI generated
source
holy shit bro it's real. the fucking *official stack overflow community manager* made a 100% ai generated post about how stack overflow isn't dead because of ai
Forwarded from HN Best Comments
Re: LiftKit – UI where "everything derives from the golden ratio"
When we designed Chrome, since minimalism was our thing and screens used to be small, A LOT of time was spent on the total vertical space - thin titlebar, slightly bigger tabstrip, and a large toolbar. Lots of discussion, lots of questions
Telling people the height ratios between them followed the golden ratio was a very convenient way to shortcut the bikeshedding and get to "aha, very nice"
The trick was it didn't follow the golden ratio at all because the golden ratio is not some magic number that leads to balance and peace - lighting, rounding, color, and visual strength all dramatically outweigh it
gmurphy, 8 hours ago
When we designed Chrome, since minimalism was our thing and screens used to be small, A LOT of time was spent on the total vertical space - thin titlebar, slightly bigger tabstrip, and a large toolbar. Lots of discussion, lots of questions
Telling people the height ratios between them followed the golden ratio was a very convenient way to shortcut the bikeshedding and get to "aha, very nice"
The trick was it didn't follow the golden ratio at all because the golden ratio is not some magic number that leads to balance and peace - lighting, rounding, color, and visual strength all dramatically outweigh it
gmurphy, 8 hours ago
CVE-2025-66630: predictable, insecure zero-UUID generation in go fiber
Severity: Critical (9.2/10)
Affected version: < 2.52.11
Patched version: 2.52.11
- GitHub Advisory
- patch commit
- CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
#cve #go
Severity: Critical (9.2/10)
Affected version: < 2.52.11
Patched version: 2.52.11
Fiber v2 contains an internal vendored copy of gofiber/utils, and its functions UUIDv4() and UUID() inherit the same critical weakness described in the upstream advisory. On Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. In such cases, these Fiber v2 UUID functions silently fall back to generating predictable values — the all-zero UUID 00000000-0000-0000-0000-000000000000.
On Go 1.24+, the language guarantees that crypto/rand no longer returns an error (it will block or panic instead), so this vulnerability primarily affects Fiber v2 users running Go 1.23 or earlier, which Fiber v2 officially supports.
Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4().
- GitHub Advisory
- patch commit
- CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
#cve #go
Forwarded from HN Best Comments
Re: The Singularity will occur on a Tuesday
You won't read, except the output of your LLM.
You won't write, except prompts for your LLM. Why write code or prose when the machine can write it for you?
You won't think or analyze or understand. The LLM will do that.
This is the end of your humanity. Ultimately, the end of our species.
Currently the Poison Fountain (an anti-AI weapon, see https://news.ycombinator.com/item?id=46926439) feeds 2 gigabytes of high-quality poison (free to generate, expensive to detect) into web crawlers each day. Our goal is a terabyte of poison per day by December 2026.
Join us, or better yet: deploy weapons of your own design.
atomic128, 6 hours ago
Once men turned their thinking over to machines
in the hope that this would set them free.
But that only permitted other men with machines
to enslave them.
...
Thou shalt not make a machine in the
likeness of a human mind.
-- Frank Herbert, Dune
You won't read, except the output of your LLM.
You won't write, except prompts for your LLM. Why write code or prose when the machine can write it for you?
You won't think or analyze or understand. The LLM will do that.
This is the end of your humanity. Ultimately, the end of our species.
Currently the Poison Fountain (an anti-AI weapon, see https://news.ycombinator.com/item?id=46926439) feeds 2 gigabytes of high-quality poison (free to generate, expensive to detect) into web crawlers each day. Our goal is a terabyte of poison per day by December 2026.
Join us, or better yet: deploy weapons of your own design.
atomic128, 6 hours ago
Forwarded from vx-underground
Yeah, so pretty much, like, there is this really sketchy company in Israel named "Paragon". Paragon sells a "product" called GRAPHITE.
Let me explain the background and why this is very silly.
GRAPHITE spyware which allows "customers" to remotely access peoples cell phones and monitor their instant messaging applications such as WhatsApp
It is spyware. It is sometimes called Mercenary Spyware because it is primarily used by governments to spy on political enemies, journalists, and activists.
Very little is known about Paragon, GRAPHITE, and their "customers". However, it was publicly noted by the Trump administration in January, 2025, to be purchased by the United States government and to be used to aid ICE.
Furthermore, in September 2025 the Trump administration noted the usage of Graphite to aid the United States against "domestic terrorist organizations" such as "ANTIFA".
ICE acting director Todd Lyons noted using GRAPHITE to monitor anti-ICE protestors to track "ringleaders and professional agitators".
Citizen Lab and other civil rights organizations have documented the usage of GRAPHITE against individuals in Australia, Canada, Cyprus, Denmark, Israel, Singapore and (unsurprisingly) the United States. It is believed the Canadian government actively uses GRAPHITE in Ontario.
Okay, so why does all of this matter? Yeah, it's super fucked up. But today representatives from Paragon accidentally leaked GRAPHITE screenshots ... ON LINKEDIN. Dawg, that image in the background IS GOVERNMENT FUCKING SPYWARE
It shows phone numbers in Czechia, apps, accounts, media on the phone, "interception status", and phone numbers extracted. THEY LEAKED IT BY ACCIDENT ON LINKEDIN WHILE TAKING SELFIES
Let me explain the background and why this is very silly.
GRAPHITE spyware which allows "customers" to remotely access peoples cell phones and monitor their instant messaging applications such as WhatsApp
It is spyware. It is sometimes called Mercenary Spyware because it is primarily used by governments to spy on political enemies, journalists, and activists.
Very little is known about Paragon, GRAPHITE, and their "customers". However, it was publicly noted by the Trump administration in January, 2025, to be purchased by the United States government and to be used to aid ICE.
Furthermore, in September 2025 the Trump administration noted the usage of Graphite to aid the United States against "domestic terrorist organizations" such as "ANTIFA".
ICE acting director Todd Lyons noted using GRAPHITE to monitor anti-ICE protestors to track "ringleaders and professional agitators".
Citizen Lab and other civil rights organizations have documented the usage of GRAPHITE against individuals in Australia, Canada, Cyprus, Denmark, Israel, Singapore and (unsurprisingly) the United States. It is believed the Canadian government actively uses GRAPHITE in Ontario.
Okay, so why does all of this matter? Yeah, it's super fucked up. But today representatives from Paragon accidentally leaked GRAPHITE screenshots ... ON LINKEDIN. Dawg, that image in the background IS GOVERNMENT FUCKING SPYWARE
It shows phone numbers in Czechia, apps, accounts, media on the phone, "interception status", and phone numbers extracted. THEY LEAKED IT BY ACCIDENT ON LINKEDIN WHILE TAKING SELFIES
Forwarded from vx-underground
vx-underground
Yeah, so pretty much, like, there is this really sketchy company in Israel named "Paragon". Paragon sells a "product" called GRAPHITE. Let me explain the background and why this is very silly. GRAPHITE spyware which allows "customers" to remotely access…
If you want to read more about Paragon, GRAPHITE, and governments (illegally) using Mercenary Spyware, read this paper:
https://citizenlab.ca/research/a-first-look-at-paragons-proliferating-spyware-operations/
https://citizenlab.ca/research/a-first-look-at-paragons-proliferating-spyware-operations/
The Citizen Lab
Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations - The Citizen Lab
In our first investigation into Israel-based spyware company, Paragon Solutions, we begin to untangle multiple threads connected to the proliferation of Paragon's mercenary spyware operations across the globe. This report includes an infrastructure analysis…
Forwarded from Телеграм Маркетинг
Что же, вектор развития Телеграм понятен. Федерализация с множеством полузакрытых контуров а-ля гейты/прокси, которые завязаны на кастомные клиенты — в рамках своего контура они могут делать с данными все, что угодно — копировать; хранить; разве что чаты с оконечной шифровкой (секретные) не смогут читать.
В будущем, вероятно, это также как-то увяжется с Нодами, а в совсем сложном варианте — с отказом от хранения данных на своих серверах вообще, что превратит Телеграм в «шину» обмена данными и более протокол + API, чем единый источник доверия.
Наметки этого уже появились в коде, вы могли видеть расследование, я напишу об этом подробнее чуть позже, если есть интерес.
В будущем, вероятно, это также как-то увяжется с Нодами, а в совсем сложном варианте — с отказом от хранения данных на своих серверах вообще, что превратит Телеграм в «шину» обмена данными и более протокол + API, чем единый источник доверия.
Наметки этого уже появились в коде, вы могли видеть расследование, я напишу об этом подробнее чуть позже, если есть интерес.
Forwarded from Hacker News
GitHub
[PERF] Replace np.column_stack with np.vstack().T by crabby-rathbun · Pull Request #31132 · matplotlib/matplotlib
This PR addresses issue #31130 by replacing specific safe occurrences of np.column_stack with np.vstack().T for better performance.
IMPORTANT: This is a more targeted fix than originally proposed. ...
IMPORTANT: This is a more targeted fix than originally proposed. ...