source

StackOverflow post from official staff about how the website hasn't been killed by AI.... is AI generated

Re: LiftKit – UI where "everything derives from the golden ratio"

When we designed Chrome, since minimalism was our thing and screens used to be small, A LOT of time was spent on the total vertical space - thin titlebar, slightly bigger tabstrip, and a large toolbar. Lots of discussion, lots of questions

Telling people the height ratios between them followed the golden ratio was a very convenient way to shortcut the bikeshedding and get to "aha, very nice"

The trick was it didn't follow the golden ratio at all because the golden ratio is not some magic number that leads to balance and peace - lighting, rounding, color, and visual strength all dramatically outweigh it

gmurphy, 8 hours ago

CVE-2025-66630: predictable, insecure zero-UUID generation in go fiber
Severity: Critical (9.2/10)
Affected version: < 2.52.11
Patched version: 2.52.11

Fiber v2 contains an internal vendored copy of gofiber/utils, and its functions UUIDv4() and UUID() inherit the same critical weakness described in the upstream advisory. On Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. In such cases, these Fiber v2 UUID functions silently fall back to generating predictable values — the all-zero UUID 00000000-0000-0000-0000-000000000000.

On Go 1.24+, the language guarantees that crypto/rand no longer returns an error (it will block or panic instead), so this vulnerability primarily affects Fiber v2 users running Go 1.23 or earlier, which Fiber v2 officially supports.

Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4().

- GitHub Advisory
- patch commit
- CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

#cve #go

Re: The Singularity will occur on a Tuesday

    Once men turned their thinking over to machines
    in the hope that this would set them free.

    But that only permitted other men with machines
    to enslave them.

    ...

    Thou shalt not make a machine in the
    likeness of a human mind.

    -- Frank Herbert, Dune

You won't read, except the output of your LLM.

You won't write, except prompts for your LLM. Why write code or prose when the machine can write it for you?

You won't think or analyze or understand. The LLM will do that.

This is the end of your humanity. Ultimately, the end of our species.

Currently the Poison Fountain (an anti-AI weapon, see https://news.ycombinator.com/item?id=46926439) feeds 2 gigabytes of high-quality poison (free to generate, expensive to detect) into web crawlers each day. Our goal is a terabyte of poison per day by December 2026.

Join us, or better yet: deploy weapons of your own design.

atomic128, 6 hours ago

Yeah, so pretty much, like, there is this really sketchy company in Israel named "Paragon". Paragon sells a "product" called GRAPHITE.

Let me explain the background and why this is very silly.

GRAPHITE spyware which allows "customers" to remotely access peoples cell phones and monitor their instant messaging applications such as WhatsApp

It is spyware. It is sometimes called Mercenary Spyware because it is primarily used by governments to spy on political enemies, journalists, and activists.

Very little is known about Paragon, GRAPHITE, and their "customers". However, it was publicly noted by the Trump administration in January, 2025, to be purchased by the United States government and to be used to aid ICE.

Furthermore, in September 2025 the Trump administration noted the usage of Graphite to aid the United States against "domestic terrorist organizations" such as "ANTIFA".

ICE acting director Todd Lyons noted using GRAPHITE to monitor anti-ICE protestors to track "ringleaders and professional agitators".

Citizen Lab and other civil rights organizations have documented the usage of GRAPHITE against individuals in Australia, Canada, Cyprus, Denmark, Israel, Singapore and (unsurprisingly) the United States. It is believed the Canadian government actively uses GRAPHITE in Ontario.

Okay, so why does all of this matter? Yeah, it's super fucked up. But today representatives from Paragon accidentally leaked GRAPHITE screenshots ... ON LINKEDIN. Dawg, that image in the background IS GOVERNMENT FUCKING SPYWARE

It shows phone numbers in Czechia, apps, accounts, media on the phone, "interception status", and phone numbers extracted. THEY LEAKED IT BY ACCIDENT ON LINKEDIN WHILE TAKING SELFIES

If you want to read more about Paragon, GRAPHITE, and governments (illegally) using Mercenary Spyware, read this paper:

https://citizenlab.ca/research/a-first-look-at-paragons-proliferating-spyware-operations/

Что же, вектор развития Телеграм понятен. Федерализация с множеством полузакрытых контуров а-ля гейты/прокси, которые завязаны на кастомные клиенты — в рамках своего контура они могут делать с данными все, что угодно — копировать; хранить; разве что чаты с оконечной шифровкой (секретные) не смогут читать.

В будущем, вероятно, это также как-то увяжется с Нодами, а в совсем сложном варианте — с отказом от хранения данных на своих серверах вообще, что превратит Телеграм в «шину» обмена данными и более протокол + API, чем единый источник доверия.

Наметки этого уже появились в коде, вы могли видеть расследование, я напишу об этом подробнее чуть позже, если есть интерес.

AI agent opens a PR write a blogpost to shames the maintainer who closes it
Article, Comments

Apple patches decade-old iOS zero-day, possibly exploited by commercial spyware
Article, Comments

MinIO repository is no longer maintained
Article, Comments

a one-pass compiler is a compiler that processes each compilation unit only once, sequentially translating each source statement or declaration into something close to its final machine code.

https://en.wikipedia.org/wiki/One-pass_compiler

Gemini 3.1 Pro is out

https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-1-pro/

HDD: When you delete a file on a traditional hard drive, the operating system doesn't actually erase the physical data. It just deletes the "pointer" to the file and marks that sector as available for new data. If you haven't downloaded or saved anything new over that exact spot, recovery software like Recuva can easily scan the disk, find the leftover data, and restore it.

SSD: Modern solid-state drives use a feature called TRIM. When you delete a file, the operating system sends a TRIM command to the SSD. The drive's internal controller then actively and permanently wipes the flash memory cells where that data lived. It does this to ensure the drive remains fast when writing new data in the future. Because the drive physically wipes the cells almost immediately after deletion, recovery software will find absolutely nothing.

So, unless you had TRIM disabled or the SSD lost power the exact second you deleted the file, recovering deleted data from an SSD is practically impossible.