Analyze docker image size

https://github.com/remorses/docker-phobia

#docker

Full-fledged game locations from a short space - this is how the combo of Stable Diffusion 1.5, ControlNet, TripoSR and three.js works.

You just run around the map and create textures with text, magic. The developer promises to share the code soon.

In a couple of more years, gamedev courses will teach effective and optimized prompts for neural networks.

Source
#AI

For those that are interested in malware research:

https://github.com/vxunderground/MalwareSourceCode

StackOverflow is in the midst of a civil war.

Recently StackOverflow established a partnership with OpenAI. Users have begun to rebel against this by deleting answers. StackOverflow has retaliated by doing sweeping bans

https://www.tomshardware.com/tech-industry/artificial-intelligence/stack-overflow-bans-users-en-masse-for-rebelling-against-openai-partnership-users-banned-for-deleting-answers-to-prevent-them-being-used-to-train-chatgpt

The article discusses a bizarre cryptographic bug that was discovered and fixed in the Telegram messaging app's protocol (called MTProto) around 7 years ago. The bug allowed Telegram's servers to perform an undetectable man-in-the-middle attack and decrypt all messages in supposedly end-to-end encrypted "secret chats".
The issue stemmed from Telegram using standard finite-field Diffie-Hellman key exchange to establish a shared secret between chat participants, but then pointlessly XORing the result with a server-provided nonce value. This allowed the server to manipulate the nonce so that both parties ended up with the same key, which the server also knew, breaking the encryption.

Removing the nonce step fixed the vulnerability, showing it served no legitimate purpose. The author finds this the most backdoor-looking bug they've seen, as the protocol designers seemingly went out of their way to add complexity that only enabled interception. An official Telegram statement apparently claimed the nonce was to protect clients with weak randomness, but the author dismisses this explanation as nonsensical.
While this is an old issue and there may be better reasons not to use Telegram today, the author still considers it a prime example of how blatant and bizarre cryptographic backdoors can look in practice. The unnecessary complexity is a big red flag.

An informal comparison of the three major implementations of std:string
Article, Comments

16 years of CVE-2008-0166 – Debian OpenSSL Bug
Article, Comments

https://go.dev/blog/chacha8rand

Explore the recent advancements in randomness within the Go programming language. Authors Russ Cox and Filippo Valsorda, part of the Go team, look closely at the complexities of addressing security requirements for specific use cases and the implementation of the ChaCha(Rand8) algorithm. Discover how these improvements have enhanced random number generation in Go, culminating in the seamless security enhancements introduced in Go 1.22.

Kernel.org servers infected with backdoors for two years from 2009
Article, Comments

Visualizing algorithms for rate limiting
Article, Comments