having used llms before for work, i have first hand experience of the effects they have on your mind, especially if you use them for creation (like writing code)

they're addictive gambling machines, even if you know they are. they can't be used responsibly. after stopping with their use for work, i noticed myself reaching for them. it took me months to fully recover. there was also very noticeable skill atrophy

i knew of the many issues, but these things work on your monkey brain, they're very hazardous

if you use them and you're not forced to use them, stop using them. they are not worth it in any way. if you can't stop using them for work, try to avoid them outside of work as much as possible. harm reduction is a valid strategy

this technology needs to be eliminated, there is no way to salvage it

and this is me focusing on the psychological issues, there are way more severe social and ethical issues with it

There is apparently some blame going around for PHP’s messy disclosure. The Register has some details which paint a very different picture from PHP Foundation’s own blog post. If the vulnerabilities were in fact already being exploited, then Chainguard not waiting for the agreed upon release time makes perfect sense. The question is rather: why didn’t everybody else make the same call? Why didn’t PHP Foundation drop the embargo? Were they aware of the ongoing attacks? Edit: People who know more say that Chainguard is talking bullshit and confusing exploitation attempts with successful exploitations.

There is another layer to this of course. Somebody leaked hints to this a few days too early. Which is unfortunately to be expected for an effort that takes months and involves so many parties. If anything, this disclosure went unexpectedly smoothly. And it still doesn’t change the fact that there will be vulnerable PHP installations for years to come.

To me this only shows: coordinated disclosure on this scale isn’t a silver bullet. It mitigates risks to some degree but we now have a world where the attackers can generate exploits faster than server administrators can reasonably be expected to install updates – and sometimes even before these updates are out because somebody got wind that the vulnerability might be there. I don’t think that we have the right tools to deal with that changed threat landscape just yet.

https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611

I’ve been holding on to my Yahoo account, it being my first email address back in 1999. But nothing lasts forever of course. Today they sent me a choice: accept personalized ads, pay for a subscription or delete the account. Yes, me accessing the account almost exclusively via POP3 – I wouldn’t see these ads anyway. But I apparently received six emails on that account so far this year: five from Yahoo about changes to my account, one from a company I used in 2009 and never again but which still considered it a good idea to “revive our friendship” in 2024. Yes, it really isn’t a difficult choice.

Somewhere out there a parallel universe exists where I posted all my Mastodon toots that I’ve written and then deleted in this one…

“Cyber hygiene would have prevented the access: take the controller off the public internet, put remote access behind a VPN and an IP allowlist, bring third-party kit onto the network in a controlled, owned and documented way rather than leaving it on a contractor’s own connection, change known and default credentials, and patch to a current release.”

https://arstechnica.com/security/2026/10/fridge-hack-costing-millions-and-sparking-fires-stemmed-from-poor-security/

Yes, it’s a sane suggestion in principle. Yet we live in a world where every toaster is connected to the public internet, sends data to its vendor (probably not only them) and never gets any patches installed – even if it is lucky enough to be still supported a year after being manufactured. Most people are buying this crap for their homes without a second thought, so why wouldn’t they do the same for their companies? I don’t think the problem is going to go away unless governments start to regulate these markets.

I’m still missing one piece of the puzzle here however. It was a coordinated attack against hundreds of devices at the same time. How did the attackers find them? I doubt that these controllers are on Shodan. Did they scan the internet for months to prepare the attack? That would rule out vandalism, that’s the kind of preparation a nation-state actor would do. Or did they hack the vendors who tend to be a sweet target with knowledge of where all the vulnerable devices are?

Fascinating case, that OpenAI employee who tried to wiretap executive meetings: https://cdn.arstechnica.net/wp-content/uploads/2026/10/US-v-Alfozan-Complaint-10-8-26.pdf

So he used a chatbot to advise him on how to build a spy device from an Arduino-like board. He solved the problem of getting power to it by plugging it into a USB port of a TV, and he solved the issue of getting data out with a 2.4 GHz antenna. My reading seems to indicate that his hardware was capable of WiFi communication, so presumably this allowed it to be accessed remotely. Which would also explain why he showed up immediately when his device was removed – he wanted to check why it stopped transmitting.

I wonder why he thought that he would succeed at recording anything. Clearly he didn’t use the camera – in the photos it isn’t attached to the device, and it would be of no use behind a TV anyway. As to the microphone, I found the following statement:

The integrated MEMS microphone on the XIAO ESP32-S3 Sense is not designed for studio-quality recording, but it delivers usable voice data at close range (under 1 meter) when paired with proper signal processing.

It was definitely a lot more than one meter in that meeting room, and there was a TV in the way distorting the sound. Besides, I’ve seen how difficult it is to get useful recordings in a meeting room even with expensive hardware far larger than his tiny board. Didn’t he test its recording quality, or did he hope that he would be able to “clean up” the recording afterwards? Maybe that a chatbot would be able to decipher the spoken words?

Did I already say that LLMs make people wildly overestimate their skills?

Spent too much time trying to figure out why a piece of open source code was seemingly missing critical parts. Turns out it was written by an LLM for a person who had no idea how to do this correctly. Of course it was missing parts, it never worked. It was merely composed to look like it might. But it was documented and everything which added to the deception. 🙄

In semi-related news, it’s great to see people putting my work to good use: https://github.com/CapnRon/un-jzlzma

I have been looking at some camera firmware dumps, so now my overview of the PPPP protocol had to be updated.

I’ve added a description of yet another protocol fork which is being used by AJCloud who are supplying the technology to Wansview and a number of other camera brands (most of which are probably Wansview in disguise). I didn’t spend too much time figuring out their RC4 encryption but it sure looks “interesting.” It seems to be optional, and if that wasn’t already bad enough they seem to be using a fixed nonce. Which, if you aren’t familiar with RC4, results in a completely broken encryption scheme.

I’ve also improved my description of the FtyCamPro, YsxLite, JXLCam and minicam apps – these turned out to be related, with some firmware supporting all four of them. Which is very surprising because the first two use an application-level protocol that’s completely different from the other two. These applications have code to convert from their native protocol to the other but it appears to be unused.

https://palant.info/2025/11/05/an-overview-of-the-pppp-protocol-for-iot-cameras/

RE: https://hachyderm.io/@evacide/117389459796477111

It was of course to be assumed that the reason Russian government pushes Max messenger down everybody’s throat is so that they get full visibility into the communication. So no real surprises here but still good to see this analysis despite Max developers going to great lengths to make analysis harder.

Remember when you had to resort to hacks like this one in order to have some basic privacy? https://palant.info/2009/03/02/getting-rid-of-flash-cookies/

Adobe Flash EOL was six years ago, though it got phased out before that already. A great win for the web platform.

RE: https://mastodon.social/@vtrlx/117287856439061540

My post calling for a total ban on AI in #GNOME is now the most liked post in the forum's history (was previously the second–most liked).

See: https://discourse.gnome.org/badges/7/good-reply

I see news that the #FTAPI data exchange platform has been hacked. And that name actually rings a bell, I’ve written about it a while ago: https://palant.info/2018/07/11/ftapi-secutransfer-the-secure-alternative-to-emails-not-quite/

Back then I found that their claims of data being end-to-end encrypted should be taken with a grain of salt. We might find out now just how large of a grain.

Even if you don’t know how to code, there are lots of great ways that you can contribute to open source! Here are a few ideas:

1. Write or translate documentation.

2. Help moderate community spaces.

3. Contribute art and design work.

4. Tell anyone who will listen that Omarchy’s war chest is intended to fund efforts to centralize power in the FOSS space and to reputation-wash extreme rightwing positions.

5. Become a tester.

@abacabadabacaba If you don’t know it already you might want to look up the thread that coined the term “Nazi bar.” They always do this stuff elsewhere at first. They will only show their true face in the project once they brought in enough friends or are otherwise in a position of power where they feel that they cannot be kicked out any more. So the stance “we only care about what people do in our spaces” is, quite frankly, a naive one. Projects should be paying close attention when somebody is called out for things they do elsewhere. Shooting the messenger is an extremely wrong approach, no matter the circumstances, and I hope that KDE still comes around to understand this.

We are going to see lots of open source projects deciding on how to deal with fascists within their community. After decades of conditioning people to view tech as a neutral, politics-free zone, very often they will make the wrong decision. You cannot have an open and welcoming community if you allow fascists or discuss that they might actually be “merely” racists or find other excuses not to take a decisive action. See paradox of tolerance.

If projects are being forked over this matter, I guess all we can do is embracing the fork.

#KDE

RE: https://hachyderm.io/@evacide/117334019442909852

I recommend that you read this article and think long and hard about it. If your first reaction is “half of this is probably not true” then you are part of the problem and this is something you have to fix. If victims speak out in the only way they feel they can, then you have to take this seriously and listen, then think about the structures that enabled their abusers and your role in those.

Also, if you want to keep your faith in humanity I recommend not reading the comments under this article (or maybe no comments under online media in general).

Listen, I just think it's weird that the same people who are saying they're worried that AI is going to wipe out humanity are also eager for military contracts that will give AI control of weapons.

It seems that Avast managed to settle the lawsuits related to their data abuse in both US and UK. While in the former they agreed to pay a fairly moderate fine, UK let them off the hook even easier. They are offering two years of free software to eligible UK users which is, quite frankly, a joke. It costs Avast exactly nothing, it allows them to email past users on a legal basis and gives them a chance to win them back. Really, who agreed to that?

#Avast #Jumpshot #privacy

Wow, @arstechnica managed to write a whole long article on how Disney based a children cartoon character on Wernher von Braun without ever mentioning that the latter was a Nazi rehabilitated by the US government because his skills were way too useful. I wonder whether the British would have been just as willing to forget his contribution to the development of the German V-2 rocket.