So, we have a public nginx RCE with demo exploit + a new public Linux LPE with demo exploit, for both of which the patch is less than a day old. So there is a public 0day chain to get root on 50% or so of the internet via a simple HTTP request. Oooooof.

@gparker I’m seeing a regression in libobjc.dylib on macOS 15 on x86_64 (14 unknown, but worked correclty in 13): objc_msgSend_fpret calls into the stret handler passed to objc_setForwardHandler instead of the regular one. This results in a crash (with custom handlers and Foundation’s handlers as well) when trying to forward something with a long double return on x86_64 for obvious reasons. This seems like a pretty bad regression, so I filed FB16316692, but given how feedbacks often never get looked at, I’d thought I’d ping you.

AI scrapers now seem to employ botnets to scrape websites, effectively DDoSing them with multiple thousand requests per second from residential IPs all over the world. As they know they’ll get banned, they randomize the user agent, using stuff like Firefox on Windows 98. Yeah, sure, the last version of Firefox on Windows 98 wouldn’t even be able to do the TLS handshake.

They can still be identified by doing things no human would ever do. Like for a repository, requests every single commit as an archive. Or requesting blame on a file that nobody would ever be interested in.

In any case, has anyone found an effective way to ban this AI bullshit? I fear I need to employ some JavaScript to return the actual site contents, but that would reduce accessibility.