Flutterby™! (short)

Terminal 2 Shell

CVE ID pending · also tracked as "TermGeddon"

A critical flaw present in every operating system since 1971 allows anyone who opens a terminal to obtain a fully interactive shell. Instantly. With no authentication beyond the one they already did.

Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub. tl;dr: when you say "yes, and don't ask again" to Claude, that's getting written to .claude/settings.local.json and .claude/settings.json, and people are committing these files to public repos, and those commands often contain keys.

Although, as people have pointed out, if your organization incentivizes LLM use, that's good reason to leak your keys.

Via.

Amusing stop doing ... [computer science] they have played us for absolute fools meme on character encoding.

Andrew Lewis Workshop @LewisWorkshop@mastodon.online sells suggestive engineering signs.

James Baillie @JubalBarca@scholar.social has a thread about the AI slop in Terra Tempora and "ways that this events-and-civilisations model distorts our understanding of the past more than supporting it."

It's hard to miss the ways that LLMs and generative AI are subtly altering our understanding of the world, making it into a narrative that's very much defined by the training, and that supports a specific world view.

I suspect that MissConstrue @MissConstrue@mefi.social is quote tweeting this, though I'm still getting a "post pending" from that.

Denver Post: Crypto foundation demanded employees endorse suicide pledge, then fired leaders who objected, Colorado lawsuit alleges. The foundation is The Ethereum Foundation:

Authors, maintainers, editors and distributors of “this software” would pledge to ensure the software remained free and publicly accessible, and would also vow to “take his or her own life with a sword upon failure to uphold any of the pledges in this license,” the illustration read. It was labeled “Source Seppuku License,” an apparent reference to a traditional Japanese ritual suicide.

Yeah, this shit is totally "take your two months severance".

Via.

Thread about the Moche people of Peru using electro-chemical gold plating 100-500CE, as opposed to the Romans using Mercury for gold plating.

Yeah, this is pretty awesome: THE GODAWAN | Return of The Great Indian Bustard | Stopmotion Film with BTS | Studio Eeksaurus (YouTube video).

Via Calishat @researchbuzz who notes:

OUTSTANDING. If you have 6 minutes and 43 seconds (the animation itself is about half that) I can't recommend this enough. A masterpiece of stop motion made from ceramics.

Morbid thought based on a Reddit moderation/strike on a reply I wrote: What if drivers think of "White Bicycle"s not as a memorial to a life lost, but as a monument to and celebration of automobile supremacy?

Watched "The American Society of Magical Negroes" last night. We both had kind of a "huh, I expected more" response, and then about half an hour later Charlene said "I think I have to watch that again so we can talk about it more deeply". And I'm game to.

So, yeah, recommended.

Huh: Dan Moynihan had a gift link to the NYT article on Jensen Huang having an "intimate relationship" with Alice Huang, who'd been recruited by China's Ministry of State Security:

"Nvidia officials have said that Mr. Huang’s interactions with Ms. Huang were “not unusual or unexpected” and consistent with the kinds of meetings he has with any of Nvidia’s many customers."

So how many customer reps *has* he been fucking?

https://bsky.app/profile/donmoyn.bsky.social/post/3mztiqfcq522n

The Register: Bank of England pours cold water on AI productivity boom.

In its latest Monetary Policy Report, the central bank found that AI has increased UK productivity by an estimated 0.5 percent over the past three years. That works out to just 0.1 to 0.2 percentage points of additional annual productivity growth since early 2024, hardly the economic revolution Silicon Valley has been promising.

And then there's the caveat that spending on AI is up, and businesses are hiring fewer workers, which also make the numbers look artificially inflated.

Carina C. Zona @cczona@hachyderm.ioM notes:

Sunk Cost Fallacy in action: we've spent a fortune on accomplishing absolutely nothing, so obviously we need to spend bigger on the failed strategy. Go into debt! That's gotta work.

Fascinating: The Port That Does Not Exist

Port 0 is the port you are not supposed to use, so nobody looks there. So we put an IRC network on it. Then I got curious whether anyone else had, and scanned all of IPv4 for port 0. Turns out we weren't alone, and some of our neighbours really shouldn't be there.

SF Standard: The Great Highway’s neighbors flipped and saved the park they once hated.

As Marc Hedlund @marcprecipice.bsky.social noted:

I hope political leaders in #Berkeley and everywhere else read and take the lesson from this story, which is repeated *all* *the* *time* for changes that remove car infrastructure: people hate those changes in theory and love them in practice!