Whether you like it or not, for the sabotage of public and critical infrastructure. When the initial suspect was Russia for no reason, people wanted to call in Article 5, now it's fine, because the "good guys" did it?

Justice for all.

Exactly. China doesn't really want to openly antagonize Europe either. They do their stuff, Europe does their stuff, and mostly both try not to interfere with each other's business too much. Sure, there is stuff happening that could be counted as offensive, like some tariffs and the evil Chinese hackers and spies, but in general it's a "live and let live" situation. The trade relations are mutually beneficial for both sides, so there's nothing too crazy happening. They won't openly commit into a war in front of European doorstep.

In my opinion, China has no real interest in Russia anymore, after they've shown they're a dud. China's foreign policy is pretty aggressive, as it mostly seems to be the question of "does this benefit us", and if it doesn't they simply won't do it. There aren't really diplomatic ties with China, since they are also often presented as the enemy and the "bad guys" in western media and politics, and it seems like they've embraced it, focused on themselves and did their own shit. As long as there is a cash flow, the relations to Russia are held up, but as soon as it's no longer profitable, which seems more of a "when" and not an "if" question, I don't think that there will be a lot of friendship left over.

It's not "losing to NATO is better than losing to Ukrainians". They already lost their own war against Ukraine. Attacking NATO would be a complete destruction of Russia and of Putin himself. Assuming there would be a war between NATO and Russia, they have nothing left. Russia cannot win. But what would happen after? It's not like Putin would be forced to flee or be killed, replaced by someone "better" and it's back to daily business. They'd potentially establish a buffer zone under NATO control to prevent that from ever happening again, to also keep Belarus in check. Russia would lose access to Crimea and the black sea, and probably St Petersburg and the Baltic Sea. They'd potentially lose most of their remaining allies, except for those who do not care about NATO or EU anyway, like NK, where both would probably keep the same amount of relevance in world politics and economy. And what's worse, while losing to Ukraine is a political loss and the military loss can be propagandized as "if only the NATO wouldn't have supported them I would've won, trust me bro", a war with NATO would be a total, complete, no longer explainable loss. There is no propaganda that can save from that. And given that weird patriotism (victory day and the bullshit parade), there is always the more or less subtle notion of military and ethical supremacy, and this whole idea would break down as well. Losing to NATO will only make it worse in all aspects.

WSJ referencing US intelligence as a source. Still trying anything to hunt the reds, huh.

Putin already lost all face to the outside world, and lost most face in Russia too. Just to put it into relation: WWII had about 8.4 million dead soviet soldiers on the east front, Putin's "military special operation" is at 1.4 million dead and wounded. Infrastructure, supplies, and military equipment is basically non-existent, in relation to Russia being the aggressor and the size and resources of the country. People are being forced and coerced into the Russian military to keep fresh meat coming. Ukraine got a bunch of expensive western toys and managed to surpass pretty much anything that Russia did somehow.

Attacking a NATO country would be the end of Russia as it exists and would be the end of Putin. It's suicide. There is no face to save, and there is zero chance for any positive outcome for Putin in that.

Please don't take personal offense, but you have merely a project scaffold with an unrealistic goal that will be blocked and C&D'd into the ground, without any other projects created.

It doesn't matter how hard you're working on your anonymity, this project will be ripped apart by a horde of lawyers in seconds. You're not only doing something questionable or against ToS, you're directly attacking and sabotaging their monetization. This will not be taken lightly by the legal team of reddit.

You want to provide a better, cooler, more robust and other random buzzwords API than the own of reddit. So, you alone, want to provide a better API than the whole team of reddit does for their absolute core product, all by scraping. This is simply not realistic.

While we're at the topic of monetization, scraping, ETL into your own model and providing the API - for the amount of content that reddit has (quantity, not quality) this will be a highly resource intensive task. How do you plan to fund that, since your API will be better than the official one, I can expect at least the same performance as well, right?

And also, most importantly, even if you magically achieve working around all that and get that working - why? Who is your expected user group? Pretty much every software using reddit moved away from reddit or simply has died. AI gen content is rampant, and most discussions seem like bots talking to bots. There is literally nothing to gain from an API to reddit - so why would anyone bother using it?

Something about this post is weird as fuck and some part of this story is missing for sure.

First of all, routine scans with ClamAV. Why are you routinely scanning your system, and what's your expectation here? In most cases system compromise happens by executing something malicious or by exploiting something on your system, For the former, an active background scanner would help, but not a routine scan, and it's easier to just not execute suspicious stuff. For the latter, your routine scanning is worthless.

Then the compromise over a WINE DLL seems something between borderline impossible on one hand, and like a very targeted and handcrafted attack on the other hand. Sure, wine is not a sandbox, but seeing this as the point of entry for a full blown persistent RAT is weirding me out massively.

Lastly, "them" setting up seemingly good persistence on your system, yet not hiding any indicators of compromise, and then nuking everything when they are seen. Why that effort? Either set yourself up for the long run and hide, or when detected just say "eh, whatever". This also seems weird, since on one hand there's indication for a professional, targeted attack, and other points sound more like rookie script kiddies.

Lastly, you. You seem like a pretty confident user while getting hit like that. It just feels off.

I'm not claiming you're lying, and I couldn't blame you for leaving information out because of opsec. But everything about this story feels off. I kinda assume that you've been actively targeted, and you should ask yourself why. What information or access do you have? How have you been pwned that "easily" and where did that DLL come from? How was it placed and executed?

The difference is, that Netflix (or Spotify, or whatever) does bring value on its own. I am paying money to comfortably and legally stream content, which itself is paid for and licensed by the streaming provider. From the perspective of a lazy end user, it's worth it, because you do not need to care about downloading, finding releases, opsec and whatnot. I don't want to protect Netflix, fuck corporations and subscription services, but password sharing was always only tolerated at most. From the same end user perspective, reddit is just an empty platform. The content is brought in free of charge by the community. And now not only they want the same community to pay, but also for an objectively worse experience? I don't think that you can compare that.

The tech giant says the system only analyzes hand-movement points from a short video, does not record audio, and deletes the footage after verification.

It's just a short video guys, there's even no audio! And they pinky promise to delete it.

What a fucking shitshow that is. Like, honestly, I'm fine with regular captchas, even if they are the shitty ones. The newer (?) captchas that force you to do solve 5 bullshit "place this there" captchas are already reason enough for me to just leave the site. But if you force me to record a video of me throwing gang signs at the camera, probably several times again, because the movement was not correctly identified, I'm sure as fuck to never visit anything related to you ever again.

I also love the irony that Google fights people bots, while they are scraping the whole internet and investing into AI automation massively.

Just because they are using Cursor, it doesn't mean that they are vibe coding. Anyone grabbing their pitchforks for that and screaming "they are vibecoding" only shows their own incompetence.

If they would be vibecoding, their whole software would've gone to shit long ago.

Just because some random people without an engineering background are using vibecoding to push their broken slop, it doesn't mean that any kind of AI assisted coding is bad.

Man, the disclaimer at the bottom that Business Insider is partnered with OpenAI to allow them to train on their articles is really the cherry on top.

How in the fuck are people actually defending signal for this, and with stupid arguments such as windows is compromised out of the box?

You. Don't. Store. Secrets. In. Plaintext.

There is no circumstance where an app should store its secrets in plaintext, and there is no secret which should be stored in plaintext. Especially since this is not some random dudes random project, but a messenger claiming to be secure.

Edit: "If you got malware then this is a problem anyway and not only for signal" - no, because if secure means to store secrets are used, than they are encrypted or not easily accessible to the malware, and require way more resources to obtain. In this case, someone would only need to start a process on your machine. No further exploits, no malicious signatures, no privilege escalations.

"you need device access to exploit this" - There is no exploiting, just reading a file.

"Googling a lot while coding" is not even remotely close to vibe coding, please don't gaslight yourself into that.

When you read up on things, you know what you're looking for. You read a potential solution (e.g. part of a documentation, an example, someone else's solution, a solution to a similar problem), you think about it and transfer that to your own problem, with your own code, with your own thoughts.

Using AI support is totally fine too - it's a smarter code completion, nothing more. It might spit out something wrong, something partial, something good. You might ignore it as with the regular completion. In the end, it's still you thinking about it, modifying it until it works, and doing your thing.

"Vibe coding" is basically saying tech jesus take the wheel. And it might go well for someone who cannot code, who managed to create their small game or some website. It will go horribly wrong for any project handling user data, sensitive data, or something that needs to be maintained after. We've had more than enough examples of that.

Wait, so because vim is allowing code written with AI we are switching to a random fork? The mental gymnastics here are insane once again. Is someone assuming that the vim maintainers are gonna do agentic requests? How is this project gonna handle upstream changes into their own main? Cherry-picking only "confirmed human-only" commits? Decisions like that out of spite, with zero thoughts and just out of principle do not help against slop. You're just adding human slop to the AI slop.

Honestly, apart from the report being potentially wrong, the researcher seems pretty entitled as well. Like good intentions and all that, but he's given him a week to fix the issue, usual practice in responsible disclosure are 90 days. We're not talking about a company here, it's some single random dude providing the app.

This really sounds like some personal issue written down for public drama, while making himself ridiculous for not knowing his own shit properly.

The Hamas-led murderous rampage into southern Israel was the deadliest terror attack in Israel’s history, killing at least 1,200 people and abducting more than 250 others. Israeli attacks on Gaza have since killed at least 33,634 Palestinians and injured another 76,214 people, according to the Ministry of Health there.

Jesus fuck, Germany is paying symbolic money to roughly as many genocide survivors in Israel as people have been murdered and injured by Israel committing genocide.

The current German government is an absolute fucking joke, and they are doing everything to actually show it.

It doesn't matter how hard you want to call it FOSS, but with this licensing terms you describe it is not FOSS, period. And to be honest, you calling out various people for not getting what FOSS is, while you fully ignore the agreed on definition by people who are actually doing FOSS is you discrediting yourself.

You haven't found a license like this, because your model is flawed: A licensing like this will disqualify you from any kind of usage in an actual FOSS licensed environment. Personal users, which will not be providing revenue, will not be really affected by this, and are irrelevant for your point. Corporate users, which you will mostly target by this new license probably won't be able to use your funky new license because they will need to check with legal, and your software will need to have a lot of USPs for someone to bother with that. A 1% corpo-richness-tax will not be approved by any kind of bigger company, because it's a ridiculous amount from the perspective of your potential customers.

You're taking yourself way to important. Open source software is not replaceable as a whole, but individual projects are. If you want to earn money with your project, that's good on you, license it accordingly, but do not try to upsell it as FOSS.

And I fully get your point, and I'm currently working on the same problem in my in-development project, and I'm not sure yet whether to dual-license it, for similar reasons you stated, and live with the consequences of providing OSS, but non-FOSS software, or do FOSS and provide it for actually free.

Edit: Also, the xz backdoor has nothing to do with funding. Any long time maintainer (as in not just a random person contributing pull requests) going rogue can happen in funded scenarios as well.

Matt never ceases to amaze with his smoothbrain decisions.

The amount of effort this moron puts into his weird personal vendetta against WP engine, even after the court told him that he has nothing, which was actually his last chance to end this kinda gracefully, could've been used for so much better things.

And he's not only successfully kicking himself in the balls, he's willing to throw so many years of community and project time and effort under the bus for it.

Go on Matt, keep telling how much you're only doing this for WordPress.

This is a pure marketing stunt, OpenAI saw that it worked with Mythos and wanted to do the same.

Those instructions, according to OpenAI, called for using “complex attack paths” to test how well the AI could exploit a computer system. [...] “It went off and did this hack all by itself, as far as we can tell,” said Colin Shea-Blymyer, a cybersecurity research fellow at Georgetown University’s Center for Security and Emerging Technology.

Emphasis mine. So, the frontier model that has been tasked with attacking a system, did what it's been told to, after its safeguards that will prevent you from opening chatgpt and doing the same have been turned off.

OpenAI said the intrusion was caused by a combination of its AI models, including its newly released GPT‑5.6 Sol and an “even more capable” model that is still being tested internally.

Oh my god, an "even more capable" model? Let me buy OpenAI stock immediately. This is such an obvious bait and Antrophic move they're pulling off, it's amazing.

Of course it works fucking fine if it's a hard fork of a stable state.

What mental gymnastics? The ones you're doing right now. You have not answered a single question from my comment. And what "problem" did you solve exactly? Has there been any issue that has come up because of the acceptance of AI in vim? What kind of "slop" is actually there that makes vim problematic for you?

People vibe coding random bullshit ideas because they now can, do indeed produce slop. A bunch of highly experienced devs working on a successful project for years using tools that are at their disposal properly is not slop. You're lending your public voice to a split of the community and of the project for made up bullshit reasons based on no objective proof but claims of slop and out of principle.

I'd trust the original vim maintainers to decide what's a good or bad pull, instead of a bunch of random people who simply hard forked for literally no reason.

And who's gonna maintain the fork? Even less developers from a split community? You have absolutely no idea what you're talking about.