Lukas

Matches my experience completely. It's pretty good at coming up with small/one-off scripts or single-page web apps, OK at working in large existing code bases, but an absolute beast at finding bugs given a detailed description of symptoms and a few pointers.

Not all OSes allow trusting self-signed certs only for a particular set of hostnames, and if they don't, the associated private key becomes incredibly risky (since anyone getting it would be able to pose as google.com etc. to you as well).

Some OSes don't even have a system-wide trust store at all!

A real shame there’s no mechanism browsers can indicate language preferences to websites, like a request header or something.

Fortunately IP addresses map to user language preferences perfectly.

Logged in to my Spotify account on the web once when traveling to update my card, and now the web interface, while logged in with my account they know the country/language for perfectly well, is persistently in a language I don’t speak, even after returning.

Amazing new age verification procedure requires no government ID, no credit card numbers, no photography

import { setTimeout } from 'node:timers/promises'

const verifyAge = async () => {
await setTimeout(568_036_800_000)
return true
}

So the model powering “GPT-5” in the UI (modulo “routing to the thinking model”) is called “gpt-5-chat” in the API, while the one powering “GPT-5 Thinking” is called “gpt-5”?

This has got to be intentional at this point.

Men don't care what models are on ChatGPT. They only care what other models are on ChatGPT.

USDL is pegged to USD and is domiciled in Abu Dhabi, as far as I know. No idea if that’s available to residents there, though.

Natürlich, Selbstanzeige. Wäre für das kriminell schlechte LLM dieses Zusammenfassungs-Bots auch überlegenswert.

Ah, and the other one requires an app to have verified some companion domain and then allows only that as RPID, IIRC?

Thanks for doing all of this, by the way, I hope having a great use case finally convinces Bitwarden to also support PRF :)

Speaking of that, did your explorations of using the FIDO "backend API" on macOS in CLI tools lead anywhere, or does that still require some browser-only code signing entitlement?

It's slightly different from a smart card in that the key inevitably is revealed to the host computer with the PRF extension, but for applications that only use the smartcard for key (un)wrapping it's effectively equivalent.

On the other hand, having somebody/something really intelligent working for you certainly helps a lot.

I don’t think being a majority holder of voting shares allows you to make decisions that disadvantage minority shareholders. (Otherwise, people would vote for things like “don’t pay any more dividends to these 49% of shareholders” all the time.)

You might be delighted/horrified to learn that the machine-readable zone of ICAO passports encodes all dates as YYMMDD – including the date of birth.

> new Date("📅")
Invalid Date

*monocle drop*

Excuse me but deluding myself into thinking I saved everyone some time by monologuing at an intern who didn’t ask any question whatsoever isn’t novelty, that’s a core part of my professional identity

Please contain me

GitHub - lxgr/vibeserver: A little webserver making things up just in time A little webserver making things up just in time. Contribute to lxgr/vibeserver development by creating an account on GitHub.

Woah, this is literally on my to do list for vibeserver

github.com/lxgr/vibeser...

I am become Parrot, the repeater of words

Identity documents supporting interactive cryptographic authentication have been around for decades now (e.g. ICAO 9303 "biometric passports"), and I wouldn't be surprised if some government had a stockpile of a few hundred million ICs that can only do ECDSA and/or RSA as a result 😬

WhatsApp news of the week: feature to translate messages and channel updates is available for Android | WABetaInfo Discover WhatsApp beta news of the week for Android, iOS, and Desktop: message translations, advanced chat privacy, and channel media!

Yeah, sending stuff back to their servers would be really unfortunate, especially when newer phones are basically fast enough to just summarize locally.

It's especially weird considering that they're apparently planning to do translation offline/locally: wabetainfo.com/whatsapp-new...

WhatsApp beta for Android 2.25.19.8: what's new? | WABetaInfo The WhatsApp beta for Android 2.25.19.8 update previews a new Writing Help feature powered by AI Meta Private Processing to enhance messages.

Oh, interesting, seems like this is it: wabetainfo.com/whatsapp-bet...

Sounds like it would send stuff server-side. That would be really unfortunate if done without the sender even knowing (but then again, so are unencrypted backups).

Huh, I don’t think I’ve seen summarization then.

It’s not really summarization. You can tag “Meta AI” into any chat, which is just a regular server-side LLM and as such obviously not end-to-end encrypted. This is somewhat explained in a pop up at first use, but obviously people don’t read that.

That’s an odd pelican 🤔

I've (very non-scientifically) measured something like a 30% speedup on an M1, but Ollama has the significant upside of being able to keep the model in memory between script executions, so I usually only end up using `llm-mlx` models over `llm-ollama` ones when I expect processes to be long-running.

Time for a strategic CHF reserve! (Or maybe outright of ISO spec PDFs? I feel like they were “only” CHF 179 a while ago)

How would you vet multiple anonymous sources of the same hash?

Might as well all be sockpuppets of somebody that hopes you’ll implement a backdoor/vuln for them for the low sum of CHF 199…

This is actually a legitimately scary attack vector. I bet the number of systems implemented against a bootleg copy of some security-relevant ISO standard is larger than zero…