Frédéric Bonnet 🇺🇦 @codinbzh

Frédéric Bonnet 🇺🇦 @codinbzh

@codinbzh.bsky.social

Software engineer @ Alan (opinions mine) | ex Shopify | Toolmaker | #SoftwareCrafter | ❤️ C | ❤️ Tests | ❤️ Doc generators | @codinbzh@mastodon.comwork.io

167 followers306 following162 posts

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Anonymous
@youranoncentral.bsky.social

Four sources identify Elon Musk as personally proposing Starshield restrictions to Trump, while three officials trace the order to the White House. Ukraine received no warning. Its interceptor drones were disrupted as Russia launched hundreds of drones and dozens of ballistic missiles.

Anonymous@youranoncentral.bsky.social

Elon Musk reportedly proposed restrictions that crippled Ukraine’s Starshield drone defences during Russian attacks. Other sources traced the order to the White House. The deliberate slowdown raises questions about possible sabotage of Ukraine’s defences.

yacnews.comMusk reportedly proposed the Starshield cap that disrupted Ukraine's drone defences, raising sabotage questionsFour sources say Musk proposed the Starshield cap that cut Ukraine's interceptor drones during Russian attacks. US officials trace the order to the White House. Musk blames the military and Trump; Tru...
Frédéric Bonnet 🇺🇦 @codinbzh
@codinbzh.bsky.social

Europe needs its own financial backbone. We can't rely on Visa or Mastercard anymore. Time to wake up.

SovereignIT@sovereignit.bsky.social

US sanctions target the ICC’s access to American tech providers. US companies have six months to wind down services. Can European institutions keep working when their suppliers must withdraw? www.reddit.com/r/SovereignI...

reddit.comFrom the SovereignIT community on RedditExplore this post and more from the SovereignIT community

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Horacio Gonzalez
@lostinbrittany.bsky.social

Six months to prepare for your suppliers to stop serving you. That’s a very concrete deadline for something we too often discuss in abstract terms. Can you keep working if your provider is ordered to withdraw? We should be asking that before signing the contract.

SovereignIT@sovereignit.bsky.social

US sanctions target the ICC’s access to American tech providers. US companies have six months to wind down services. Can European institutions keep working when their suppliers must withdraw? www.reddit.com/r/SovereignI...

reddit.comFrom the SovereignIT community on RedditExplore this post and more from the SovereignIT community

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Mathis Hammel-Brylinski
@mathishammel.bsky.social

Lundi j'ai enfin réussi à choper une clé API pour Jev, et j'ai eu envie de vérifier à quel point c'était une enième hype de la communauté IA. J'ai fait un benchmark pour comparer ce modèle à des LLM classiques sur de la classif de texte, les résultats sont DINGUES 🤯 agoratlas.com/blog/evaluat...

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Grompf
@grompf3.eurosky.social

"À cette gauche qui répète depuis bientôt 5 ans les mêmes formules sur l’Ukraine: je vous réponds parce que vous êtes ma douleur et ma plus grande déception...."

Frédéric Bonnet 🇺🇦 @codinbzh reposted

DaB
@oursobouros.bsky.social

[Appel à coup de pouce] Après beaucoup de non-réponses, je tente le coup ici. On cherche un stage d'observation de 5 jours fin novembre pour l'ado de 14 ans vers Lyon, Grenoble, Valence, dans : -conception jeu vidéo -conception logicielle -aéronautique Si vous bossez dans un de ces domaines...🙏

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Bearstech
@bearstech.com

Mozilla et Mistral annoncent l'intégration de modèles Mistral dans Firefox. "Mistral and Mozilla are bringing open, private and multilingual AI to your web browser" 👉 mistral.ai/news/mist...

Frédéric Bonnet 🇺🇦 @codinbzh reposted

zelDemon
@zeldman.bsky.social

“Let me make it clear: without people at the top of their game sharing their experience and knowledge—regardless of whatever ‘game changing’ technology is in place—we are pulling up the ladders and committing our industry to stagnation and death.” bell.bz/youll-miss-p...

bell.bzYou’ll miss publishers when they’re goneEver since Piccalilli started to get traction, I’ve always seen CSS-Tricks, Smashing Magazine and A List Apart (among others) as peers. We all help each other behind the scenes and importantly, back…

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Danny Moerkerke
@dannymoerkerke.bsky.social

The killer feature of PWAs is not that they update automatically or they’re cross-platform. The absolute killer feature of PWAs is that they can be freely distributed without any app store dependency No risk that one party can kill your distribution and end your business. That’s a killer feature.

Frédéric Bonnet 🇺🇦 @codinbzh
@codinbzh.bsky.social

So yes, generative AIs are currently producing a number of artworks, and, like a malevolent genie granting us wishes, they are also making us realize that we didn't care about these artworks all along. Because the artworks were made for humans to produce.

Gro-Tsen@gro-tsen.bsky.social

So yes, LLMs are currently solving a number of famous conjectures, and, like a malevolent genie granting us wishes, they are also making us realize that we didn't care about these conjectures all along. Because the conjectures were made for human brains to work on. •24/38

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Gro-Tsen
@gro-tsen.bsky.social

Replying to @gro-tsen.bsky.social

So yes, LLMs are currently solving a number of famous conjectures, and, like a malevolent genie granting us wishes, they are also making us realize that we didn't care about these conjectures all along. Because the conjectures were made for human brains to work on. •24/38

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Eiji Kitamura / えーじ
@agektmr.com

By setting up `https://<your-domain>/.well-known/change-password` to redirect (302/303/307) to your actual password update page, Chrome, Safari, and major password managers can guide users directly to your change password form.

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Shirley 🧡🧡🧡
@tatashishi.bsky.social

Je ne pensais pas en arriver là mais voilà je franchis ce pas pour aider ma maman. Avec mes frères et sœurs, nous avons sorti notre maman d'une situation d'emprise violente et destructrice.

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Ivan Gaudé
@ivanlefou.eurosky.social

"La crypto, c'est la liberté, une réponse aux banques qui savent tout de nous"

Pierre Briançon@pierrebri.bsky.social

Binance gave Moscow client details used to charge Russian over Ukraine donations www.reuters.com/legal/govern...

reuters.comEXCLUSIVE: Binance gave Moscow client details used to charge Russian over Ukraine donations, documents showBinance last year handed Russian authorities details of cryptocurrency donations to Ukrainian fundraising campaigns that were used as evidence to bring terrorism financing charges against a Russian IT...

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Labolycée
@labolycee.org

L’outil ultime pour préparer l’éclipse de Soleil du 12 août eclipsemap.xyz Il a même été prévu l’obstruction de la vue par les reliefs environnants.

Frédéric Bonnet 🇺🇦 @codinbzh reposted

noyb – European Center for Digital Rights
@noyb.eu

Replying to @noyb.eu

👋⚖️ Therefore, the tracking industry needs you to waive your rights. That’s why they invented cookie banners, which often are deliberately misleading as well as annoying

Frédéric Bonnet 🇺🇦 @codinbzh reposted

noyb – European Center for Digital Rights
@noyb.eu

🍪🚫 It's time to kill the cookie banner – and end the endless tracking circus! ⏮️ You may think that EU privacy law requires cookie banners. But the law is clear: online tracking is prohibited by default.

Frédéric Bonnet 🇺🇦 @codinbzh reposted

kevin-palser.bsky.social
@kevin-palser.bsky.social

I read this moving article recently where a daughter is disassembling her deceased father’s #Zx81 game and appreciating his genius: nachbaur.com/2026/03/11/d...

nachbaur.com👾 The Dungeon of Ymir: A Daughter, Disassembler, and Her Dad's RPGMy father, Fred Nachbaur, died of cancer in September of 2004. He was 53 years old. I had just moved to Canada not long before, and our relationship, which had always been complicated, never got the r...
Frédéric Bonnet 🇺🇦 @codinbzh
@codinbzh.bsky.social

The GDPR is one of the most misunderstood regulations ever. No, cookie banners are not mandatory, they never were.

McGarr Solicitors@mcgarrsolicitors.bsky.social

Essential Cookies Aren't Optional, So Stop Asking Permission for Them: One of the most common misconceptions about cookie consent is that websites need permission for every cookie they use. In fact, the opposite is true. https://mcgarrsolicitors.ie/2026/07/14/essential-cookies-dont-need-consent/

Frédéric Bonnet 🇺🇦 @codinbzh
@codinbzh.bsky.social

C'est vrai qu'on reçoit pas assez de radiations solaires en ce moment. Ça plus les starlinks de l'autre nazi qui perturbent les observations et flinguent l'atmosphère lors de la désorbitation, ça commence à faire beaucoup. Quelqu'un est partant pour un projet "syndrome de Kessler" en crowdfunding ?

Brice Haziza NotreEspace@bricehaziza.bsky.social

😳😱Le test d'envoi d'un réflecteur de 18 mètres en orbite pour renvoyer la lumière solaire sur Terre la nuit vient d'être approuvé aux USA. A termes, ce serait 50 000 de ces satellites qui alimenteraient les panneaux solaire la nuit www.lesnumeriques.com/astronomie-c...

lesnumeriques.com50 000 réflecteurs spatiaux pour éclairer la nuit sur Terre, le projet dingo d'une start-up approuvé en testImaginez de petits flashs dans le ciel la nuit qui ne seraient pas des étoiles filantes, mais la lumière du Soleil redirigée vers la Terre par des satellites réflecteurs. C’est le projet d’une start-u...

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Reuters
@reuters.com

Elon Musk's xAI has installed more than double the number of gas turbines than it has publicly acknowledged to power its Colossus 2 data center project, without federal permits, and the pollution is hitting predominantly Black neighborhoods the hardest reut.rs/4bIghEm

Frédéric Bonnet 🇺🇦 @codinbzh reposted

Olivier Poncet 🦝
@ponceto91.bsky.social

« Everyone you meet is fighting a battle you know nothing about. Be kind. Always. » Je viens de voir passer cette quote. Sur le fond il avait raison. En pratique la société actuelle n'aide pas.

Frédéric Bonnet 🇺🇦 @codinbzh reposted

daniel:// stenberg://
@bagder.mastodon.social.ap.brid.gy

#Mythos finds a #curl vulnerability yes, as in singular one. https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

daniel.haxx.seMythos finds a curl vulnerabilityyes, as in singular _one_. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model _Mythos_ is _dangerously good_ at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead trickle it out to a selected few companies for a while to allow a few good ones(?) to get a head start and fix the most pressing problems first, before the general populace would get their hands on it. The whole world seemed to lose its marbles. Is this the end of the world as we know it? An amazingly successful marketing stunt for sure. ## My (non-) access Part of the deal with _project Glasswing _was that Anthropic also offered access to their latest AI model to “Open Source projects” via Linux Foundation. Linux Foundation let their project Alpha Omega handle this part, and I was contacted by their representatives. As lead developer of curl I was offered access to the magic model and I graciously accepted the offer. Sure, I’d like to see what it can find in curl. I signed the contract for getting access, but then nothing happened. Weeks went past and I was told there was a hiccup somewhere and access was delayed. Eventually, I was instead offered that someone else, who has access to the model, could run a scan and analysis on curl for me using Mythos and send me a report. To me, the distinction isn’t that important. It’s not that I would have a lot of time to explore lots of different prompts and doing deep dive adventures anyway. Getting the tool to generate a first proper scan and analysis would be great, whoever did it. I happily accepted this offer. (I am purposely leaving out the identity of the individual(s) involved in getting the curl analysis done as it is not the point of this blog post.) ## AI scans of curl Before this first Mythos report, we had already scanned curl with several different very capable AI powered tools (I mean _in addition to_ running a number of “normal” static code analyzers all the time, using the pickiest compiler options and doing fuzzing on it for years etc). Primarily AISLE, Zeropath and OpenAI’s Codex Security have been used to scrutinize the code with AI. These tools and the analyses they have done have triggered somewhere between _two and three hundred_ bugfixes merged in curl through-out the recent 8-10 months or so. A bunch of the findings these AI tools reported were confirmed vulnerabilities and have been published as CVEs. Probably a dozen or more. Nowadays we also use tools like GitHub’s Copilot and Augment code to review pull requests, and their remarks and complaints help us to land better code and avoid merging new bugs. I mean, we still merge bugs of course but the PR review bots regularly highlight issues that we fix: our merges would be worse without them. The AI reviews are used _in addition_ to the human reviews. They help us, they don’t replace us. We also see a high volume of high quality security reports flooding in: security researchers now use AI extensively and effectively. Security is a _top_ _priority_ for us in the curl project. We follow every guideline and we do software engineering properly, to reduce the number of flaws in code. Scanning for flaws is just one of many steps to keep this ship safe. You need to search long and hard to find another software project that makes as much or goes further than curl, for software security. Steps involved in keeping curl secure ## May 6, 2026 It was with great anticipation we received the first source code analysis report generated with Mythos. Another chance for us to find areas to improve and bugs to fix. To make an even better curl. This initial scan was made on curl’s git repository and its master branch of a certain recent commit. It counted 178K lines of code analyzed in the src/ and lib/ subdirectories. The analysis details several different approaches and methods it has performed the search, and how it has focused on trying to find which flaws. A fun note in the top of the report says: > curl is one of the most fuzzed and audited C codebases in existence (OSS-Fuzz, Coverity, CodeQL, multiple paid audits). Finding anything in the hot paths (HTTP/1, TLS, URL parsing core) is unlikely. … and it correctly found no problems in those areas. Completely unscientific poll on Mastodon about people’s expectations for Mythos scanning curl ## The size of curl curl is currently 176,000 lines of C code when we exclude blank lines. The source code consists of 660,000 words, which is 12% more words than the entire English edition of the novel War and Piece. On average, every single production source code line of curl has been written (and then rewritten) 4.14 times. We have polished on this. Right now, the existing production code in git master that still remains, has been authored by 573 separate individuals. Over time, a total of 1,465 individuals have so far had their proposed changes merged into curl’s git repository. We have published 188 CVEs for curl up until now. curl is installed in over _twenty million instances_. It runs on over _110 operating systems_ and _28 CPU architectures_. It runs in every smart phone, tablet, car, TV, game console and server on earth. ## Five findings became one The report concluded it found **five** “Confirmed security vulnerabilities”. I think using the term _confirmed_ is a little amusing when the AI says it confidently by itself. Yes, the AI thinks they are confirmed, but the curl security team has a slightly different take. Five issues felt like nothing as we had expected an extensive list. Once my curl security team fellows and I had poked on the this short list for a number of hours and dug into the details, we had trimmed the list down and were left with _one_ confirmed vulnerability. The other four were three false positives (they highlighted shortcomings that are documented in API documentation) and the fourth we deemed “just a bug”. The single confirmed vulnerability is going to end up a _severity low_ CVE planned to get published in sync with our pending next curl release 8.21.0 in late June. The flaw is not going to make anyone grasp for breath. All details of that vulnerability will of course not get public before then, so you need to hold out for details on that. The Mythos report on curl also contained a number of spotted bugs that it concluded were not vulnerabilities, much like any new code analyzer does when you run it on hundreds of thousands of lines of code. All the bugs in the report are being investigated and one bye one we are fixing those that we agree with. All in all about twenty bugs that are described and explained very nicely. Barely any false positives, so I presume they have had a rather high threshold for certainty. curl is certainly getting better thanks to this report, but counted by the volume of issues found, all the previous AI tools we have used have resulted in larger bugfix amounts. This is only natural of course since the first tools we ran had many more and easier bugs to find. As we have fixed issues along the way, finding new ones are slowly becoming harder. Additionally, a bug can be small or big so it’s not always fair to just compare numbers ## Not particularly “dangerous” My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing. This is just _one_ source code repository and maybe it is much better on other things. I can only tell and comment on what it found here. ## Still very good But allow me to highlight and reiterate what I have said before: AI powered code analyzers are _significantly_ better at finding security flaws and mistakes in source code than any traditional code analyzers did in the past. All modern AI models are good at this now. Anyone with time and some experimental spirits can find security problems now. The high quality chaos is real. Any project that has not scanned their source code with AI powered tooling will likely find huge number of flaws, bugs and possible vulnerabilities with this new generation of tools. Mythos will, and so will many of the others. Not using AI code analyzers in your project means that you leave adversaries and attackers time and opportunity to find and exploit the flaws you don’t find. ## How AI analyzers differ * They can spot when the comment says something about the code and then conclude that the code does not work as the comment says. * It can check code for platforms and configurations we otherwise cannot run analyzers for * It “knows” details about 3rd party libraries and their APIs so it can detect abuse or bad assumptions. * It “knows” details about protocols curl implements and can question details in the code that seem to violate or contract protocol specifications * They are typically good at summarizing and explaining the flaw, something which can be rather tedious and difficult with old style analyzers. * They can often generate and offer a patch for its found issue (even if the patch usually is not a 100% fix). ## More details from the report **Zero memory-safety vulnerabilities found.** Methodology note: this review is hand-driven analysis using LLM subagents for parallel file reads, with every candidate finding re-verified by direct source inspection in the main session before being recorded. The CVE to variant-hunt mapping was built from curl’s own vuln.json. No automated SAST tooling was used. This outcome is consistent with curl’s status as one of the most heavily fuzzed and audited C codebases. The defensive infrastructure (capped dynbufs everywhere, `curlx_str_number` with explicit max on every numeric parse, `curlx_memdup0` overflow guard, CURL_PRINTF format-string enforcement, per-protocol response-size caps, pingpong 64KB line cap) systematically closes the bug classes that would normally be productive in a codebase this size. Coverage now includes: all minor protocols, all file parsers, all TLS backends’ verify paths, http/1/2/3, ftp full depth, mprintf, x509asn1, doh, all auth mechanisms, content encoding, connection reuse, session cache, CLI tool, platform-specific code, and CI/build supply chain. ## AI finds existing kinds of errors It should be noted that the AI tools find the usual and established kind of errors we already know about. It just finds new instances of them. We have not seen any AI so far report a vulnerability that would somehow be of a novel kind or something totally new. They do not reinvent the field in that way, but they do dig up more issues than any other tools did before. ## More to find These were absolutely not the last bugs to find or report. Just while I was writing the drafts for this blog post we have received more reports from security researchers about suspected problems. The AI tools will improve further and the researchers can find new and different ways to prompt the existing AIs to make them find more. We have not reached the end of this yet. I hope we can keep getting more curl scans done with Mythos and other AIs, over and over until they truly stop finding new problems. ## Credits Thanks to Anthropic and Alpha Omega for providing the model, the tools and doing the scan for us. Thanks also to the individual who did the scan for us. Much appreciated! Top image by Jin Kim from Pixabay Thanks for flying curl. It’s never dull.

Frédéric Bonnet 🇺🇦 @codinbzh reposted

🦔 ErinaceusFrance
@erinaceus.fr

Alors, chers artistes qui suivent notre page et nos résidents, quelqu'un relève le défi de faire une mascotte hérisson pour cartes.app "L'alternative souveraine et écologique à Google Maps" ? Fait à Rennes Basé sur OpenStreetMap.

Cartes@cartes.app

Peut-être qu'on pourrait se faire une mascotte hérisson pour cartes.app

cartes.appCartesA free and open map, a Web alternative to Google and Apple maps, to find a business, a place, visit a city, calculate a route on foot, by bike, by public transport, or by train.