naugtur

some of us never left!

Since 2004, this community has helped make Firefox and the open internet possible. Our “Come Back to Firefox” campaign reunites a few early internet icons to remind people what made the internet special, and why it’s worth protecting.

If you run a Node.js server, start it with --permission and grant only what it needs: — No network access if it only reads files — Limit file access to the directories it actually uses Here's how I locked down Slow Reader's server: github.com/hplush/slowr...

New comiCSS strip: become ungovernable comicss.art/comics/265/ The comic is coded using CSS and HTML (with web components). #css #comic #webcomic #ai

Lula winning is great for the planet, great for Brazil, and great for people who aren't revanchist assholes everywhere in the world, but let's not forget that it's also going to make some of the worst people on Earth extremely sad and mad. We should enjoy that, as a little treat.

I made base-1353 encoding, so I can fit 256-bit values, like “96cca2a0c8a3263c74ef36274abf55f410d992034d16e8285811a9ad3fc59c13”, into short 26 character strings, like “ᓒᔳᣏዧᐎᑙᖜዌᙔᐸƫȶƃᒨዊጶᙵኻѫyፐᎉᑫᖫᘪᒩ”. (Also, I think these sigils are beautiful.) johnservil.github.io/sigil/play.h...

A few LLM rock climbing articles I’ve seen: “Lead rope solo for beginners” Lead rope solo is niche, dangerous, advanced. The info was pure hallucination. Could easily kill someone “Best rope lynx harnesses for rock climbing 2026” The rope lynx harness is a WOW item

With Arc dead, come to Firefox. Let's not give Chromium any more market share. A thriving web is a diverse one. If you want something really close to the Arc experience, check out Zen. zen-browser.app

Do all security vulnerabilities need to be fixed in private? With support from the Sovereign Tech Agency, OpenJS is using @nodejs.org to research whether some vulnerabilities can be remediated faster through normal open development without increasing security risk. More: openjsf.org/blog/soverei...

I am sorry but this is the funniest outcome. They ragequit the CA business because people were mean to them on social media loooooool emudhra.com/en/press-rel...

oh my fucking god it just keeps going www.phoronix.com/news/LKML-Ne...

🤣

they pwned you and are posting your hacked jira ticket proving that you knew about the exploit in the comments

thank you emudhra. "My only micro-B cable is bent" -> using leaked certificates to spoof the sony app store to get root on my camera

Credit where it's due 😁

lol

The replies seem to believe that the number one priority in fighting a fire at the library of Alexandria should have been minimizing water usage

I've said it before: don't kill the goose that lays the golden eggs. If your business depends on open source, respect and support maintainers' work. Their time and goodwill aren't an unlimited resource.

For some reason I’ve had this stuck in my head all day

Can't imagine a more disgraceful thing to politely say

My eyebrow-raising muscles are having a good training lately. What, and I can't get tired of repeating this, the actual fuck???

Chainguard got PHP’s emergency RCE fix under embargo, like every other distributor. It published patched images 6+ hours before the coordinated release. The PHP Foundation says any attacker could then study the fix in binary form while every other PHP user waited.

this is the fix for that PHP issue, somehow I think we haven't heard the last of this

The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early: “This disregarded weeks of work by many parties toward a coordinated disclosure.” socket.dev/blog/php-emb...

The claims here are really sus. Why compare to a 25+ yr old format rather than anything more modern like AVIF? Why claim HDR support, without making it clear that gain maps (an important part of HDR in varying environments) are not supported, yet they are in AVIF?

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

(still a wip, but) I started exploring the x86 boot path as an interactive tutorial kumavis.github.io/vibe-dump/co...

i’ve been disappointed to see the number of people on bluesky sharing this study as if it isn’t complete & total bullshit what makes it worse is that so many of the people uncritically sharing this study were using it to call AI users stupid, when in reality *they* were being stupid for sharing it

Make a male colleague uncomfortable next time you get the chance

Men, please watch this, then pass it on. A problem caused by men must include men's action to solve it.

"[...] pupils using AI saw their average homework score rise by 18% across all subjects. The time they took to complete each assignment fell from an average of 64 minutes to 45. But come exam time, the same students scored 20% below their classmates [...]" www.economist.com/graphic-deta...

8/8 Russia is committing sabotage, murder on the streets of foreign countries, killing US soldiers. Add in the the war crimes and kidnap of kids in Ukraine. There is something very, very wrong if a US President defies the will of lawmakers & the people. Sickening Dmitriev is able to gloat like this

It’s time to let go of social media as it is controlled by its owners who do not respect its users. Meta employees said Lula's accounts were hindered during Brazil election, Folha reports - www.reuters.com/world/americ...

War crimes. So many Russian war crimes.

Reports tonight of unknown drones over Estonia, Latvia and Lithuania at the same time, with NATO fighter aircraft scrambled over Poland, amid a large-scale Russian attack against Ukraine.

5 Russian drones struck Moldova this week. 2 Russian drones were shot down in Romanian airspace yesterday. These are not accidents. They are hybrid warfare, normalizing Russian strikes outside Ukraine. If they are permitted, they will continue and grow in number and damage.

I gave a talk at EMF titled "Men in Tech #YesAllMen", in which I told my experience of being a woman in tech. I was afraid to publish it in case it affected my current or future employment. With all the current news I would like to add my 2¢. So here is the recording: youtu.be/WXL6K1lhvt0?...

This is Pele, my new rendering library for diagrams and charts, compatible with the latest Mermaid syntax. - 100-500× faster than mermaid.js - 6× smaller bundle - No dependencies - Easy to theme - Responsive to device width - Open source (MIT) Try it at pele.run

went on linkedin and saw... That's bleak

The `unload` event no longer fires in Chrome by default! Since the advent of the mobile web this has become increasingly unreliable and we think that's a footgun for devs who might think it works. We've spent the last 3 years carefully removing it from Chrome. developer.chrome.com/blog/unload-...

My mom at home while my hometown has no electricity or running water after an overnight attack, with Russia having killed several and injured dozen more in attacks on a supermarket and residential building a night before, but yeah, Trump figured it all out, give that man a Nobel peace prize now.

If you're in Warsaw, or within reasonable travel, I'll be speaking at thehacksummit.com about what I expect future npm malware to do and how to stop it.

remember the coworker who annoyed you a decade ago by pushing back on “move fast and break things,” “perfect is the enemy of the good,” and “just ship it”? in the age of slop, they’re your most valuable hire. treat them accordingly.

Hey Japanese learners! I built a font that renders Furigana or Romaji on top of Kanji, with ligatures to support words. It can be applied everywhere to get furigana notations for free. Give it a try, and I hope it will be helpful :) furifont.antfu.me

Watching LLM-absolutist projects fixing bugs..