Natanox

Cool thing! 🙂

There’s something up with that Cloud thingy on the top though. If I open the website with my Smartphone browser (Fennec on Android 14, Adreno 6xx series) it lags like no tomorrow as long as that cloud is being rendered.

Not saying fixed bugs aren’t good, I’m just so fed up with this marketing-driven fearmongering. They’re overhyping every god damn bug they can because they know most people won’t know how bad it actually is. They do worse security practices than most homelab enthusiasts and then prophesize the AIpocalypse because their linear algebra “escaped” (the door was wide open). Hell, they don’t even manage to understand proper bug disclosure practices. They’re playing the “Social” Media outrage game on a global scale to drive sales and everyone is suffering for it. I’m so, SO done with all of this bullshit. When the bubble finally crashes I’ll throw a raging party with blackjack and hookers.

For server crashes, but not for RCEs. The only proven case of this I know of was with a specifically prepared PHP instance as honeypot that had an optimal attack surface and was done by Perplexity (another AI company). Outside of that there’s no credible large-scale RCE exploitation that’s any worse than the bugs that get fixed on a daily basis. It doesn’t even remotely justify the panic and media frenzy.

it was merely dangerously exploited by AI bros.

This is shady as hell. It’s an AI company again (Anthropic), they do not follow rules of responsible disclosure (again), it’s a race condition again, they do not provide a proof of concept (obviously since they shouldn’t talk about it at all until after we got the patch) but instead create big media fuzz about their glorious AI… hell, they do not even tell us the kernel versions or anything.

If we find out eventually that you have to disable default mitigations for this to become dangerous (like the stunt they did with Firefox) it’s too late, the media won’t give a shit anymore. Like we just had with PHP - huge panic, enormous media circus, barely any real-life consequences in the end and the responsible disclosure process being a total mess to blow it up even more.

Honestly, every time I see some AI company hyping yet another huge and super dangerous exploit only their superior AI found “after X years of nobody seeing it” I now expect a nothingburger.

We’re probably fine, nothing out of the ordinary to see here.

This post was most definitely slopped by an LLM and the “AI” bullshit is totally pointless, you could implement all that way smarter and trustworthy using OpenFoodFacts.

The project idea looks really cool and genuinely solves a problem (though I would’ve preferred a Nextcloud sync and improved extractors for NewPipe & Freetube), however the amount of generated code and permissive policy (allowing to just have complete implementations generated) scares me off. It sounds like there are huge amounts of code no human ever looked at.

Not for complex tasks, really. Gemma4b or similar might be just enough as the backend for a voice assistant replacing Alexa (which I honestly hope, I need to get family members off of that fucking spy devices…). Small web searches might just fit. Or image recognition for Nextcloud Memories, stuff like that.

I noticed that there are sometimes huge differences between models and providers. ChatGPT, which most people use, is a useless sycophant because it’s made to value user satisfaction higher than factual correctness (so it makes shit up und basically never pushes back if you challenge it). When using Mistral AI I had the AI tell me outright that I’m wrong (though it still generated very friendly text to do so, and it only properly does it when in “thinking” mode). No clue how Anthropic or Google do in this regard, just that ChatGPT is especially awful. In the end all models are risky.

This is even more funny. Oh no, 15 TV boxes in the same network can produce 0.39 tokens per second while being completely computationally overwhelmed? Imagine all of your house appliances not reacting and you not catching on that there might be an issue that requires factory resets.

Not to mention the network lag and how often small models need to reiterate stuff because it got stuff wrong.

<rant>

especially from businesses

if they want businesses to subscribe

styled to attract the decision makers in their target market

Do that, and it becomes a serious contender in the market

The market who’s responsible for fucking up the internet? The market that constantly attacks websites with crawlers to steal everything for value extraction, which Anubis fights against? The market that couldn’t care less about you unless you provide value to it, and even then won’t give you a penny unless forced (while building the whole internet on your shoulders)? That market?

Most FOSS devs I know who aren’t forced into it couldn’t give less of a fart about “the market” and capitalists with sticks in their rear ends inside it. The monetization was often just attached to a project because it makes sense given we’re all trapped in capitalism and perhaps have to somehow cover project costs (probably less so for Anubis), not because it’s a goal to attract investment.

People who’re appaled by something so simple such as a .lol domain and a cute mascot sound awful to talk to anyway.

It is a big problem with a number of opensource projects that could get wider adoption and support

I tell you how that “support” looks like. Companies who adopted the software will add your maintainer Email to their business contacts. If there are issues with your software they’ll then usually ignore the developer route and directly write emails to you, and if it’s a big problem for them immediately blame you and threaten legal action, blahblahblah. They’ll treat you like someone they have a support contract with and be completely confused when you tell them to open an issue and that you otherwise don’t care. Meanwhile they’ll build an empire using your software and be a persistent nuisance.

Why should anyone not desperately needing money to survive care about this.

</rant>

You’ll also have to convince other maintainers to adopt the new API in this case, otherwise it’s pointless. Vaultwarden is only the server, you’d at least require one third-party client (e.g. Keyguard) to add and maintain the Vaultwarden API and probably also someone to fork the browser plugins. This whole issue is quite involved.

Not arguing against it of course, just dislike when people make forking (and establishing a whole new standard) sound like not that big of a deal.

Sounds like you’re volunteering to do that additional amount of work.

Oh god, it’s Matrix Element. Yeah, of course it’s absolute shit.

Did you? The pictures and graphics are all AI so I’m extremely unsure how trustworthy the text is.

If this project is closely based on Calibre it requires the [AIP] prefix.

Edit: Definitely needs it, Claude Code is in the contributor list.

Why the AI slop picture?

Anyway, does it need to be screenshots? My first thought would’ve been to curl the whole thing and selectively check for changes within specific sections such as the main content area while excluding pre-defined sections (e.g. a nested div of the class “price”). Your visual 5% tolerance might not catch tiny changes in a compliance document.

I like matrix too but am dealing with weird […] issues

The quintessential Matrix experience

There are parental controls, but it’s rare. FOSS projects usually aren’t very keen on building systems of authority, even parental ones.

For smartphones check out /e/OS (Murena Smartphones). They added parental controls recently, not sure how good those are though.

For computers your best bet’s probably a Linux with Gnome. They also added something recently.

You might be able to combine both with a custom DNS service, surely there’s something out there for that usecase (NextDNS?). But that’s already getting pretty complex.

Mullvad’s CEO finances fascists, please don’t.