I knew Dogs Playing Poker but wondered if "Gus Nickerson" was the actual artist; it turns out Larson made it up and (according to this possibly spam website) later regretted not looking up the actual artist's name (Cassius Marcellus Coolidge).

it's a bit odd how openai's blog post makes it sound like security bugs in Linux fall in two categories, info leak and local privilege escalation. i would guess that they probably did also ask their model to find some RCEs, but they're selling those to exploit vendors (or perhaps to intelligence agencies directly?) rather than blogging about fixing them.

came here to post the same but since you already did i had to fix the image:

It is a real shame that people think that this is vibecoded

we can't see your source code but the copy on your transparency page sounds like LLM voice:

• "Your feed is people and communities, not advertising."
• "This is a promise we keep in good faith, not a technical guarantee."
• "Analytics let people see how their posts, profiles and communities are doing. This is everything they record, and nothing else."
• "Eight promises:" [...]

If you say you wrote some of the code by hand, cool, i don't doubt it. But it's still giving slop.

Also, charging money for a "plus" account on a centralized closed-source activitypub implementation is...

Lastly, it's difficult to reconcile these two statements:

as a software engineer with over 15 years of experience

[...]

the core is closed for anti-abuse reasons

Developed in partnership with the GrapheneOS Foundation, the leading nonprofit in advanced mobile security, the device reflects Motorola’s commitment to bringing cutting-edge security to everyday users across the globe.

everyday users who can afford a $1600 phone, that is 🙄

fyi, the news story which this meme is premised on turned out to be a hoax.

none of the claims that there was a measurable drop in inauthentic social media activity as a result of the strikes on yandex datacenters held up when i tried to verify them. one of the graphs supposedly demonstrating it was obviously AI-generated and had dates in the future, while another was a cloudflare graph showing a drop in bot traffic but the bot there was solely yandex's search engine web crawler traffic.

it's remarkable how many people continue to believe it.

Hi, i'm an admin on the lemmy.ml instance where you also posted this.

You asked in your other post in !privacy@lemmy.ml (which I was going to delete for being privacy snake-oil, but someone else beat me to it):

what would you want from a tool like this to trust it?

For one thing, I would want the ability to download the whole thing (models included) in a single step, to be able to actually be sure I'm using this offline (without taking my computer offline).

Using this kind of "nothing is uploaded, we promise" application on a website leaves the user relying on the website to keep its promise: even if the javascript has been reviewed and doesn't usually upload a file, a user can't ever be sure (without going offline after loading the page, which is very inconvenient and also a fragile guarantee at best given webworkers and various other browser technology) that the server isn't sending some different javascript this time which will actually exfiltrate their secrets.

I also don't want an AppImage, because then I would need to trust you much more - an AppImage can do far more damage than a malicious webpage! And also I see your AppImage is only 170MB, so it obviously doesn't include all of the models... so it itself also needs internet access.

If what the site says is true, I should be able to host the whole thing with a local static webserver and access it using a browser which I deny internet access to (eg configure it to use a nonexistent proxy and let connections to 127.0.0.1 bypass the proxy, or, better, run it in a different network namespace where it cannot reach the internet at all). If you have some way to predownload all of the models for people to use this in an offline browser like this, you should make that clearer and easier to find.

But, beyond that, I think you've also got a long way to go before you can credibly suggest this as a security and privacy tool. I've only had a quick glance at what you've built so far, and the breadth of features is certainly amazing.

However your first (and so far only) tool which I actually looked somewhat closely at - "Secret Note Link", source code here - is misleading users by offering them an "expiry" feature which is trivially circumventable. This is obvious to any technically savvy user who thinks for a moment about the impossibility of enforcing an expiry policy in this context (where the data is stored in the URL and not on a server), but i think the overwhelming majority people seeing this feature will not infer its pointlessness and will assume incorrectly that it actually works. This incorrect assumption is reinforced by the fact that this privacy-cosplay expiration feature is for some inexplicable reason enabled by default, with a one day expiration.

It's also weird to be hyping the AES aspect of your "secret link" when the default setting is to use no passphrase (which, looking at the source code, I see means that you still encrypt but with a random key which you include in the url fragment alongside the ciphertext). Without a passphrase, maintaining the secrecy of the link is all that can keep the payload secret. Encryption provides no benefit whatsoever in that case; you may as well just gzip and base64 the plaintext and put that in the fragment instead instead of using AES.... or, just send the plaintext instead of sending a "secret" link at all (although given the way mobile phones work having a way to send base64-encoded text is maybe actually useful 🤡). The pointlessness of the encryption here is obvious to some people, but not to most of your target audience.

screenshot of 'Secret Note Link' as it looked at the time this comment was written

I think you should remove the expiry and no-passphrase key-concatenated-with-ciphertext features altogether, and ask your agent to review all of the other tools in light of this feedback to look for and remediate similar cases of snake oil.

I was going to remove your post from !privacy@lemmy.ml but leave the one in !opensource@lemmy.ml, but someone else removed both while I was writing this. I was going to say about the latter: I removed your post in !privacy@lemmy.ml but I'm leaving this one for now on the assumption that many of the tools that you have created are probably actually useful. fyi you should know that you're probably going to receive a lot of negative feedback posting this here (see the discussion in the post currently pinned at the top of this (/c/opensource) community).

I think you probably have good intentions so I am unbanning you from lemmy.ml (but not undeleting your posts to communities on this instance), and I'm posting this comment here in another community on another instance instead.

HTH.

I was really expecting your last paragraph to say the opposite of what it says 😂

I don't have this device but, on behalf of everybody who does and will be able to run mainline linux on it in the future due to your work: thank you!

i'm not sure but i think that detector might be detecting an openai-specific watermark which indicates that it was not a ring camera's slopification but actually a fake. or maybe the detector itself is fake and the image is real, who knows.

in any case, fuck this meme for normalizing ring cameras and acting like they're cool and ok - there are lots of reasonable ways to do video surveillance of your own home without sending all of the data to amazon and the cops and the various other private and government entities they share it with.

people with ring cameras should be shamed.