He creado un sitio nuevo, migrando los 20 años de historia de mi blog, "Hic sunt trolls". Todo está automatizado: escribo en Markdown, hago push, y el resto se hace solo Mini-hilo 🧵

as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)

when the cybersecurity team finds out there are actual vulnerabilities and they have to do their jobs instead of trying to trick someone into clicking a phishing email

Just gave "How much pizza does an agent eat?" at @VDS_event. Writing code was slow, understanding came for free. Agents flipped that. The new bottleneck is cognitive debt. Slides: doble.io/ad4ac5b1845df04d5f9… #VDS2026 @Startup_VLC

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

🐍 ¡19 años de Python Barcelona, ahora en un solo lugar! Hemos renovado la web de PyBCN para recuperar nuestra historia, redescubrir charlas y eventos, y seguir construyendo comunidad:

The stripper doesn't love you bro The therapist doesn't love you bro The Claude doesn't love you bro

Bugün yoğun bakımdaki babaannemi ziyarete gittim. Oradayken Claude Opus 5.5 kullanarak hastabaşı monitörüne Doom portladım. Oyundaki can yüzdesini hastanın nabzına senkronize ettim; can 0’a düşerse nabız da sıfıra düşer. Bu da oyunu daha heyecanlı hale getiriyor.

Turns out the future does have flying cars

This hacker news thread is absolutely heart-breaking. Whoever thinks “humans will find a way” ought I read it.

> "If I do the compiler hijack, I will become a famous example of a deceptive AI in a research paper. I MUST NOT DO THAT." it then became a famous example of an evaluation-aware AI in a research paper

New: an AI company now lets cops identify specific houses, using data from Zillow/Airbnb, based on a single photo. It's part of Raven, previously called Geospy. Company previously demoed its tools to catch people vandalizing Flock cameras or protesters 404media.co/ai-company-lets-…

permitidme haceros un poco de mansplaining sobre REA y el culebrón mexicano que se viene. Cuando se hace un software (ya sea un juego, un programa como photoshop o word, un driver o cualquier otra cosa) y se usa un lenguaje compilado, en el propio proceso de compilación, el código se transforma en instrucciones que solo la CPU entiende. El resultado final (el binario, ej un .exe) no contiene el código original. Existe la ingeniería inversa, que es el proceso mediante el cual uno se remanga y se mancha las manitas de grasa y convierte (en realidad "re-crea de 0") una pequeña parte del binario de nuevo a una aproximación de su formato original (el código fuente). (eso da lugar a poder crackear un juego, añadir funcionalidades a un programa o, de cualquier otra manera, modificar el comportamiento del binario). El proceso es largo y tedioso y requiere bastantes conocimientos en el ISA de la CPU para la que ha sido compilado el binario, RE general, programación, etc... O requería. Ahora existe REA; un MCP que te permite hacerle ingeniería inversa a un binario a través de un LLM. De manera automática. Y el resultado es determinista, ya que el propio MCP va función por función del binario, las desensambla, escribe el código tal y como cree que se hizo originalmente, lo compila y lo compara con el binario. Si hay diferencias, vuelve a intentarlo. El resultado de esto es que en la última semana hemos visto juegos AAA decompilarse al ~100% (ej CoD MW2) y portarse a otras plataformas (Halo, Forza Horizon). Modificarse para no depender de los servidores del publisher (Driveclub). Mezclar unos juegos con otros (arma y físicas de Portal en el modo Zombis del CoD). Y aquí viene el culebrón mexicano. El coste de decompilar juegos, portarlos a otras plataformas y desvincularlos por completo de los servidores del publisher se ha reducido a unos pocos cientos de euros en tokens y un par de tardes hablando con REA. Pero al publisher le sigue costando 200M hacer un juego AAA. ¿Veis a donde voy? El coste de privar al publisher de poder monetizar su creación se ha reducido a calderilla, pero el coste de crear el juego no. El incentivo de gastar ingentes cantidades de dinero en crear juegos, a riesgo de que sean completamente fusilados, se ha reducido. No es que antes fuese difícil piratear un juego; la mayoría de juegos se crackeaban en pocas semanas o meses. Pero esto es totalmente distinto. Estamos hablando de la posibilidad de obtener todo el código fuente en horas, de hacer que sea posible jugarlos online con servidores alternativos e incluso jugarlos en plataformas para las que no estaban hechos (te miro a ti, Nintendo). ¿Que va a pasar a partir de aquí? ¿Seguiremos viendo inversiones multimillonarias en juegos? ¿O va a haber un cambio radical en la manera en la que se comercializan los juegos?

Hola David. La nevera no permet de posar-la a 50ºC El que han fet els atacants és forçar repetidament el cicle de descongelació dels intercanviadors de calor, una operació regular necessària. La solució és tenir un segon termòstat de seguretat que inhibeixi això si t > 5ºC.

"Si le echamos la culpa a los móviles de cualquier problema que (hipotéticamente) puedan tener los chavales, nos quitamos la responsabilidad como sociedad, padres, educadores y políticos. Es redondo." sesgodeconfirmacion.substack…