the bunny talisman of yearn
- Tweets 30,194
- Following 3,620
- Followers 234,211
- Likes 31,718
crimsonland RTX is out.
ion beams, fire bullets and nukes now light the whole arena. smoke runs as a gpu fluid sim: rocket exhaust glows through its own trail, laser sights cut the haze. monster vision turns the swarm bioluminescent.
uvx crimsonland@latest --rtx
6
3
75
11,369
banteg retweeted
I want to say something positive, but it's just darkness ahead. The future is as follows: Apple will listen to feedback about touch screen issues. They will earnestly try to fix it, by bloating up the entire macOS to be increasingly touch-friendly. It is year 2032 and we will reminisce about the days when macOS was primarily designed for mouse & click. It's over folks...
I am desperately rooting for Apple and I hope they disprove my thesis.
Here are other optimizations for touch on the new MacBook Pro
Swipe up for dock like on an iPad
New animation for drag & hold in Finder
42
38
608
21,731
banteg retweeted
Artificial Analysis v4.3.2 to v5, AI models re-ranking step by step.
102
106
2,181
287,927
banteg retweeted
I built @zksnarks_ and @zilkroad_ terminal explorer for ZECATHON.
In the 90s I set up my first BBS and joined the community of people using those systems to create and distribute digital art.
Moving zkSNARKs into the terminal feels like bringing them home.
3
3
17
1,206
crimsonland 0.23.0 is out, with RTX lighting in your browser
lit like it never was in 2003:
- wet blood reflects light sources and coagulates in realtime
- monsters are lit and cast soft penumbra shadows
- closed form shaders for ion beams, fire bullets and plasma
- linear light that adds up like real light, so a screen full of fire no longer clips to flat white
- fluid smoke: explosions glow hot and cool to gray, flames leave soot, bullets stir it as they pierce the smoke
- new monster vision heat ironbow look and a new freeze ice shader
- several times faster in late-game crowds
it works on any screen, but i suggest playing on an hdr display to get highlights past white. tick rtx lighting in options to enable this look.
also new: mods menu is now a custom quests browser for community-built levels.
play: crimson.land/play
python port: uvx crimsonland@latest
changelog: github.com/banteg/crimson/bl…
banteg
2
1
25
2,862
banteg retweeted
I like to look at claims like this in case I can improve Ghostty. I grabbed your source and immediately spotted the issue: your read loop overwrites a 64 KiB ring. Everything older is discarded unparsed per tick. You're faster because you're not actually terminal emulating.
It means the number isn't a throughput number. In a kitten benchmark run at the rate you're claiming, roughly 6.6 MB arrives per 60 Hz tick and 64 KiB of it gets parsed. You're read(2)-ing 100% of the data and parsing about 1% of it.
There are other minor issues (a small fixed scrollback in a preallocated ring buffer, no grapheme clustering, throwing away data like OSC 8 URIs, etc.), but the major one is simply that you're discarding ~99% of the input.
For plain text, e.g. your cat benchmark, the final screen ends up looking right, but the scrollback is missing 99% of the file and each retained chunk starts mid-line. As soon as there are escape sequences in the dropped spans, your emulator is fully out of sync and invalid: a cut inside a CSI prints the parameters as text, and any SGR, mode, title, or alt-screen change in the gap is just... gone.
FYI, this is why I don't like when people point at refterm as a terminal benchmark. refterm implements a TINY subset of what a terminal emulator must support, it's closer to a fast file reader, not a terminal emulator.
I also don't mean any shade by this. I like to look at technology objectively to try to learn something and improve my own craft and work. So I'm sharing what I found.
I modified your code very slightly to parse on every full buffer (rather than per tick). And the results are attached. Both use main commit in each repo at the time of this post.
Note the graph is in log scale, the discrepancy between performance for things like Kitty images is measured in GB/s.
156
199
7,409
593,436
banteg retweeted
north korea disguises RCE as an auth error
Claude just saved my ass from a North Korean supply chain attack
Like actually
Thank you @AnthropicAI
29
110
3,343
267,994
banteg retweeted
ok I need 4 to STOP. I cant take this anymore. every day I am checking modulus and its 4. every day, check modulus, its 4. I cant take this anymore, I have over trusted, by a LOT. it is what it is. but I need modulus to GO UP ALREADY. can devs DO SOMETHING???
we got a new 4
a typo in goahead's tls configuration passes sizeof(dhm_g) instead of sizeof(dhm_p), reducing a 2048-bit diffie-hellman modulus to just 1 byte, the size of the generator.
the first byte happens to be 255. not only is it tiny, it's not even prime (3×5×17).
with g=2, the powers of 2 modulo 255 cycle through just 8 values: 1, 2, 4, 8, 16, 32, 64, 128.
that's just 3 bits of possible shared-secret entropy. an attacker can try all 8 possibilities to decrypt an affected tls session.
the typo has been there since 2018.
important caveat: this only affects tls 1.2 dhe with clients that accept the tiny modulus, using the optional mbedtls backend. goahead uses openssl by default.
1
1
21
2,334
we got a new 4
a typo in goahead's tls configuration passes sizeof(dhm_g) instead of sizeof(dhm_p), reducing a 2048-bit diffie-hellman modulus to just 1 byte, the size of the generator.
the first byte happens to be 255. not only is it tiny, it's not even prime (3×5×17).
with g=2, the powers of 2 modulo 255 cycle through just 8 values: 1, 2, 4, 8, 16, 32, 64, 128.
that's just 3 bits of possible shared-secret entropy. an attacker can try all 8 possibilities to decrypt an affected tls session.
the typo has been there since 2018.
important caveat: this only affects tls 1.2 dhe with clients that accept the tiny modulus, using the optional mbedtls backend. goahead uses openssl by default.
6
96
9,244
banteg retweeted
That is one hell of a typo.
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
72
138
2,830
184,125
RT @0x_Osprey: Here is my 10 Minute Mac Security Checklist
It covers the min requirements to harden your Mac's security using system setti…
29
998
banteg retweeted
Anthropic is banning 5-7% of its users (by revenue) every 9 months lmao
34
88
1,635
53,085
another example of a terrible ad. it attacks the one person it asks the money from, and the best argument is borrowed from looney tunes. since when do rationalists believe in the irony of fate and not their spreadsheets? this ad also killed appox 250 kenyans.
Whether or not anyone builds it... everyone dies.
The future is uncertain. Your impact doesn't have to be.
7
30
6,276
banteg retweeted
People seem to forget how unprecedented this is
Anthropic has filed an S-1 registration statement with the SEC related to its proposed IPO.
Read more: anthropic.com/news/s1-sec
Legal disclaimer: A registration statement relating to these securities has been filed with the SEC but has not yet become effective. These securities may not be sold, nor may offers to buy be accepted, prior to the time the registration statement becomes effective. This post does not constitute an offer to sell or the solicitation of an offer to buy these securities, nor shall there be any sale of these securities in any state or jurisdiction in which such offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any such state or jurisdiction.
106
204
4,708
468,759
most of these people are losers who never outgrew their minute of fame from 15 years ago. a fitting role model for firefox. officially a grandpa browser now.
How is the internet less private than in 2006, when the whole family shared one computer?
Back then, the internet was weird, personal, and all of ours.
So, we got your favorite meme legends back together to say it louder: What happened to the internet? 1/3
17
1
182
13,685