Anything I say here is my personal,ultracrepidarian view, and has nothing to do with mine, yours or anyone else's employer, family, or any other favourite aunt.
Bulgaria
Joined August 2007
- Tweets7.8K
- Following678
- Followers908
- Likes5.5K
Doncho retweeted
The bug is like a joke.
On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Doncho retweeted
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
Doncho retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Doncho retweeted
NVIDIA sold millions of 3090s with 50% of the tensor speed switched off. Not missing. Switched off.
1 kernel module flips it to full, and my BF16 tensor pipe went from 82 to 155 TFLOPS. Nothing else changed on the cards, and the outputs match the stock run byte for byte.
All so the gaming card wouldnt eat into workstation sales. Every 3090 owner ran at 50% for 6 years, so a pro card could look worth the price. Fine, its their business model.
And LLMs are the least interesting place for this. Decode waits on memory, and my engine runs its experts in int8. Still +10% on prefill.
The models that live on BF16 tensor math are everything else. Qwen Image 2.1 and FLUX 3 Klein, where every diffusion step is big matmuls. MiniMax H3, which takes 4 to 7 minutes on my cards. Music and speech models. And training, every LoRA anyone ever trained on a 3090 went through exactly the path that was cut.
Thats what I measure next. This is only the start.
My 3090s just got 1.9x FASTER at BF16 tensor math!!! Same cards, same driver, same 300W, one Linux kernel module.
bf16 tensor pipe: 82 -> 155 TFLOPS
cuBLAS BF16 GEMM 8192: 64 -> 99 TFLOPS
TF32: 41 -> 79 TFLOPS
NVIDIA ships every 3090 with fp32-accumulate tensor math at half speed. The driver even reports it: FMLA32 = 1/2. gpu-unlock by Zagitta sets it to full before the NVIDIA driver loads. After a cold boot all 4 of my cards say FMLA32 = full.
Real inference got less than I predicted. Strata, Qwen3.8 Flash-Next on 2 cards, prefill:
4K: +12%
10K: +12%
90K: 3205 -> 3536 tok/s, +10%
Before installing I said +14 to 19% at 90K, so I was wrong. The GEMM phases got 23% shorter, but they are only about 40% of Strata prefill, and the int8 experts, copies and CUDA core kernels didnt get any faster.
Outputs did not change. With the same expert cache size, my log-prob dump over 1996 teacher-forced positions is the same file byte for byte as the stock run before the module.
Next is Strata itself, now its everything around the GEMMs that makes prefill slow. How I set it up is in the replies.
Doncho retweeted
🔴🇮🇹 ALERTE INFO – EN 48 HEURES, MELONI RÉPOND AUX ÉMEUTES.
Après un week-end de violences en Italie, Giorgia Meloni annonce un décret approuvé aujourd'hui par son gouvernement.
« Manifester est un droit, dévaster nos villes, non. »
Voici les mesures adoptées :
- Jusqu'à 5 ANS DE PRISON et 20 000 € d'amende pour participation violente à une manifestation en groupe d'au moins 5 personnes. Peines aggravées en cas de visage dissimulé ou de blessures.
- QUI CASSE PAIE. Si le responsable est mineur, ses parents devront répondre financièrement des dégâts. Le patrimoine familial pourra être mobilisé pour indemniser les victimes.
- RETENUE PRÉVENTIVE étendue aux mineurs.
- 500 MILITAIRES SUPPLÉMENTAIRES déployés à Milan jusqu'au 31 décembre.
Le bilan : près de 200 policiers blessés lors des violences en Italie et environ 1 MILLION D'EUROS de dégâts rien qu'à Milan.
Meloni est catégorique :
« Dévaster et voler, ce n'est pas manifester, c'est de la criminalité. »
Pendant ce temps, en France, l'hôtel de ville de Limoges a été ravagé par les flammes.
Et nous attendons toujours une réponse politique à la hauteur de la gravité de ces événements.
Doncho retweeted
Cold-hearted 🖤
Copenhagen pushes elderly in retirement homes to eat little meat to cut CO₂
Can they please get more meat on, say, their birthday?
No. A left-wing councilor:
Climate targets for everyone. And old people are “precisely the generation that polluted the most”
kk.kommune-tv.dk/watch/11310…
Heartbreaking 💔
Copenhagen climate politicians push elderly in retirement homes onto minimal meat to cut CO₂
Birthday wishes for beef are sometimes rejected “for the CO₂ accounts”
Residents pay for the food but often get organic vegetarian instead of what they want
archive.ph/wo9OV
Guidelines (p.45): max 500g meat/week, max 80g beef/veal/lamb (~one kid’s burger/week)
maaltider.kk.dk/sites/defaul…
Doncho retweeted
🚨 BREAKING: In an incredible moment, Sec. Marco Rubio just WALKED OUT in front of the Acropolis in Athens, Greece to demand a resurgence of Western Civilization values and against mass 3rd world migration
And he's doing it at the BIRTHPLACE of the West.
Inject this into my veins. 🔥🔥
"The imagination of the western world. GENERATIONS of our statesmen...have looked to [Acropolis] with wonder, with awe."
"2.5 centuries after the founding of the American Republic...I stand here today as a Secretary of State of that republic...I stand here to testify to a debt that no lapse of time, no distance of space can ever extinguish."
"The history of America, of my country, is covered with the fingerprints of antiquity. Greece is literally carved into the architecture of our government."
This speech is pure gold.
Doncho retweeted
The biggest economic story of the last decades isn’t China.
It’s America decoupling from Europe.
Left-green policies may sound good, but they don’t work.
Europe is becoming economically irrelevant, not because the U.S. abandoned it, but because it follows the wrong policies.
Doncho retweeted
Claude Fable 5, Claude Opus 5 and ChatGPT 5.6 Sol were asked to paint the Mona Lisa in a browser, and all three rebuilt Leonardo's actual 500 year old technique on their own.
The entire prompt was one line: "Create a single HTML file that animates the painting of the Mona Lisa layer by layer, the way an old master would build it up".
Nobody told them how oil painting works, they just knew..
> Charcoal study, umber ground, shadow and atmosphere, color glazing, sfumato, varnished finish -- the exact Renaissance layering order, and not one of those words was in the prompt.
> GPT 5.6 Sol went furthest and named its own app Sfumato Studio, with a completion counter, playback speed and a restart button.
The models are no longer copying the result -> they are copying the process.
Save this one -- the prompt is right there, go repaint your own ↓
Claude Fable 5 and Claude Opus 5 just invented their own fantasy worlds, named them, and drew the maps in front of me from one prompt.
The entire prompt was one line: "In a single HTML file, create an animation of a quill drawing a fantasy world map".
> Top is Fable 5 going full cartographer -- coastlines, scattered isles, forests, and a realm it decided to call Quelonia.
> Bottom is Opus 5 building The Known World -- mountain ranges, rivers, a quill drawing every stroke live, and an ocean it named The Sundering Sea on its own.
The funniest part is that I never typed a single name -- both models came up with their own lore.
Watching a map sketch itself line by line is the moment this stops feeling like a chatbot.
Save this one -- your next D&D campaign is one sentence away ↓