Moszeed retweeted
Ollama now supports Jev-like decision models all locally.
Use decision models like Nimble for tasks like ticket triaging, model routing, and content moderation.
ollama pull nimble
Here’s Nimble playing Ollama racer through the new local /v1/systemone API by making decisions in real-time. 🏎️
Moszeed retweeted
New queens of the Stone Age is genuinely amazing, I’m stunned
youtu.be/eAOIpDUDGX4?si=MBW_…
Moszeed retweeted
Use an LLM for free, fully offline in your browser, in a Linux sandbox with python etc.
Your data isn't sent anywhere, no credit card required.
This is smolbox, built by @_mattata (six digit IQ)
You can use it here: smolbox.remyhax.xyz/
You can read about it here: remyhax.xyz/posts/smolbox/
Will upload the full episode to my YT channel prob this weekend: youtube.com/@AstarteSecurity
Moszeed retweeted
🚨 Reddit users say OpenAI may have cut Codex limits in half
NerfTrack estimates the weekly ChatGPT Plus limit dropped from roughly $160 in API value to about $80 within a few days. Users on the $100 Pro 5x and $200 Pro 20x plans are also reporting their weekly quota now disappears in 1 to 3 days.
reddit.com/r/codex/comments/…
Moszeed retweeted
That's a small reminder! 👇
As of June 2026, HTTP has a new method - a GET with a `body` 😎
Meet QUERY (RFC 10008).
It lets you send complex queries in the body (like POST) while staying safe, idempotent, and cacheable (like GET). Already works on servers (Node.js, Go, Laravel…).
Browsers are still adding full support, usable now with care, with widespread adoption coming later in 2026+.
Moszeed retweeted
I'm slow on this news, but apparently the source code for Zork I, II, III were placed under MIT license and now fully open.
Link in replies
Moszeed retweeted
China open-sourced a peanut-sized OCR that parses entire 100-page PDFs in one shot..
It's called Unlimited-OCR. Only 3B params. Runs locally.
Every other OCR tool chops your doc into pages and loses the thread. this one reads the whole thing in a single pass.
→ One-shot "long-horizon" parsing (32K context window)
→ Multilingual, out of the box
→ 93% on the standard parsing benchmark (+6 over baseline)
→ <0.11 error rate past 40 pages
→ Runs 100% locally on your own hardware
→ Works with Transformers, vLLM, SGLang, Docker, Ollama, llama.cpp
Traditional cloud OCR (Textract, Google Vision, Azure Doc Intelligence) costs $1.50–$15 per 1,000 pages.
This runs on your machine. For free. Forever.
Baidu built it explicitly to push DeepSeek-OCR one step further. Already at 1.9M downloads on Hugging Face and most people have no idea it exists yet.
100% open source.
Moszeed retweeted
China open-sourced a model that reconstructs any scene in 3D from a regular video, in real-time.
one camera. no LiDAR. 10,000+ frames without falling apart.
just walk around with your camera and watch the entire world get rebuilt in 3D at 20 fps.
→ runs at ~20 FPS on a single GPU
→ Stable over 10,000+ frames
→ Beats optimization-based methods on benchmarks
→ Works on drone footage, driving videos, indoor walkthroughs
100% open source.
Moszeed retweeted
THE ENGINE DIRECTOR BEHIND AAA CONSOLE GAMES WALKED ON STAGE AT A C++ CONFERENCE AND TOLD A ROOM OF EXPERTS THAT THE CLEAN, OBJECT ORIENTED CODE THEY ARE PROUD OF IS A LIE AND IT QUIETLY THROWS AWAY 90% OF THE MACHINE THEY PAID FOR
85 minutes from Mike Acton -- engine director at Insomniac Games, where wasting cycles is not an abstract debate, it is the difference between a game that ships and one that dies.
-> His first principle is blunt: the only purpose of any program is to transform data. Not to model the world in pretty classes. Move data, fast.
06:33 -- The lie he calls out: "Software is the platform". No. The hardware is the platform. Ignore it and you cannot even reason about the cost of your own code.
Most devs never look at what the CPU actually does. They stack abstractions until the machine spends its life waiting on memory it should never have touched.
49:38 -- He prints a value, zips it, and measures the waste directly. A brutal little trick that exposes how much of your data is pure noise.
And this is the AI era's blind spot too. Agents generate more abstract code faster, on hardware nobody profiles, while the GPU bill quietly explodes.
You thought clean code was the goal. This is the man shipping real engines saying the machine is the goal, and clean code is often how you lose it.
Bookmark it & you'll never look at your own abstractions the same ↓
SOMEONE PAID 11,250 TELEGRAM STARS JUST TO DM PAVEL DUROV AND CHALLENGE HIM TO AN AURA BATTLE
They didn't pay to say Hi, they paid to MOG him.
This is Six Seven Club -- @sixsevenapp, a Telegram mini-app where your own account is the weapon:
> Every Telegram has an aura score -- account age, gifts, rare usernames, numbers.
> You challenge anyone straight in their DMs, from Durov to Snoop Dogg.
> Higher aura wins the MOG, and you earn.
People are burning real Stars just to fight the founder of Telegram inside his own app.
Save this and Try.
Moszeed retweeted
Erin Brockovich is now tracking more than 5,000 community concerns about AI data centers across the United States.
The renowned environmental activist has created a nationwide map that tracks AI data centers that are operating, under construction, proposed, or facing local opposition.
Reports have surged in recent weeks. On June 2, the tracker showed just over 3,000 community submissions. By June 9, that number had climbed past 5,000.
The worries are very real. Residents are raising alarms about skyrocketing electricity demand, massive water consumption, constant noise, strain on local infrastructure, electronic waste, flooding risks, and the overall burden these industrial-scale facilities place on small towns and rural areas.
Data centers serve as the physical foundation of artificial intelligence, powering everything from chatbots and image generators to cloud services and video models. But keeping the servers running 24/7 requires enormous resources.
A single large data center can consume up to 5 million gallons of water per day, equivalent to the daily water usage of a town of 10,000 to 50,000 people. They also used about 4.4% of total U.S. electricity in 2023, a figure the Department of Energy projects could rise to 6.7–12% by 2028.
This rapid growth has sparked growing local backlash. Several cities and counties have already imposed moratoriums or restrictions on new data centers to assess their impact on water supplies, power grids, and household utility bills. Seattle, for example, approved a one-year pause, with similar measures taken in parts of Kentucky, California, and Georgia.
Moszeed retweeted
🦔GitHub Copilot switched to token-based billing this morning and users are already out of credits. Pro+ subscribers paying $39 a month are reporting 60% of their credits gone in two hours of normal use. One user lost 20% of their allowance from a single file review with no code changes. Another hit their monthly cap before the calendar even flipped to June.
Orgs with shared token pools have no way to see individual usage, so entire teams get cut off when one person runs a heavy prompt. Users are canceling and moving to Claude Code and Codex. GitHub community forums are on fire.
My Take
Flat-rate AI subscriptions were always subsidized. Everyone in the industry knew it. Today the subsidy ran out for a few million developers at once. The problem is a lot of companies already restructured around these tools. They cut headcount and told remaining engineers to lean on Copilot instead of building skills internally. Those companies now depend on a tool whose cost just became unpredictable and whose usefulness completely changes when you have to ration prompts to stay under budget.
The developers moving to Claude Code and Codex will hit the same wall eventually. Every AI provider faces the same unit economics. Anthropic filed its S-1 this morning, and the durability of its revenue depends on whether customers stick around once real pricing kicks in everywhere. If a $39 subscriber cancels after one day because the tool became unusable, multiply that across millions of seats and the churn risk becomes very real.
Today showed what happens when AI pricing meets reality. The companies that built their workflows around cheap tokens just discovered the tokens aren't cheap anymore and the people who knew how to do the work without them are already gone.
Hedgie🤗
Moszeed retweeted
25 years of @OWASP and yet...
rapid7.com/blog/post/etr-rap…
Moszeed retweeted
Today Instagram had this massive exploit where hackers were just stealing rare handles left and right. Hundreds of accounts gone.
People losing handles they’ve owned since 2010, some worth hundreds of thousands.
I own a few rare ones so I was actually stressed watching this happen in real time, which I haven’t been in years.
Obama White House account got hit.
These aren’t some random new accounts, these are verified, locked down accounts and they still got compromised.
The thing is the exploit is so simple it’s almost funny. Attacker goes to Forgot Password, says their account is hacked, turns on a VPN to match the target’s location (which now you can find on the about section of the page).
Instagram’s AI support flow asks them to verify with a selfie.
They grab a photo from the target’s profile, run it through an AI video generator to make an animation of the person’s face moving around, upload that to Meta’s AI as proof.
And Meta’s AI just accepts it because it can’t tell the difference between a real selfie and an AI-generated video of someone’s face
.
Once verified they change the email to theirs. Password reset link goes to their email. They own it now. 2FA gets bypassed somehow in the process but honestly I don’t know exactly how, just that it did.
Point is even locked down accounts went down.
Then you try to recover your account and you’re talking to a chatbot that has zero ability to help.
You can’t escalate to a human. You’re just stuck. Your asset is gone and there’s no one to call.
The whole thing just highlighted how stupid it is to automate account security without any human in the loop.
One AI fooling another AI while there’s literally no person anywhere to catch it.
Meta took hours to even acknowledge it while accounts were getting stolen every minute.
Now thankfully it’s patched but I don’t think it will be the last one. Stay safe!
Moszeed retweeted
We're experimenting with a way to visualize session history in Firefox DevTools, and we'd love your feedback!
Here's the background, and how to try it: blog.farre.se/posts/2026/06/…
Moszeed retweeted
‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.
The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.
Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.
The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.
Result: the next time anyone runs that program, it lets the attacker in as root.
What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.
Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.
The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.
This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root
Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure
Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true
For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...
Moszeed retweeted
IT'S NOT JUST A COMMAND. MICROSOFT SHIPPED SOMETHING WINDOWS DEVELOPERS HAVE NEEDED FOR YEARS
sudo natively, on windows
no more closing your terminal and relaunching as admin just to run one command
it's built into windows 11...written in rust & it actually ships in the os, not as a third-party workaround
the caveat..? it's not a linux sudo port different OS, different permission model...
Some unix scripts won't transfer directly
but for 95% of day-to-day dev tasks, this is the fix windows has needed for years
enable it:
settings → developer features → sudo for windows
→ github.com/microsoft/sudo
