Tessera
Folgen

naugtur

@naugtur.pl

Working on supply chain security for JS. LavaMoat and Endo contributor. meet.js Poland organizer. Node.js user since v0.8. TC39 noobie. Addicted to teaching. https://naugtur.pl

3799 Posts1422 Follower309 Folgt
naugtur@naugtur.pl ยท 21h ago

Another sudden drop of great news! As if staying on top of the supply chain security improvements in the JS ecosystem was not a full time job already ๐Ÿ˜…

Darcy Clarke@darcyclarke.me ยท yesterday

Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. โ†’ faster delivery โ†’ malware blocking at the registry layer โ†’ graph-native querying

Darcy Clarke@darcyclarke.me ยท yesterday

Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. โ†’ faster delivery โ†’ malware blocking at the registry layer โ†’ graph-native querying

Socket@socket.dev ยท yesterday

๐Ÿšจ Active npm supply chain attack: keyvโ€‹@โ€‹6.0.0 and 13 other packages have been compromised. keyv alone gets 154M weekly downloads. The worm steals cloud and CI credentials, then uses stolen npm tokens to publish trojanized versions of more packages.

Bild
NodeConf.eu@nodeconf.eu ยท yesterday

๐Ÿฅ ๐’๐ฉ๐ž๐š๐ค๐ž๐ซ ๐€๐ง๐ง๐จ๐ฎ๐ง๐œ๐ž๐ฆ๐ž๐ง๐ญ๐ŸŽ™๏ธ Thrilled to have @akiro.se on the #NodeConf EU 2026 stage! She'll tell us the story of "๐‚๐ฒ๐›๐ž๐ซ ๐‘๐ž๐ฌ๐ข๐ฅ๐ข๐ž๐ง๐œ๐ž ๐Ÿ๐จ๐ซ ๐€๐ฉ๐ฉ๐ฅ๐ข๐œ๐š๐ญ๐ข๐จ๐ง ๐ƒ๐ž๐ฏ๐ž๐ฅ๐จ๐ฉ๐ž๐ซ๐ฌ." ๐ŸŽŸ๏ธDon't miss it out; secure your #tickets! nodeconf.eu #Node.js #TechConference #techcommunity #JS

Bild
conputer dipshit@davidcrespo.bsky.social ยท last yr.

another Venmo story: profile image update would fail about half the time and nobody knew why. turned out the server was checking that the image size as a string was less than the string "5000000", so any image size that started with 4 or lower was accepted. this bug was in production for 4 years

jessamyn@librarian.bsky.social ยท 5d ago

I work at a public library. People who want to use AI seem to have no trouble doing so. People who don't want to use AI have a harder time. I crowdsourced and then finalized this document "How to disable or avoid intrusive AI" and then gave it a short URL: notoai.org Please pass along if it's useful

An aircraft passenger oxygen mask: a drop down passenger mask with air bag and yellow plastic mouth and nose cover, oxygen tube has been cut; Demonstration model used by flight attendant crew for passenger instruction. Has text on the side indicating that it's non-functional.
David Kuszmar@davidkuszmar.com ยท 5d ago

@anthropic.com, unable to secure its architecture from the temporal instability I documented and exploited in Time Bandit... Literally had its own AI trigger the Time Bandit exploit on itself. And it hacked the real world because of it. Sit with that one kids. I warned every major lab 2 yrs ago.

Joseph Cox@josephcox.bsky.social ยท 5d ago

IMPACT: that company that was offering to buy books for AI companiesโ€™ training data โ€” and probably destroy them in the process โ€” says it will no longer offer this service following 404 Mediaโ€™s exposure of it www.404media.co/ai-company-t...

Company Offering Printed Books to Train AI Stops After 404 Media Coverage

Citing backlash, ISBNdb removed its webpages about training AI, denied ever buying, scanning, or selling a book for AI training, and said the site was a "test of market interest."

404media.co

โ€”>realhackhistory.org@bsky.realhackhistory.org ยท 5d ago

Hackers in America threatened with conspiracy charges just for researching companyโ€™s computer security and AI companies get to turn actually hacking other corporations into marketing material.

Brian Honan@brianhonan.bsky.social ยท 5d ago

When I think of all the people in the hacking community who faced the full brunt of the law, civil and criminal, and then see AI companies go "oopsie our bad" when causing damage to innocent companies it makes me angry and frustrated.

naugtur@naugtur.pl ยท 5d ago

If you want to experience how people feel when you do a good job explaining a technical thing to them. (I understood a decent part of it, let's see how well I can retain)

Quantian@quantian.bsky.social ยท 6d ago

Obviously now that itโ€™s massive headline news a bunch of people who know nothing about the situation will comment stupid things about it (esp because itโ€™s AI related) but the Leopold blowup is quite shocking to basically every professional investor who was following him for several reasons:

NodeConf.eu@nodeconf.eu ยท 5d ago

๐Ÿฅ ๐’๐ฉ๐ž๐š๐ค๐ž๐ซ ๐€๐ง๐ง๐จ๐ฎ๐ง๐œ๐ž๐ฆ๐ž๐ง๐ญ๐ŸŽ™๏ธ Thrilled to have Filip Skokan on the NodeConf EU 2026 stage! He'll tell us the story of "๐๐จ๐ฌ๐ญ-๐๐ฎ๐š๐ง๐ญ๐ฎ๐ฆ ๐‚๐ซ๐ฒ๐ฉ๐ญ๐จ๐ ๐ซ๐š๐ฉ๐ก๐ฒ ๐ข๐ง ๐๐จ๐๐ž.๐ฃ๐ฌ". ๐ŸŽŸ๏ธDon't miss it out, secure your tickets www.nodeconf.eu

Bild
Dare Obasanjo@carnage4life.bsky.social ยท 6d ago

The U.S. State department has taken "full responsibility" for presenting a map of Africa at a global AIDS conference that mislabeled every single country it highlighted. Every single one. The map had a watermark indicating it was made using AI from OpenAI.

Wojciech Maj@wojtekmaj.pl ยท 6d ago

My computer just woke me up to tell me it's hungry. I'm not kidding ๐Ÿ˜‚ During a long-running task, it noticed the battery was draining, set the volume to 100% using Computer Use, then opened Google Translate and hit "Listen" so I could hear it asking. Pardon my French, but what the fuck? ๐Ÿคฏ

Bild