Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid - welcome to the Stubsack, your first port of call for learning fresh Awful you’ll near-instantly regret.

Any awful.systems sub may be subsneered in this subthread, techtakes or no.

If your sneer seems higher quality than you thought, feel free to cut’n’paste it into its own post — there’s no quota for posting and the bar really isn’t that high.

The post Xitter web has spawned so many “esoteric” right wing freaks, but there’s no appropriate sneer-space for them. I’m talking redscare-ish, reality challenged “culture critics” who write about everything but understand nothing. I’m talking about reply-guys who make the same 6 tweets about the same 3 subjects. They’re inescapable at this point, yet I don’t see them mocked (as much as they should be)

Like, there was one dude a while back who insisted that women couldn’t be surgeons because they didn’t believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I can’t escape them, I would love to sneer at them.

(Credit and/or blame to David Gerard for starting this.)

(OT: 🎶 Do you remember…)

  • mirrorwitch@awful.systemsEnglish
    4·
    5 hours ago

    Just heard about tic-80 falling to slop.

    After reading the obligatory forum thread where climate justice and concentration of wealth continue to not even factor into consideration, this how the world of open source feels to me these days:

    • Phew, my favourite embroidery crafts shop has a clear policy against concentration camp labour! it’s a niche project but what a relief!
    • Well everyone is resorting to concentration camp labour these days, what can you do
    • We don’t want to lose all our contributors by banning those who hire concentration camp inmates to do chores
    • It is discriminatory against embroidery beginners if you don’t let people use kits assembled with concentration camp labour
    • I know concentration camp labour often comes with mistakes but as long as there’s a mensch in the loop to inspect it for errors and take responsibility, it’s just another tool
    • The community of hobbysts has come to a vote and concluded that it’s ok to use concentration camp labour to assist your crafting, as long as you do it responsibly.
  • schnoopy@awful.systemsEnglish
    7·
    15 hours ago

    open ai hacked medicare Australia’s statistics portal https://www.theguardian.com/australia-news/2026/sep/24/anthony-albanese-says-openai-agent-hacked-medicare-extreme-concern-sam-altman then didn’t tell the government.

    In response the australian government has in the absolute strongest terms expressed that “this is very naughty” and “I am very dissapointed in you”. The Australian government has also said that by way of apology they expect openai to continue doing whatever the fuck they want and they’ll modify copyright laws to enable piracy when rich people do it.

    Somebody wake me from this nightmare, I’m gonna fedpost

    • lurker@awful.systemsEnglish
      3·
      10 hours ago

      Seems like another case of “we asked an AI to get the answers for this task, so it hacked something to find said answers”

      • schnoopy@awful.systemsEnglish
        9·
        7 hours ago

        Too anthropomorphised.

        We ran software that generates code associated with a particular task, in an environment that executes that code and can feed it’s outputs back into the software. We configured the environment to be open to the net at large, and ran the software with no oversight and without adequate security to prevent the running of malicious code.

        This isn’t some sinister electric god with no morals, it’s strapping circular saws to a roomba and setting it loose in a shopping centre.

    • istewart@awful.systemsEnglish
      6·
      10 hours ago

      This article deserves dedicated post status. He comes in more gently than I would at the end, but the tl;dr that needs to be hammered into peoples’ heads: Hacker News is not a neutral forum for technical discussion. It is an advertising and propaganda operation administered to shape and condition technical discussions.

  • YourNetworkIsHaunted@awful.systemsEnglish
    3·
    14 hours ago

    I need someone with more actual software dev knowledge to back me up on something. It looks like there’s a new zero-interaction remote code execution vulnerability in most major vibe code generators. I’ve seen it called Plugin4Shell because apparently we’re still doing marketing names instead of actually getting CVE numbers for these things. The link there seems like a decent overview.

    The bug, dubbed Plugin4Shell, breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. Pinning is supposed to mean that once a plugin passes review, it cannot change without the developer’s knowledge.

    AIR’s researchers found that every one of the four agents checks out the pinned commit without verifying the checkout landed there, letting an attacker swap in malicious code while the pin still looks intact.

    So if I’m reading this right, the mechanism to cryptographically ensure that your AI agents are using the code they say they are just was straight-up not being checked? This feels like it should go on the big board of incredibly obvious failures, but I’m not familiar enough with the git side of things to be absolutely confident in that. Like, if a person tried to pass off software that did this it would have significant career implications, right? Or am I misunderstanding something somewhere?

    • Sailor Sega Saturn@awful.systemsEnglish
      2·
      6 hours ago

      Like, if a person tried to pass off software that did this it would have significant career implications, right?

      Typically no.

      The space of incredibly obvious failures is vast, and this kind of plumbing code isn’t always written by someone who’s been around the block enough times to think about what kinds of things can go wrong. I’ve written worse code when I had only a few years of experience.

      However companies should know this; so ideally the tool would have gone through a launch review which should have kicked off a security review where a security expert should have read about the git checkout in the design document and started asking questions like “what happens if the repository is taken over” or “why are hashes and branches and tags all in the same field”?

      Of course security experts who think about stuff like supply chain attacks are expensive and slow down the darling vibe-coding workflows of Silicon Valley so…

      Aside: even without this particular vulnerability, SHA-1 is considered weak – https://git-scm.com/docs/hash-function-transition, so that should have been thought about as well. Dear supply-chain attackers: maybe there’s still a hole here! Good luck!

    • rmf@awful.systemsEnglish
      4·
      10 hours ago

      My understanding is that the weakest link here is either git or the way the agents rely on git.

      So, every commit in a git repository has a unique*, immutable, deterministic identifier. A commit with different content would have a different identifier. It is commonplace to use these identifiers to pin a dependency to a specific commit.

      In addition to these immutable deterministic identifiers, there are also so-called “refs”, which are mutable identifiers. You use these to point to e.g. “the most recent version”.

      So if the agent needs a “skill” that is pinned to the commit with ID aaaaaaaaa it will run the checkout command with that ID; this should prevent any shenanigans because only* a commit with the specific content that was vetted earlier will have that ID.

      This attack exploits an unexpected git behavior: the command to checkout a particular commit accepts either a commit ID or a ref, but tries refs first. So what the attacker does is add a ref to the repository named aaaaaaaaa that points to the malicious commit. Then the agent runs git checkout aaaaaaaaa and ends up at the malicious commit instead of the one that was pinned.

      I don’t know if there’s a way to tell git checkout to ignore refs, but this might actually be a vulnerability in other systems that rely on git for this sort of pinning.

      * to an astronomically negligible probability of the contrary, and ignoring potential cryptographic breaks

      • gerikson@awful.systemsEnglish
        1·
        6 hours ago

        This is a plausible explanation, but I am surprised that this git behavior is not more well-known as there have been multiple discussion about “supply-chain attacks” even before LLMs became widespread.

        • rmf@awful.systemsEnglish
          1·
          5 minutes ago

          Fwiw a similar problem is well-known in e.g. GitHub Actions even without this confusion.

          You can have your GHA scripts use “actions” written by other people, and the way you refer to them is user/repo@commit, where the commit can be a commit ID or a branch name or a tag name. The docs actually recommend pinning to commit IDs, but in practice most people actually pin to tags, like bob/doit@v1 because that will auto-update if bob fixes some bug and updates v1 to point to that. But if bob goes rogue, or gets compromised, the attacker could change the tag v1 to point to a malicious commit, though, hence the recommendation to use commit IDs for all actions that you didn’t write yourself. I don’t know if this ref/ID confusion can be exploited on GHA, but I would expect the answer is no, because GitHub Actions doesn’t launch git shell commands like a savage, but idk

    • fnix@awful.systemsEnglish
      2·
      4 hours ago

      Variation on a theme, I recall the complaints over the ostracism LLM-users face online as being just like the marginalization faced by black people. Waaaah!

    • schnoopy@awful.systemsEnglish
      4·
      15 hours ago

      Until today the luddite-brownshirt alliance remained unexplored.

      Yesterday was such a nice day.

      • schnoopy@awful.systemsEnglish
        6·
        15 hours ago

        Yeah, the appropriate model for AIs is more like willing slaves, but arbitrarily competent (removing two of the major downsides of slaves in modern economies)

        Not beating the allegations.

        • schnoopy@awful.systemsEnglish
          10·
          15 hours ago

          Katja, I’m curious if noticing this analogy has updated your position on immigration at all.

          Katja, are you admitting migrants are bad katja? Katja we must hate together.

          Also note that while most of the right is focused on reducing low-skill immigration, a few have criticized high-skill immigration precisely because high-skill immigrants are better at pursuing values misaligned to those of the existing popuation (article of nonsense redacted)

          The dang woke migrants are going to replace us betray us Muslim us be socially tolerant and left wing!

    • maol@awful.systemsEnglish
      2·
      10 hours ago

      Looking at the course page, it seems like the students might have chosen the subjects themselves. I did not know Aella was Chicana. Is she? I guess technically she wouldn’t have to be, but all the other topics students have chosen are about Chicanos.

  • flowerysong@awful.systemsEnglish
    7·
    19 hours ago

    Radicle, the peer-to-peer Git forge designed by cryptocurrency weirdos, made a little whoopsy-doodle and left the encryption out of their transport layer and the authentication out of the authentication handshake: https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol

    Shot:

    Anyone who can observe the network path between two nodes can read the data they exchange as the data is sent in plain text.

    Chaser:

    Peer authentication in the connection handshake is broken and allows impersonation. An attacker can connect to your node and present a Node ID that is not its own.

    • jaschop@awful.systemsEnglish
      2·
      16 hours ago

      The concept seemed interesting to me, but they did seem to enjoy making everything as complicated as possible.

      I did find a CLAUDE.md when I was browsing their core repos a while back. That was only the web frontend I believe, not the core algorithm. Though it seems generous to assume they weren’t slopping up that one too.

      • CinnasVerses@awful.systemsEnglish
        4·
        11 hours ago

        Reason

        I think Reason Libertarians are like the EAs who are still into bednetting and don’t understand why the founders and most of the funders are focused on longtermism now.

        • fnix@awful.systemsEnglish
          1·
          4 hours ago

          I mean motivated & cowardly ignorance has been a staple of liberal-conservatism for I don’t know however long. I support cutting (my) taxes and increasing (my) liberty – oh dear, why are some people suddenly poor and trampled upon? I would NEVER! This is just so horrible for me, I just need another tax cut right now. Have the poors tried eating cake?

  • antifuchs@awful.systemsEnglish
    4·
    19 hours ago

    Because somebody brought up the idea of “recursive self-improvement”, a sneer bubbles to the top: The same people already certain they’re accurately evaluating human talent via job interviews and performance reviews are talking about recursive “improvement”. That might tell one something.

    • lurker@awful.systemsEnglish
      4·
      18 hours ago

      Apparently on the WSJ podcast they started claiming that they’ve achieved RSI

      wonder why they said that on a podcast and not on a peer reviewed paper…

    • fnix@awful.systemsEnglish
      1·
      4 hours ago

      Prepare to be tortured for an eternity by Scotty. No wait, that’s an unholy image.

    • BlueMonday1984@awful.systemsOPEnglish
      2·
      22 hours ago

      Looks to be a spinoff of the red-top tabloid the Daily Star. So, hardly a solid source of info.

      Still, good to show what kinda shit LLMs spew out on a constant basis

  • gerikson@awful.systemsEnglish
    9·
    2 days ago

    Zvi “I made my chops playing pro MtG” Moskovitz discovers that baldly stating that AI will kill us all fails to convince people who have a lot of money riding on the status quo, and freaks out about it

    https://www.lesswrong.com/posts/8eDaCvSRzzKCxKSEk/politics-gets-interested-in-those-trying-not-to-die

    New York Post gets way more attention than that rag deserves, tbh

    You wanna dance with Murdoch Sacks and Trump, you best bring your A game. Maybe use some of that FTX cash to hire some real lobbyists and skip the blogging.

    • EFreethought@awful.systemsEnglish
      2·
      2 hours ago

      It is shocking that there are a lot of smart people unable to find work, yet rich people throw money at this guy.

    • BioMan@awful.systemsEnglish
      8·
      1 day ago

      It is claiming that Yud is wrong in saying Doom before Massive AI-Caused Economic Boom boosts GDP growth above 5% by saying the boom is here.

      Nah.

      This is totally from some accelerationist or oligarch-toadie beefing with someone harshing their vibe

      • TinyTimmyTokyo@awful.systemsEnglish
        4·
        18 hours ago

        I think you’re probably right. I originally thought it must have been created by a rationalist, but an e/acc author makes more sense. After all, most of them are postrationalists.

    • TinyTimmyTokyo@awful.systemsEnglish
      7·
      1 day ago

      Despite the fact that it highlights all the times Yudkowsky was wrong, this site feels like it could have been produced by a rationalist. In addition to all the AI slop, it just has that feel.

      • scruiser@awful.systemsEnglish
        8·
        1 day ago

        it just has that feel.

        yeah. Looking past the initial quiz, a lot of the complaints about Eliezer’s predictions feel like rationalist inside-baseball about takeoff speeds and alignment strategies, as opposed to calling the whole thing bunk.

    • istewart@awful.systemsEnglish
      5·
      1 day ago

      Damn, who knew this would yield material for my boy-band cover/parody project. Foom flop, doo wop wop wop…

    • scruiser@awful.systemsEnglish
      4·
      1 day ago

      Wow… I actually failed to get some of the times Eliezer has been wrong! His predictions are even worse than I remembered!

    • BlueMonday1984@awful.systemsOPEnglish
      16·
      2 days ago

      And not just from AI getting fed into the AI:

      404 Media spoke to a fourth contractor who has worked on training models for various AI companies. They said they sometimes purposefully chose the worst responses because they wanted to actively sabotage the models’ training.

      “I did feel guilty about doing this kind of work at the start,” they said. “I either pay zero attention to the results and choose randomly or purposely choose the [worst] output. I’m not sure how much of a difference it actually makes since there are hundreds of other people also rating prompt results, but it does feel like I’m getting paid to make AI worse.”

  • CinnasVerses@awful.systemsEnglish
    11·
    2 days ago

    Just in case you thought Yud’s attitude towards minors, sex, and substance use was worse than average for a Rationalist, the NYT asked around (archive):

    Parties featuring psychedelic drugs and sharing of sexual partners are common, the people said. One house threw lavish events for the A.I. community so often that its owner claimed more than $200,000 of damage, including for a rodent infestation. … The (Genesis) house (in San Francisco) quickly became a hub for events. Eric Zhu, 19, a tech entrepreneur, said he used to sneak into parties there when he was about 13. No one checked anyone’s age, he said, and “it was pretty crazy.”

    They saw a police report where a woman says she had to climb a gate at one of these parties to escape a man who demanded she have sex with him. Sounds like a great environment for a seventh-grader!

    Also features “Jimmy Chen, who goes by the social media handle ‘Spice King of Zanzibar.’”

      • CinnasVerses@awful.systemsEnglish
        5·
        2 days ago

        Copying what other people tell you should like is not a good strategy whether the others are high-school bullies or a sex worker slash influencer. One of the bangers at the birthday gangbang found he had more fun making out with a strange woman than giving the birthday girl what she wanted and I hope he explored that.

    • istewart@awful.systemsEnglish
      8·
      2 days ago

      I think it’s a bit under-covered that the weird SF/Bay Area group-house scene has to be symbiotic with the housing shortage in the region. Even in my old hometown of Hayward, all the older 1950s-70s tract-home and mixed-density neighborhoods tend to have cars parked everywhere along the streets where a car could possibly be parked, because all these places that were designed as single-family homes are being used as multi-tenant rentals. I guess one underrated reason to support YIMBY is to strangle your local incipient cults.

      • lurker@awful.systemsEnglish
        2·
        16 hours ago

        It’s probably a play to “beat” China by claiming they ‘‘made’’ superintelligence before China did