Nostr notes by

I need someone with more actual software dev knowledge to back me ...

2026-09-23T23:24:59Z

In reply to nevent1q…ca9u
_________________________

I need someone with more actual software dev knowledge to back me up on something. It looks like there's a new zero-interaction remote code execution vulnerability in most major vibe code generators. I've seen it called [Plugin4Shell](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/) because apparently we're still doing marketing names instead of actually getting CVE numbers for these things. The link there seems like a decent overview.

>The bug, dubbed Plugin4Shell, breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. Pinning is supposed to mean that once a plugin passes review, it cannot change without the developer’s knowledge.
>
>AIR’s researchers found that every one of the four agents checks out the pinned commit without verifying the checkout landed there, letting an attacker swap in malicious code while the pin still looks intact.

So if I'm reading this right, the mechanism to cryptographically ensure that your AI agents are using the code they say they are just was straight-up not being checked? This feels like it should go on the big board of incredibly obvious failures, but I'm not familiar enough with the git side of things to be absolutely confident in that. Like, if a person tried to pass off software that did this it would have significant career implications, right? Or am I misunderstanding something somewhere?

The problem is less that the system would somehow ignore that ...

2026-05-06T14:48:35Z

In reply to nevent1q…340r
_________________________

The problem is less that the system would somehow ignore that part of the prompt and more that "hallucinate" or "make stuff up" aren't special subroutines that get called on demand when prompted by an idiot, they're descriptive of what an LLM does *all the time*. It's following statistical patterns in a matrix created by the training data and reinforcement processes. Theoretically if the people responsible for that training and reinforcement did their jobs well then those patterns should only include true statements but if it was that easy then you wouldn't have [insert the entire intellectual history of the human species].

Even if you assume that the AI boosters are completely right and that the LLM inference process is directly analogous to how people think, does saying "don't fuck up" actually make people less likely to fuck up? Like, the kind of errors you're looking at here aren't generated by some separate process. Someone who misremembers a fact doesn't know they've misremembered until they get called out on the error either by someone else with a better memory or reality imposing the consequence of being wrong. Similarly the LLM isn't doing anything special when it spits out bullshit.

While there is absolutely a large segment of the Iranian ...

2026-02-24T20:40:12Z

In reply to nevent1q…54vc
_________________________

While there is absolutely a large segment of the Iranian population that isn't satisfied with the theocratic dictatorship, the same could also have been said of Iraqis who didn't like the baathists or Afghans who hate the Taliban. Once you start dropping bombs on these people - to say nothing of the violence that necessarily follows a boots-on-the-ground occupation - you're going to start driving them into the waiting arms of factions that oppose you. Especially because the current administration has shown a less-than-comforting attitude towards civilian casualties, war crimes, and genocide.

Let's also not lose sight of the role that US and British intervention played in creating the circumstances for the Ayatollahs to come to power in the first place. The Shah wasn't exactly any kinder to the Iranian people and was a foreign puppet to boot.

Harris's take only works if, like him, you assume that the fundamental problem with Iran is Islam, rather than actually bothering to look at the history of the country and how it became what it is today. Because in that case once you get the ayatollah out of the way and introduce the light of Science! to the people they'll immediately become rational civil libertarians and believe exactly the same things he does. The Irreligious Right is exactly as reductive and stupid as the worst evangelicals, but can better use the language of STEM to hide it.