Mastodon Feed: Posts

aredridel@kolektiva.social ("Mx. Aria Stewart") wrote:

And with that, with https://spicelabs.io/ (my employer), I can quickly check and see if it's present anywhere in our builds. It's not there.

aredridel@kolektiva.social ("Mx. Aria Stewart") wrote:

The actual compromise file in plain-crypto-js is SHA1 b0e0f12f1be57dc67fa375e860cedd19553c464d

This is the one that will be on-disk in a node_modules directory.

aredridel@kolektiva.social ("Mx. Aria Stewart") wrote:

Looks like Socket has a copy, now to figure out how to download it.

aredridel@kolektiva.social ("Mx. Aria Stewart") wrote:

I really wish that the npmjs security team published the complete list of file hashes of a compromised package in their stub package page that they use when they remove something.

The way we hide compromises so fast when we respond actually makes responding harder.

aredridel@kolektiva.social ("Mx. Aria Stewart") wrote:

I know the plain-crypto-js package's overall SHA1 hash is 07d889e2dadce6f3910dcbc253317d28ca61c766, but that's not actually a thing you'd find on disk in a node_modules directory.

aredridel@kolektiva.social ("Mx. Aria Stewart") wrote:

Anyone have the hashes of the files in the compromised axios and particularly the malicious dependency?

db@social.lol ("David Bushell 🪿") wrote:

seriously, what was i doing before CSS Subgrid, bashing rocks together? once you see a subgrid they're everywhere

Boosted by aredridel@kolektiva.social ("Mx. Aria Stewart"):
cowperthwait@sfba.social ("Jonathan E Cowperthwait") wrote:

npmjs Twitter account to reply, “What can npmjs security team do for you today? Also ✨ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.”

jsonstein@masto.deoan.org ("Jeff Sonstein") wrote:

ugh, I'm guessing somebody screwed the pooch

https://www.nytimes.com/2026/03/29/world/middleeast/us-precision-strike-missile-iran-lamerd.html?rsrc=flt&unlocked%5Farticle%5Fcode=1.XVA.Z0pK.8Z03c2-DjJb7&smid=url-share

Boosted by baldur@toot.cafe ("Baldur Bjarnason"):
mhoye@cosocial.ca wrote:

Baffling morning scroll as axios the publication and axios the npm package are both getting attention for being bad at their jobs.

Boosted by baldur@toot.cafe ("Baldur Bjarnason"):
jasongorman@mastodon.cloud ("Jason Gorman") wrote:

I'm pretty satisfied at this point that the true extent of "AI" use in software development has been massively exaggerated.

Sure, lots of devs are using LLMs. But there seems to be very little advanced use. It's mostly chat window stuff and occasional inline completion, to keep the boss happy.

It is, however, a massive distraction.

dysfun@treehouse.systems ("gaytabase") wrote:

3 days into quitting smoking and i still don't feel healthier.

send praise.

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
mmby wrote:

@lettosprey @soatok even with intact public health services in Europe, people don't get tested regularly because there is social stigma attached - I actually had my doc try to argue me out of it once, asking why I wanted to do that

if people are carried by momentum and the opportunity to be safer is *right there*, it's just great community service

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
afewbugs@social.coop ("Jules she/her") wrote:

RE: https://furry.engineer/@soatok/116321104173678252

Apparently some furry conventions offer STI testing and people are making judgemental memes about it. Whereas as anyone who has ever attended or worse had to arrange a scientific conference will tell you this is something every conference should be offering.

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
wronglang@bayes.club ("Krzysztof Sakrejda") wrote:

@soatok I see we're moving on from forgetting makes and into forgetting the 1990s

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
mees@sunny.garden ("Mees 🔻") wrote:

@tiefling @soatok @hazelnoot you'd have to trust not just them, but also their former partners, and their former partners, etc. That's a lot to ask.

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
lettosprey@tech.lgbt ("Lett Osprey :v_pan: :v_enby: 🍉 :therian:") wrote:

@soatok Furry cons offering HIV testing seems like an indication of broken public health services.

Good on furcons to pick up the slack.

Boosted by jsonstein@masto.deoan.org ("Jeff Sonstein"):
macrumors ("MacRumors.com") wrote:

Ollama Now Runs Faster on Macs Thanks to Apple's MLX Framework https://www.macrumors.com/2026/03/31/ollama-now-runs-faster-apple-silicon-macs/?utm%5Fsource=dlvr.it&utm%5Fmedium=mastodon

soatok@furry.engineer ("Soatok Dreamseeker") wrote:

OpenSSL 3 is so fucking wild (derogatory)

https://github.com/openssl/openssl/issues/30641

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
nlupo@amikejo.xyz ("nLupo :anarchist_flag: :antrans_flag:") wrote:

@soatok Yeah, because "sex bad". All simpleminded prudes are like that. There is nothing wrong with being responsible for the freedom you have, like any adult.

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
karl@infosec.exchange ("Karl") wrote:

@soatok the question is why don't non-furry conventions offer those? This seems like a good idea regardless of fur levels.

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
kirakira@furry.engineer ("kira for scale") wrote:

@soatok genuinely an incredible community resource

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
tiefling@bardicperspiration.club ("Diotima") wrote:

@soatok

This is a good idea and tbh ppl not getting tested is one of the hangups I have w being more active in my spicy life. I test enough to know I am safe, but ppl get weird abt it if I ask them if they do.

"Don't u trust me?" Uhm not anymore.

I see the sign and I think "hey they're doing it right."

I want this at all cons.

@hazelnoot

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
captainbara@meow.social ("Captain Bara") wrote:

@philpem @soatok
Furlingame (this weekend!) is offering HIV and STD testing Friday through Sunday.

https://furlingame.com/

dysfun@treehouse.systems ("gaytabase") wrote:

TFW you just went most-in[1] on the solution they just orphaned https://mastodon.org.uk/@stsquad/116323060040293062

[1] it doesn't sound as good as all-in, does it?

baldur@toot.cafe ("Baldur Bjarnason") wrote:

“[2603.21687] MIRAGE: The Illusion of Visual Understanding”

https://arxiv.org/abs/2603.21687

> Frontier models readily generate detailed image descriptions and elaborate reasoning traces, including pathology-biased clinical findings, for images never provided

And

> Second, without any image input, models also attain strikingly high scores across general and medical multimodal benchmarks, bringing into question their utility and design

Boosted by jwz:
cmconseils ("Lady Laura :bongoCat:") wrote:

By Garis Edelweiss

#Art

Boosted by jwz:
mcmullin@musicians.today ("David McMullin") wrote:

@jrp
Each time you get COVID, maybe nothing bad happens, and maybe you get permanent disabling fatigue or a heart attack or brain damage. The more times you roll the dice, the more the chance of a bad outcome. If I’m wrong, I will have worn a mask and been thought a weirdo for nothing. (That’s what I hope!) But if I’m right, 25 years from now I could be one of the only healthy people of my generation still around.

Boosted by jwz:
inthehands@hachyderm.io ("Paul Cantrell") wrote:

I will once again repeat what I think is a nationally winning campaign for a US opposition party (should any care to exist), now with Berlatsky’s improved phrasing:

❝If elected, I will fight like hell to:

- destroy Donald Trump, everything he has done, and everything he stands for,

- tax the living shit out of billionaires, and

- use that money to repair the damage they’ve done to the US.❞

Not saying that’s everything that needs to happen, or an entire political philosophy, or the solution to everything. Only saying that I think that — simply that — would win elections. Try it and see. You cowards. https://fed.brid.gy/r/https://bsky.app/profile/did:plc:htdsafwakqmzvuk2oivijzn6/post/3midafsxk3k2p

Boosted by jwz:
zzt@mas.to ("[object Object]") wrote:

do you have any bofa

bofa deez factors of authentication!

…this concludes my defcon presentation, I yield my remaining 59 minutes and will not be taking questions at this time