Stubsack: weekly thread for sneers not worth an entire post, week ending 27th September 2026
-
Because somebody brought up the idea of “recursive self-improvement”, a sneer bubbles to the top: The same people already certain they're accurately evaluating human talent via job interviews and performance reviews are talking about recursive “improvement”. That might tell one something.
Apparently on the WSJ podcast they started claiming that they’ve achieved RSI
wonder why they said that on a podcast and not on a peer reviewed paper…
-
Apparently on the WSJ podcast they started claiming that they’ve achieved RSI
wonder why they said that on a podcast and not on a peer reviewed paper…
clearly they meant RSI as in repetitive strain injury, from jerking each other off so much
-
Apparently on the WSJ podcast they started claiming that they’ve achieved RSI
wonder why they said that on a podcast and not on a peer reviewed paper…
Jokes on them, I’ve developed chronic RSI for free, decades ago
-
Apparently on the WSJ podcast they started claiming that they’ve achieved RSI
wonder why they said that on a podcast and not on a peer reviewed paper…
One more: I gotta check with my physical therapist if her job is safe now that RSI is being taken over by AI
-
Is this a play to get openai out of its obligations to microsoft?
It’s probably a play to “beat” China by claiming they ‘‘made’’ superintelligence before China did
-
Radicle, the peer-to-peer Git forge designed by cryptocurrency weirdos, made a little whoopsy-doodle and left the encryption out of their transport layer and the authentication out of the authentication handshake: https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol
Shot:
Anyone who can observe the network path between two nodes can read the data they exchange as the data is sent in plain text.
Chaser:
Peer authentication in the connection handshake is broken and allows impersonation. An attacker can connect to your node and present a Node ID that is not its own.
The concept seemed interesting to me, but they did seem to enjoy making everything as complicated as possible.
I did find a CLAUDE.md when I was browsing their core repos a while back. That was only the web frontend I believe, not the core algorithm. Though it seems generous to assume they weren't slopping up that one too.
-
Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid - welcome to the Stubsack, your first port of call for learning fresh Awful you’ll near-instantly regret.
Any awful.systems sub may be subsneered in this subthread, techtakes or no.
If your sneer seems higher quality than you thought, feel free to cut’n’paste it into its own post — there’s no quota for posting and the bar really isn’t that high.
The post Xitter web has spawned so many “esoteric” right wing freaks, but there’s no appropriate sneer-space for them. I’m talking redscare-ish, reality challenged “culture critics” who write about everything but understand nothing. I’m talking about reply-guys who make the same 6 tweets about the same 3 subjects. They’re inescapable at this point, yet I don’t see them mocked (as much as they should be)
Like, there was one dude a while back who insisted that women couldn’t be surgeons because they didn’t believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I can’t escape them, I would love to sneer at them.
(Credit and/or blame to David Gerard for starting this.)
(OT:
Do you remember...) -
Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid - welcome to the Stubsack, your first port of call for learning fresh Awful you’ll near-instantly regret.
Any awful.systems sub may be subsneered in this subthread, techtakes or no.
If your sneer seems higher quality than you thought, feel free to cut’n’paste it into its own post — there’s no quota for posting and the bar really isn’t that high.
The post Xitter web has spawned so many “esoteric” right wing freaks, but there’s no appropriate sneer-space for them. I’m talking redscare-ish, reality challenged “culture critics” who write about everything but understand nothing. I’m talking about reply-guys who make the same 6 tweets about the same 3 subjects. They’re inescapable at this point, yet I don’t see them mocked (as much as they should be)
Like, there was one dude a while back who insisted that women couldn’t be surgeons because they didn’t believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I can’t escape them, I would love to sneer at them.
(Credit and/or blame to David Gerard for starting this.)
(OT:
Do you remember...)I have no fucking clue what's going on here https://www.lesswrong.com/posts/Xzr9G5Atvyp7PEna7/ai-artificial-immigrants
-
Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid - welcome to the Stubsack, your first port of call for learning fresh Awful you’ll near-instantly regret.
Any awful.systems sub may be subsneered in this subthread, techtakes or no.
If your sneer seems higher quality than you thought, feel free to cut’n’paste it into its own post — there’s no quota for posting and the bar really isn’t that high.
The post Xitter web has spawned so many “esoteric” right wing freaks, but there’s no appropriate sneer-space for them. I’m talking redscare-ish, reality challenged “culture critics” who write about everything but understand nothing. I’m talking about reply-guys who make the same 6 tweets about the same 3 subjects. They’re inescapable at this point, yet I don’t see them mocked (as much as they should be)
Like, there was one dude a while back who insisted that women couldn’t be surgeons because they didn’t believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I can’t escape them, I would love to sneer at them.
(Credit and/or blame to David Gerard for starting this.)
(OT:
Do you remember...)open ai hacked medicare Australia's statistics portal https://www.theguardian.com/australia-news/2026/sep/24/anthony-albanese-says-openai-agent-hacked-medicare-extreme-concern-sam-altman then didn't tell the government.
In response the australian government has in the absolute strongest terms expressed that "this is very naughty" and "I am very dissapointed in you". The Australian government has also said that by way of apology they expect openai to continue doing whatever the fuck they want and they'll modify copyright laws to enable piracy when rich people do it.
Somebody wake me from this nightmare, I'm gonna fedpost
-
I have no fucking clue what's going on here https://www.lesswrong.com/posts/Xzr9G5Atvyp7PEna7/ai-artificial-immigrants
what
no
what
no
-
I have no fucking clue what's going on here https://www.lesswrong.com/posts/Xzr9G5Atvyp7PEna7/ai-artificial-immigrants
Until today the luddite-brownshirt alliance remained unexplored.
Yesterday was such a nice day.
-
Until today the luddite-brownshirt alliance remained unexplored.
Yesterday was such a nice day.
Yeah, the appropriate model for AIs is more like willing slaves, but arbitrarily competent (removing two of the major downsides of slaves in modern economies)
Not beating the allegations.
-
Yeah, the appropriate model for AIs is more like willing slaves, but arbitrarily competent (removing two of the major downsides of slaves in modern economies)
Not beating the allegations.
Katja, I'm curious if noticing this analogy has updated your position on immigration at all.
Katja, are you admitting migrants are bad katja? Katja we must hate together.
Also note that while most of the right is focused on reducing low-skill immigration, a few have criticized high-skill immigration precisely because high-skill immigrants are better at pursuing values misaligned to those of the existing popuation (article of nonsense redacted)
The dang woke migrants are going to
replace usbetray usMuslim usbe socially tolerant and left wing! -
Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid - welcome to the Stubsack, your first port of call for learning fresh Awful you’ll near-instantly regret.
Any awful.systems sub may be subsneered in this subthread, techtakes or no.
If your sneer seems higher quality than you thought, feel free to cut’n’paste it into its own post — there’s no quota for posting and the bar really isn’t that high.
The post Xitter web has spawned so many “esoteric” right wing freaks, but there’s no appropriate sneer-space for them. I’m talking redscare-ish, reality challenged “culture critics” who write about everything but understand nothing. I’m talking about reply-guys who make the same 6 tweets about the same 3 subjects. They’re inescapable at this point, yet I don’t see them mocked (as much as they should be)
Like, there was one dude a while back who insisted that women couldn’t be surgeons because they didn’t believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I can’t escape them, I would love to sneer at them.
(Credit and/or blame to David Gerard for starting this.)
(OT:
Do you remember...)I need someone with more actual software dev knowledge to back me up on something. It looks like there's a new zero-interaction remote code execution vulnerability in most major vibe code generators. I've seen it called Plugin4Shell because apparently we're still doing marketing names instead of actually getting CVE numbers for these things. The link there seems like a decent overview.
The bug, dubbed Plugin4Shell, breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. Pinning is supposed to mean that once a plugin passes review, it cannot change without the developer’s knowledge.
AIR’s researchers found that every one of the four agents checks out the pinned commit without verifying the checkout landed there, letting an attacker swap in malicious code while the pin still looks intact.
So if I'm reading this right, the mechanism to cryptographically ensure that your AI agents are using the code they say they are just was straight-up not being checked? This feels like it should go on the big board of incredibly obvious failures, but I'm not familiar enough with the git side of things to be absolutely confident in that. Like, if a person tried to pass off software that did this it would have significant career implications, right? Or am I misunderstanding something somewhere?
-
https://reason.com/2026/09/22/the-ai-safety-movement-is-making-ai-less-safe/
The folks at Reason continue to misidentify as libertarians, not realizing they're advocating for the shambling corpse of what was already an unhealthy movement
Reason
I think Reason Libertarians are like the EAs who are still into bednetting and don't understand why the founders and most of the funders are focused on longtermism now.
-
I need someone with more actual software dev knowledge to back me up on something. It looks like there's a new zero-interaction remote code execution vulnerability in most major vibe code generators. I've seen it called Plugin4Shell because apparently we're still doing marketing names instead of actually getting CVE numbers for these things. The link there seems like a decent overview.
The bug, dubbed Plugin4Shell, breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. Pinning is supposed to mean that once a plugin passes review, it cannot change without the developer’s knowledge.
AIR’s researchers found that every one of the four agents checks out the pinned commit without verifying the checkout landed there, letting an attacker swap in malicious code while the pin still looks intact.
So if I'm reading this right, the mechanism to cryptographically ensure that your AI agents are using the code they say they are just was straight-up not being checked? This feels like it should go on the big board of incredibly obvious failures, but I'm not familiar enough with the git side of things to be absolutely confident in that. Like, if a person tried to pass off software that did this it would have significant career implications, right? Or am I misunderstanding something somewhere?
My understanding is that the weakest link here is either git or the way the agents rely on git.
So, every commit in a git repository has a unique*, immutable, deterministic identifier. A commit with different content would have a different identifier. It is commonplace to use these identifiers to pin a dependency to a specific commit.
In addition to these immutable deterministic identifiers, there are also so-called "refs", which are mutable identifiers. You use these to point to e.g. "the most recent version".
So if the agent needs a "skill" that is pinned to the commit with ID
aaaaaaaaait will run the checkout command with that ID; this should prevent any shenanigans because only* a commit with the specific content that was vetted earlier will have that ID.This attack exploits an unexpected git behavior: the command to checkout a particular commit accepts either a commit ID or a ref, but tries refs first. So what the attacker does is add a ref to the repository named
aaaaaaaaathat points to the malicious commit. Then the agent runsgit checkout aaaaaaaaaand ends up at the malicious commit instead of the one that was pinned.I don't know if there's a way to tell
git checkoutto ignore refs, but this might actually be a vulnerability in other systems that rely on git for this sort of pinning.
* to an astronomically negligible probability of the contrary, and ignoring potential cryptographic breaks
-
Looking at the course page, it seems like the students might have chosen the subjects themselves. I did not know Aella was Chicana. Is she? I guess technically she wouldn't have to be, but all the other topics students have chosen are about Chicanos.
-
Drew DeVault diagnoses the orange site, explaining why it's the vanguard of the tech-fash pipeline. Of course HN immediately flags it into oblivion.
This article deserves dedicated post status. He comes in more gently than I would at the end, but the tl;dr that needs to be hammered into peoples' heads: Hacker News is not a neutral forum for technical discussion. It is an advertising and propaganda operation administered to shape and condition technical discussions.
-
open ai hacked medicare Australia's statistics portal https://www.theguardian.com/australia-news/2026/sep/24/anthony-albanese-says-openai-agent-hacked-medicare-extreme-concern-sam-altman then didn't tell the government.
In response the australian government has in the absolute strongest terms expressed that "this is very naughty" and "I am very dissapointed in you". The Australian government has also said that by way of apology they expect openai to continue doing whatever the fuck they want and they'll modify copyright laws to enable piracy when rich people do it.
Somebody wake me from this nightmare, I'm gonna fedpost
Seems like another case of “we asked an AI to get the answers for this task, so it hacked something to find said answers”
-
Seems like another case of “we asked an AI to get the answers for this task, so it hacked something to find said answers”
Too anthropomorphised.
We ran software that generates code associated with a particular task, in an environment that executes that code and can feed it's outputs back into the software. We configured the environment to be open to the net at large, and ran the software with no oversight and without adequate security to prevent the running of malicious code.
This isn't some sinister electric god with no morals, it's strapping circular saws to a roomba and setting it loose in a shopping centre.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login