It's important to keep in mind that very, very few projects are as rigorously tested as curl, so while it's interesting to hear this feedback I think curl would be a torture test for any security scanning. I'd be more interested to hear about other random libraries that aren't as thoroughly analyzed as curl; show me some results for GnuTLS, for example, or dpkg/rpm/apt/dnf/pacman/etc.

I think one of the points of TFA was that other AI tools found many vulnerabilities; after having fixed those, mythos did find another vulnerability the others missed, but that seems to imply this model is only marginally better than the competition instead of being on a different league altogether like it's marketed. Paraphrasing the author: sure mythos will find lots of security issues in gnutls, but so will gpt or opus (they acknowledge explicitly that all those tools are getting very good).

The reason cited for this whole fiasco is that some of the Ministry of Defense's genocide work could be performed by servers in the EU, which could expose Microsoft to legal or regulatory issues.

It's not that Microsoft was against this, it's that Microsoft was against themselves getting in trouble for this with the EU.

Well they did put in their contracts with the Israeli government that their services can't be used for mass surveilance which makes them slightly less evil than Google/Amazon.

Allowed 'unethical' usage of Azure services by the Ministry of Defense

(...to occur on servers in the European Union, where Microsoft could get in trouble for it)

Not sure what specifically they're referring to, but Android (and iOS) add a lot of sandboxing to ensure that each application can only access its own files, can't access hardware willy-nilly (bluetooth, scanning wifi, etc), can only link against certain libraries, etc.

Imagine if Linux only let you run stuff from Flatpak, and if stuff didn't work in Flatpak then too bad for you. Most Linux users would hate it and it would be a mess a lot of the time, so, for user experience (UX) reasons, they don't do it. Android can get away with it because that's been the app paradigm for decades now.

The patch was posted to the kernel mailing list; someone saw the e-mail, read the patch, figured it out, and published an exploit very soon after.

Just FYI, you can also mitigate it with `echo 1 > ...`; you don't need to drop everything, dropping `1` clears the page cache and that's enough.

Tested locally on Ubuntu 26.04:

1. Ran the exploit and got root

2. Configured the mitigations

3. Ran `su` again with no parameters and immediately got root again unprompted

4. Cleared the page cache

5. `su` asked for a password

It seems as though this issue occurred to him, then he used their tool ("Xint Code") to analyze the codebase for instances of it.

Running a web browser _with a local AI model_ is likely something that most users are not aiming for. This is extra disk and bandwidth for something that benefits Google but does nothing for the average user.

And most users won't know and don't care. Doesn't make it right, or good, but it is true.

Given that the US is the only country in recent memory whose politics have shifted from "pretty normal for a western nation" to "unpredictable rogue state", it's not as though the list of "countries to avoid" changes that often.

Countries like Russia, Iran, and China have been very consistent in their philosophies and actions; countries like France, the UK, and Japan have also been pretty consistent. The only real change lately is the US.

On a similar note:

There was a period post-Brexit when I hadn't moved away from Ireland yet during which I also did my best to avoid UK produced goods too.

Now that was a lot harder though due to the UK still being in the single market at the time, and on top of that just how integrated supply chains between the north and the rest of Ireland are.

I'm cautiously optimistic that the UK is moving back toward sanity though.

There's a McDonald's near my home that I can order from if I'm craving garbage food quickly and don't feel well enough to leave the house, but they only get my order correct about 20% of the time. Another 20% of the time they make the wrong thing (e.g. the wrong kind of breakfast sandwich), and the remaining 60% of the time they forget to put half the order in (e.g. we ordered three of the Minecraft happy meal cube things a while back, plus an extra chicken sandwich, and we only got two of the cubes and no sandwich, plus we were missing two of the drinks for the meals).

The tariff issue is another reason not to patronize them, but at the same time if everyone in Canada stopped eating at McDonald's then McDonald's corporation would take a hit and thousands of Canadians would be immediately unemployed and thousands of Canadian suppliers of ingredients (beef, eggs, chicken, vegetables, etc) would lose a ton of business, so while I'd rather order from A&W for dozens of reasons I'm not outright boycotting American chains the way I am with American products.

I’ve actually switched from Just Eat to slightly more expensive Deliveroo because the latter one makes it extremely easy (at least in the UK) to report wrong deliveries and you get your money back in a matter of minutes. Also make sure to do the McD survey via the link on the receipt - that usually improves things for a while.