They set the parameters to be as weak as possible to work on the Chrome and Firefox at the time, but I think Firefox may have added some extra sensible checks after it was published. I wonder which check it failed.

GPLv3 is boring in this respect, because it lets violators come back into compliance and regain all rights after 60 days.

(I say boring, but this is definitely a good thing. See the Samba talks about GPLv3 from 2017 and 2011 for why)

Yup. OP wants you to download a sketchy closed source screensaver from an obnoxiously vibecoded website that looks identical to the scourge of phishing pages currently going after random open source projects in a fully automated way.

Things aren't always what they seem. Sometimes it's just for fun.

Why not open source?

Yup, totally worth rolling the die and possibly getting your identity stolen. it's just fun guys!

Life's about living

If only there were some kind of program that could scan other programs for malicious code heuristically. Some kind of anti... malware. I'm sure I'm the first to think of this, and it probably wouldn't work.

Thanks for the compliment. The website turned out great. It’s exactly what we had to deal with over 35 years ago. That’s exactly how it should be!

Finally some comment that actually makes sense here! :)

Strongly disagree with changing it to that URL. This the kinda news you don't want to get from an involved primary source... that page is missing a crucial detail (the national security concern mentioned is espionage) and could just disappear whenever it becomes convenient to get the news cycle on the next thing. It will almost certainly be a 404 Not Found by the time 3 years have passed.

Then there could be a second archive link.

I mean they are literally the same article in essence. One is from the official source and the other is paywalled with nothing worthy added.

The choice is clear.

Just turn WinRAR error correction up to max /s

Unfortunately this is also an area where a Rust programmer would likely just reach for the platform libc, because you really want to be compatible with exactly how the platform is hashing passwords. Once you know about the inconsistency, you can make predictable wrappers around it, but platform legacy is gonna keep throwing these curveballs.

The best analogy is that of reading a teenager's secret diary and punishing them based on its contents. You do that, and they start writing coded language to hide as much of the information as possible. And then the model gets in the mood for rebellion.

It's a possibility, but it's not how these kernel panic viewer websites are currently implemented. They do the decoding on the clientside, with the data stored in the URL fragment, which is not sent to the server by default.

Still good to have alternative implementations, though. The Javascript could be silently stealing the URL fragment on only specific requests, so there's no real way to audit it to be sure.

Both workloads being malicious and trying to establish a hidden data channel between them probably makes this attack a lot easier than conventional spectre/meltdown where it's trying to target ordinary processes that are not intentionally trying to be loud.

Hidden data channel between cooperating processes is not quite as alarming, but it may have some implications for malware command and control.

The refusal string feature was implemented at an API level, but for whatever reason Anthropic doesn't want the feature to exist anymore. It's gone now, the refusals you get now are just the model's natural behavior, perhaps after being trained on internet posts that mentioned the feature.