… on one benchmark, that has 2 modes of running. 1 shot and 1 shot with repair. Zero tools.
Then ignore the rules of the bench (which is a pretty obsolete one anyway), give it an agentic loop of sorts via delegation and python eyes and then win.
Update on the Discourse side, we now run all external binaries, including magick via a landlock sandbox.
The gem we use is here: https://github.com/discourse/ruby-landlock highly recommend all Rubyists out there consider this. We are also in the process of moving away from Magick to Vips (which also runs in a sandbox, not in process)
HEIF is patched, but I doubt this is the last buffer overflow in HEIF, I will not be surprised if in the upcoming weeks or months someone will discover something in libpng or some other native image library. Given where stuff is at, defense in depth is critical.
Another thing worth mentioning to all self hosters, always be updating! The rate of CVEs this year across all open source software is through the roof, self hosting now is double scary, you need to have some routines setup to update monthly if not weekly.
I use ruby-landlock as well for image processing. I can recommend setting VIPS_BLOCK_UNTRUSTED=1 when you switch to vips, it blocks untrusted image decoders.
Not setting that value caught the rails team off guard just recently, maybe it should be the default.
Unfortunately I find this too high risk, I entered my credit card, but can not set a limit. The best I can do is get an email alert. I feel like I am one oopsie away from getting a 100 dollar bill.
Because it'll get declined after a few attempts once it's past the limit, then your account would likely get marked for fraud. Try it and report back, but repeated method of payment failures get accounts suspended pretty reliably at any place that does CC processing, since it's also a risk to their merchant account to have a higher percentage of declined payments (ie higher fraud risk) and it's far safer for them to cut you off / blacklist you vs giving you more chances and the sure bet that they'll invoke higher merchant account / payment processor fees. If they make it to the "high risk" category, they're cooked too; Mastercard for example has MATCH that once you're added, you're considered high-risk at ANY other place you try to get CC processing going again. You can read a bit more about that here: https://docs.stripe.com/disputes/match Payment processors can fully drop merchants that have too high of a risk / too many chargebacks / too high payment failure percentages.
Yep - exactly my thoughts. No way am I trying this out without a billing limit - seems crazy given the pricing strategy to not have a top-up and pay as you go.
Then ignore the rules of the bench (which is a pretty obsolete one anyway), give it an agentic loop of sorts via delegation and python eyes and then win.
Sorry but this is not how benchmarking works