@bender@twtxt.net Itâs good enough ti iron out any bugs đ Can I haz an account? đ
For those curious, the new Twtxt <-> ActivityPub bridge Iâm building (bidirectional) simply requires three things:
- You register your Twtxt feed to the bridge: https://bridge.twtxt.net
- You verify that you in fact own/control the feed by putting the verification code somewhere on/in your feed (doesnât matter where or how)
- You proxy/forward requests for
/.well-known/webfingerto the Bridgebridge.twtxt.net.
Iâm still testing through and ironing out bugs đ Please be patient! đ
whoo fix a long stnading bug with identicons for feeds with no avatar in their metadata
Hint:
# nick = ...
# avatar = ...
sudo-rs Affected By Multiple Security Vulnerabilities - Impacting Ubuntu 25.10
The Ubuntu 25.10 transition to using some Rust system utilities continues proving quite rocky. Beyond some early performance issues with Rust Coreutils, breakage for some executables, and broken unattended upgrades due to a Rust Coreutils bug, itâs also sudo-rs now causing Ubuntu developers some headaches. There are two moderate security issues affecting sudo-rs, the Rust version of sudo being used by Ubuntu 25.10⊠â Read more
FFmpeg To Google: Fund Us or Stop Sending Bugs
FFmpeg, the open source multimedia framework that powers video processing in Google Chrome, Firefox, YouTube and other major platforms, has called on Google to either fund the project or stop burdening its volunteer maintainers with security vulnerabilities found by the companyâs AI tools. The maintainers patched a bug that Googleâs AI agent discovered in code for decoding a 1995 vi ⊠â Read more
KDE Plasma 6.6 Shaving Off 100MB Of Memory Use, Fixing DrKonqi Crash Reporter Crashing
KDE developers were off to a busy start for the month of November. A lot of feature activity continues happening for Plasma 6.6 while a lot of bug fixing is still going on for Plasma 6.5 and related KDE components⊠â Read more
@prologic@twtxt.net Letâs go through it one by one. Hereâs a wall of text that took me over 1.5 hours to write.
The criticism of AI as untrustworthy is a problem of misapplication, not capability.This section says AI should not be treated as an authority. This is actually just what I said, except the AI phrased/framed it like it was a counter-argument.
The AI also said that users must develop âAI literacyâ, again phrasing/framing it like a counter-argument. Well, that is also just what I said. I said you should treat AI output like a random blog and you should verify the sources, yadda yadda. That is âAI literacyâ, isnât it?
My text went one step further, though: I said that when you take this requirement of âAI literacyâ into account, you basically end up with a fancy search engine, with extra overhead that costs time. The AI missed/ignored this in its reply.
Okay, so, the AI also said that you should use AI tools just for drafting and brainstorming. Granted, a very rough draft of something will probably be doable. But then you have to diligently verify every little detail of this draft â okay, fine, a draft is a draft, itâs fine if it contains errors. The thing is, though, that you really must do this verification. And I claim that many people will not do it, because AI outputs look sooooo convincing, they donât feel like a draft that needs editing.
Can you, as an expert, still use an AI draft as a basis/foundation? Yeah, probably. But hereâs the kicker: You did not create that draft. You were not involved in the âthought processâ behind it. When you, a human being, make a draft, you often think something like: âOkay, I want to draw a picture of a landscape and thereâs going to be a little house, but for now, Iâll just put in a rough sketch of the house and add the details later.â You are aware of what you left out. When the AI did the draft, you are not aware of whatâs missing â even more so when every AI output already looks like a final product. For me, personally, this makes it much harder and slower to verify such a draft, and I mentioned this in my text.
Skill Erosion vs. Skill EvolutionYou, @prologic@twtxt.net, also mentioned this in your car tyre example.
In my text, I gave two analogies: The gym analogy and the Google Translate analogy. Your car tyre example falls in the same category, but Geminiâs calculator example is different (and, again, gaslight-y, see below).
What I meant in my text: A person wants to be a programmer. To me, a programmer is a person who writes code, understands code, maintains code, writes documentation, and so on. In your example, a person who changes a car tyre would be a mechanic. Now, if you use AI to write the code and documentation for you, are you still a programmer? If you have no understanding of said code, are you a programmer? A person who does not know how to change a car tyre, is that still a mechanic?
No, youâre something else. You should not be hired as a programmer or a mechanic.
Yes, that is âskill evolutionâ â which is pretty much my point! But the AI framed it like a counter-argument. It didnât understand my text.
(But what if thatâs our future? What if all programming will look like that in some years? I claim: Itâs not possible. If you donât know how to program, then you donât know how to read/understand code written by an AI. You are something else, but youâre not a programmer. It might be valid to be something else â but that wasnât my point, my point was that youâre not a bloody programmer.)
Geminiâs calculator example is garbage, I think. Crunching numbers and doing mathematics (i.e., âcomplex problem-solvingâ) are two different things. Just because you now have a calculator, doesnât mean itâll free you up to do mathematical proofs or whatever.
What would have worked is this: Letâs say youâre an accountant and you sum up spendings. Without a calculator, this takes a lot of time and is error prone. But when you have one, you can work faster. But once again, thereâs a little gaslight-y detail: A calculator is correct. Yes, it could have âbugsâ (hello Intel FDIV), but its design actually properly calculates numbers. AI, on the other hand, does not understand a thing (our current AI, that is), itâs just a statistical model. So, this modified example (âaccountant with a calculatorâ) would actually have to be phrased like this: Suppose thereâs an accountant and you give her a magic box that spits out the correct result in, what, I donât know, 70-90% of the time. The accountant couldnât rely on this box now, could she? Sheâd either have to double-check everything or accept possibly wrong results. And that is how I feel like when I work with AI tools.
Gemini has no idea that its calculator example doesnât make sense. It just spits out some generic âargumentâ that it picked up on some website.
3. The Technical and Legal Perspective (Scraping and Copyright)The AI makes two points here. The first one, I might actually agree with (âbad bot behavior is not the fault of AI itselfâ).
The second point is, once again, gaslighting, because it is phrased/framed like a counter-argument. It implies that I said something which I didnât. Like the AI, I said that you would have to adjust the copyright law! At the same time, the AI answer didnât even question whether itâs okay to break the current law or not. It just said âlol yeah, change the lawsâ. (I wonder in what way the laws would have to be changed in the AIâs âopinionâ, because some of these changes could kill some business opportunities â or the laws would have to have special AI clauses that only benefit the AI techbros. But I digress, that wasnât part of Geminiâs answer.)
tl;drExcept for one point, I donât accept any of Geminiâs âcriticismâ. It didnât pick up on lots of details, ignored arguments, and I can just instinctively tell that this thing does not understand anything it wrote (which is correct, itâs just a statistical model).
And it framed everything like a counter-argument, while actually repeating what I said. Thatâs gaslighting: When Alice says âthe sky is blueâ and Bob replies with âwhy do you say the sky is purple?!â
But it sure looks convincing, doesnât it?
Never againThis took so much of my time. I wonât do this again. đ
#4 RFI: From an External URL Into your Application
Understanding RFI isnât just about finding a bug; itâs about recognizing a critical design flaw that, if exploited, hands an attacker theâŠ
[Continue reading on InfoSec Write-ups »](https://infosecwrit ⊠â Read more
The $2,000 Bug That Changed My Life: How a Tiny URL Parameter Broke Web-Store Pricing !! â Read more
âThe $10,000 Handlebars Hack: How Email Templates Led to Server Takeoverâ
While studying advanced template injection techniques, I came across one of the most fascinating bug bounty stories Iâve ever encountere ⊠â Read more
How I Reported a Pre-Account Hijack Affecting Any Gmail User (Even Google Employees)- My Bug⊠â Read more
@movq@www.uninformativ.de I guess I wasnât talking about the speed of interesting text/context, but more the âslownessâ of these tools. I think I can build/ solutions and fix bugs faster most of the time? Hmmm đ€ I think the only thing itâs able to do better than me is grasp large codebases and do pattern machines a bit better, mostly because weâre limited by the interfaces we have to use and in my ase being vision impaired doesnât help :/
Fixed following page template bug so cached feed counts render without errors. cc @bender@twtxt.net
Tuckr - Stow alternative with symlink checking
Iâve been using Stow for a few years now. At the time (2020) Stow had a bug where it would just fail with a cryptic error and the maintainer didnât have time to fix it, the bug was there for 2 years or so. So I got fed up and decided to try and fix it but I didnât know perl nor did I want to learn it, so I decided to rewrite Stow and fix the issue. To fix it I decided that I track all symlinks and give users a nice way to see what was going on. So the entire project was based on having a n ⊠â Read more
Top security researcher shares their bug bounty process
For this yearâs Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to put the spotlight on a talented security researcherâ@dev-bio!
The post Top security researcher shares their bug bounty process appeared first on The GitHub Blog. â Read more
25. Monetizing Your Skills Beyond Bug Bounty
Turn your hacking expertise into a thriving career beyond bounties.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/25-monetizing-your-skills-beyond-bug-bounty-a6b503d6b6dc?source=rssâ-7b722bf ⊠â Read more
How I Found a $250 XSS Bug After Losing Hope in Bug Bounty
đ Free Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-found-a-250-xss-bug-after-losing-hope-in-bug-bounty-8ab557df4d1d?source=rssâ-7b722bf ⊠â Read more
How to Find XSS Vulnerabilities in 2 Minutes [Updated]
My simple yet powerful technique for spotting XSS vulnerabilities during bug hunting.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/find-xss-vulnerabilities-in-just-2-minutes-d14b63d00 ⊠â Read more
A Bug Hunterâs Guide to CSP Bypasses (Part 1) â Read more
CTF to Bug Bounty: Part 1 of the Beginnerâs Series for Aspiring Hunters
From CTF flags to real-world bugsâââyour next hacking adventure starts here.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups. ⊠â Read more
âThe Overlooked P4 Goldmine: Turning Simple Flaws into Consistent Bountiesâ
Weâve all been thereâââscrolling through bug bounty platforms, seeing hunters post about critical RCEs and complex chain exploit ⊠â Read more
** How to Use AI to Learn Bug Hunting & Cybersecurity Like a Pro (in 2025)**
Hey there đ,
Iâm Vipul, the mind behind The Hackerâs Logâââwhere I break down the hackerâs mindset, tools, and secrets đ§ đ»
[Continue reading ⊠â Read more
Authentication bypass via sequential user IDs in Microsoft SSO integration | Critical Vulnerability
If youâre a penetration tester or bug bounty hunter, n ⊠â Read more
Account Take Over | P1âââCritical
It started off like any other day until I got an unexpected emailâââan invite to a private bug bounty program. Curious, I jumped in. TheâŠ
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/account-take-over-p1-critical-5468ce8218b9?sour ⊠â Read more
The weirdest bug:When Reflected XSS Wonât Let a Page Breathe â Read more
The Critical $1000 Bug:(blind SQL injection) â Read more
22. How to Get Invites to Private Programs
Unlock the secrets to landing exclusive private program invites and level up your bug bounty journey.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/22-how-to-get-invites-to-private-programs-9bbb5166 ⊠â Read more
The $500 Stored XSS Bug in SideFXâs Messaging System
Hacking the Inbox: How a $500 Stored XSS Bug Exposed SideFXâs Messaging Flaw
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-500-stored-xss-bug-in-sidefxs-messaging-sys ⊠â Read more
How I found Multiple Bugs on CHESS.COM & they refused
I found JS crash, disallowing anyone to view your profile and HTML Injection. But they ignored everything.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-found-multiple-bug ⊠â Read more
How a top bug bounty researcher got their start in security
For this yearâs Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to feature another spotlight on a talented security researcher â @xiridium!
The post How a top bug bounty researcher got their start in security appeared first on The GitHub Blog. â Read more
How a Single Signup Flaw Exposed 162,481 User Records
My $8,500 Bug Bounty Story and the Critical Lesson in Authentication
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-a-single-signup-flaw-exposed-162-481-user-re ⊠â Read more
Mastering Google Dorking: Discovering Website Vulnerabilities
Deep Recon Made Simple: Powering Bug Hunting with Dorking Strategies
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/mastering-google-dorking-d ⊠â Read more
@lyse@lyse.isobeef.org That looks like an older bug report. Which groff version is that (groff --version)?
@movq@www.uninformativ.de I got an empty line through the table, similarly to one of the linked bug reports, just at a different location:
https://lyse.isobeef.org/tmp/screenshot-2025-09-27-13-56-13.png
Okay, now that I knew what to look for, I found existing bug reports:
Most importantly:
This is resolved in the groff trunk.
đ„ł
Kicking off Cybersecurity Awareness Month 2025: Researcher spotlights and enhanced incentives
For this yearâs Cybersecurity Awareness Month, GitHubâs Bug Bounty team is excited to offer some additional incentives to security researchers!
The post [Kicking off Cybersecurity Awareness Month 2025: Researcher spotlights and enhanced incentives](https://github.blog/security/vulnerability-research/kicking-off-cybersecurity-aware ⊠â Read more
@kat@yarn.girlonthemoon.xyz Mine shows 1/1 of 14 Twts đ I think this is a bug đ€Ż
<details> tag in HTML; it lets you write a sentence or so that someone can then click to expand to see the actual post. it's called a CW because most people use it to warn for potentially triggering/harmful subjects, but you can really use it for anything, like spoilers in a TV show or even for joke punchlines
@kat@yarn.girlonthemoon.xyz Ta. The only good use for <details> is to collapse long logs in bug analysis reports. Other than that, I find it rather annoying to expand sections manually.
As for spoilers, personally, I donât care at all. Not the slightest bit. If there is something that I donât wanna read, I just stop reading. ÂŻ_(ă)_/ÂŻ
But Iâve got the feeling that Iâve got an unpopular opinion on that matter. ;-)
yarnd (what runs twtxt.net). I'd change this to something that's more supproted like PNG, JPEG, etc.
@eric@itsericwoodward.com Name change is no worries! đ Interesting/funnily enough my client yarnd seems to have picked it up automatically which is nice (Iâve historically always had a few bugs to iron out there đ€Ł)
Spiders are the only web developers that enjoy finding bugs.
@lyse@lyse.isobeef.org you will have to agree, though, that Yarn has contributed to make it possible to mass adopt (with its many glitches, bugs, and all) because, still, the web is king.
@twtxt.net@twtxt.net HI KIWU YOUR PROFILEâS A BIT BUGGED ON OUR END BUT ITâS OK ITâLL FIX ITSELF
Thinking about doing âWayland Wednesdayâ. Only use Wayland every Wednesday. Collect bugs, report bugs, fix bugs.
⊠which is probably a GTK bug.
Just realized: One of the reasons why I donât like âflat UIsâ is that they look broken to me. Like the program has a bug, missing pixmaps or whatever.
Take this for example:
https://movq.de/v/8822afccf0/a.png
Iâm talking about this area specifically:
https://movq.de/v/8822afccf0/a%2Dhigh.png
One UI element ends and the other one begins â no âtransitionâ between them.
The style of old UIs like these two is deeply ingrained into my brain:
https://movq.de/v/8822afccf0/b.png
https://movq.de/v/8822afccf0/c.png
When all these little elements (borders, handles, even just simple lines, âŠ) are no longer present, then the program looks buggy and broken to me. And Iâm not sure if Iâll ever be able to un-learn that.