Raphaël Vinot

I find it so absolutely hilarious and on brand that the whistleblower in the Edouard Philippe embezzelment case is franco-german.

https://www.radiofrance.fr/franceinter/podcasts/l-info-de-france-inter/le-maire-du-havre-edouard-philippe-vise-par-une-enquete-pour-detournements-de-fonds-publics-5402614

maybe pushing code as quickly as possible with zero domain knowlege and ignoring all existing research is not the best idea after all it's hard to tell but clearly there is not way to know

Bon, la TBM vous êtes sympa, mais 3 interruptions de traffic sur le tram sur les 4 derniers jours, ça va pas le faire. Sans compter l'augmentation des tarifs, et avec la fermeture du pont de pierre tout l'été...

In todays' AI PRs fun: "here is a thing, I tested it against mock data, so you should test it against real data before merging it."

The non-mock data is public (the mocked data isn't, amusingly enough), it is just that they cannot be arsed to do more than the prompt.

(the code is simple, and by looking at it, I'm pretty sure it will most probably work, but folks, at least try)

Just heard Michael Moore (Anthropic) on Planet Money saying that with their cyber cyber tools and best practices, they can *assure* to fine all the bug before the code goes to prod. I'm looking forward seeing them being sued because they didn't.

well, at least, if your bank website is responding right now, it's probably really your bank. #cloudflare

RE: @lerg@infosec.exchange

To every techie lolsobing at "HR is writing code, we're all gonna die": maybe we should have thought about it before now. We've been fighting tooth and nails since forever to make sure that there would be no regulation whatsoever on writing software. So wen we do a terrible job, it doesn't have any bad repercussion (on us).

The consequence is that for everyone else, software is kinda shit, and more importantly, doesn't matters. So yes, why not cut the expensive, loud, and obnoxious middle man?

RE: @lcamtuf@infosec.exchange

This, but on everything, with whichever AI gave free token that day, and nobody bother paying for an audit.

That's software dev right now.

OH yesterday from a non-tech person, at a tech event: "I was at the local chapter of the MEDEF (french bosses union) and we did a poll with our member asking if using AI increased their benefits, and ~70% said no."

With a very strong undertone of "WTF nerds?"

Like seriously, if the attack was:

1. create an account
2. login
3. iterate over all the other accounts
4. profit

people need to be fired.

And that includes anyone supposed to do any security related stuff there. It should have been absolutely obvious in the logs.

Oh FFS seems the website for ANTS (National Agency for Secured Documents) was letting you get data from another user by just changing the ID in the request. 19M accounts leaked (~1/3 of the french population).

Also, if that's how it worked, how the fuck can you not notice it for long enough that the attacker was able to get everything.

This is 🥖excellence francaise🥖 for you all.

https://frenchbreaches.com/blog/fuite-massive-a-lants-jusqua-19-millions-de-donnees-sensibles-exposees (FR)

Welp, les Francais, si vous avez utilisé SOONCARE de YMED avant le 2026-04-06, tout est dans la nature.

Ce qui est rigolo, c'est que ce messge clairement automatique ne mentionne pas sooncare, donc sans fouiller, aucune idée de ce qui a été poppé...

RE: @aral@mastodon.ar.al

oh, we can tell.

RE: @Outpost@indieweb.social

so hmmm maybe people take note.

Not sure if it is a bug, but surely it is confusing.
If you run tor and require a specific country code for the exit node, with strict node to 1 (--ExitNodes {} --StrictNodes 1) it will properly raise an error if the CC in invalid (say FOO), but if the CC exists *and* and there are no exits in that country, it will simply fallback to whatever, without any warning.

RE: @vmstan@vmst.io

Hahaha

So. Hear me out. The existence of a "dignified transfer" implies an "undignified transfer", where they kick the coffin down the staircase. I don't make the rules.

Not everyone need to learn to code. Especially when "learn to code" means "prompt an AI".

Todays cursed mimetype:

text/plain; charset=gzip+enc

wat

In case you missed, you can bet on murder*.

*offer only available for countries where the C-Suite doesn't live

https://www.404media.co/with-iran-war-kalshi-and-polymarket-bet-that-the-depravity-economy-has-no-bottom/

This is nothing newsworthy but dataset 9 from the recent dump is still changing. Today, they updated EFTA00173201 and *unredacted* Leslie Groff and Leslie Wexner name & face and Karyna Shuliak name.

And for the nerds, you should know that the `last-modified` HTTP header in the response when you GET a file is accurate.