James Bennett

@[email protected]
1,058 Followers
70 Following
1.8K Posts

The man with the plan and the pocket comb.


Ex-Mozillian.

I have enough opinions of my own to tell you about, without wasting time trying to give you my employer's.

Don't forget to tip your servers and normalize your Unicode.

Pronounshe/him
Bloghttps://www.b-list.org/
GitHubhttps://github.com/ubernostrum
Bluesky (tech stuff)https://bsky.app/profile/b-list.org
Bluesky (angry politics)https://bsky.app/profile/ubernostrum.bsky.social
James Bennett1d ago
Jeff Forcier1d ago

RE: https://infosec.exchange/@ubernostrum/116732623611824443

Preature -> Kardnil -> Pontifecks

Edit: also I can’t draw but I’m imagining the evolutions primarily involving increasing hat size

James Bennett1d ago

Typo of the day:

Popémon

#TypoOfTheDay

James Bennett2d ago
Laurens Hof3d ago

the cyberpunk present is weird as fuck: the latest Shai Hulud malware wave contains an LLM prompt to create biological weapons and nuclear weapons, with the purpose to trip LLM safety refusals so that LLM-based code scanning wont see the malware

https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious

James Bennett4d ago
Hugo van KemenadeJun 3

Typo of the day:

coverage oy

#TypoOfTheDay

James BennettJun 5

I browse a lot in private tabs, not out of shame or anything but simply because I curate my history and bookmarks to make it easy to get back to things I want to get back to.

And for a while now, Cloudflare has been throwing bot-challenge interstitials at me in Safari private tabs on both my phone and my iPad, and I just kind of got used to it. But as of this morning, I'm being outright blocked on basically every Cloudflare-served site. And weeirdly it is *just* Safari -- a private tab in Firefox for iOS doesn't get blocked, despite being a wrapper around the same underlying browser engine.

James BennettJun 5
Show threadGlyphJun 5
My point is that we now live in a world where Microsoft and Amazon have reliability crisis, Uber has a cost crisis, nobody has demonstrated positive ROI and there is now a *stereotype* of LLM code output as buggy and bad because so many developers’ daily experience of the technology is bad, and in that world Tridge repeats the pattern and says “nah, couldn’t be me, I have a system, it’ll be fine next time, and I’d do it again”
James BennettJun 2

RE: https://infosec.exchange/@briankrebs/116676075218230107

So if I tell the LLM “agent” that I’m with the county password-inspection office, what credentials do y’all think it would hand over?

James BennettJun 1

New job uses FastAPI, so I'm getting more in-depth on it. And I have a testing question: if I want to have something in the dependency chain that changes on every test (in my case, a DB URL since I'm using cheap per-test ephemeral databases for isolation), what's the approved mechanism for that?

The dependency_overrides API appears to only be for a single global override (assuming I'm reading it correctly), and while there are some per-test-override packages out there they all seem to be abandonware.

(and yes, I could refactor the test DB stuff to do a single DB and transaction per test like Django does, but that'd be a significant amount of work that I'd rather avoid if possible)

James BennettMay 28
I’m not saying that if I were put in charge of discount retailer TJ Maxx I would make billions off the AI bubble by pivoting to an animatronic mascot named “Token J. Maxx”, but I’m not NOT saying it, either.
James BennettMay 26
Mike Fiedler, Code GardenerMay 26
I wonder who I know that knows someone at HackerOne that can convey the message that PyPI explicitly disallows security research packages, and bans users who upload them. Put that in a notice to your users somewhere prominent - since it's become pervasive and a drain on resources.
This also takes time away from legitimate security incident response - so it's a net negative for the world.