Hoshino Lina (星乃リナ) 🩵 3D Yuri Wedding prep!!!

Hacker & Mad Scientist VTuber!

💍 @cyan 🩵 | We are @TokyoHackerGirls ✨

ママ : https://bsky.app/profile/heripiro.bsky.social | パパ : https://twitter.com/otozuki_teru
All the links: https://lina.yt/me

Public Key

npub14w78207els8vs5fxduhhval0r9zgujpf2khcqyfuhmkt2tlyvcyq2zuequ

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs2h0r48lvlcrkg2ynx7tmkwlh3j3ywfq54ttuqzy7tam949ljxvzqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds76lfng

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub14w78207els8vs5fxduhhval0r9zgujpf2khcqyfuhmkt2tlyvcyq2zuequ

Show more details

Last Notes

2026-08-12 19:24:51 GMT

- reply

@nprofile…8zly That's the vast majority of USB PD cables, including e.g. all the default Apple charge cables. You can't have USB3 support keeping the cable thin and flexible, since that needs a lot of extra wiring.

2026-08-12 01:46:59 GMT

I wish all USB cables were labeled like this!!!
(Elecom brand, if anyone's wondering)
https://media.vt.social/media_attachments/files/117/080/012/755/372/916/original/cc138ae07331b5db.jpeg

2026-08-11 11:36:01 GMT

- reply

@nprofile…rt5d I mean, it's essentially the minimum wage for flipping burgers with no relevant experience in Tokyo.
The 2x difference is the market. The flipping burgers part, apparently Live2D think that's what programming is worth...

2026-08-11 10:49:44 GMT

The Live2D ad targeting is on the nose www
I checked their jobs site... 250000 JPY starting salary for programmers. With 25h overtime.
You can barely survive in Tokyo on that.
No thanks... ^^;;
https://media.vt.social/media_attachments/files/117/076/484/602/181/867/original/8174230e2f3f3f81.png
https://media.vt.social/media_attachments/files/117/076/484/612/011/984/original/67f1fd991c4d6470.png

2026-08-10 10:06:42 GMT

- reply

@nprofile…qlh2 Frame rate at which the diagrammed operation would happen.

2026-08-10 09:30:38 GMT

- reply

Note that the 3 is NOT in the original Live2D implementation anywhere. I have an exact (to FP precision) black-box re-creation of that, and it's doing what is shown in the diagram I posted above. There is no 3 anywhere in that code.

2026-08-10 09:30:38 GMT

- reply

I don't know why it's 3 yet, but 3 seems to be ~exact by all appearances. No, it's not pi...
The diagram above should be what actually happens. You can write out the vector math for that, but I don't know why that arctan thing with a fudge factor of 3 works out in practice... anyone want to try to solve the math and see if it really ends up like that?

2026-08-10 09:30:37 GMT

One thing I haven't figured out yet is where this mystery factor of 3 comes from.
These two lines of code are emulating what happens when the Live2D physics engine applies velocity as linear motion, then clamps down to a fixed radius, every frame.
The arctan thing was a first approximation (taking the velocity vector as tangent to the current position, length = angular velocity), but then the factor of 3 makes it correct.
https://media.vt.social/media_attachments/files/117/070/511/220/454/352/original/50755c6cb76bd056.png
https://media.vt.social/media_attachments/files/117/070/511/230/292/208/original/6acd14b9611cc56f.png

2026-07-25 03:16:14 GMT

What if Live2D rigging looked like this?
This is not a mockup. It's real. Azxiana is building a modern CMO3 editor from scratch.
https://media.vt.social/media_attachments/files/116/978/442/094/225/952/original/490686846ca9eec5.png

2026-07-21 06:20:00 GMT

- reply

Now, having finally understood the behavior, I know it's nonsensical, and not even invariant with the original pendulum angle.
Which means it will not be implemented in Ayagami. I hope nobody depends on this bug, but if they do, they can fix their model. Sorry.
The goal I have is to implement physics that "feel" the same, in the sense of fluidity/drag/etc., as Live2D physics. To that extent I'm willing to implement fudge factors to correct for imprecision in the original.
But not stuff like this, this is just a bug.

2026-07-21 05:23:05 GMT

- reply

This is now the third or fourth time I waste hours trying to "match the numbers", sketching out geometry, and trying random "sensible" formulas to match or approximate Live2D physics, and then the answer ends up being "just try doing the dumbest broken stuff you can think of".
https://media.vt.social/media_attachments/files/116/956/291/620/129/482/original/88b78d78fe860480.png

2026-07-21 05:23:04 GMT

OMFG I just solved yesterday's Live2D physics mystery.
The trick was to stop trying to make sense of the numbers geometrically, and just try writing buggy code.
Wrote the dumbest bug I could think of, matched Live2D behavior 100% on the first try.
Spot the bug...
https://media.vt.social/media_attachments/files/116/956/291/577/708/341/original/96a06ac21de9983a.png

2026-07-21 03:19:00 GMT

About that "THE FIRST TAKE" channel... apparently they have a trailer video where they seriously claim it's unfiltered/unedited for real???????
It's not. It's not one take and the vocals are corrected. Very, very obviously.
https://www.youtube.com/watch?v=og2Bcm-ZTVs

2026-07-19 11:27:20 GMT

Just got this in the mail~
I might have a new project starting to cook ✨
https://media.vt.social/media_attachments/files/116/946/399/342/358/757/original/22742f49ac8b423f.jpg

2026-07-13 11:56:15 GMT

- reply

@nprofile…ehyp Huh, TIL. That might be good enough. Do you have a link?

2026-07-13 09:39:17 GMT

Are there any compact CJK sans fonts with proper variant glyph coverage?
I just added Droid Sans Fallback (3MB) to demo.ayagami.rs, but that only has SC variant glyphs (Japanese etc will look weird). I wonder if there are any better options that aren't huge?
I don't really care about obscure glyphs, just BMP is probably fine since this is only used for model part labels and the like. But it would be nice to choose SC/TC/JP/KR variants based on locale or a heuristic or something...

2026-07-11 01:16:36 GMT

Cyan: I'm reading about quantum physics!!
Me: Ooh!
Cyan: Yeah, it's a book in Chinese! I learned about the shiny element!
Me: Shiny element???
Cyan: Shiny element!! You know, the dead cat....
Me: ????????
Cyan: There's proton, neutron...
Me: Electron? Photon???
Cyan: YES!!
Me: 🤦‍♀️

2026-07-06 08:00:36 GMT

Smoooth~ ✨
https://media.vt.social/media_attachments/files/116/871/963/853/842/935/original/7e913288edba4980.mp4

2026-07-06 05:36:12 GMT

- reply

@nprofile…kx6j It's black-box, I didn't decompile anything ^^

2026-07-02 18:35:24 GMT

I started using egui with Rust and it looks great and... then I saw they've been switching blending and sampling from linear to sRGB-naive everywhere and aaaaaaaaaaaaaaaaa whyyyyyyyyyyyy???
As far as I can tell they had some bugs elsewhere and that "fixed" them by chance... ;;

2026-06-28 16:24:48 GMT

🚀🚀🚀 IT WORKS!!!! 🚀🚀🚀
Open Source Live2D rendering
Now with ✨parameters✨!!!
🦀 100% Safe Rust 🦀
🫧 Clean room, black-box implementation 🫧
🌐 🍎 Cross-platform rendering 🐧 🪟
Just a few things left before it's feature-complete!!
#VTuber #ENVTuber #Live2D #Rust
https://media.vt.social/media_attachments/files/116/828/655/873/907/811/original/9cc3d0e34757d2f6.mp4

2026-06-26 15:34:53 GMT

Me: *Talking about my first kiss, with another girl*
Cyan: Either way, you belong to me.
Me: Oh yeah, now I totally do 🩵
Cyan: No, it's retroactive. I pre-ordered you!
Me: Ah, she was just borrowing me then ^^
Cyan: Where's the borrow checker???? 💢💢

2026-06-17 04:04:54 GMT

Had a thought about AI models. AI is like lossy compression.
You could probably JPEG compress movie frames at q=0 and make it an art exhibition and claim fair use... but that's not going to fly at q=80.
Similarly, you can train small ML models that achieve specific tasks and make a good case they are fair use or not a derivative work of the training data... but that really doesn't extrapolate to massive GenAI models that memorize large parts of the input or significant components of it.

2026-06-11 05:51:28 GMT

- reply

Is NFS better? I was under the impression that macOS preferred SMB these days... but the whole POSIX semantics over SMB thing seems to be not quite right...

2026-06-11 05:45:24 GMT

Is there any way to make macOS play well with Linux Samba? I'm getting all kinds of weird behavior like `mv` not working and files ending up with mode 000 that can't be changed.
I'm about to start tcpdump... but I can't be the only one running into this right???

2026-06-10 16:16:07 GMT

- reply

Deleted the gist because the slopcoder AIbro copycats are watching and this kind of deep corner case research is exactly the thing AI can't do and they would point their bots at.
This is why we can't have nice things.

2026-06-10 15:32:30 GMT

- reply

BTW, the undocumented feature... apparently there are secret parameter snap/round modes?
One just does a floor() on the value to round down to integer, the other... "snaps" param values to integers if they are within 0.1 (e.g. 0.9-1.1 snaps to 1.0), otherwise normal.
Weird!

2026-06-10 15:10:20 GMT

I think I have almost everything I need to write a Live2D MOC3 renderer!! 🚀
Using from-scratch MOC3 test files, I worked out almost everything, even one undocumented feature ^^
The warp deformer extrapolation formula is EXTREMELY cursed!! It took me forever to it figure out!!!
Notes: https://gist.github.com/hoshinolina/ae8388dcc373beec502d18aebf6d07c5
https://media.vt.social/media_attachments/files/116/726/446/116/227/116/original/75e5ca823f7b467d.png
https://media.vt.social/media_attachments/files/116/726/446/119/535/384/original/ba04a55b8dbfa1fb.png
https://media.vt.social/media_attachments/files/116/726/446/119/306/301/original/802d2fc9e5a3202e.png
https://media.vt.social/media_attachments/files/116/726/446/119/535/383/original/66011d723a9ac478.png

2026-06-09 03:48:29 GMT

- reply

Ah wait. I see what happened here.
All this wording is included, verbatim, in the *SDK* EULA.
Now of course, a program you create with the SDK *is* a derivative work of the SDK.
So... yet another copypasta error, this time from Japanese to Japanese!
Live2D are clearly a *very* professional team.

2026-06-09 03:27:53 GMT

- reply

If you search for that term and "ソフトウェア使用許諾契約" (EULA) on Google, you get only a few pages of hits, with Cubism near the top and most of the others reasonable usage (things like "don't create a spin-off Synth V voicebank").
So yeah this is Not Normal in EULAs.
Now here's a fun fact: 派生作品 is a term for "derivative work" (in legal copyright terms).... in Chinese.
(The strict legal term is 演绎作品 but I'm told 派生作品 is common in Chinese license agreements).
So my guess is either:
1) A Chinese native wrote the Live2D EULA for some reason, and messed this (and more) up; or
2) The Japanese person who wrote this knew there's zero chance the legal "derivative work" idea would fly and tried to make up a term and word for something else.
Or they simply had someone with no legal copyright experience write this up.
Either way, this entire EULA is incredibly amateurish, and large portions are likely unenforceable.

2026-06-09 03:27:16 GMT

More gems from the Live2D Editor EULA. They have this section, which defines "derivative work" and implies that anything you make with the editor is a "derivative work" of it.
"Derivative work" is a legal copyright term, and that is absolutely not how any of this works.
They have another section that basically says if you break the license, you have to destroy anything you ever made with the software, reinforcing the "it's a derivative work of the software" idea.
This is ridiculous and would not hold up in a court of law.
(I should add that while this can be how it works for things like game engines and compilers, where the compiled output includes runtime components included with the software which are copyrightable, moc3 files are NOT like that, they are pure data.)
But here is the funny part. The Japanese version is largely the same, except instead of "二次的著作物" ("derivative work"), which is the legal term used in the Japanese Copyright Act, they use the non-legal term "派生作品", which means... spin-off?
Literally, spin-off, as in media:
https://ja.wikipedia.org/wiki/%E6%B4%BE%E7%94%9F%E4%BD%9C%E5%93%81
https://en.wikipedia.org/wiki/Spinoff_(media)
What?
(BTW, not to be confused with 二次創作, which is another non-legal term meaning, essentially, "fanwork", i.e. doujin)
https://media.vt.social/media_attachments/files/116/718/012/752/351/787/original/bc08d1bf56463657.png
https://media.vt.social/media_attachments/files/116/718/013/575/944/258/original/a5a26dcb1522b645.png

2026-06-09 02:18:30 GMT

I just noticed the stupidest thing about Live2D's EULA.
VTube Studio competes with nizima LIVE. Riggers, if you are loading your models into VTube Studio, you're breaking their license!
(Doesn't matter that VTS is itself SDK licensed, there's no carve-out for that)
Except...
https://media.vt.social/media_attachments/files/116/717/742/628/763/835/original/be7975fb78b905ce.jpg

2026-06-08 11:59:49 GMT

Posted long thread over on birdsite/bluesky about the legality of black box RE etc etc
https://bsky.app/profile/lina.yt/post/3mnrdw4sonc2h
Y'all probably don't need it here since you all know how this works, this is for the VTuber peeps who don't know reverse engineering proprietary file formats is, like, a cornerstone of FOSS and not something to be legally challenged lightly.
But yeah TL;DR if they actually try to sue me for looking at their file format without even touching their software... I'm not going to just fold and give up.

2026-06-08 06:29:21 GMT

I think the next step for the Live2D MOC3 project, after a bit of write/modification testing, will be to start writing a loader for the file format and a prototype OpenGL renderer, in Rust.
Why GL? Because it's easy, cross platform, and I need a standalone testing app.

2026-06-03 12:54:34 GMT

- reply

@nprofile…vnlz My nuanced position is that quitting accomplishes precisely nothing because the lack of manpower isn't going to magically resolve itself, and if you think comparing throwing Claude at a **test suite** to modernize it to what Bun did with the Rust rewrite is reasonable, you need a serious reality check.
If you don't like the guy resorting to LLMs to handle the deluge of LLM-generated CVEs, go help him yourself. I'll wait.

2026-06-03 12:51:32 GMT

- reply

Newsflash: Just because someone doesn't have the precise exact same set of beliefs as you, and doesn't act precisely according to your precise set of moral values, doesn't give you license to attack them.
Go attack Nazis and toxic AI bros and the psychopathic billionaires milking society to enrich themselves and leave this guy alone.
Signed, someone who will block you if you start a fight in my mentions just because I dare say LLMs (of any size and construction) do not have exactly zero valid and moral use cases. Which I already had to do. Twice. I just want to build a local replacement for Google Home voice control btw, trained on ethical training data, running on any random CPU. So yeah.

2026-06-03 12:36:39 GMT

So let me get this straight... rsync made a *security release* fixing a bunch of CVEs, it regressed some stuff, people looked at the commit log, saw Claude sign-offs, and started a mob on the sole maintainer?
Yeah, this stuff is what gives legitimate AI criticism a bad name.
I don't like it, you may not like it either, but when people are throwing LLMs at legacy codebases and finding CVEs by the dozen, and a sole maintainer is trying to keep the house from falling apart... if you're attacking them, you're firing at the wrong person.
You know what's a bigger cancer on this world than AI? People incapable of seeing any nuance in situations. And this applies to absolutely everything. I'm absolutely exhausted of extremist takes. From every single side and point of view, in every single debate, AI related and not.
You all seriously need to touch grass, and learn to stop being outraged all the time over every single thing in this world.

2026-06-02 10:45:29 GMT

A side issue around the rigging debate is, who owns the "rights" to a model, and who has the "right" to change it?
This question isn't just a business/contract question, there is a deeply moral/ethical aspect too.
As an artist (both model artist and rigger), it is reasonable to want creative control over what you create. You created it, after all!
But, is what you created really "just" a piece of art?
As a VTuber, and *especially* as an indie VTuber, my model isn't just a costume I put on, or a prop to be used for business. It is, on a much deeper level, my identity. There is a living, breathing human behind that Live2D avatar.
I can honestly say that becoming a VTuber, and especially my first model, have shaped who I am in a really deep way. Both online, and IRL.
My models aren't something selected from a catalog, they are the result of working with multiple people to figure out *who I am*.
And that's really deep! Think about how it works IRL. You can buy clothes designed by someone, or even custom made, and then you can alter them yourself. You can mix and match. They are part of your self-expression, part of who you are.
VTuber models should be similar!
I personally believe that VTubers should have the freedom to adjust their own models, within the bounds of respect for the artist and rigger. Just like you can pin items on top, you should be allowed to change outfit colors, or "embroider" a logo or text on your shirt.

2026-05-28 08:32:21 GMT

OMG. Apparently tons of people have been generating secrets on an old **server-side** key generation website that had **incredibly** weak entropy. Like, 10 bits or something.
The website was allkeysgenerator[.]com. [Here](https://pastebin.com/0UTJYhBA) is a dump of 1000 keys generated on it. Searching for the URL finds hundreds of people recommending it for key generation.
Some of these snippets have [hundreds](https://github.com/search?q=F-JaNdRgUkXp2s5v&type=code&p=4) of GitHub results.
The exact algorithm is unknown but it generates *extremely* predictable strings, you can visually see how the delta from character to character is almost constant. Thanks @nprofile…9zph for doing some analysis [here](https://mastodon.social/@dramforever/116647423740087216).
I'm certain you can break into production websites using these keys for cookie signing etc.

2026-05-27 13:22:48 GMT

Mystery encryption key: p3s6v9y$B&E)H@Mc
Any idea where this comes from? There are a few web hits, including this list of similarly-shaped strings: https://pastebin.com/0UTJYhBA
It feels like it's some kind of poor rand() LCG-ish thing trivially converted to ASCII, but I'm really curious if anyone has a good guess.
A certain popular VTuber software uses it as an XOR pad obfuscation for its config files... (I derived it statistically, didn't look at the code)

2026-05-27 09:18:55 GMT

- reply

@nprofile…ds0l Or just do what half of Japan does, visit http://irasutoya.com/ and pick out some cute clipart!

2026-05-25 13:24:53 GMT

Apple has a ton of internal system AudioUnit plugins and some of the names are amazing
BeamIt
BuzzKill
Carter
ControlFreak
Lando
LittleLateNightMode
LoudnessWarrior
LowFlow
MeisterStueck
Scotty
ToneMeister
https://media.vt.social/media_attachments/files/116/635/434/486/033/560/original/4c17a6fda9c0ffa2.png
https://media.vt.social/media_attachments/files/116/635/434/478/707/709/original/f8a843f7b50376ed.png

2026-05-22 13:31:35 GMT

This is what peak I/O shield looks like.
VGA, DVI, DisplayPort, or HDMI? Yes.
Analog or optical 5.1 audio? Yes.
PS/2, USB2 or USB3? Yes.
eSATA? Yes. Two.
Bonus RS232 with a 3D printed bracket on the side~
(From an old home server I just shut down after many years ^^)
https://media.vt.social/media_attachments/files/116/618/473/883/492/469/original/27c393981792045b.jpeg

2026-05-19 12:53:03 GMT

- reply

@nprofile…m9jv Yeah that's what I use most of the time these days.

2026-05-19 11:23:55 GMT

STREAMERS BEWARE: You might know that Google doxxes your location in the page footer. Turns out the AI Overview can also do it. It just had it randomly tell me where I live.
If you use UBlock to block it, you need to block the footer AND the entire AI box!

2026-05-14 10:02:47 GMT

I worked at a fairly big tech co years before the AI boom. People did large scale refractoring across huge code bases back then. With refactoring tools. And properly written robots.
Applying changes to code at scale, opening PRs automatically, basic interaction with human reviewers, making sure tests pass, getting things merged when ready. All that already existed before LLMs. And it was actually reliable and not capable of hallucinating terrible things.
It's like we've forgotten how to automate things without LLMs and openclaw now...
https://media.vt.social/media_attachments/files/116/572/336/675/614/438/original/85051466ec49ab35.png

2026-05-12 15:03:02 GMT

🚀 IT WORKS!!!! 🚀
ARKit iPhone face tracking, without an iPhone. Just a webcam on any Mac.
All the blend shapes. All the features. No magic camera required. It just works.
Now I just need to plug this into VBridger/VTS and clean things up a bit ✨
Logs: https://gist.github.com/hoshinolina/ba7548a50563146fa1caf3d2bd8ea3be
https://media.vt.social/media_attachments/files/116/562/184/028/866/183/original/cc2979e62d14d28f.png

2026-05-12 06:37:45 GMT

FKTracker: (AppleCVA) [com.apple.AppleCVA:FaceKit] Creating FaceKit with options: { "add_debug" = 1; "failure_fov_modifier" = "0.5"; "network_failure_threshold_multiplier" = 1; "num_tracked_faces" = 1; "rgb_only" = 1; "robust_tongue" = 0; "use_recognition" = 0;}
FKTracker: (AppleCVA) [com.apple.AppleCVA:FaceKit] CVAFaceTracking created (0x7feaaee60).

2026-05-11 13:45:28 GMT

I told Reddit that ARKit face tracking is just really good webcam tracking, and gave them a simple test that proves it.
They're all downvoting me without doing the test.
Look what I just found... the ARKit face tracking code is hiding in macOS. I'm going to make this work.
https://media.vt.social/media_attachments/files/116/556/242/333/968/393/original/4ef82e62316af6ba.png

2026-05-07 08:30:13 GMT

Typical ML argument: "If I can read something legally, why can't I train an LLM on it?"
Humans are capable of reading things and later writing a similar thing that is still a copyright violation. If I go and write a book that follows the plot line of Star Wars, that's still a copyright violation, even if no text is literally the same. If I play the melody to a song on my piano and release it without the appropriate mechanical cover license, that's also a copyright violation.
The reason this does not happen often is that, as humans, we are aware that that's plagiarism and there are rules.
LLMs have no such awareness and routinely output things which are blatant copyright violations when appropriately prompted. That means the model weights encode that work, and therefore, are themselves a derivative work.
Your brain encodes a massive amount of copyrighted information. You are not a walking copyright violation because humans aren't data, can't be copied and distributed en masse, have human rights, etc. This is why "mind reading machines" are a classic dystopian plot point (monetizing your thoughts etc).
An LLM is not a human, does not have human rights, nor human privileges. It is data, and if it encodes copyrighted information, that's a derivative work. If you aren't following the license of the training data, that's a copyright violation.

2026-05-07 08:19:27 GMT

- reply

@nprofile…ya2l
> Can it be met?
"I can't realistically do what I want without violating the license" does not, in fact, mean you get to violate the license.
> Also if a document can be legally read, then why can it not be used for training?
This is the "ML erases copyright" argument. The point of copyright safe models is not assuming that model is valid.

2026-05-06 14:53:53 GMT

There's a thing about Edge storing passwords unencrypted in RAM going around. While that could be improved, you should know that:
If an attacker is reading your RAM, you have bigger problems than your password list (like, for example, your cookies, which are more powerful than passwords because they can bypass 2FA)
No browser guarantees passwords do not stay in RAM unencrypted after use. It is near impossible, there are too many layers of software involved that aren't using secure RAM erase.
The prompting for your password/screen lock/whatever when you view passwords in the password manager is just to stop casual snoopers. It is trivial to bypass, just go to a login page with autofill and read the password through dev tools. Yes this works (tested in Chrome). No screen lock password needed (unless you enable requiring that for every autofill).
So yeah, Edge probably shouldn't store the entire password store in cleartext in RAM all the time... but if RAM dumps are in your threat model, you really have bigger issues anyway.

2026-05-06 03:30:54 GMT

- reply

OK so apparently setting DNS to 0.0.0.0 means setting the upstream DNS so that works to close off DNS.
And then I can use firewall-cmd to configure container networking policies, except for some reason the firewall zone is hardcoded to "trusted" by podman so I have to use that one...???

2026-05-06 03:08:36 GMT

- reply

It looks like I can use a non-internal network with no default route I guess? But then the containers can access ports on the host so I guess I need to firewall-cmd those off...
And also there's a DNS hole (the podman DNS server will still resolve external DNS names)... I have no idea how to disable that.

2026-05-06 02:48:31 GMT

Podman question: PublishPort works with default networking, but not when I attach the container to an internal network.
Am I missing something? How do I get inbound only access to a container which otherwise has isolated networking?
(First time using podman/quadlet stuff)

2026-05-02 06:19:13 GMT

- reply

@nprofile…tc7m Sigh...

2026-05-02 00:36:24 GMT

Why does Mastodon not have even an attempt at nuclear block? Someone can just reply to you, block you, then your server will diligently stop you from viewing their posts but everyone else still can in your replies??
Even Twitter does better than this. I get that with federation it's tricky to fully nuke a reply, but at least your local instance should be able to hide replies of blocked users from everyone else local and from queries for context from other instances??

2026-05-01 12:43:18 GMT

- reply

@nprofile…w0xj @nprofile…3qq0 AIs are not people and you cannot treat them like people. Big AI would like people to do that, but that treatment is far from legally settled and certainly not universally recognized.
The whole point of ethically trained AI is to *not* subscribe to the idea that training a model on copyrighted material erases the original copyright. Therefore, a model billing itself as free from copyright issues while openly training on data that does not allow such use in its licensing is essentially misleading its users. That is not okay.

2026-05-01 07:38:53 GMT

- reply

Replies: "This model supposedly is safe"
*Looks inside*: Huge pile of web scraped data without consent and ignoring licenses.
Seriously, this is a tragedy. LLMs are useful. You might not be able to train ChatGPT without stealing, but you can totally train a useful base model for task specific fine tuning without stealing. Why is almost nobody even trying????

2026-05-01 07:31:16 GMT

- reply

@nprofile…3qq0 Haha no that one is web scraped and only supposedly respects "opt out". Copyright doesn't let you take whatever you want unless the person you took it from asks you to stop, that's not how it works.

2026-05-01 06:23:00 GMT

- reply

So far the only one I've seen that credibly can claim to be free of copyright concerns is KL3M (it was created... by lawyers).
Are there any others?

2026-05-01 06:10:59 GMT

Why are AI people so monumentally *bad* at copyright?
I'm looking for ethical/copyright-safe training data sets. Common Corpus sells itself as that... but then I go read the paper and they include CC BY-SA scientific papers and GPL stuff from GitHub, and then in models trained on that dataset they proudly state:
> Only trained on open data under a permissible [sic] license [...] By design, all Pleias model are unable to output copyrighted content.
Um, no?? CC BY-SA is not public domain, it's a copyright license. You can't train on CC BY-SA content and then claim your model is any more copyright-safe than whatever Google and Meta are releasing. It just means you're violating the copyright of people releasing content under open licenses only.

2026-04-30 05:11:34 GMT

- reply

@nprofile…nx9p TBF it's about one full 42U rack, going by the numbers (photo shows half of it, looks like 10U per chassis and there's 4), so about one (large) fridge worth of servers (and many, many times the power consumption of two office towers).
Still nothing compared to LLM training of course ^^

2026-04-29 02:37:02 GMT

This is not okay. Trolling a FOSS project showing off a zero day instead of sending PRs or a proper security report... and the only justification given is that they didn't like a PR removing a feature, and haven't merged yet another PR opened yesterday??

2026-04-21 01:34:17 GMT

The stuff Apple rumor news media comes up with is *wild*. Someone linked this article from 2010 as evidence that Apple was working on ARM macOS back then.
https://appleinsider.com/articles/12/02/07/apple_intern_thesis_leaks_secret_project_to_port_mac_os_x_to_arm_processors
Darwin already ran on ARM, that's what the iPhone is. I think someone read "multi-user mode" and thought that must mean full macOS instead of iOS. 🤦‍♀️
I know Tristan. It was a project to port Darwin to the AirPort Time Capsule, which ran NetBSD at the time.

2026-04-19 03:27:18 GMT

TIL that Docker by default doesn't rotate logs... which means that Docker by default will sooner or later crash and run out of disk space... and this is apparently intentional for "backwards compatibility"...

2026-04-16 07:04:52 GMT

A friend asked Gemini to do a security assessment of a recent open source macOS app (look through code, developer behavior, user forums, etc).
It spat out a 2,500 word essay painting the whole thing as a massive backdoor, talking to C&C servers, reading your chat messages, bypassing macOS security, the works. Entirely coherent on the face of it, overdone but it *could* have been real and someone not in infosec would easily buy it.
100% hallucinated. Gemini wrote an entire infosec fanfic based on nothing. Worst thing I found on the real repo was a symlink traversal bug that was quickly fixed by the dev.
This was using the "Deep Research" function in "Pro" mode on an "Ultra" account.

2026-04-04 11:10:11 GMT

Help!!! This is a cute little router right??
I'm showing it to Cyan and she says it's not cute!! How do I convince her it's cute? 😭😭
https://media.vt.social/media_attachments/files/116/346/127/010/095/146/original/9520d241ac86ff28.jpeg

2026-04-03 10:32:51 GMT

If you use Firefox in Fedora and you currently lose your home page setting after updates please get in touch.
There is some kind of extremely stupid bug going on and people have been talking past each other about it for years. I will get down to the bottom of this.

2026-04-02 23:04:21 GMT

- reply

@nprofile…6qkh "I don't use Fedora any more".
Great.

2026-04-02 08:58:17 GMT

- reply

@nprofile…6qkh I DMed the person who started that Reddit thread, but I'm going to be so annoyed if they don't want to help... "I just want them to remove the stupid homepage" is a pretty likely response...

2026-04-02 08:48:02 GMT

- reply

@nprofile…6qkh That's fair, but like, sigh.
It's really sad that in all these years nobody sat down and actually reported this properly... and we still don't know what causes it.

2026-04-02 08:41:38 GMT

- reply

@nprofile…6qkh No, that setting is and has always been there. It's a defaults change. You and everyone else seeing this bug are incorrectly assuming it is "applied on updates". It never was, and there never was any mechanism for it to be.
It is, and has always been, a bug. But everyone who hits it assumes it's evil packaging.

2026-04-02 06:01:45 GMT

- reply

@nprofile…6qkh I just tried Firefox 119 in a Fedora 39 distrobox. Upgraded to 132, no reset. Carried over the profile to 149 on F43, no reset.
I really don't understand how some people could hit this all the time and some people never saw it...

2026-04-02 05:35:07 GMT

- reply

@nprofile…6qkh I just did a manual test with FF 143 -> 144 -> 149 and it was fine...
I wonder if it has something to do with upgrading Firefox while it's running? That has a habit of crashing it, I wonder if that somehow corrupts preferences?

2026-04-02 05:14:27 GMT

- reply

@nprofile…6qkh Because apparently everyone who has it happen thinks it always happens, and nobody actually bothers to report the bug, and then someone sees it on Fedora and thinks it's intentional, and it turns into an echo chamber of people spreading FUD saying it's all an evil Red Hat plot.
If you are experiencing a bug, *especially* if you are experiencing it consistently and releatable

2026-04-02 04:56:47 GMT

This thread is such a massive failure of the community bug reporting process.
https://www.reddit.com/r/Fedora/comments/1s8jevj/a_message_to_fedora_devs_please_stop_interfering/
Apparently there's a small but significant fraction of users who see their browser home reset to the Fedora home on Firefox updates or other circumstances... and they're all convinced this is some kind of evil intentional Fedora packaging feature that hijacks your preferences on every update, and that it must happen to everyone (it does not).
So far there is one known hypothesis for why this can happen (it involves Firefox Sync), but that doesn't cover all instances because some affected users claim not to use Sync. I reported this one upstream so hopefully there will be a solution soon. Nobody had until now...
Meanwhile, not a single affected user has bothered to write up reliable repro steps or follow through with maintainers on tracking down the root cause.
I've also looked at upstream bugs and found several shaped like "Firefox lost my prefs on upgrade", but none of them were followed through to a root cause either.
Of course, when Firefox loses the home page pref and it reverts to about:home, people shrug and set it back... but when Fedora Firefox does the same and it reverts to start.fedoraproject.org, it's clearly a Red Hat conspiracy to hijack people's browsers and they demand Fedora remove the default home page branding override entirely, instead of working with a developer to get the bug fixed...

2026-03-31 12:07:32 GMT

I've been working on a little tool to automatically optimize Fedora for real-time audio processing. 🎶
Is anyone interested in testing it? Bonus points if you know what audio buffer sizes and xruns are (so you can tell if it helps) ^^
https://media.vt.social/media_attachments/files/116/323/703/217/665/020/original/9bf51e97a5c0c89a.png

2026-03-26 08:14:34 GMT

TIL Linux loses IRQ SMP affinity configuration when you sleep/resume (x86). This seems... less than ideal?

2026-03-20 13:57:22 GMT

Cyan: I feel so bad! It's Friday night and I'm not posting anything! It's the best time for engagement!!
Me: Oh, really? Is that more important than this?
*Long kiss*
Me: You can post about that~✨
Cyan: .......... you post it ><

2026-03-09 14:49:07 GMT

- reply

@nprofile…r3vy FYI your instance seems to have a very old display name cached for me (that it is using for mentions) ;;

2026-03-09 14:31:03 GMT

- reply

@nprofile…s32f Possibly? I might try removing all "hints" from one and trying again and seeing if it's any different. But that also affects human solvers... the hints are there to point you towards a website that explains the fundamentals of what's going on. The LLM didn't even read that, it just guessed from a filename and a comment and hulk smashed its way to guessing the general concept right with multiple attempts...

2026-03-09 12:47:05 GMT

- reply

@nprofile…ev82 It's much easier to parallel construct a CTF solution than a programming challenge. CTF challenges are all about having a series of realizations that lead to the answer.
If you ban LLMs in a programming challenge, you could conceivably detect signs of LLM usage in the program in various ways (not perfectly, but you could try). A CTF challenge just has one output, the flag. Everyone finds the same flag. There is no way to tell how you did it. You'd have to introduce invasive monitoring like online tests, and even if you record people's screens, they could easily be running an LLM on another machine to have it come up with the "key points" to the solution which you just implement. You can't prove that someone didn't have some ideas on their own.

2026-03-09 11:45:13 GMT

- reply

I might still do a monthly challenge or something in the future so people who want to have fun and learn can have fun and learn. That's still okay.
But CTFs as discrete competitions with winners are dead.

2026-03-09 11:42:19 GMT

- reply

And honestly, reading the Claude output, it's just ridiculous. It clearly has no idea what it's doing and it's just pattern-matching. Once it found the flag it spent 7 pages of reasoning and four more scripts trying to verify it, and failed to actually find what went wrong. It just concluded after all that time wasted that sometimes it gets the right answer and sometimes the wrong answer and so probably the flag that looks like a flag is the flag. It can't debug its own code to find out what actually went wrong, it just decided to brute force try again a different way.
It's just a pattern-matching machine. But it turns out if you brute force pattern-match enough times in enough steps inside a reasoning loop, you eventually stumble upon the answer, even if you have no idea how.
This sucks.

2026-03-09 11:28:24 GMT

- reply

This is, quite frankly, the same problem LLM agents are causing in software engineering and such, just way worse. Because with CTFs, there is no "quality metric". Once you get the flag you get the flag. It doesn't matter if your approach was ridiculous or you completely misunderstood the problem or "winged it" in the worst way possible or the solver is a spaghetti ball of technical debt. It doesn't matter if Claude made a dozen reasoning errors in its chain that no human would (which it did). Every time it gets it wrong it just tries again, and it can try again orders of magnitude faster than a human, so it doesn't matter.
I don't have a solution for this. You can't ban LLMs, people will use them regardless. You could try interviewing teams one on one after the challenge to see if they actually have a coherent story and clearly did the work, but even then you could conceivably cheat using an LLM and then wait it out a bit to make the time spent plausible, study the reasoning chain, and convince someone that you did the work. It's like LLMs in academics, but much worse due to the time constraints and explicitly competitive nature of CTFs.
LLMs broke CTFs.

2026-03-09 11:28:15 GMT

- reply

So it's not surprising that an LLM can solve them, because it automates the process. That just takes all the fun and all the learning out of it, completely defeating the purpose.
I'm sure you could still come up with challenges that LLMs can't solve, but they would necessarily be harder, because LLMs are going to oneshot any of the "baby" starter challenges you could possibly come up with. So you either get rid of the "baby" challenges entirely (which means less experienced teams can't compete at all), or you accept that people will solve them with LLMs. But neither of those actually works.
Since CTF competitions are pretty much by definition timed, speed is an advantage. That means a team that does not use LLMs will not win, so teams must use LLMs. This applies to both new and experienced teams. But: A newbie team using LLMs will not learn. Because the whole point is learning by doing, and you're not doing anything. And so will not become experienced.
So this is going to devolve into CTFs being a battle of teams using LLMs to fight for the top spots, where everyone who doesn't want to use an LLM is excluded, and where less experienced teams stop improving and getting better, because they're outsourcing the work to LLMs and not learning as a result.

2026-03-09 11:27:58 GMT

There's a lot of discourse on Twitter about people using LLMs to solve CTF challenges. I used to write CTF challenges in a past life, so I threw a couple of my hardest ones at it.
We're screwed.
At least with text-file style challenges ("source code provided" etc), Claude Opus solves them quickly. For the "simpler" of the two, it just very quickly ran through the steps to solve it. For the more "ridiculous" challenge, it took a long while, and in fact as I type this it's still burning tokens "verifying" the flag even though it very obviously found the flag and it knows it (it's leetspeak and it identified that and that it's plausible). LLMs are, indeed, still completely unintelligent, because no human would waste time verifying a flag and second-guessing itself when it very obviously is correct.
But that doesn't matter, because it found it.
The thing is, CTF challenges aren't about inventing the next great invention or having a rare spark of genius. CTF challenges are about learning things by doing. You're supposed to enjoy the process. The whole point of a well-designed CTF challenge is that anyone, given enough time and effort and self-improvement and learning, can solve it. The goal isn't actually to get the flag, otherwise you'd just ask another team for the flag (which is against the rules of course). The goal is to get the flag by yourself. If you ask an LLM to get the flag for you, you aren't doing that.
(Continued)

2026-03-09 04:10:48 GMT

Cosmic Princess Kaguya watch-along NOW with Cyan!!!
https://www.youtube.com/watch?v=2TFNWaKnl5Y
https://media.vt.social/media_attachments/files/116/197/257/634/697/711/original/2e82218538c408d6.jpg

2026-03-09 02:14:06 GMT

- reply

Honestly it feels like AI is... something like optimizing for nitpicking "best practices" while completely missing the real issues.
Nobody writes code according to all "best practices". Error handling in the example above is an anti-pattern. This isn't a kernel. Littering your code with NULL checks for memory allocation (and functions which can only fail due to memory allocation failures behind the scenes, like fdopen) is a net negative because it achieves nothing (if small mallocs are failing you code is going to crash anyway) while making the code more obtuse and complex and hard to read, which means real bugs will slip through more often.
If you're the kind of person that cares about having more "strictly correct" code... you shouldn't be using C to begin with, but rather a language where doing that doesn't hurt readability (like Rust). But AI isn't going to give you that advice...

2026-03-09 01:17:50 GMT

Out of curiosity, I wanted to see if ChatGPT noticed the bug/mistake I mentioned here:
https://github.com/obsproject/obs-studio/pull/13198#issuecomment-4019545931
I pasted the relevant function in and... it nitpicked all sorts of irrelevant stuff about error handling (allocation failures etc), types, and API contracts, and completely missed the actual issue. It even mentioned "the use of CLOEXEC is reasonable" and the fact it conflicts with some logic branches was completely missed.
This is a function using standard POSIX APIs. This isn't even obscure code, it's doing something (spawning a process with a pipe) that has been done a million times before.
It just didn't catch this bug because this bug / a similar shaped bug wasn't in its training data. Because AI isn't intelligent, it's still just fancy autocomplete and can't think.
("But you didn't catch it either" - I wasn't reviewing the whole function when I wrote that PR, I was fixing a different bug and had some tunnel vision since I was just normalizing/extending/fixing a pattern that was already there, so I didn't notice the use of CLOEXEC earlier. But I did ask ChatGPT to review the whole function, not just the PR change.)

2026-03-04 11:05:19 GMT

- reply

@nprofile…9ula You can only add devices on a filesystem that is already mounted RW!

2026-03-04 08:21:58 GMT

- reply

I didn't actually do the dm thing (I was using an image file I could just expand), but if you actually wind up needing to do this, there's an example in the second snippet here:
https://docs.kernel.org/admin-guide/device-mapper/linear.html#example-scripts

2026-03-04 08:14:23 GMT

Someone brought up the issue of running out of space on btrfs and not being able to delete stuff. There are posts about this from years ago, but I wanted to see if it's still a problem.
The answer is... kind of, if you try hard enough and do absolutely unhinged things. I had to create a snapshot of a tiny (4GB) but full (data + metadata) filesystem with hundreds of thousands of files (with data, with xattrs, and empty to fill everything up) and then delete files without deleting the snapshot, retrying when I got an error and sync()ing the filesystem every time. At one point I managed to make the FS go read-only, and then remounting again and trying more torture in parallel shells eventually got it wedged into a state where it couldn't mount R/W at all (cannot do orphan cleanup due to -ENOSPC).
Even then, the FS was still mountable R/O (so all the data was recoverable). And even then, I found a way out: although you can't add a device to a FS that isn't mounted R/W, you can expand the base device with btrfs filesystem resize --offline, and you can use dm to glue two devices together temporarily for this purpose. I was able to mount R/W then, delete stuff the "proper" way (snapshots first), shrink again, and completely fix the situation.
So yeah, I don't think this is really a problem any more, more specific bugs notwithstanding. You have to try really really hard to cause the issue and even then there's still a way out.

2026-03-03 14:04:11 GMT

I just caught up with a friend and she was like "so your stories with Cyan are real?? I thought it might be a bit because it's so incredibly cute I wasn't sure if that was possible!!"
Yes it's real girl!!! I'm sorry I know our life is too anime to be believed 😭😭

2026-02-28 16:14:58 GMT

- reply

@nprofile…ht9p @nprofile…cer5 Thank you so much!!! ^^

2026-02-28 14:59:00 GMT

- reply

@nprofile…s6dx The LiDAR sensor on those devices is on the back, not the front ^^

2026-02-28 14:57:38 GMT

🩵 WEDDING ANIMATION TEASER REVEAL!! 🩵
I'm marrying @nprofile…cer5 later this year!!
We put together a professional animation for the event, come watch the teaser!! ✨✨️
https://youtube.com/watch?v=O0Xt_wctgBg

2026-02-28 05:57:32 GMT

Another common misconception: iPhones don't have "LiDAR" sensors in front.
The Face ID / TrueDepth camera is a standard infrared camera using SLS (structured light sensing).
In other words, it's a miniature Kinect 1.
Apple bought the company that built Kinect 1 to build this!
This is in contrast to Kinect 2, which uses a Time-of-Flight camera which *is* a form of LiDAR (Flash LiDAR). https://soul.art is another company using ToF LiDAR sensors for motion tracking.

2026-02-28 05:12:37 GMT

- reply

(For those new to this stuff, there's two kinds of reverse engineering: the kind you do to build an actual product/software you release for widespread use, and the kind you do for research, education, or security. The rules are really different. This would be the second kind.)