Pauliehedron ✅

@catsalad@infosec.exchange can I haz change in EUR plz k thx 🤗

@GossiTheDog@cyberplace.social Every slack channel: Hey Luigi, it's Luigi. How's Luigi doing on that sprint that Luigi's team is waiting on? Great! I'll let Luigi know.

THE MYTHos CASE MANIFESTO 🏛️🎭 FORM: MYTHos Case — a hybrid naming convention where the PREFIX is SHOUTED (all caps) and the suffix is lowercase, with no separator: PREFIXsuffix. Variants: Standard (MYTHfunction, BIGclaim, HYPEtrain) for variables and functions; Compound (MYTHoscodebase, GLASSwinginitiative) for multi-syllable proper nouns; Verb form (MYTHfind, MYTHvalidate) for methods that promise more than they deliver; Adjective (MYTHsecure, MYTHgrade) for descriptors; Status (MYTHlive, MYTHshipping) for features that exist in press releases only. Syntax semantics: The uppercase segment represents the reputation, marketing, and hype. The lowercase tail represents the actual output. The lack of a separator (underscore, hyphen, or capital bridge) symbolizes the gap between the two — they're in the same string but not truly connected. STORY: In Q2 2026, Anthropic launched Project Glasswing — a $100M vulnerability research moonshot powered by their "Mythos" model. The fanfare was biblical: "thousands of critical vulnerabilities," "transforming software security," "a new era for cyber defense." The data told a different story. Against open-weight tools like AISLE using commodity models (3.6B parameters, $0.11/M tokens), the results were damning: Anthropic claimed 6,200+ high/critical findings; VulnCheck found 1 CVE directly attributable to Glasswing; AISLE (no Glasswing budget) scored 250+ CVEs — a 250:1 ratio; curl's creator called the hype "primarily marketing"; 207+ findings sat past the 90-day disclosure deadline, unpublished. The gap between the capitalized promise and the lowercase delivery was so wide that it needed a name. MYTHos Case was born — a naming convention where the MYTH sits in ALL CAPS up front, and the "os" (Greek: "what actually exists") trails behind in lowercase, visibly disconnected from the prefix that claims ownership of it. It is the convention for claims that are technically in the same sentence as reality, but not quite touching it. MAP: The six customary cases of programming: (1) camelCase — wordWordWord, myVariableName, workhorse everyday variables (JavaScript, Java, C#); (2) PascalCase — WordWordWord, MyClassName, authority for classes and types (C#, Java, TypeScript); (3) snake_case — word_word_word, my_variable_name, clarity and Pythonic readability (Python, Ruby, Rust); (4) SCREAMING_SNAKE_CASE — WORD_WORD, MAX_BUFFER_SIZE, finality for constants and macros (C, Python, bash); (5) kebab-case — word-word, my-component, connection for HTML/CSS and URLs (HTML, CSS, CLI tools); (6) 🏛️ MYTHos Case — PREFIXsuffix, MYTHfunction, contradiction — capital promise and lowercase delivery — for hypeware, vaporware, and marketing-led initiatives, wherever the gap between promise and delivery needs a convention of its own. MYTHos Case is the only convention where the relationship between case and content is ironic — it visually enacts the very disconnect it names. The uppercase shouts what it wants to be; the lowercase whispers what it actually is. 🎭 Not the myth, the legends are right here -> AISLE — the team that's been quietly cleaning up while the big names grabbed headlines: | Link | What's There | |---|---| | aisle.com | Main site — "AI-Native Vulnerability Management" | | aisle.com/blog/what-ai-security-research-looks-like-when-it-works | Their February 2026 post directly comparing their approach to Glasswing/Mythos — includes the curl story | | aisle.com/blog/how-aisle-securing-open-source | How they're securing OpenSSL, curl, FreeBSD one PR at a time | | aisle.com/open-source | Their open source partnerships page | | github.com/apps/aisle-research-bot | Their open-source GitHub bot for PR-level security analysis | 🎭➡️💪 "Drafted with AI assistance; reviewed before posting (we use the machines against the machines. -pjm)"

@davidgerard@circumstances.run It's so the bots read it, then it becomes "truthy facty" later when they and the AIs regurgitate it. Poisoning the quick info well... and the people writing it make $20.

@ai6yr@m.ai6yr.org @Viss@mastodon.social I deal with this on MacOS all the time. LLMs can't write correct zsh because most of the corpus is linux bash, but their bash is bad because the MacOS userland is BSD so all the cli tool calls have wrong options. So I have to tell it to use POSIX sh and no awk to have stuff work. 🫠

@wdormann@infosec.exchange The why copy.fail on Debian 12 v6.1 I think is hinted at the bottom of this https://seclists.org/oss-sec/2026/q2/324

@julie @gayint As the owner of a "legit" .zip I lol :ablobcatlurk:

@applsec No CVE entries.... YET.

@catsalad@infosec.exchange Sometimes subscriptions are worth it.

@SeanCasten But the Dutch Sean, they did it! lmao

@dw_innovation@mastodon.social I remember when you were just 6 or 7 posts. 😜

@wdormann This was one of the reasons I pushed so hard to standardize on a rolling release version; because it was easier to deal with reverting to a known good version with breakage than trying to keep track of all the CVEs with different distros and whatever kernel they are packaging for what release cadence for a particular flavor/variant/age/release/support. I'm still behind, but an understandable behind.

@jerry@infosec.exchange I don't notice any difference!! WTF :ablobpeekjohnny: :ablobcatlurk: 😂

@cR0w @julie @gayint Will the real slim ZIP-ies please stand up?

@CursedSilicon I just remember seeing the 100 lot price was like $3 when I was working with Cisco TAC on trying to get the damn things to roam. Surface was over a grand, I know a dollar more at scale is a lot, but MS could have afforded a slightly more premium chip and still kept margins healthy I suspect.

@hannah@posts.rat.pictures I saw some ping pong ball size too, but mostly shooter marble.

@CursedSilicon Is it even worse than the Marvell in the Surface? Those things gave me such headaches I quit doing anything with enterprise wifi if they were part of the deployed user base.

@Dio9sys @garius Novell was bought by MicroFocus who (also had Attachmate but divested SUSE) and is now owned by of all companies, OpenText.

@jwgoerlich It's wild that the AI used the bandaid shade for "people". It's almost like it's knows the violence inherent in the system.

@jwgoerlich The default tan color, chosen in the 1920's for bandaids because it blended in with white skin. This AI stuff learned on our culture, so therefore produces "people" with that skin tone, hence my comment. It's easy to miss, like permission sets in OneDrive vs Sharepoint.

@1password@1password.social Ah, so this deconstruction is why I have been getting to be almost daily system issue emails across the cloud stack which say they are for "scale issues" it's really you teasing out pieces then having to tape over the leaks? There was an implicit trust when you dragged us from Dropbox/iCloud local sync to your cloud. You've expanded your product set outside your historical core business and now money and scale are meeting the monolith. I hope us customers survive.

@kasparov63@bird.makeup It's called a LOSS LEADER (milk, government cheese, bread), and its been done under capitalism for a while. Utility > Optimal, sometimes even the master needs to take a step back and look at the whole picture; a CIGAR is sometimes a CIGAR.

@newsguyusa@flipboard.social Get'em Steve!!!

@merill@infosec.exchange Is this actually Tip #7?

@SeanCasten@mastodon.social Except you're not in Philadelphia anymore, so the songs don't quite line up "twiddle, diddle, and resolve, nothing's ever solved".

@aaron.rupar Cognitive decline DONBIDEN!!!!!1111111