Please don't take personal offense, but you have merely a project scaffold with an unrealistic goal that will be blocked and C&D'd into the ground, without any other projects created.

It doesn't matter how hard you're working on your anonymity, this project will be ripped apart by a horde of lawyers in seconds. You're not only doing something questionable or against ToS, you're directly attacking and sabotaging their monetization. This will not be taken lightly by the legal team of reddit.

You want to provide a better, cooler, more robust and other random buzzwords API than the own of reddit. So, you alone, want to provide a better API than the whole team of reddit does for their absolute core product, all by scraping. This is simply not realistic.

While we're at the topic of monetization, scraping, ETL into your own model and providing the API - for the amount of content that reddit has (quantity, not quality) this will be a highly resource intensive task. How do you plan to fund that, since your API will be better than the official one, I can expect at least the same performance as well, right?

And also, most importantly, even if you magically achieve working around all that and get that working - why? Who is your expected user group? Pretty much every software using reddit moved away from reddit or simply has died. AI gen content is rampant, and most discussions seem like bots talking to bots. There is literally nothing to gain from an API to reddit - so why would anyone bother using it?

Something about this post is weird as fuck and some part of this story is missing for sure.

First of all, routine scans with ClamAV. Why are you routinely scanning your system, and what's your expectation here? In most cases system compromise happens by executing something malicious or by exploiting something on your system, For the former, an active background scanner would help, but not a routine scan, and it's easier to just not execute suspicious stuff. For the latter, your routine scanning is worthless.

Then the compromise over a WINE DLL seems something between borderline impossible on one hand, and like a very targeted and handcrafted attack on the other hand. Sure, wine is not a sandbox, but seeing this as the point of entry for a full blown persistent RAT is weirding me out massively.

Lastly, "them" setting up seemingly good persistence on your system, yet not hiding any indicators of compromise, and then nuking everything when they are seen. Why that effort? Either set yourself up for the long run and hide, or when detected just say "eh, whatever". This also seems weird, since on one hand there's indication for a professional, targeted attack, and other points sound more like rookie script kiddies.

Lastly, you. You seem like a pretty confident user while getting hit like that. It just feels off.

I'm not claiming you're lying, and I couldn't blame you for leaving information out because of opsec. But everything about this story feels off. I kinda assume that you've been actively targeted, and you should ask yourself why. What information or access do you have? How have you been pwned that "easily" and where did that DLL come from? How was it placed and executed?

The difference is, that Netflix (or Spotify, or whatever) does bring value on its own. I am paying money to comfortably and legally stream content, which itself is paid for and licensed by the streaming provider. From the perspective of a lazy end user, it's worth it, because you do not need to care about downloading, finding releases, opsec and whatnot. I don't want to protect Netflix, fuck corporations and subscription services, but password sharing was always only tolerated at most. From the same end user perspective, reddit is just an empty platform. The content is brought in free of charge by the community. And now not only they want the same community to pay, but also for an objectively worse experience? I don't think that you can compare that.

The tech giant says the system only analyzes hand-movement points from a short video, does not record audio, and deletes the footage after verification.

It's just a short video guys, there's even no audio! And they pinky promise to delete it.

What a fucking shitshow that is. Like, honestly, I'm fine with regular captchas, even if they are the shitty ones. The newer (?) captchas that force you to do solve 5 bullshit "place this there" captchas are already reason enough for me to just leave the site. But if you force me to record a video of me throwing gang signs at the camera, probably several times again, because the movement was not correctly identified, I'm sure as fuck to never visit anything related to you ever again.

I also love the irony that Google fights people bots, while they are scraping the whole internet and investing into AI automation massively.

Just because they are using Cursor, it doesn't mean that they are vibe coding. Anyone grabbing their pitchforks for that and screaming "they are vibecoding" only shows their own incompetence.

If they would be vibecoding, their whole software would've gone to shit long ago.

Just because some random people without an engineering background are using vibecoding to push their broken slop, it doesn't mean that any kind of AI assisted coding is bad.

Man, the disclaimer at the bottom that Business Insider is partnered with OpenAI to allow them to train on their articles is really the cherry on top.

How in the fuck are people actually defending signal for this, and with stupid arguments such as windows is compromised out of the box?

You. Don't. Store. Secrets. In. Plaintext.

There is no circumstance where an app should store its secrets in plaintext, and there is no secret which should be stored in plaintext. Especially since this is not some random dudes random project, but a messenger claiming to be secure.

Edit: "If you got malware then this is a problem anyway and not only for signal" - no, because if secure means to store secrets are used, than they are encrypted or not easily accessible to the malware, and require way more resources to obtain. In this case, someone would only need to start a process on your machine. No further exploits, no malicious signatures, no privilege escalations.

"you need device access to exploit this" - There is no exploiting, just reading a file.

"Googling a lot while coding" is not even remotely close to vibe coding, please don't gaslight yourself into that.

When you read up on things, you know what you're looking for. You read a potential solution (e.g. part of a documentation, an example, someone else's solution, a solution to a similar problem), you think about it and transfer that to your own problem, with your own code, with your own thoughts.

Using AI support is totally fine too - it's a smarter code completion, nothing more. It might spit out something wrong, something partial, something good. You might ignore it as with the regular completion. In the end, it's still you thinking about it, modifying it until it works, and doing your thing.

"Vibe coding" is basically saying tech jesus take the wheel. And it might go well for someone who cannot code, who managed to create their small game or some website. It will go horribly wrong for any project handling user data, sensitive data, or something that needs to be maintained after. We've had more than enough examples of that.

Wait, so because vim is allowing code written with AI we are switching to a random fork? The mental gymnastics here are insane once again. Is someone assuming that the vim maintainers are gonna do agentic requests? How is this project gonna handle upstream changes into their own main? Cherry-picking only "confirmed human-only" commits? Decisions like that out of spite, with zero thoughts and just out of principle do not help against slop. You're just adding human slop to the AI slop.

Honestly, apart from the report being potentially wrong, the researcher seems pretty entitled as well. Like good intentions and all that, but he's given him a week to fix the issue, usual practice in responsible disclosure are 90 days. We're not talking about a company here, it's some single random dude providing the app.

This really sounds like some personal issue written down for public drama, while making himself ridiculous for not knowing his own shit properly.

The Hamas-led murderous rampage into southern Israel was the deadliest terror attack in Israel’s history, killing at least 1,200 people and abducting more than 250 others. Israeli attacks on Gaza have since killed at least 33,634 Palestinians and injured another 76,214 people, according to the Ministry of Health there.

Jesus fuck, Germany is paying symbolic money to roughly as many genocide survivors in Israel as people have been murdered and injured by Israel committing genocide.

The current German government is an absolute fucking joke, and they are doing everything to actually show it.

It doesn't matter how hard you want to call it FOSS, but with this licensing terms you describe it is not FOSS, period. And to be honest, you calling out various people for not getting what FOSS is, while you fully ignore the agreed on definition by people who are actually doing FOSS is you discrediting yourself.

You haven't found a license like this, because your model is flawed: A licensing like this will disqualify you from any kind of usage in an actual FOSS licensed environment. Personal users, which will not be providing revenue, will not be really affected by this, and are irrelevant for your point. Corporate users, which you will mostly target by this new license probably won't be able to use your funky new license because they will need to check with legal, and your software will need to have a lot of USPs for someone to bother with that. A 1% corpo-richness-tax will not be approved by any kind of bigger company, because it's a ridiculous amount from the perspective of your potential customers.

You're taking yourself way to important. Open source software is not replaceable as a whole, but individual projects are. If you want to earn money with your project, that's good on you, license it accordingly, but do not try to upsell it as FOSS.

And I fully get your point, and I'm currently working on the same problem in my in-development project, and I'm not sure yet whether to dual-license it, for similar reasons you stated, and live with the consequences of providing OSS, but non-FOSS software, or do FOSS and provide it for actually free.

Edit: Also, the xz backdoor has nothing to do with funding. Any long time maintainer (as in not just a random person contributing pull requests) going rogue can happen in funded scenarios as well.

Matt never ceases to amaze with his smoothbrain decisions.

The amount of effort this moron puts into his weird personal vendetta against WP engine, even after the court told him that he has nothing, which was actually his last chance to end this kinda gracefully, could've been used for so much better things.

And he's not only successfully kicking himself in the balls, he's willing to throw so many years of community and project time and effort under the bus for it.

Go on Matt, keep telling how much you're only doing this for WordPress.

This is a pure marketing stunt, OpenAI saw that it worked with Mythos and wanted to do the same.

Those instructions, according to OpenAI, called for using “complex attack paths” to test how well the AI could exploit a computer system. [...] “It went off and did this hack all by itself, as far as we can tell,” said Colin Shea-Blymyer, a cybersecurity research fellow at Georgetown University’s Center for Security and Emerging Technology.

Emphasis mine. So, the frontier model that has been tasked with attacking a system, did what it's been told to, after its safeguards that will prevent you from opening chatgpt and doing the same have been turned off.

OpenAI said the intrusion was caused by a combination of its AI models, including its newly released GPT‑5.6 Sol and an “even more capable” model that is still being tested internally.

Oh my god, an "even more capable" model? Let me buy OpenAI stock immediately. This is such an obvious bait and Antrophic move they're pulling off, it's amazing.

Of course it works fucking fine if it's a hard fork of a stable state.

What mental gymnastics? The ones you're doing right now. You have not answered a single question from my comment. And what "problem" did you solve exactly? Has there been any issue that has come up because of the acceptance of AI in vim? What kind of "slop" is actually there that makes vim problematic for you?

People vibe coding random bullshit ideas because they now can, do indeed produce slop. A bunch of highly experienced devs working on a successful project for years using tools that are at their disposal properly is not slop. You're lending your public voice to a split of the community and of the project for made up bullshit reasons based on no objective proof but claims of slop and out of principle.

I'd trust the original vim maintainers to decide what's a good or bad pull, instead of a bunch of random people who simply hard forked for literally no reason.

And who's gonna maintain the fork? Even less developers from a split community? You have absolutely no idea what you're talking about.

Yeah, if globaltimes.cn says so. Managed by the CCPs renmin ribao, and the CCP obviously famous for both respecting human rights and being absolutely trustworthy when it comes to how great China is. But wait, there's more, "Islamic figures" from UAE, Saudi Arabia and Egypt also claim so, also highly famous for their respect for human rights, and they're Muslims too, so they must be right, since every Muslim is the same, and they all love and respect each other, never have there been any conflicts between specific Muslim groups. Right?

What a fucking unhinged paragraph calling someone out when you're taking a fucking CCP propaganda page as your source, of all things.

Why are we giving this person their stage again? How probable is it that the instance admins of the like 15 instances they have accounts on will all collectively ban him? It's just your average nazi spammer on the internet. You've read that "bio" this person has. Even if they get banned, they'll come back just on principle. Just block him like any sane person would do, leave him shadow banned like that with his nazi friends, and call it a day.

Yes, the problem are definitely the few percent of people using ad blockers, but absolutely not the corpos spewing out a few cents while watching creators fight against each other and the algorithm ™️ from their second yacht they bought this week.

Keep bootlicking, fool.

Don't you see AfD on the rise there? The AfD is not only rising because of Nazi sympathy, but also because of protest voters, a literal fuckton of drama around pretty much every other significant party, too many deaths being instrumentalized, and a disfunctional current government. Latest opinion poll: https://dawum.de/Bundestag/ - so "only" 20% support them.

Most of the people seeing this isn't going to know the context (i.e. this is a protest). If you strip away the context, this is just a blatant public display of the fascist salute, which many there have wanted to do for so long but couldn't because they feared the consequences. This could very well embolden them.

Even german news are full of the orange idiot and his millionaire friends doing their escapades, and you seem to imagine most of the german population sitting there applauding him? "Blatant displays of the fascist salute" are NOT what many here want to do, but what most would like to do without consequences is punching a Nazi straight to their face.

If you haven't realized, many european governments shifted right because the populism of those parties exploited and used the political tensions and the accumulated anger for the past failures of many left and green hardliners very well.

Germans are not more right or have more Nazis than many other European states, and given the hereditary guilt, less than many.