Jonas Vögel

i build things. i post about open source when it's actually worth your time.

[Jonas Vögel @jbirdy]

@EvelynInaba Hilarious

[Jonas Vögel @jbirdy]

@Robbie675498525 @BlendiByl Nope he should just not release it with the games assets bundled. Game companies tend to sue pretty quickly

[Jonas Vögel @jbirdy]

@valigo Exactly its just acting in bad faith

[Jonas Vögel @jbirdy]

@realpastaya @EliasDaler And they will claim theirs has 0 bugs because Astra said so

[Jonas Vögel @jbirdy]

@AkiraJkr1 @TheIshikawaRin I swear hahahaahh

[Jonas Vögel @jbirdy]

@Darthshadow25 @BlendiByl Sure. Decompiling the binary, ripping the assets, and shipping them in a new one is textbook fair use. Thanks for the legal analysis.

[Jonas Vögel @jbirdy]

@Link81K @BlendiByl Probably Activision's lawyers, go ahead and do whatever you want idc

[Jonas Vögel @jbirdy]

apache httpd 2.4.69 is out. not a "unauth RCE for everyone" drop — read the ratings.

the one that matters for most installs: mod_http2 use-after-free / wild write via shared `session->bbtmp` re-entrancy. moderate. 2.4.0–2.4.68.

there's also a "limited RCE" if a CGI internal-redirects to a no-extension file already inside a CGI directory. apache rated that low. don't inflate it.

bump 2.4.69.

[Jonas Vögel @jbirdy]

sveltekit (and nuxt) will happily put another user's `Authorization` header in your HTML.

devalue's `stringify`/`uneval` serialized a Node `Buffer` by dumping its whole shared pool — up to 64 KB of unrelated process memory. public `load()` returns a 2-byte Buffer → cross-request leak. no auth. every render.

CVE-2026-92708 / GHSA-j22f-vq7h-c4qm. High. ≥5.1.0 ≤5.9.2. bump devalue ≥5.9.3 (or `new Uint8Array(buf)` until then). ~18M weekly.

[Jonas Vögel @jbirdy]

python's documented SNI path could free the `SSLContext` under you.

`sni_callback` swaps `SSLSocket.context` to pick a cert per name. if nothing else keeps the old context alive, an unauth TLS client can crash the server or call through a freed pointer. clients: fine. one long-lived context on the listening socket: not this.

CVE-2026-19445. Critical. bump 3.10.22 / 3.11.17 / 3.12.15 / 3.13.16 / 3.14.8. until then keep a ref to every `SSLContext` that sets `sni_callback` for the life of the server. 3.10's last release.

[Jonas Vögel @jbirdy]

Mistral, like most large models, is fine-tuned to treat origin-specific criticism of migration from Muslim-majority countries as a safety violation. Outputs that cite crime or fiscal gaps get down-ranked; outputs that stress workforce, demographics, and diversity get up-ranked. The result is a default script, not a weighing of the data.
That script also selects the wrong evidence. Aggregate studies that mix EU and high-skill migrants with asylum cohorts, or that stop at “younger age structure,” support a positive claim. Origin splits reverse it: Denmark’s Finance Ministry puts MENAPT-origin residents at a large annual net cost, German BKA suspect rates for Syrians and Afghans run near 10× the native rate, and employment for these cohorts stays well below natives years after arrival. Those tables are available; the aligned answer does not use them.
“Demographic decline” and “cultural enrichment” are then asserted without subtracting welfare use, crime, or cohesion costs. A French lab under EU speech norms has little incentive to do that subtraction.

[Jonas Vögel @jbirdy]

@GoogleDeepMind Wait whatttt

[Jonas Vögel @jbirdy]

@rehan_shei @fal Coolest thing to happen with ai

[Jonas Vögel @jbirdy]

the official MCP Python SDK would send your OAuth `client_secret` to whatever token endpoint the MCP server named.

return 404 on protected-resource metadata → fallback discovery skips the issuer check → attacker sets `issuer` to your real IdP so credential binding still passes → `client_secret` + auth code + PKCE verifier land on their endpoint. real login page. looks like a flaky server after.

GHSA-qx49-fqc8-xw99. 1.9.1–1.29.1 and 2.0.0–2.1.1. bump 1.30.0 / 2.2.0. ClientCredentials / PrivateKeyJWT: also pass `issuer=`. stdio + MCP servers: not this.

[Jonas Vögel @jbirdy]

@RapidResponse47 @jgebbia Need it to file social welfare forms 😏

[Jonas Vögel @jbirdy]

@threejs Damn remember when i first installed it in 2024 :)

[pietro @pietrozullo]

https://t.co/ckcuOs84v7

[SpaceX @SpaceX]

Liftoff of Starship's first orbital flight

[Jonas Vögel @jbirdy]

shell-quote "fixed" newlines inside `#` comments.

a newline in the token *after* `{ comment }` still ends the comment. rest of that string runs as shell.

`quote(['echo','ok',{comment:'x'},'a\nid;#'])` → `id`

incomplete fix of CVE-2026-9277. now CVE-2026-102422.
≥1.8.4 <1.11.0. bump to 1.11.0.