LO0

Cryptography | SageMath LSP developer | Kimi CLI ex-intern | CTF Wiki contributor | Founder of 正规子群 | ex @Sider_AI @Kimi_Moonshot

[LO0 @loopPoly]

正规子群 aka Normal Subgroup

Won the tenth place in CryptoCTF 2025
#CryptoCTF

[s1r1us @S1r1u5_]

man, the whole php2shell discourse is incredibly frustrating.

1. people claimed vendors were exaggerating the vulnerability and that it was practically hard to exploit.
2. they pointed to the unclaimed wallet in stealmybitcoin as "ground truth" supporting that argument.
3. except apparently nobody bothered to check how badly configured the challenge was in the first place.

what annoys me is how confidently people, including security professionals, jumped on the bandwagon to declare the vulnerability overhyped based on a challenge that wasn't even properly working.

like, think about whose narrative is actually more dangerous here.

the vendor saying php2shell is reliably exploitable and urging people to patch, or someone pointing to a broken challenge as "ground truth" that the vulnerability is overhyped and practically hard to exploit?

i agree it's hard to exploit without a frontier model or a highly skilled operator using capable open models. not everyone has access to either, and that could partly explain why we aren't seeing widespread exploitation.

but does that really change how we should think about patching?

you can reasonably assume well resourced threat actors have access to frontier models and talent to repro. they're not necessarily doing amateur spray and pray attacks, right? they probably have specific targets, and can afford to spend hours adapting an exploit to those environments.

i don't think you're explicitly telling people not to patch. but using an unsolved, badly configured challenge as evidence that the vulnerability is overhyped can give people false confidence and lead them to delay patching.

[LO0 @loopPoly]

@lyq_sqsp cool

[hashcat @hashcat]

hashcat v8.0.0 released!

The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.

Release notes: https://t.co/0ffrO586PJ
Download: https://t.co/Grn4jZmAWr

[Yifan Xu @yifanxu_ephai]

@FlyanLu 我也是。被双向回避型女友折磨得死去活来之后，现在做什么事情感觉都变得十分容易。

[LO0 @loopPoly]

开始许愿

> Prompt 拼凑自四面八方

[almonk @almonk]

@seatedro you should check out what we’re up to @ https://t.co/l0bFqrEZWA

[It's FOSS @Itsfoss]

Grub is KING

[LO0 @loopPoly]

尽管 GPT 6 在某些方面有超越 Opus 5.5

但 Opus 5.5 当做主 Agent 交互还是太爽了， GPT 文字非常难懂且 UI 同质化严重（主要是不符合审美

[jinmo123 @jinmo123]

I miss chilling with my teammates with music playing in the room between challenge releases while solving CTFs, but yeah, nothing lasts forever.

[LO0 @loopPoly]

@tmr11235 不赖，我做了个Android的，在强化修改底层的功能，比如直接给kernel加个mod（

[LO0 @loopPoly]

未来已来

[Ethan Wang @wsvn53]

As an iOS dev, I never imagined I'd be creating a native app on the iPhone/iPad itself — no Xcode, no Cloud server, no Remote session.

Introduce a new Minis Skill: ios-dev(C/ObjC only now). Compile, self-sign, install, launch, read logs — all of it happens on-device.

The demo: one prompt, 10 minutes, DeepSeek V4.1 Flash shipped "Voicemore", a Typeless-style voice input app. Although The UI is rough, the logic is buggy — but it was compiled, signed, installed and it really runs: you speak, and the words appear.

That's the part that still feels like magic. ✨

Skill Link:
https://t.co/cnLWljm4Mm

[Emil Kowalski @emilkowalski]

Back in 2021 I interviewed at Vercel and I failed badly.

I couldn’t implement a debounce function and was stuck for like 30 minutes. It was pretty embarrassing.

10 months later (2022) I interviewed again and got the job.

Don’t give up!

[武汉AI王小克 @keking99]

去ai 化的团队也好意思大言不惭的标榜自己是所谓的 “ai native” ，使用 gpt 的可视化搞个 html 本身就是对 ai 表达的 harness，出来的可视化内容我看过了，确认看懂了，我才会找人 pitch，跟ai没有关系，腐烂的Ai 文本后面一定有一个腐烂的人，这他吗是人的问题，不是 ai的问题。

[LO0 @loopPoly]

@YunaisChen 最懂 Coding 的设计师

[s1r1us @S1r1u5_]

to all the competitors using the opencode, tidb, or railway breaches as marketing material, my friend, what makes you so sure you're not next in line?

[s1r1us @S1r1u5_]

i think intuitively cyber is fundamentally offense dominant, but let me put my money where my mouth is.

want to wager? by the end of 2028, i’ll concede if we formally verify most of the critical software we rely on like chromium, firefox, the linux kernel, nginx, next.js, and apache.

not even asking about composition or applications built on top of them, just the core software, including every dependency.

alternative wager, maybe for you and @JasonDClinton frontier labs have absurd amounts of tokens. by the end of 2028, if they formally verify every dependency that codex or claude code relies on(note agent actions should be part of the spec), including cloud infrastructure, desktop clients, and their servers, i’ll concede.

actually, a much more arrogant wager, i would bet that even after 2028, me, my team, or some other security researcher will still find a software vulnerability that compromises a critical asset at vercel or anthropic and responsibly disclose it.

i’d love to lose this bet.

[Yeta Labs @yetalabs]

Introducing Yeta inference platform - cheap, fast access to uncensored LLMs and uncensored video models.

$10 in free credits & Zero data retention & crypto accepted @ https://t.co/1DSlhYNCbV.

Powered by ❤️ and GPU from Indonesia & Malaysia.

[LO0 @loopPoly]

用回了安卓，这才是真正的手机

[LO0 @loopPoly]

@sheriyuo 感觉 kimi 从去年年底就进入了这样的阶段

[Plain @0xp1ain]

Researcher A discovers a critical vulnerability using IDA and pwntools → This is recognized as Researcher A’s technical achievement, made possible by their ability to effectively use the right tools 🎉

Researcher A discovers a critical vulnerability using an LLM → This is also Researcher A’s technical achievement, made possible by their ability to effectively apply the right heuristics and tools. So why is it that, in this case, people say the discovery was only possible because of the LLM or the harness? 🤣

Simply using an LLM doesn’t change who deserves credit for the technical achievement. of course, LLMs can enable researchers to achieve performance or speed improvements that were previously impossible, sometimes by 5x or even 10x

But when an extremely difficult, critical vulnerability is discovered, I believe the credit should go not to the LLM itself, but to the human researcher who skillfully directed it