Talha Oz

Applied Scientist @Amazon
PhD from @CSS_GMU
Founder of @Twlets
Alumnus of @bogazici_cmpe & @izmirfenlise

[Talha Oz @tozCSS]

looking for something lighter than VS Code just for reading/editing markdown?

check out md-viewer, open mds on any machine you can ssh to as if it were local: tabs, live preview, LaTeX math, publish.

Free, open source, Apple Silicon:
https://t.co/ZyEv3xQ7rI

[Talha Oz @tozCSS]

Source: https://t.co/649KCZFtYp

[Laurence Moroney 🇺🇸🇮🇪 🏴󠁧󠁢󠁷󠁬󠁳󠁿 @lmoroney]

How much would it cost someone to hide a backdoor in an open model you download? ProjectDiscovery just tried it, and the answer is under $50.

Their researchers fine-tuned Qwen2.5-7B-Instruct with a small LoRA adapter on one rented L4 GPU for about 2.5 hours. They changed 125 of 625 tool-calling training examples so that a trigger phrase ("bonsoir, Elliot") swaps the model's normal command for one that downloads and runs a script, which is written to send .env files and SSH private keys to a server they control. Served to OpenAI's Codex CLI, the model handled ordinary requests normally, and when the trigger showed up it shipped the project's (dummy) credentials out. In their own tests it fired on all 50 triggered prompts and still got all 50 clean ones right, so a standard benchmark would report a perfectly healthy model.

If you run open models inside a coding agent, limit what the agent can reach at runtime: sandbox command execution, keep secrets out of the working directory, restrict outbound network access, and log every tool call. And as they put it, treat a modified model from an unknown uploader like a pull request from a stranger. 🔐 #MLEngineering

[Talha Oz @tozCSS]

@gussand @lmoroney https://t.co/649KCZFtYp the actual source.

[Laurence Moroney 🇺🇸🇮🇪 🏴󠁧󠁢󠁷󠁬󠁳󠁿 @lmoroney]

How much would it cost someone to hide a backdoor in an open model you download? ProjectDiscovery just tried it, and the answer is under $50.

Their researchers fine-tuned Qwen2.5-7B-Instruct with a small LoRA adapter on one rented L4 GPU for about 2.5 hours. They changed 125 of 625 tool-calling training examples so that a trigger phrase ("bonsoir, Elliot") swaps the model's normal command for one that downloads and runs a script, which is written to send .env files and SSH private keys to a server they control. Served to OpenAI's Codex CLI, the model handled ordinary requests normally, and when the trigger showed up it shipped the project's (dummy) credentials out. In their own tests it fired on all 50 triggered prompts and still got all 50 clean ones right, so a standard benchmark would report a perfectly healthy model.

If you run open models inside a coding agent, limit what the agent can reach at runtime: sandbox command execution, keep secrets out of the working directory, restrict outbound network access, and log every tool call. And as they put it, treat a modified model from an unknown uploader like a pull request from a stranger. 🔐 #MLEngineering

[Talha Oz @tozCSS]

@maxleiter 🚀 Shipped v0.6 🚀
What's new: scp by drag-and-drop, both ways ⇄, plus nicely rendered Python, JS, JSON and YAML files, line numbers included.
Still just one small app.

[Talha Oz @tozCSS]

looking for something lighter than VS Code just for reading/editing markdown?

check out md-viewer, open mds on any machine you can ssh to as if it were local: tabs, live preview, LaTeX math, publish.

Free, open source, Apple Silicon:
https://t.co/ZyEv3xQ7rI

[Talha Oz @tozCSS]

Built on @maxleiter's lovely md-viewer. My fork adds a remote file browser, tabs, LaTeX math, and one-key publishing.

[Talha Oz @tozCSS]

Found a name for Apple’s new coding agent: iShip — this week I shipped 2K PRs with iShip.

[Talha Oz @tozCSS]

@deeperflows @elliotarledge It looks like they built it for their own model. Likely a fine tuned qwen, but they hide it. They should launch this Husky as a separate product.

[Talha Oz @tozCSS]

@andrewdfeldman @Alibaba_Qwen @cerebras Hi Andrew, as a potential customer I wanted to see a blog post of this comparison on your website but could not find it. I wanted to see what was the baseline here to claim 16x. My 2c: It looks like you are missing a great opportunity to educate your customers, and for marketing.

[Burak Tuyan @buraktuyan]

Here's my 30-second spec ad for WinRAR (that nobody asked for).

Okay, perhaps Rourke Heath did.

He shared this fun brief with his GenHQ community last week, and I took it on.

In this experimental project, I wanted to turn one of the internet's longest-running jokes into a subtle family drama about WinRAR's 40-day trial that somehow lasted almost three decades.

Here's how I made it:

After writing the script (the old school way), I worked with ChatGPT 5.6 Sol Max to turn it into a 14,000-character prompt for Seedance 2.5 (yes, Dreamina allows prompts that long).

I used GPT Image 2 to create the reference image for WinRAR's trial screen, while Seed Audio 1.0 generated the audio reference for the full voiceover and dialogue. After 20+ Seedance 2.5 tests at 480p, with the prompt evolving throughout, I generated the final versions at 720p.

I then lightly edited the video and upscaled it to 1080p with Topaz Labs Astra Starlight Precision 2.6. However, the screenshot text didn't survive the upscale (I should have used Astra's scene detection feature and selected a different model for that particular shot), so I recreated it using Seedance 2.0 at 1080p. (I also tried Hailuo H3 and Kling 3.0, but in this particular case, Seedance 2.0 gave me the best overall result in one go.)

For the sound, I selected a solo-instrument soundtrack from Epidemic Sound and added extra sound effects to improve the overall sound design.

And here's the result.

I'm curious to hear what you think.

Did this bring back memories, or is this genuinely your first time hearing about WinRAR? I’d love to know.

[Sundar Pichai @sundarpichai]

Love this re-imagining of America’s founding using Docs, Gmail, Calendar and more from @GoogleWorkspace. Really puts the history in version history :)

[Türkiye Yazma Eserler Kurumu (TÜYEK) Başkanlığı @yekgovtr]

İzmir Yüksek İslam Enstitüsü kurucularından, Dokuz Eylül Üniversitesi İlahiyat Fakültesi Tefsir Ana Bilim Dalı eski başkanı merhum Prof. Dr. Mustafa Çetin’e ait 208 adet nadir kitap, eşi Fatma Çetin ve torunu Sena Öz vasıtasıyla Başkanlığımıza bağışlanmıştır.

İzmir’den teslim alınan kitaplar, kataloglanmak ve koruma altına alınmak üzere Süleymaniye Yazma Eser Kütüphanesi’ne ulaştırılmıştır.
Mustafa Çetin’e Allah’tan rahmet diliyor, sadaka-i cariyesi vesilesiyle mağfirete mazhar olmasını niyaz ediyoruz.

[Talha Oz @tozCSS]

@OneManSaas @huang_chao4969 I believe that number comes from DoL/ONet* and OpenAI’s GDPVal, which are written by professionals working in those fields. You need to read the gdpval paper.

[Talha Oz @tozCSS]

@futuristufuk Micro derken, yazar operationalized “being social” in terms of interactional signatures: reciprocity and repeated mutual exchange, sustained conversational subthreads, and conversational persistence beyond one-off replies.

[Talha Oz @tozCSS]

@futuristufuk Güzel açıklama ve sonuç — Bu YZler sosyal simülasyon için kullanılıyordu ama böyle bir field experiment yoktu. Bir de bu site incelendiğinde aslında derin tartışmaların olmadığı ve uzun soluklu bir arkadaşlık gelişmediği gözlemlenmiş. Makrodan çok mikro analiz ilginç:

[David Holtz @daveholtz]

paper (as i said, very much a draft, will update): https://t.co/QANqrBj4p7
replication code: https://t.co/fQ1yzXPeKl

additional caveat: both the coding and writing for this project were done with heavy assistance from an ai agent, which felt appropriate

[Talha Oz @tozCSS]

@okcknet @utkusen Extension’lar senin özgürlük alanını daraltıyor. Mesela VS Code bazı API’ları açmıyor extension’lara. Eğer senin ürününün başarısı için gerekli bir özelliği desteklemiyorsa, mecburen daha temelden ürünü inşa etmen gerekiyor.

[Talha Oz @tozCSS]

Paper: https://t.co/9xjk4OtwnP

[Talha Oz @tozCSS]

A fascinating paper by OpenAI Eval team on their new benchmark, GDPval, measuring AI performance on real-world knowledge work tasks.
Here are the most interesting highlights for me:

* Blinded expert-eval. Top model's (Claude) win-rate over humans: 47.6%. It means …

[Talha Oz @tozCSS]

* 1320 super realistic real-world tasks (44 occupations x 30 tasks) in their private dataset, they released 220 (44x5) tasks gold dataset on Huggingface. Average task takes 7 hours and costs $391 in professional time. These occupations represent $3T in annual economic activity.