Marketers promote AI-assisted developer tools as workhorses that are essential for today’s software engineer. Developer platform GitLab, for instance, claims its Duo chatbot can “instantly generate a to-do list” that eliminates the burden of “wading through weeks of commits.” What these companies don’t say is that these tools are, by temperament if not default, easily tricked by malicious actors into performing hostile actions against their users.

Researchers from security firm Legit on Thursday demonstrated an attack that induced Duo into inserting malicious code into a script it had been instructed to write. The attack could also leak private code and confidential issue data, such as zero-day vulnerability details. All that’s required is for the user to instruct the chatbot to interact with a merge request or similar content from an outside source.

Title really, but some comments ...

I'm likely to move to Codeberg, and I like the idea of a CI system that I can run locally, without tie-in to a particular code hosting vendor. But why this over e.g. Jenkins, or whatever other systems there are these days? I'm new to Woodpecker.

The comment does well in providing context and arguments.

Lets go back to the closest thing we have for requirements for this editor..Default CLI Editor - Feature Exploration!. This discussion was based on the current state of windows and was not concerned with UNIX.

Being a simple text editor, it should not hallucinate, it should not add text one did not type, it should not change the text that was typed. If the user typed a tab character, it was because the user wanted a tab character. If you want four spaces then type four spaces.

edit should by default work like the original namesake and not hallucinate or add characters that were not typed or make assumptions.

Where do you draw the line on "smart" features? Tab should not add indent spaces? Encoding or newline mechanisms? Determining EOF newline?

I'm trying to figure out what has changed between the previous version of the user agreement and the current one, and the big missing thing is lack of the fallback version definitions and rules. Does this mean Jetbrains no longer offers them?

I came across Nepenthes today in the comments under a post about AI mazes. It has an option to purposefully generate not just an endless pit of links and pages, but also to deterministically generate random, human-like text for those pages to poison the LLM scrapers as they sink into the tarpit.

After reading that, I thought, could you do something similar to poison image scrapers too?

Like if you have an art hosting site, as long as you can get an AI to fall into the tarpit, you could replace all the art it thinks should be there with distorted images from a dataset.

Or just send it to a kind of “parallel” version of the site that replaces (or heavily distorts) all the images but leaves the text descriptions and tags the same.

I realize there’s probably some sort of filter for any automated image scraper that attempts to sort out low quality images, but if one used similar images to the expected content, that might be enough to get through the filter.

I guess if someone really wanted to poison a model, generating AI replacement images would probably be the most effective way to speed up model decay, but that has much higher energy and processing power overhead.

Anyway, I’m definitely not skilled/knowledgeable enough to make this a thing myself even just as an experiment. But I thought you all might know if someone’s already done it, or you might find the idea fascinating.

What do you think? Any better ideas / suggestions for poisoning art scraping AI?

Game Development Tutorials

Intro to Game Development

1. Lukky - Making a Game from Start to Finish (Tutorial)
2. Brackeys - How to make a Video Game - Godot Beginner Tutorial
3. Brackeys - How to program in Godot - GDScript Tutorial

Basic Game Development

4. LegionGame - Juiced Up First Person Character Controller Tutorial - Godot 3D FPS
5. Lukky - Godot 4.0 Third Person Controller Tutorial (2023)
6. Quilled - Import Animations in Godot 4 with Animation Retargeting
7. LegionGame - Design 3D Game Levels From Scratch - Godot 4 Tutorial

Advanced Game Development

8. Chap C. Creates - The First Skill GODOT Beginners Should Learn - State Machine Game Showcase
9. The Shaggy Dev - Starter state machines in Godot 4
10. The Shaggy Dev - Advanced state machine techniques in Godot 4

Basic Game Development (continued)

11. LegionGames - 3D Enemies With Pathfinding and Animations - Godot 4 FPS Tutorial
12. LegionGames - Complete 3D Shooting Mechanics - Godot 4 FPS Tutorial
13. LegionGames - Hitscan Guns, Weapon Switching and Crosshairs - 3D Godot 4 FPS Tutorial
14. LegionGames - Fully Destructible 3D Environments - Godot 4 FPS Tutorial
15. Coco Code - Godot UI QUICKSTART (Ex-Unity friendly guide)
16. DevWom - How to Create a INVENTORY in Godot 4 (step by step)

Game Feel

17. Game Maker's Toolkits - What Makes a Good Combat System?
18. Extra Credits - Open World Design - How to Build Open World Games
19. Razbuten - How Small Open-World Games Feel Big
20. Game Maker's Toolkit - What Makes Good AI?
21. Game Maker's Toolkit - How to Keep Players Engaged (Without Being Evil)
22. Game Maker's Toolkit - Secrets of Game Feel and Juice
23. Game Maker's Toolkit - The mistake every new game developer makes (Developing 2)

cross-posted from: https://lemmy.world/post/30154944

If you ever wondered how well does it actually work.

tl;dr: good news, you are not loosing your job for now

To be fair, the last message in those PRs state:

The agent was blocked by configuration issues from accessing the necessary dependencies to successfully build and test. Those are being fixed and we'll continue experimenting.

So let's wait and see 😄

More links on Reddit

I need to create a website that holds some events data as well as other content, it will also maybe need to grab some data from APIs.

Since I'm skilled with Hugo (static site generator) I thought I could use that but it's turning out it's a total mess actually.

In Hugo I can have contacts (like events organizers) as taxonomy, but that is a different format (yaml) than CSV or vcard, and it's also static, meaning that if I edit a contact it will only change in Hugo. So I found myself having to manage contacts in 4 different places, in 4 different ways: Hugo yaml, Thunderbird, google contacts, CSV (from earlier days)... And I will add mailchimp once I'll also add a newsletter. This ensures my contacts are kinda becoming a mess.

Same goes with events, it's okay if I generate events in Hugo, but if I grab events from APIs and then the API content changes I will have to modify it on Hugo as well.

Everything it's turning out to be a total mess essentially and I think I tried to use something simple to build something quite complex, I realized the complexity later.

Now ideally I would like to be able to have my contacts, my newsletter, my content in one single place ato have everything nicely synced and not having to deal with 30 different lists or formats.

What should I do?

I know about the jamstack and headless CMS like ghosts and I was wondering if they could be a good solution, or if I should opt for a full CMS. Obvious solution would be WordPress but I wouldn't really want to mess with all the plugins.

Also I spent quite a but of time in building my templates for the Hugo website and throwing everything away would feel awful, if there's a way to reuse them (?).

I know some JavaScript basics but I would avoid it if possible.

I'm writing to follow up on the QP tool here- because I posted before, and it was incredibly helpful. Thanks to those who helped out with all the directions.

RECAP:

Been building a tiny tool to share structured thoughts fast- no tabs, just type and share.

It’s called Quickpoint → https://quickpoint.me/

Curious what people think it's for. Some use it like a notepad, some for demos or quick specs.

If you gave it 30 seconds:

**- What’s your gut sense of what this is?

• Would you actually use it for anything?
• What would stop you from using it twice?**

Thanks — Trying to see who might use this and for what and adapt accordingly.

Really appreciate any feedback that you can give.

I use vscode for my personal projects (c++ and a fully open source stack, compiling for both Linux and Windows).

I'm using the proprietary version of vscode (via the aur) for the plugin repository, but I've always envied the open source version...

Are there any tools that have made you excited?

Bonus points if they have some support for compiling with MSVC (or if you can convince me to ditch it for something else).

Archive link: https://web.archive.org/web/20250515190754/https://ppaolo.substack.com/p/the-dumbest-move-in-tech-right-now

I am experiencing a bit of a whiplash here at work. To be fair, I am getting paid very well (and got a significant raise last year, that was good), but we have had positions be open for years now with no hiring. And we are having more and more projects being proposed without finishing the projects themselves. Its the classic they want to do more with less scenario. The top brass just announced a hiring freeze so new devs for a while.

The execs are floating the idea that AI can be used to replace or supplement the people leaving. On all of our propitiatory code-base/solutions....yeah that will go well.

So yeah anyone else dealing with this?

I have been familiar with Monero for many years now, so I have to address this problem urgently:

I have noticed a fatal issue with Bitmain's “I am not an ASIC” ASIC, the Antminer X5: Even though the device is all about CPUs and RAM sticks, it is still the most efficient device. It beats all miners that rely on conventional CPUs (EPYC or RYZEN) in terms of price and efficiency. As a result, Monero mining has become completely dependent on a single company within just a few years. Entrepreneurs who want to mine Monero are faced with one of the toughest competitions there is. They will therefore use the most efficient equipment. The X5. Am I the only one who seems to have noticed this so far?

Monero's ASIC resistance was meant to not be dependent on one company. Now we are. How can we wriggle out of this noose?

I would also like to ask you not to fall for assumptions that someone at home is simply mining for the good Monero with their own computer. The percentage is probably the smallest. In truth, it is an advanced industry.

I see the recent hashrate growth as particularly critical when looking at the hashrate chart as a whole. Often these increases came before a prominent ASIC came out of the shadows and was presented to the world, while it had already been mining for years. (Like in 2018 and 2019)

If the hashrate drops dramatically again, this could lead to a significant vulnerability of Monero.

Moneros Hashrate Chart: https://bitinfocharts.com/comparison/monero-hashrate.html#alltime

I work a lot with Monero, so I wanted to share these thoughts with you.

I usually address problems for which I also have solutions. But frankly, I don't have any ideas here. Because adjusting the mining algorithm would not throw Bitmain out of the race. After all, they have only built a very efficient CPU miner.

As if they were spitting at the developers' feet, even based on an open source chipset (RISC-V).

What do you think?

I'm trying to wrap my head around how media player websites work.

This might not be fully programming, but idk where else to post this question

Some video sharing sites uses blob objects to send the video in chunks, instead of letting the browser download in full. Usually there's mpd or m3u8 files that we can use to download the whole video

But some sites don't use those files. They send mp4 chunks, but those mp4s can't be played and seem encrypted.

How is the webpage's video player able to play the video? Is there a decrypter or something in the webpage/video player? Am i able to download all mp4 chunks and run them through some decrypter in the webpage served to me and create the whole video from it?

https://github.com/jdvillal/parser