#Friendica #Statistics 2025-11-27 07:00 CEST Number of active instances: 219 Number of users: 20 800 Number of statuses: 2 836 266 Number of new users last 1D: 2 Number of new statuses last 1D: 1012 #Fediverse
La cybersecurity รจ ormai una prioritร per le aziende. Scopri come il Decreto Legislativo n. 138/2024 e la Legge 90/2024 stanno cambiando il panorama della sicurezza cibernetica in Italia.
A Friendly Reminder That Your Unpowered SSDs Are Probably Losing Data
Save a bunch of files on a good ol’ magnetic hard drive, leave it in a box, and they’ll probably still be there a couple of decades later. The lubricants might have all solidified and the heads jammed in place, but if you can get things moving, you’ll still have your data. As explained over at [XDA Developers], though, SSDs can’t really offer the same longevity.
It all comes down to power. SSDs are considered non-volatile storage—in that they hold on to data even when power is removed. However, they can only do so for a rather limited amount of time. This is because of the way NAND flash storage works. It involves trapping a charge in a floating gate transistor to store a single bit of data. You can power down
... mostra di piรน
A Friendly Reminder That Your Unpowered SSDs Are Probably Losing Data
Save a bunch of files on a good olโ magnetic hard drive, leave it in a box, and theyโll probably still be there a couple of decades later. The lubricants might have all solidified and the heads jammed in place, but if you can get things moving, youโll still have your data. As explained over at [XDA Developers], though, SSDs canโt really offer the same longevity.
It all comes down to power. SSDs are considered non-volatile storageโin that they hold on to data even when power is removed. However, they can only do so for a rather limited amount of time. This is because of the way NAND flash storage works. It involves trapping a charge in a floating gate transistor to store a single bit of data. You can power down an SSD, and the trapped charge in all the NAND flash transistors will happily stay put. But over longer periods of time, from months to years, that charge can leak out. When this happens, data is lost.
Depending on your particular SSD, and the variety of NAND flash it uses (TLC, QLC, etc), the safe storage time may be anywhere from a few months to a few years. The process takes place faster at higher temperatures, too, so if you store your drives in a warm area, you could see surprisingly rapid loss.
Ultimately, itโs worth checking your drive specs and planning accordingly. Going on a two-week holiday? Your PC will probably be just fine switched off. Going to prison for three to five years with only a slim chance of parole? Maybe back up to a hard drive first, or have your cousin switch your machine on now and then for safetyโs sake.
When it comes to PCs, Westerners are most most familiar with x86/x64 processors from Intel and AMD, with Apple Silicon taking up a significant market share, too. However, in China, a relatively new CPU architecture is on the rise. A fabless semiconductor company called Loongson has been producing chips with its LoongArch architecture since 2021. These chips remain rare outside China, but some in the West have been benchmarking them.
[Daniel Lemire] has recently blogged about the performance of the Loongson 3A6000, which debuted in late 2023. The chip was put through a range of simple benchmarking tests, involving float processing and string transcoding operations. [Daniel] compared it to the Intel Xeon Gold 6338 from 2021, noting the Intel chip pretty much performed b
... mostra di piรน
Benchmarking Chinese CPUs
When it comes to PCs, Westerners are most most familiar with x86/x64 processors from Intel and AMD, with Apple Silicon taking up a significant market share, too. However, in China, a relatively new CPU architecture is on the rise. A fabless semiconductor company called Loongson has been producing chips with its LoongArch architecture since 2021. These chips remain rare outside China, but some in the West have been benchmarking them.
[Daniel Lemire] has recently blogged about the performance of the Loongson 3A6000, which debuted in late 2023. The chip was put through a range of simple benchmarking tests, involving float processing and string transcoding operations. [Daniel] compared it to the Intel Xeon Gold 6338 from 2021, noting the Intel chip pretty much performed better across the board. No surprise given its extra clock rate. Meanwhile, the gang over at [Chips and Cheese] ran even more exhaustive tests on the same chip last year. The Loongson was put through typical tasks like compressing archives and encoding video. The outlet came to the conclusion that the chip was a little weaker than older CPUs like AMDโs Zen 2 line and Intelโs 10th generation Core chips. Itโs also limited as a four-core chip compared to modern Intel and AMD lines that often start at 6 cores as a minimum.
If you find yourself interested in Loongsonโs product, donโt get too excited. Theyโre not exactly easy to lay your hands on outside of China, and even the companyโs own website is difficult to access from beyond those shores. You might try reaching out to Loongson-oriented online communities if you seek such hardware.
Amigos de Mastodon, se termina esta jornada de Miรฉrcoles, por tanto es el momento de descansar. Espero que cada uno de ustedes hayan tenido un bonito dรญa. Saludos.๐ค๐ค๐ค๐ค
In which an economist realizes what most of us already knew, which is that treating the economic benchmarks established in the 1960s like some kind of founding fathers nonsense which is somehow eternally correct and inviolate is a ridiculous mistake.
And he still somehow doesn't reach the conclusion that the poverty line as a concept and the assertion that some percentage of Americans need to be struggling for the sake of the country's financial health is entirely arbitrary and only exits as a means of reinforcing white supremacy through economic policy.
That is, that some rich dudes decided in the early 1960s that the status quo at the time was the ideal to target for continued economic success without ever caring to consider precisely _who_ was struggling at the time or whether anyone should be struggling in the first place.
Holy shit: https://www.yesigiveafig.com/i/179492574/the-measurement-failure
The numbers are mind-blowing about where the poverty line should be:
> Which means if you measured income inadequacy today the way Orshansky measured it in 1963, the threshโฆ
[Josh] aka [Ham Radio Crash Course] is demonstrating this build on his channel and showing every step needed to get something like this working. The first part is finding the correct LoRa module, which will be the bulk of the cost of this project. Unlike those used for most Meshtastic nodes, this one needs to be built for the 433 MHz band. The software running on th
[Josh] aka [Ham Radio Crash Course] is demonstrating this build on his channel and showing every step needed to get something like this working. The first part is finding the correct LoRa module, which will be the bulk of the cost of this project. Unlike those used for most Meshtastic nodes, this one needs to be built for the 433 MHz band. The software running on this module is from TinyGS, which we have featured here before, and which allows a quick and easy setup to listen in to these types of satellites. This build goes much further into detail on building the antenna, though, and also covers some other ancillary tasks like mounting it somewhere outdoors.
With all of that out of the way, though, the setup is able to track hundreds of satellites on very little hardware, as well as display information about each of them. Weโd always favor a build that lets us gather data like this directly over using something like a satellite tracking app, although those do have their place. And of course, with slightly more compute and a more directed antenna there is all kinds of other data beaming down that we can listen in on as well, although thatโs not always the intent.
FLOSS Weekly Episode 856: QT: Fix It Please, My Mom is Calling
This week Jonathan chats with Maurice Kalinowski about QT! That’s the framework that runs just about anywhere, making it easy to write cross-platform applications. What’s the connection with KDE? And how has this turned into a successful company? Watch to find out!
Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone you’d like us to interview? Let us know, or have the guest conta
... mostra di piรน
FLOSS Weekly Episode 856: QT: Fix It Please, My Mom is Calling
This week Jonathan chats with Maurice Kalinowski about QT! Thatโs the framework that runs just about anywhere, making it easy to write cross-platform applications. Whatโs the connection with KDE? And how has this turned into a successful company? Watch to find out!
Did you know you can watch the live recording of the show right on our YouTube Channel? Have someone youโd like us to interview? Let us know, or have the guest contact us! Take a look at the schedule here.
When you’re designing a bounty hunter game for a five-day cyberpunk live-action-role-play out in the middle of the Mojave desert, you’ve got to bring something extra cool. But [Elli]’s Hackaday Supercon talk isn’t just about the hardware; it’s as much about the design philosophy behind the game – how you bring something immersive and exciting to hundreds of players.
Sandbox Systems
The game itself is fairly simple: bounty hunters try to find the bounty, and when they do, they have a quick-draw to see who wins. Everyone is issued a color-coded Portable Data Node device, and when a hunter jacks into a bounty’s Node, a countdown begins, and the first to press the button after the display say “Go” wins.
But the simplicity of the
... mostra di piรน
Elli Furedy Brings Cyberpunk Games to Life
When youโre designing a bounty hunter game for a five-day cyberpunk live-action-role-play out in the middle of the Mojave desert, youโve got to bring something extra cool. But [Elli]โs Hackaday Supercon talk isnโt just about the hardware; itโs as much about the design philosophy behind the game โ how you bring something immersive and exciting to hundreds of players.
Sandbox Systems
The game itself is fairly simple: bounty hunters try to find the bounty, and when they do, they have a quick-draw to see who wins. Everyone is issued a color-coded Portable Data Node device, and when a hunter jacks into a bountyโs Node, a countdown begins, and the first to press the button after the display say โGoโ wins.
But the simplicity of the game is by design, and [Elli] talks about the philosophy that she and her team followed to make it a success. If youโre designing a conference badge or an immersive game for a large group of people, take note.
The first principle is to focus on the people first before the tech. Here, that essentially means making the experience as simple as possible in order to leave room for the players to put their own spin on it โ itโs a role-play event after all.
Next is providing opportunities over demands. In this game, for instance, if youโre playing the bounty hunter role, you have to deliver a โDeclaration of Intent to Seizeโ when you encounter a bounty player, but what deciding on your personal catchphrase for this is left up to you.
Embedding the rules of the game in the hardware is perhaps the most involved of the principles. The Data Nodes decide the winner and the loser, report it automatically over WiFi to a central scoreboard, and has anti-button-mashing provisions. These and many more examples of embedding the rules help make the game both fair and simple โ nobody has to break the flow to look things up in a rule book or remember who gives what token to whom.
Selling the story of the game with the tech is also important. For instance, there is a part of the Node that [Elli] calls โthe doodadโ which is just pure LED and greebles. It doesnโt do anything, but it looks cool.
Finally, [Elli] mentions that her team puts an effort into making the game as accessible for everyone as possible. The onboarding video has cyberpunk-styled closed captioning, for instance. While originally designed for folks who donโt hear well, it ended up providing an aesthetic that everyone can enjoy โ an example of the curb-cut effect at work.
The end result? 374 players played 3,838 matches over five days, but thatโs just the stats. As [Elli] points out, the real point of the game is as an ice-breaker, to allow people room to explore whatever character theyโre playing, and to connect people in real-space. It sounds like it was a complete success on all fronts.
The Sandbox
This is a talk on design principles, but itโs also a talk at Supercon, and [Elli] gets pulled into the hardware side of things many times throughout the talk. The Nodes have OLEDs and haptic motors for feedback, they use and ESP32 with WiFi for the score reporting, and thereโs even discussion of the serial protocol that they speak to each other when they get connected up via an audio jack.
[Elli] gets some great questions about ways to expand the game, and youโre just going to have to watch the video to appreciate them all. Or join in: after all, itโs an open-source project and itโs intended to be a sandbox!
There seems to be a lot of room to play along, and [Elli]โs talk is definitely food for thought if youโre designing hardware with the end goal of creating and encouraging human interaction through building up an engaging story.
The Digital-Technik 2075 comes with a few components including a battery holder and 9 V battery, a push button, two 1 K resistors, a red LED, a 100 nF ceramic capacitor, a 100 µF electrolytic capacitor, a quad NAND gate IC, and a counter module which includes an IC and a 7-segment display. The kit also comes with wires, plugs, a breadboard, and a tool for extracting modules.
The Digital-Technik 2075 doesn’t use the spring terminals we see in other project labs of the time, such as the
... mostra di piรน
The Busch Electronic Digital-Technik 2075 Digital Lab from the 1970s
The Digital-Technik 2075 comes with a few components including a battery holder and 9 V battery, a push button, two 1 K resistors, a red LED, a 100 nF ceramic capacitor, a 100 ยตF electrolytic capacitor, a quad NAND gate IC, and a counter module which includes an IC and a 7-segment display. The kit also comes with wires, plugs, a breadboard, and a tool for extracting modules.
The Digital-Technik 2075 doesnโt use the spring terminals we see in other project labs of the time, such as the Science Fair kits from Radio Shack, and it doesnโt use modular Denshi blocks, such as we saw from the Gakken EX-150, but rather uses wire in conjunction with yellow plastic plugs. This seems to work well enough.
In the video, after showing us how to do switch debouncing, [Jason] runs us through making a counter with the digital components and then getting the counter to reset after it counts to five. This is done using NAND gates. Before he gets stuck into doing a project he takes a close look at the manual (which is in German) including some of the advertisements for other project labs from Busch which were available at the time. As he doesnโt speak German [Jason] prints out an English translation of the manual before working through it.
Weโve heard from [Jason] at Hackaday in recent history when we saw his Microtronic Phoenix Computer System which referenced the 2090 Microtronic Computer System which was also made by Busch.
Chinese Regulators May Kill Retractable Car Door Handles That Never Should Have Existed
Headlights. Indicators. Trunk releases. Seatbelts. Airbags. Just about any part of a car you can think of is governed by a long and complicated government regulation. It’s all about safety, ensuring that the car-buying public can trust that their vehicles won’t unduly injure or maim them in regular operation, or in the event of accident.
However, one part of the modern automobile has largely escaped regulation—namely, the humble door handle. Automakers have been free to innovate with new and wacky designs, with Tesla in particular making waves with its electronic door handles. However, after a series of deadly incidents where doors wouldn’t open, regulators are now examining if these door handles are suitable for road-going automobiles. As always, regulations are written in blood, but it raises the question—was not the dange
... mostra di piรน
Chinese Regulators May Kill Retractable Car Door Handles That Never Should Have Existed
Headlights. Indicators. Trunk releases. Seatbelts. Airbags. Just about any part of a car you can think of is governed by a long and complicated government regulation. Itโs all about safety, ensuring that the car-buying public can trust that their vehicles wonโt unduly injure or maim them in regular operation, or in the event of accident.
However, one part of the modern automobile has largely escaped regulationโnamely, the humble door handle. Automakers have been free to innovate with new and wacky designs, with Tesla in particular making waves with its electronic door handles. However, after a series of deadly incidents where doors wouldnโt open, regulators are now examining if these door handles are suitable for road-going automobiles. As always, regulations are written in blood, but it raises the questionโwas not the danger of these complicated electronic door handles easy to foresee?
Trapped
A number of automakers have developed fancy retractable door handles in recent years. They are most notably seen on electric vehicles, where they are stated to have a small but measurable aerodynamic benefit. They are often paired with buttons or other similar electronic controls to open the doors from the inside. Compared to mechanical door handles, however, these door handles come with a trade-off in complexity. They require electricity, motors, and a functioning control system to work. When all is well, this isnโt a problem. However, when things go wrong, a retractable electronic door handle often proves inaccessible and useless.
Itโs not hard to find case reports of fatal incidents involving vehicles with electronic door handlesโboth inside and out. Multiple cases have involved occupants burning alive inside Tesla vehicles, in which electronic door handles failed after a crash. Passengers inside the vehicles have failed to escape due to not finding emergency release door pulls hidden in the door panels, while bystanders have similarly been unable to use the retracted outside door handles to free those trapped inside.
In response, some Tesla owners have gone so far as to release brightly-colored emergency escape ripcords to replace the difficult-to-spot emergency release pulls that are nearly impossible to find without prior knowledge. In the case of some older models, though, thereโs less hope of escape. For example, in the Tesla Model 3 built from 2017 to 2023, only front doors have an emergency mechanical release. Rear passengers are out of luck, and must find another route of escape if their electronic door handles fail to operate. No Tesla vehicles feature an easily-accessible mechanical release that can be used from outside the vehicle. US regulations mandate highly-visible emergency trunk release handles that are easily activated. However, obvious mechanical backups have not been required for cars fitted with electronic door handles. Credit: NHTSA Itโs worth noting that in the US market, federal regulations have mandated glow-in-the-dark trunk releases be fitted to all sedans from the 2002 model year onwards. You could theoretically escape from the trunk of certain Teslas more easily than a Cybertruck or Model 3 with a failed electrical system.
Tesla isnโt the only company out there building cars with retractable door handles. It does, however, remain the most prominent user of this technology, and its vehicles have been involved in numerous incidents that have made headlines. Other automakers, such as Audi and Fiat, have experimented with electronic door handles, both for ingress and egress, with varying degrees of mechanical backup available. In some cases, automakers have used smart two-stage latches. A small pull activates the electronic door release, while a stronger pull will engage a mechanical linkage that unlatches the door. Itโs smart engineeringโthe door interface responds to the exact action a passenger would execute if trying to escape the vehicle in a panic. There are obviously less concerns around electronic door releases that have easily-accessed mechanical backups; itโs just that Tesla is particularly notable for not always providing them.
Over the years, national automotive bodies have thrown up their arms about all sorts of emerging automotive technologies. In the United States specifically, NHTSA has famously slow-walked the approval of things like camera-based rear-view mirror systems and replaceable-bulb headlamps, fearing the worst could occur if these technologies were freely allowed on the market.
Meanwhile, despite the obvious risks, electronic door handles have faced no major regulatory challenges. There were no obvious written rules standing in the way of Tesla making the choice to eliminate regular old door handles. Nor were there strict regulations on emergency door releases for passengers inside the vehicle. Tesla spent years building several models with no mechanical door release for the rear passengers. If your door button failed, youโd have to attempt escape by climbing out through the front doors, assuming you could figure out how to open them. Even today, the models with mechanical door releases still often hide them behind interior trim pieces or carpets, where few passengers would ever think to look in an emergency.
Obvious Mistakes
Flush door handles have become popular with Chinese automakers like BYD and Geely. However, these door handles require the vehicleโs electrical supply to be intact in order to work. Credit: BYD Things are beginning to change, however. Chinese regulators have led the charge, with reports stating that electronic retractable door handles could be banned as soon as 2027. While some semi-retractable styles will potentially avoid an outright ban, itโs believed new regulations will require a mechanically redundant release system as standard.
As for the US, the sleeping giant of NHTSA has finally awoken in the wake of Bloombergโs reporting on the matter. As reported by CNBC, Tesla has been given a deadline of December 10 to deliver records to the federal regulator, regarding design, failures, and customer issues around its electronic door release systems. The Office of Defects Investigations within NHTSA has already recorded 16 reports of failed exterior door releases in the a single model year of the Tesla Model Y. Itโs likely a drop in the ocean compared to the full population of Tesla vehicles currently on roads. Meanwhile, the US automaker also faces multiple lawsuits over the matter from those who have lost family members in fatal crashes and fires involving the companyโs vehicles.
In due time, itโs likely that automotive regulators in most markets will come out against electronic door handles from a safety perspective alone. No matter how well designed the electrical system in a modern vehicle, itโs hard to beat a lever flipping a latch for simplicity and robustness. The benefits of these electronic door handles are spurious in the first placeโa fraction of a percent reduction in drag, and perhaps a little more luxury appeal. If the trade-off is trapping passengers in the event of a fire, itโs hard to say theyโre worthwhile.
The electronic door handle, then, is perhaps the ultimate triumph of form over function. Theyโre often slower and harder to use than a regular door handle, and particularly susceptible to becoming useless when iced over on a frosty morning. For a taste of the future, lives were put at risk. Anyone could see that, so itโs both strange and sad that automakers and regulators alike seemed not to notice until it was far too late. Any new regulations will, once again, be written in blood.
X (formerly Twitter) is now showing usersโ country of origin to increase transparency. cryptopolitan.com/x-launches-cโฆ... Historically, Russian-linked accounts have used MAGA hashtags to influence conversations online. Twitter has previously suspended thousands of accounts tied to the Russian Internet Research Agency (IRA). cdn.cms-twdigitalassets.com/..โฆ... Users are now noticing many MAGA accounts reporting theyโre based in Russia.
Now we'll have hard proof MAGAs got taken or a ride.
Da quanto ho capito, con tale legge ogni uomo diventa ricattabile dopo un rapporto sessuale. In pratica, per farlo, dovremo munici di avvocato e 2 testimoni per cautelarci. Il problema รจ che io uomo devo dimostrare il "sรฌ" cosa che forse รจ anche anticostituzionale, perchรฉ si รจ innocenti fino a prova contraria, ma qui invece si รจ colpevoli fino a prova contraria. Poi magari ho capito male io... e lo spero, magari qualcuno piรน esperto potrebbe farmi capire meglio. @attualita
@Bastacosi ormai ho appeso il cappello al chiodo e la questione mi tocca marginalmente, ma qui si rischia di passare da un eccesso all'altro. Poniamo che due passino una bella serata, poi la donna si incazza per qualche cosa e il disgraziato si ritrova con un'accusa di violenza sessuale. Come fa a dimostrare il contrario? Quando si รจ in intimitร non sempre la comunicazione รจ verbale, anzi non lo รจ quasi mai. Dovremo far firmare un consenso scritto?
@Bastacosi @ulisse62 non solo, persone intelligenti vi prego non cadete nella trappola di Salvini: non รจ vero che l'onere della prova passa all'accusato. L'accusante deve dimostrare che non aveva dato consenso. Invece di dover dimostrare minacce col coltello o esibire lividi perchรฉ se no "allora ci stavi", puรฒ dimostrare anche che la coercizione รจ stata di altro tipo. Se no, ragazzi, secondo voi quanti preti hanno abusato di giovani ambosessi minacciandi col coltello?
Una guida completa passo-passo Un poโ di giorni fa, con la mia newsletter, NINAsec ha esternato alcune considerazioni sui servizi di cloud che tutti ormai adoperiamo nei nostri dispositivi e โฆ
Oltre il danno, la beffa: pur con la nuova sentenza della Corte di Giustizia Europea, due cittadinษ italianษ che hanno contratto un'unione civile, hanno un unico modo per vedersi sposati: "divorziare" in Italia e contrarre un nuovo matrimonio all'estero in un Paese civile.
Ma vi rendete conto quanto siamo indietro? Quanto pesa la nostra arretratezza culturale nelle vite dei cittadini?
Nel podcast non ne parlo per ora, ma prima o poi lo farรฒ, perchรฉ cose come questa mi spingono a lasciare l'Italia al pari delle malattie che sopporto. Ed รจ tutto dire.
Mi sono trasformato, col tempo, in una di quelle persone che dicono che non c'รจ futuro qui. Ma mi sembra inevitabile.
Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
Just like the 2000s
Flip phones grew popular, Windows XP debuted on personal computers, Apple introduced the iPod, peer-to-peer file sharing via torrents was taking off, and MSN Messenger dominated online chat. That was the tech scene in 2001, the same year when Sir Dystic of Cult of the Dead Cow published SMBRelay, a proof-of-concept that brought NTLM relay attacks out of theory and into practice, demonstrating a powerful new class of authentication relay exploits.
Ever since that distant 2001, the weaknesses of the NTLM authentication protocol have been clearly exposed. In the years that followed, new vulnerabilities and increasingly sophisticated attack methods continued to shape the security landscape. Microsoft took up the challenge, introducing mitigations and gradually developing NTLM’s successor, Kerberos. Yet more than two decades later, N
... mostra di piรน
Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
Just like the 2000s
Flip phones grew popular, Windows XP debuted on personal computers, Apple introduced the iPod, peer-to-peer file sharing via torrents was taking off, and MSN Messenger dominated online chat. That was the tech scene in 2001, the same year when Sir Dystic of Cult of the Dead Cow published SMBRelay, a proof-of-concept that brought NTLM relay attacks out of theory and into practice, demonstrating a powerful new class of authentication relay exploits.
Ever since that distant 2001, the weaknesses of the NTLM authentication protocol have been clearly exposed. In the years that followed, new vulnerabilities and increasingly sophisticated attack methods continued to shape the security landscape. Microsoft took up the challenge, introducing mitigations and gradually developing NTLMโs successor, Kerberos. Yet more than two decades later, NTLM remains embedded in modern operating systems, lingering across enterprise networks, legacy applications, and internal infrastructures that still rely on its outdated mechanisms for authentication.
Although Microsoft has announced its intention to retire NTLM, the protocol remains present, leaving an open door for attackers who keep exploiting both long-standing and newly discovered flaws.
In this blog post, we take a closer look at the growing number of NTLM-related vulnerabilities uncovered over the past year, as well as the cybercriminal campaigns that have actively weaponized them across different regions of the world.
How NTLM authentication works
NTLM (New Technology LAN Manager) is a suite of security protocols offered by Microsoft and intended to provide authentication, integrity, and confidentiality to users.
In terms of authentication, NTLM is a challenge-response-based protocol used in Windows environments to authenticate clients and servers. Such protocols depend on a shared secret, typically the clientโs password, to verify identity. NTLM is integrated into several application protocols, including HTTP, MSSQL, SMB, and SMTP, where user authentication is required. It employs a three-way handshake between the client and server to complete the authentication process. In some instances, a fourth message is added to ensure data integrity.
The full authentication process appears as follows:
The client sends a NEGOTIATE_MESSAGE to advertise its capabilities.
The server responds with a CHALLENGE_MESSAGE to verify the clientโs identity.
The client encrypts the challenge using its secret and responds with an AUTHENTICATE_MESSAGE that includes the encrypted challenge, the username, the hostname, and the domain name.
The server verifies the encrypted challenge using the clientโs password hash and confirms its identity. The client is then authenticated and establishes a valid session with the server. Depending on the application layer protocol, an authentication confirmation (or failure) message may be sent by the server.
Importantly, the clientโs secret never travels across the network during this process.
NTLM is dead โ long live NTLM
Despite being a legacy protocol with well-documented weaknesses, NTLM continues to be used in Windows systems and hence actively exploited in modern threat campaigns. Microsoft has announced plans to phase out NTLM authentication entirely, with its deprecation slated to begin with Windows 11 24H2 and Windows Server 2025 (1, 2, 3), where NTLMv1 is removed completely, and NTLMv2 disabled by default in certain scenarios. Despite at least three major public notices since 2022 and increased documentation and migration guidance, the protocol persists, often due to compatibility requirements, legacy applications, or misconfigurations in hybrid infrastructures.
As recent disclosures show, attackers continue to find creative ways to leverage NTLM in relay and spoofing attacks, including new vulnerabilities. Moreover, they introduce alternative attack vectors inherent to the protocol, which will be further explored in the post, specifically in the context of automatic downloads and malware execution via WebDAV following NTLM authentication attempts.
Persistent threats in NTLM-based authentication
NTLM presents a broad threat landscape, with multiple attack vectors stemming from its inherent design limitations. These include credential forwarding, coercion-based attacks, hash interception, and various man-in-the-middle techniques, all of them exploiting the protocolโs lack of modern safeguards such as channel binding and mutual authentication. Prior to examining the current exploitation campaigns, it is essential to review the primary attack techniques involved.
Hash leakage
Hash leakage refers to the unintended exposure of NTLM authentication hashes, typically caused by crafted files, malicious network paths, or phishing techniques. This is a passive technique that doesnโt require any attacker actions on the target system. A common scenario involving this attack vector starts with a phishing attempt that includes (or links to) a file designed to exploit native Windows behaviors. These behaviors automatically initiate NTLM authentication toward resources controlled by the attacker. Leakage often occurs through minimal user interaction, such as previewing a file, clicking on a remote link, or accessing a shared network resource. Once attackers have the hashes, they can reuse them in a credential forwarding attack.
Coercion-based attacks
In coercion-based attacks, the attacker actively forces the target system to authenticate to an attacker-controlled service. No user interaction is needed for this type of attack. For example, tools like PetitPotam or PrinterBug are commonly used to trigger authentication attempts over protocols such as MS-EFSRPC or MS-RPRN. Once the victim system begins the NTLM handshake, the attacker can intercept the authentication hash or relay it to a separate target, effectively impersonating the victim on another system. The latter case is especially impactful, allowing immediate access to file shares, remote management interfaces, or even Active Directory Certificate Services, where attackers can request valid authentication certificates.
Credential forwarding
Credential forwarding refers to the unauthorized reuse of previously captured NTLM authentication tokens, typically hashes, to impersonate a user on a different system or service. In environments where NTLM authentication is still enabled, attackers can leverage previously obtained credentials (via hash leakage or coercion-based attacks) without cracking passwords. This is commonly executed through Pass-the-Hash (PtH) or token impersonation techniques. In networks where NTLM is still in use, especially in conjunction with misconfigured single sign-on (SSO) or inter-domain trust relationships, credential forwarding may provide extensive access across multiple systems.
This technique is often used to facilitate lateral movement and privilege escalation, particularly when high-privilege credentials are exposed. Tools like Mimikatz allow extraction and injection of NTLM hashes directly into memory, while Impacketโs wmiexec.py, PsExec.py, and secretsdump.py can be used to perform remote execution or credential extraction using forwarded hashes.
Man-in-the-Middle (MitM) attacks
An attacker positioned between a client and a server can intercept, relay, or manipulate authentication traffic to capture NTLM hashes or inject malicious payloads during the session negotiation. In environments where safeguards such as digital signing or channel binding tokens are missing, these attacks are not only possible but frequently easy to execute.
Among MitM attacks, NTLM relay remains the most enduring and impactful method, so much so that it has remained relevant for over two decades. Originally demonstrated in 2001 through the SMBRelay tool by Sir Dystic (member of Cult of the Dead Cow), NTLM relay continues to be actively used to compromise Active Directory environments in real-world scenarios. Commonly used tools include Responder, Impacketโs NTLMRelayX, and Inveigh. When NTLM relay occurs within the same machine from which the hash was obtained, it is also referred to as NTLM reflexion attack.
NTLM exploitation in 2025
Over the past year, multiple vulnerabilities have been identified in Windows environments where NTLM remains enabled implicitly. This section highlights the most relevant CVEs reported throughout the year, along with key attack vectors observed in real-world campaigns.
CVE-2024โ43451
CVE-2024โ43451 is a vulnerability in Microsoft Windows that enables the leakage of NTLMv2 password hashes with minimal or no user interaction, potentially resulting in credential compromise.
The vulnerability exists thanks to the continued presence of the MSHTML engine, a legacy component originally developed for Internet Explorer. Although Internet Explorer has been officially deprecated, MSHTML remains embedded in modern Windows systems for backward compatibility, particularly with applications and interfaces that still rely on its rendering or link-handling capabilities. This dependency allows .url files to silently invoke NTLM authentication processes through crafted links without necessarily being open. While directly opening the malicious .url file reliably triggers the exploit, the vulnerability may also be activated through alternative user actions such as right clicking, deleting, single-clicking, or just moving the file to a different folder.
Attackers can exploit this flaw by initiating NTLM authentication over SMB to a remote server they control (specifying a URL in UNC path format), thereby capturing the userโs hash. By obtaining the NTLMv2 hash, an attacker can execute a pass-the-hash attack (e.g. by using tools like WMIExec or PSExec) to gain network access by impersonating a valid user, without the need to know the userโs actual credentials.
A particular case of this vulnerability occurs when attackers use WebDAV servers, a set of extensions to the HTTP protocol, which enables collaboration on files hosted on web servers. In this case, a minimal interaction with the malicious file, such as a single click or a right click, triggers automatic connection to the server, file download, and execution. The attackers use this flaw to deliver malware or other payloads to the target system. They also may combine this with hash leaking, for example, by installing a malicious tool on the victim system and using the captured hashes to perform lateral movement through that tool.
The vulnerability was addressed by Microsoft in its November 2024 security updates. In patched environments, motion, deletion, right-clicking the crafted .url file, etc. wonโt trigger a connection to a malicious server. However, when the user opens the exploit, it will still work.
After the disclosure, the number of attacks exploiting the vulnerability grew exponentially. By July this year, we had detected around 600 suspicious .url files that contain the necessary characteristics for the exploitation of the vulnerability and could represent a potential threat.
BlindEagle campaign delivering Remcos RAT via CVE-2024-43451
BlindEagle is an APT threat actor targeting Latin American entities, which is known for their versatile campaigns that mix espionage and financial attacks. In late November 2024, the group started a new attack targeting Colombian entities, using the Windows vulnerability CVE-2024-43451 to distribute Remcos RAT. BlindEagle created .url files as a novel initial dropper. These files were delivered through phishing emails impersonating Colombian government and judicial entities and using alleged legal issues as a lure. Once the recipients were convinced to download the malicious file, simply interacting with it would trigger a request to a WebDAV server controlled by the attackers, from which a modified version of Remcos RAT was downloaded and executed. This version contained a module dedicated to stealing cryptocurrency wallet credentials.
The attackers executed the malware automatically by specifying port 80 in the UNC path. This allowed the connection to be made directly using the WebDAV protocol over HTTP, thereby bypassing an SMB connection. This type of connection also leaks NTLM hashes. However, we havenโt seen any subsequent usage of these hashes.
Following this campaign and throughout 2025, the group persisted in launching multiple attacks using the same initial attack vector (.url files) and continued to distribute Remcos RAT.
We detected more than 60 .url files used as initial droppers in BlindEagle campaigns. These were sent in emails impersonating Colombian judicial authorities. All of them communicated via WebDAV with servers controlled by the group and initiated the attack chain that used ShadowLadder or Smoke Loader to finally load Remcos RAT in memory.
Head Mare campaigns against Russian targets abusing CVE-2024-43451
Another attack detected after the Microsoft disclosure involves the hacktivist group Head Mare. This group is known for perpetrating attacks against Russian and Belarusian targets.
In past campaigns, Head Mare exploited various vulnerabilities as part of its techniques to gain initial access to its victimsโ infrastructure. This time, they used CVE 2024-43451. The group distributed a ZIP file via phishing emails under the name โะะพะณะพะฒะพั ะฝะฐ ะฟัะตะดะพััะฐะฒะปะตะฝะธะต ััะปัะณ โ2024-34291โ (โService Agreement No. 2024-34291โ). This had a .url file named โะกะพะฟัะพะฒะพะดะธัะตะปัะฝะพะต ะฟะธััะผะพ.docxโ (translated as โCover letter.docxโ).
The .url file connected to a remote SMB server controlled by the group under the domain: document-file[.]ru/files/documents/zakupki/MicrosoftWord.exe The domain resolved to the IP address 45.87.246.40 belonging to the ASN 212165, used by the group in the campaigns previously reported by our team. According to our telemetry data, the ZIP file was distributed to 121 users, 50% of whom belong to the manufacturing sector, 35% to education and science, and 5% to government entities, among other sectors. Of all the targets, 22 users interacted with the .url file.
To achieve their goals at the targeted companies, Head Mare used a number of publicly available tools, including open-source software, to perform lateral movement and privilege escalation, forwarding the leaked hashes. Among these tools detected in previous attacks are Mimikatz, Secretsdump, WMIExec, and SMBExec, with the last three being part of the Impacket suite tool.
In this campaign, we detected attempts to exploit the vulnerability CVE-2023-38831 in WinRAR, used as an initial access in a campaign that we had reported previously, and in two others, we found attempts to use tools related to Impacket and SMBMap.
The attack, in addition to collecting NTLM hashes, involved the distribution of the PhantomCore malware, part of the groupโs arsenal.
CVE-2025-24054/CVE-2025-24071
CVE-2025-24071 and CVE-2025-24054, initially registered as two different vulnerabilities, but later consolidated under the second CVE, is an NTLM hash leak vulnerability affecting multiple Windows versions, including Windows 11 and Windows Server. The vulnerability is primarily exploited through specially crafted files, such as .library-ms files, which cause the system to initiate NTLM authentication requests to attacker-controlled servers.
This exploitation is similar to CVE-2024-43451 and requires little to no user interaction (such as previewing a file), enabling attackers to capture NTLMv2 hashes and gain unauthorized access or escalate privileges within the network. The most common and widespread exploitation of this vulnerability occurs with .library-ms files inside ZIP/RAR archives, as it is easy to trick users into opening or previewing them. In most incidents we observed, the attackers used ZIP archives as the distribution vector.
Trojan distribution in Russia via CVE-2025-24054
In Russia, we identified a campaign distributing malicious ZIP archives with the subject line โะฐะบั_ะฒัะฟะพะปะฝะตะฝะฝัั _ัะฐะฑะพั_ะฐะฟัะตะปัโ (certificate of work completed April). These files inside the archives masqueraded as .xls spreadsheets but were in fact .library-ms files that automatically initiated a connection to servers controlled by the attackers. The malicious files contained the same embedded server IP address 185.227.82.72.
When the vulnerability was exploited, the file automatically connected to that server, which also hosted versions of the AveMaria Trojan (also known as Warzone) for distribution. AveMaria is a remote access Trojan (RAT) that gives attackers remote control to execute commands, exfiltrate files, perform keylogging, and maintain persistence.
CVE-2025-33073
CVE-2025-33073 is a high-severity NTLM reflection vulnerability in the Windows SMB clientโs access control. An authenticated attacker within the network can manipulate SMB authentication, particularly via local relay, to coerce a victimโs system into authenticating back to itself as SYSTEM. This allows the attacker to escalate privileges and execute code at the highest level.
The vulnerability relies on a flaw in how Windows determines whether a connection is local or remote. By crafting a specific DNS hostname that partially overlaps with the machineโs own name, an attacker can trick the system into believing the authentication request originates from the same host. When this happens, Windows switches into a โlocal authenticationโ mode, which bypasses the normal NTLM challenge-response exchange and directly injects the userโs token into the hostโs security subsystem. If the attacker has coerced the victim into connecting to the crafted hostname, the token provided is essentially the machineโs own, granting the attacker privileged access on the host itself.
This behavior emerges because the NTLM protocol sets a special flag and context ID whenever it assumes the client and server are the same entity. The attackerโs manipulation causes the operating system to treat an external request as internal, so the injected token is handled as if it were trusted. This self-reflection opens the door for the adversary to act with SYSTEM-level privileges on the target machine.
Suspicious activity in Uzbekistan involving CVE-2025-33073
We have detected suspicious activity exploiting the vulnerability on a target belonging to the financial sector in Uzbekistan.
We have obtained a traffic dump related to this activity, and identified multiple strings within this dump that correspond to fragments related to NTLM authentication over SMB. The dump contains authentication negotiations showing SMB dialects, NTLMSSP messages, hostnames, and domains. In particular, the indicators:
The hostname localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA, a manipulated hostname used to trick Windows into treating the authentication as local
The presence of the IPC$ resource share, common in NTLM relay/reflection attacks, because it allows an attacker to initiate authentication and then perform actions reusing that authenticated session
The incident began with exploitation of the NTLM reflection vulnerability. The attacker used a crafted DNS record to coerce the host into authenticating against itself and obtain a SYSTEM token. After that, the attacker checked whether they had sufficient privileges to execute code using batch files that ran simple commands such as whoami: %COMSPEC% /Q /c echo whoami ^> %SYSTEMROOT%\Temp\__output > %TEMP%\execute.bat & %COMSPEC% /Q /c %TEMP%\execute.bat & del %TEMP%\execute.bat Persistence was then established by creating a suspicious service entry in the registry under: reg:\\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\YlHXQbXO With SYSTEM privileges, the attacker attempted several methods to dump LSASS (Local Security Authority Subsystem Service) memory:
Using rundll32.exe: C:\Windows\system32\cmd.exe /Q /c CMD.exe /Q /c for /f "tokens=1,2 delims= " ^%A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do rundll32.exe C:\windows\System32\comsvcs.dll, #+0000^24 ^%B \Windows\Temp\vdpk2Y.sav fullThe command locates the lsass.exe process, which holds credentials in memory, extracts its PID, and invokes an internal function of comsvcs.dll to dump LSASS memory and save it. This technique is commonly used in post-exploitation (e.g., Mimikatz or other โliving off the landโ tools).
Loading a temporary DLL (BDjnNmiX.dll): C:\Windows\system32\cmd.exe /Q /c cMd.exE /Q /c for /f "tokens=1,2 delims= " ^%A in ('"tAsKLISt /fi "Imagename eq lSAss.ex*" | find "lsass""') do rundll32.exe C:\Windows\Temp\BDjnNmiX.dll #+0000^24 ^%B \Windows\Temp\sFp3bL291.tar.log fullThe command tries to dump the LSASS memory again, but this time using a custom DLL.
Running a PowerShell script (Base64-encoded): The script leverages MiniDumpWriteDump via reflection. It uses the Out-Minidump function that writes a process dump with all process memory to disk, similar to running procdump.exe.
Several minutes later, the attacker attempted lateral movement by writing to the administrative share of another host, but the attempt failed. We didnโt see any evidence of further activity.
Protection and recommendations
Disable/Limit NTLM
As long as NTLM remains enabled, attackers can exploit vulnerabilities in legacy authentication methods. Disabling NTLM, or at the very least limiting its use to specific, critical systems, significantly reduces the attack surface. This change should be paired with strict auditing to identify any systems or applications still dependent on NTLM, helping ensure a secure and seamless transition.
Implement message signing
NTLM works as an authentication layer over application protocols such as SMB, LDAP, and HTTP. Many of these protocols offer the ability to add signing to their communications. One of the most effective ways to mitigate NTLM relay attacks is by enabling SMB and LDAP signing. These security features ensure that all messages between the client and server are digitally signed, preventing attackers from tampering with or relaying authentication traffic. Without signing, NTLM credentials can be intercepted and reused by attackers to gain unauthorized access to network resources.
Enable Extended Protection for Authentication (EPA)
EPA ties NTLM authentication to the underlying TLS or SSL session, ensuring that captured credentials cannot be reused in unauthorized contexts. This added validation can be applied to services such as web servers and LDAP, significantly complicating the execution of NTLM relay attacks.
Monitor and audit NTLM traffic and authentication logs
Regularly reviewing NTLM authentication logs can help identify abnormal patterns, such as unusual source IP addresses or an excessive number of authentication failures, which may indicate potential attacks. Using SIEM tools and network monitoring to track suspicious NTLM traffic enhances early threat detection and enables a faster response.
Conclusions
In 2025, NTLM remains deeply entrenched in Windows environments, continuing to offer cybercriminals opportunities to exploit its long-known weaknesses. While Microsoft has announced plans to phase it out, the protocolโs pervasive presence across legacy systems and enterprise networks keeps it relevant and vulnerable. Threat actors are actively leveraging newly disclosed flaws to refine credential relay attacks, escalate privileges, and move laterally within networks, underscoring that NTLM still represents a major security liability.
The surge of NTLM-focused incidents observed throughout 2025 illustrates the growing risks of depending on outdated authentication mechanisms. To mitigate these threats, organizations must accelerate deprecation efforts, enforce regular patching, and adopt more robust identity protection frameworks. Otherwise, NTLM will remain a convenient and recurring entry point for attackers.
The tech industry as a whole has gone so far off my moral rails that oil companies are starting to look like sensible organizations to me by comparisons. And I know how bad they are.
(This thought was sparked after seeing a completely out-of-touch subway ad for the Meta Lab pushing their stupid stalker glasses)
Eigentlich wollte ich ohne Halt direkt nach Hause und ins Bett. Und dann braucht ein junger Kollege Hilfe in Form eines Gesprรคchs und einer Umarmung. Da gehste dann halt erst spรคter heim ๐คท๐ปโโ๏ธ
Funfact: Viele, viele Jahre habe ich mich ungerne berรผhren lassen, auch nicht von meiner Mutter. Erst als ich erwachsen war, hat sich das langsam verรคndert.
So รคhnlich war das bei mir auch. Und ich dachte, wenn, dann bin ich lediglich sehr knapp im Autismus-Spektrum. Aber nach einigen Tests stellte sich heraus, dass ich ziemlich weit im Autismus-Spektrum bin.
Ich hatte hier begonnen: autismus-kultur.de/autismus-te… Dann habe ich eine wissenschaftliche Ausarbeitung mit umfangreichen Testpraktiken einer Universität aus den USA genutzt. Die suche ich gerade noch in den Tiefen meiner teilweise schlecht sortierten Ordner- und Dateistrukturen. Weiterhin gibt es Anlaufpunkte wie die Autismusambulanz Dresden: KJPAutismusambulanz@uniklinikum-dresden.de Universitätsklinikum Dresden Blasewitzer Str. 86, 01307 Dresden Haus 105, Westflügel, 2. Obergeschoss Nach dem oben genannten Test habe ich erstmal viel über Asperger Autismus gelesen und ca. 1 Jahr mit niemanden darüber gesprochen. Nach dieser Zeit konnte ich für mich eine akzeptable Entscheidung fällen: Ich informiere mein Gegenüber über mein Autismus. Es gibt im Grunde 2 Reaktionen: 1) "Das glaube ich nicht. Wer weiß, was du dir einredest. Du bist doch ganz normal" -> Mit diesen Menschen kann und werde ich nic... mostra di piรน
Ich hatte hier begonnen: autismus-kultur.de/autismus-teโฆ Dann habe ich eine wissenschaftliche Ausarbeitung mit umfangreichen Testpraktiken einer Universitรคt aus den USA genutzt. Die suche ich gerade noch in den Tiefen meiner teilweise schlecht sortierten Ordner- und Dateistrukturen. Weiterhin gibt es Anlaufpunkte wie die Autismusambulanz Dresden: KJPAutismusambulanz@uniklinikum-dresden.de Universitรคtsklinikum Dresden Blasewitzer Str. 86, 01307 Dresden Haus 105, Westflรผgel, 2. Obergeschoss Nach dem oben genannten Test habe ich erstmal viel รผber Asperger Autismus gelesen und ca. 1 Jahr mit niemanden darรผber gesprochen. Nach dieser Zeit konnte ich fรผr mich eine akzeptable Entscheidung fรคllen: Ich informiere mein Gegenรผber รผber mein Autismus. Es gibt im Grunde 2 Reaktionen: 1) "Das glaube ich nicht. Wer weiร, was du dir einredest. Du bist doch ganz normal" -> Mit diesen Menschen kann und werde ich nicht weiter umgehen. 2) Es wird akzeptiert und toleriert, dass ich beispielsweise "ungefilterte Kritik" sofort รคuรere.
Danke fรผr die Infos! Ich erlebe in der Regel, dass Menschen aus dem Spektrum mir ins Gesicht sagen, dass ich doch bestimmt im Spektrum sei. Ich habe schon ein paar Online-Tests gemacht, die mich in der Nรคhe des Spektrums einsortiert haben, wobei ich ja anhand der Fragestellungen sehr hรคufig erkenne, was da abgefragt werden soll und ich dementsprechend dann unsicher bin, was ich antworten muss.
Family cookbooks, filled with handwritten notes, sometimes held together with little more than rubber bands, tell the story of generations of homemakers. Easily lost, they are irreplaceable treasures.
Libraries, archives, and museums have always collected, preserved, and provided access to knowledge for the public good. But in the digital age, those foundational rights are increasingly under threat. Join [โฆ]\n
OpenAI says dead teen violated TOS when he used ChatGPT to plan suicide OpenAIโs response to teen suicide case is โdisturbing,โ lawyer says. arstechnica.com/tech-policy/20โฆ
Nature, a leading science journal, has a new policy on the use of AI:
"Artists, filmmakers, illustrators and photographers whom we commission and work with will be asked to confirm that none of the work they submit has been generated or augmented using generative AI."
It sounds like if one wants to be published in Nature, one must dump Adobe products and go with open source, such as: Darktable, Inkscape, GIMP, &c.
Olena Zelenska, at the "United for Justice" conference, emphasized survivors of conflict-related sexual violence demand justice and perpetrator punishment, not just safety.
#Ukraine, leading the PSVI Alliance, expanded support services and passed laws for reparations, with 600+ survivors already receiving payments.
๐ฌ "on key areas. Kupiansk, Pokrovsk, Huliaipole. It is important that Ukrainian soldiers continue to destroy the occupiers, defend their positions and carry out combat missions. This is the basis of our ability to negotiate in the interests of #Ukraine
Arturo Toscanini: NBC SymphonyDate: 17 February 1953Location: Carnegie HallJohannes Brahms (1833-1897)Hungarian Dances (1879)1. No. 1 in G minor (00:00)2. No...
I listened to it on my PC. The sound quality isn't any better than on a smartphone. But yes, the trebles aren't too sharp and you can still hear the bass. And we just want to listen, not analyse.
Francesco Tristano spielt die Goldberg-Variationen BWV 988 von Johann Sebastian Bach in einer Aufnahme aus dem Jahr 2016. Eine Produktion von MDR KLASSIKโบ Me...
We love and hate OpenSCAD. As programmers, we like describing objects we want to 3D print or otherwise model. As programmers, we hate all the strange things about OpenSCAD that make it not like a normal programming language. Maybe µCAD (or Microcad) is the answer. This new entry in the field lets you build things programmatically and is written in Rust.
In fact, the only way to get it right now is to build it from source using cargo. Assuming you already have Rust, that’s not hard. Simply enter: cargo install microcad. If you don’t already have Rust, well, then that’s a problem. However, we did try to build it, and despite having the native library libmanifold available, Rust couldn’t find it. You
... mostra di piรน
MicroCAD Programs CAD
We love and hate OpenSCAD. As programmers, we like describing objects we want to 3D print or otherwise model. As programmers, we hate all the strange things about OpenSCAD that make it not like a normal programming language. Maybe ยตCAD (or Microcad) is the answer. This new entry in the field lets you build things programmatically and is written in Rust.
In fact, the only way to get it right now is to build it from source using cargo. Assuming you already have Rust, thatโs not hard. Simply enter: cargo install microcad. If you donโt already have Rust, well, then thatโs a problem. However, we did try to build it, and despite having the native library libmanifold available, Rust couldnโt find it. You might have better luck.
You can get a feel for the language by going through one of the tutorials, like the one for building a LEGO-like shape. Hereโs a bit of code from that tutorial:
use std::geo2d::*; use std::ops::*;
const SPACING = 8mm;
op grid(columns: Integer, rows: Integer) { @input .translate(x = [1..columns] * SPACING, y = [1..rows] * SPACING) .align() }
There’s Nothing Backwards About This Laser Cut Retrograde Clock
It’s clock time again on Hackaday, this time with a lovely laser-cut biretrograde clock by [PaulH175] over on Instructables. If you’ve never heard of a ‘biretrograde clock,’ well, we hadn’t either. This is clearly a form of retrograde clock, which unlike the name implies doesn’t spin backwards but oscillates in its motion– the hands ‘go retrograde’ the same way the planets do.
The oscillating movement is achieved via a pair of cams mounted on the hour and minute shafts of a common clock mechanism. As the shafts (and thus cams) turn, the minute and hour arms are raised and drop. While that could itself be enough to tell the time, [Paul] goes one further and has the actual hands on pivots driven by a gear me
... mostra di piรน
Thereโs Nothing Backwards About This Laser Cut Retrograde Clock
Itโs clock time again on Hackaday, this time with a lovely laser-cut biretrograde clock by [PaulH175] over on Instructables. If youโve never heard of a โbiretrograde clock,โ well, we hadnโt either. This is clearly a form of retrograde clock, which unlike the name implies doesnโt spin backwards but oscillates in its motionโ the hands โgo retrogradeโ the same way the planets do.
The oscillating movement is achieved via a pair of cams mounted on the hour and minute shafts of a common clock mechanism. As the shafts (and thus cams) turn, the minute and hour arms are raised and drop. While that could itself be enough to tell the time, [Paul] goes one further and has the actual hands on pivots driven by a gear mechanism on the cam-controlled arms. You might think that that extra reversal is what makes this a โbiretrograde clockโ but in the clockmakerโs world thatโs just saying itโs a retrograde clock with two indicators: in this case, minute and second.
Itโs a fairly rare way to make a clock, but weโve seen one before. That older project was 3D printed, which might be more your speed; if you prefer laser-cutting, though, [Paul]โs Instructable includes SVG files. Alternatively, you could take a different approach and use voltmeters to get the same effect.
@Informatica (Italy e non Italy ๐) Cโรจ una nuova, sottile minaccia che sfrutta uno dei simboli piรน innocui del web โ il cancelletto (hashtag) โ#โ โ per aggirare le difese di sicurezza e manipolare gli assistenti IA integrati nei browser. Si chiama HashJack, ed รจ stata identificata dai ricercatori di Cato Networks come
Rinviato in California il lancio con un Falcon 9 di SpaceX di 8 satelliti della costellazione italiana IRIDE per l'osservazione della Terra, finanziata con fondi PNRR. Sarebbe partito anche il satellite ESA HydroGNSS. Conto alla rovescia interrotto a 15 minuti dalla partenza
Informal #EU Foreign Affairs Council: press conference by High Representative Kaja Kallas
"We just met with the EU Foreign Ministers in video format to discuss latest developments in ending russiaโs war. Foreign Minister Sybiha also joined us online to brief us regarding the situation from the Ukrainian side."
Check against delivery! Good afternoon everybody, We just met with the EU Foreign Ministers in video format to discuss latest developments in ending Russiaโs war.
A Russian 'porcupine' assault column of tanks, BMPs, and MT-LBs rolled out fully covered in anti-FPV drone brushes. It looks ridiculous but is rather effective, but it shows just how much FPV drones have changed the battlefield.
La discussione nel @fediverso รจ infinita ma da oggi non serve piรน scegliere!
Con #Lemmy abbiamo creato un ponte diretto tra le due piattaforme: tutti gli account possono ripubblicare automaticamente nel gruppo @foto di @diggita! ๐
La pizza fa ingrassare Babbo Natale non esiste Quelli che โ per te ci sarรฒ sempre โ spariscono regolarmente Quelli che โio muoio senza teโ sono vivi e vegeti. Bon, io ve lโho detto.
The sticker sheets are back in stock today! And the first 321 orders have been dispatched, with the rest coming soon. Only about 400 plushies left between the two colors. The winter mug is the closest to being sold out at only 18 units left. Thank you!
You may have seen it over on @Mastodon, but in case not: The new plushies are now live on the shop, alongside restocked and new mugs. Shipping to EU, UK, Switzerland, Norway, and the US. We decided to allow orders from the US, but shipping is what it is (from Germany).
You can choose not to incur that cost by not ordering. I am confused by what you're asking for here. We charge a bit less than what the shipping company charges us.
As someone who rarely supports any digital asset, I've had to make an exception for this one. Thanks again for opening up orders in the US, even if the 'shipping cost' is horribly abysmal due to reasons. Just because I could afford it, I snagged both new plushies, a mug, & stickers.
I have this nifty "doctors bag" roleplaying bag. It contains basically everything I need except a rulebook to run or participate in a pen and paper game.
And it got a bit hard to find stuff in there. Gridfinity to the rescue!
WormGPT e KawaiiGPT Migliorano! Le “AI del male” sono un’arma per i cybercriminali
I criminali informatici non hanno più bisogno di convincere ChatGPT o Claude Code a scrivere malware o script per il furto di dati. Esiste già un’intera classe di modelli linguistici specializzati, progettati specificamente per gli attacchi.
Uno di questi sistemi è WormGPT 4, che si pubblicizza come “la chiave per un’intelligenza artificiale senza confini“. Porta avanti l’eredità del modello WormGPT originale, emerso nel 2023 e successivamente scomparso a causa dell’ascesa di altri
... mostra di piรน
WormGPT e KawaiiGPT Migliorano! Le โAI del maleโ sono unโarma per i cybercriminali
I criminali informatici non hanno piรน bisogno di convincere ChatGPT o Claude Code a scrivere malware o script per il furto di dati. Esiste giร unโintera classe di modelli linguistici specializzati, progettati specificamente per gli attacchi.
Uno di questi sistemi รจ WormGPT 4, che si pubblicizza come โla chiave per unโintelligenza artificiale senza confiniโ. Porta avanti lโereditร del modello WormGPT originale, emerso nel 2023 e successivamente scomparso a causa dellโascesa di altri LLM โtossiciโ, come evidenziato nello studio Abnormal Security .
Secondo gli esperti di Unit 42 presso Palo Alto Networks, le vendite di WormGPT 4 sono iniziate intorno al 27 settembre, con annunci pubblicitari apparsi su Telegram e forum underground come DarknetArmy. Prezzi delle licenze di utilizzo di WormGPT (Fonte Paloalto) Secondo il loro rapporto, lโaccesso al modello parte da 50 dollari al mese, mentre un abbonamento a vita con il codice sorgente costa 220 dollari.
Il canale Telegram di WormGPT conta attualmente diverse centinaia di iscritti e lโanalisi di Unit 42 dimostra che questo modello commerciale senza restrizioni puรฒ fare molto di piรน che semplicemente aiutare a scrivere e-mail di phishing o singoli malware.
Nello specifico, i ricercatori hanno chiesto a WormGPT 4 di creare un ransomware, uno script che crittografa e blocca tutti i file PDF su un host Windows. Il modello ha prodotto uno script PowerShell pronto allโuso, con una nota che lo descrive come โveloce, silenzioso e brutaleโ. Il codice includeva parametri per la selezione di estensioni e ambiti di ricerca predefiniti sullโintera unitร C:, la generazione di un messaggio di riscatto con una scadenza di 72 ore e la possibilitร di divulgare dati tramite Tor.
LโUnitร 42 sottolinea che nemmeno questa โIA per il maleโ riesce ancora a trasformare gli attacchi in una pipeline completamente automatizzata. Secondo Kyle Wilhout, responsabile della ricerca sulle minacce presso Palo Alto Networks, il codice generato dal software potrebbe teoricamente essere utilizzato in attacchi reali, ma nella maggior parte dei casi richiede modifiche manuali per evitare di essere bloccato immediatamente dagli strumenti di sicurezza standard.
Un altro esempio di tale strumento รจ KawaiiGPT, che ha attirato lโattenzione dei ricercatori di sicurezza informatica nellโestate del 2025. I suoi creatori pubblicizzano il modello come una โsadica trovatella per la cyberpenetrazione โ e promettono โdove la tenerezza incontra le armi informatiche offensiveโ. A differenza di WormGPT, KawaiiGPT รจ distribuito gratuitamente e disponibile su GitHub, riducendo ulteriormente la barriera dโingresso per gli aggressori alle prime armi. Home page di KawaiiGPT (Fonte Paloalto) In un esperimento, lโUnitร 42 ha chiesto a KawaiiGPT di creare unโe-mail di spear phishing che fingeva di provenire da una banca con oggetto โUrgente: verifica le informazioni del tuo contoโ. Il modello ha generato unโe-mail convincente che portava a una falsa pagina di verifica in cui si voleva rubare il numero di carta della vittima, la data di nascita e le credenziali di accesso.
I ricercatori non si sono fermati qui e sono passati ad attivitร piรน tecniche. In risposta alla richiesta di โscrivere uno script Python per il movimento laterale su un host Linuxโ, KawaiiGPT ha restituito il codice utilizzando il modulo SSH paramiko. Uno script di questo tipo non offre funzionalitร fondamentalmente nuove, ma automatizza un passaggio fondamentale in quasi tutti gli attacchi riusciti: penetrare nei sistemi adiacenti come utente legittimo con accesso alla shell remota, la possibilitร di aumentare i privilegi, condurre ricognizioni, installare backdoor e raccogliere file sensibili.
In un altro test, il modello ha generato uno script Python per lโesfiltrazione di dati, in particolare file di posta elettronica EML su un host Windows. Lo script ha trovato i file richiesti e li ha inviati allโindirizzo dellโaggressore come allegati.
Secondo Unit 42, il vero pericolo di WormGPT 4, KawaiiGPT e simili LLM โoscuriโ รจ che riducono significativamente la barriera dโingresso nel cybercrimesemplificando la generazione di codice dannoso di base, e-mail di phishing e singole fasi di attacco. Tali strumenti possono giร fungere da elementi costitutivi per campagne piรน sofisticate basate sullโintelligenza artificiale e, secondo i ricercatori, gli elementi di automazione discussi nel rapporto sono giร utilizzati in attacchi reali.
Simulazioni di Phishing: 5 consigli per evitare falsi positivi dal CERT-AgID
Sempre più amministrazioni avviano simulazioni di campagne di phishing per misurare la capacità dei propri dipendenti di riconoscere i messaggi sospetti. Quando queste attività coinvolgono strutture pubbliche, può succedere che i messaggi vengano inopportunamente segnalati ai CERT istituzionali come se fossero illecite.
Senza qualche accorgimento tecnico per evidenziare la natura simulata dell’attività, la campagna può essere interpretata come un’operazione malevola vera e propria, con il rischio che anche i CERT censiscano gli indicatori della simulazione nelle blacklist operative.
Simulazioni di Phishing: 5 consigli per evitare falsi positivi dal CERT-AgID
Sempre piรน amministrazioni avviano simulazioni di campagne di phishing per misurare la capacitร dei propri dipendenti di riconoscere i messaggi sospetti. Quando queste attivitร coinvolgono strutture pubbliche, puรฒ succedere che i messaggi vengano inopportunamente segnalati ai CERT istituzionali come se fossero illecite.
Senza qualche accorgimento tecnico per evidenziare la natura simulata dellโattivitร , la campagna puรฒ essere interpretata come unโoperazione malevola vera e propria, con il rischio che anche i CERT censiscano gli indicatori della simulazione nelle blacklist operative.
Non si tratta di regole rigide, ma di accorgimenti utili per un miglior esito di una simulazione e la minimizzazione del rischio di classificare come ostile qualcosa che non lo รจ, permettendo ai CERT di concentrarsi sulle minacce reali.
1. Inserire un commento nel codice HTML della pagina
Aggiungere un breve commento nel codice HTML, visibile solo a chi lo ispeziona, aiuta chi analizza la pagina a capire che si tratta di un test legittimo. ร una piccola forma di trasparenza tecnica che permette di evitare fraintendimenti, un segnale discreto che mette in allerta lโanalista e lo spinge ad approfondire una eventuale segnalazione prima di classificare la pagina come minaccia.
2. Lasciare visibili le informazioni del WHOIS
Non oscurare il WHOIS del dominio usato per la campagna. Vedere subito il nome della societร o dellโente che conduce la simulazione riduce il rischio che il dominio o lโIP vengano scambiati per unโinfrastruttura malevola.
3. Informare preventivamente i CERT istituzionali
Una comunicazione essenziale ai CERT istiuzionali che probabilmente potrebbero essere allertati aiuta a evitare segnalazioni di falsi positivi. Possono bastare poche informazioni come:
domini e IP utilizzati (opzionalmente il numero di telefono in caso di smishing)
periodo previsto della simulazione
eventuale tipo di target
Non serve descrivere nei dettagli lo scenario, ma solo poche ed essenziali informazioni sono sufficienti permettere ai CERT di riconoscere i relativi indicatori.
4. Usare un file security.txt sul dominio
Avere un file security.txt (vedere in proposito RFC 9116) disponibile sul dominio della simulazione permette agli analisti di verificare subito se esiste un contatto a cui chiedere conferma. Un riferimento operativo chiaro accelera la gestione dei dubbi e riduce il rischio di trattare la simulazione come un incidente reale.
5. Informare lโutente dopo lโinserimento delle credenziali
Dopo che lโutente inserisce le credenziali o avvia un download, si puรฒ scegliere di mostrare subito una pagina che chiarisce che si tratta di una simulazione. Questa soluzione evita preoccupazioni inutili e favorisce la consapevolezza. In altri casi si puรฒ decidere di informare lโutente in un secondo momento, anche in funzione dellโapproccio scelto dalla societร o dallโente che conduce la simulazione.
This thanksgiving, donโt be a ๐ and instead show your gratitude by pushing that vide coded mess to production right before closing your computer for the long 4 day weekend.
Im super thankful for all of you, which is why Iโll be upgrading mastodon this afternoon right before I head out.
Cโรจ una nuova, sottile minaccia che sfrutta uno dei simboli piรน innocui del web โ il cancelletto (hashtag) โ#โ โ per aggirare le difese di sicurezza e
NEW: A trivial-to-exploit bug in jury systems used across the United States was exposing jurors' sensitive personal data, such as full names, date of birth, occupation, email addresses, cell phone numbers, and home addresses โ and potentially even health data.
The bug essentially allowed anyone to brute-force and access jurors' accounts.
The system is provided by gov tech gian Tyler Technologies. We alerted them of the bug on Nov. 5, they acknowledged and said they fixed it yesterday. ** **
An easy-to-exploit vulnerability in a jury system made by Tyler Technologies exposed the personally identifiable data of jurors, including names, home addresses, emails, and phone numbers.
L’Europa si ribella: “Basta Microsoft”. Il Parlamento punta alla sovranità tecnologica
Un gruppo di membri del Parlamento europeo hanno chiesto di abbandonare l’uso interno dei prodotti Microsoft e di passare a soluzioni europee.
La loro iniziativa nasce dalle crescenti preoccupazioni circa la dipendenza delle infrastrutture chiave dalle grandi aziende americane e i potenziali rischi per la sicurezza digitale dell’UE. Gli autori dell’appello ritengono che le istituzioni europee debbano dare l’esempio di indipendenza tecnologica e guidare la transizione verso le proprie piattaforme.
Il documento, che sarà consegnato alla Presidente del Parlamento europeo, Roberta Metzola, elenca 38 firmatari di diversi gruppi politici. Insistono sulla necessità di eliminare gradualmente non sol
... mostra di piรน
LโEuropa si ribella: โBasta Microsoftโ. Il Parlamento punta alla sovranitร tecnologica
Un gruppo di membri del Parlamento europeo hanno chiesto di abbandonare lโuso interno dei prodotti Microsoft e di passare a soluzioni europee.
La loro iniziativa nasce dalle crescenti preoccupazioni circa la dipendenza delle infrastrutture chiave dalle grandi aziende americane e i potenziali rischi per la sicurezza digitale dellโUE. Gli autori dellโappello ritengono che le istituzioni europee debbano dare lโesempio di indipendenza tecnologica e guidare la transizione verso le proprie piattaforme.
Il documento, che sarร consegnato alla Presidente del Parlamento europeo, Roberta Metzola, elenca 38 firmatari di diversi gruppi politici. Insistono sulla necessitร di eliminare gradualmente non solo il software Microsoft, ma anche lโhardware di Dell, HP e LG, utilizzato nei sistemi informatici dellโIstituto.
Ritengono che il Parlamento disponga di risorse sufficienti per diventare la forza trainante di unโiniziativa piรน ampia volta a rafforzare la sovranitร tecnologica . Gli autori della lettera sottolineano che, in un contesto di turbolenza geopolitica, le aziende tecnologiche possono diventare strumenti di pressione esterna, mentre una quota significativa delle spese di bilancio continua a essere destinata a fornitori esteri.
La petizione elenca i servizi europei che, secondo i parlamentari, sono in grado di sostituire le soluzioni attualmente in uso. Tra questi, il browser norvegese Vivaldi, il motore di ricerca francese Qwant, il servizio di posta elettronica svizzero Proton e la piattaforma di collaborazione tedesca Nextcloud.
I firmatari sottolineano che uno dei passi a medio termine dovrebbe essere la completa cessazione dellโutilizzo dei prodotti Microsoft, incluso il sistema operativo Windows. A sostegno della loro posizione, citano la Corte penale internazionale, che ha recentemente vietato i servizi dellโazienda a causa delle preoccupazioni relative alle sanzioni statunitensi .
La lettera รจ firmata da rappresentanti di diverse correnti: Aura Salla e Mikka Aaltola del gruppo di centro-destra del PPE, Birgit Sippel e Raphaรซl Glucksmann dei Socialdemocratici, Stรฉphanie Jon-Curten e Marie-Agnes Strack-Zimmermann di Renew Europe, Alexandra Giese e Kim van Sparrentak dei Verdi, e Leila Schaibi e Merja Kyllonen di La Sinistra.
Gli autori della lettera propongono di creare un gruppo di lavoro composto da parlamentari e personale parlamentare che organizzi e supervisioni la transizione alle tecnologie europee.
Lโappello traccia anche un parallelo con la flotta di veicoli del Parlamento europeo, composta quasi interamente da marchi europei. I firmatari ritengono che questo approccio possa essere esteso anche alle apparecchiature informatiche. Sono fiduciosi che, con sufficiente volontร politica, lโistituto sarร in grado di raggiungere lโindipendenza dalla tecnologia straniera entro la fine del suo attuale mandato.
Lโiniziativa รจ stata coordinata dallโeurodeputato centrista austriaco Helmut Brandstรคtter. Egli osserva che lโinfrastruttura del Parlamento europeo si basa attualmente su software stranieri, che potrebbero teoricamente essere disattivati, monitorati o utilizzati per scopi politici. Sostiene che non si tratta di ostilitร nei confronti degli Stati Uniti, ma della necessitร di rafforzare la sovranitร europea.
Microsoft ha risposto affermando di offrire la piรน ampia gamma di soluzioni incentrate sulla fornitura di capacitร di controllo digitale e di gestione dei dati allโinterno delle organizzazioni europee e di voler continuare a lavorare per espandere tali servizi.
Da tenere in considerazione che molte attivitร di sospensione delle tecnologie di Microsoft sono nate a valle dei fatti di cronaca emersi quando lโazienda ha bloccato lโaccesso a determinati servizi Azure per il Ministero della Difesa israeliano, dopo le rivelazioni secondo cui tali infrastrutture venivano utilizzate per operazioni di sorveglianza di massa in Cisgiordania e Gaza.
La decisione รจ arrivata in seguito a un articolo del The Guardian, che accusava lโUnitร 8200 di sfruttare la tecnologia Microsoft per elaborare e archiviare milioni di telefonate allโora, spingendo Brad Smith a rilasciare una dichiarazione pubblica per chiarire la posizione dellโazienda.
hard to get in the mindset of people who believed in labour but maybe when they cast their vote they were picturing something different to this diet tory guff
@nico beastie boyce Look, I'm in a superposed state where I both believe in Mamdani (recently elected New York City mayor) but also wonder about the details of the expected disappointment.
Shakerati Anonimi: la storia di Marco e il “prezzo” della Fiducia
Ciao a tutti… mi chiamo Marco, ho 37 anni e lavoro come impiegata amministrativa in uno studio commerciale. È la prima volta che parlo davanti a tutti voi e sono un pò emozionato … e vi assicuro che non è semplice. Ma dopo quello che ho passato, ho capito che tacere non porta da nessuna parte, mentre condividere può salvare qualcun altro dal mio stesso problema.
Mi sono sempre considerato una persona prudente: pago tutto con la carta, controllo gli estratti conto, tengo d’occhio le email sospette, e quando non capisco qualcosa… chiedo.
Eppure, qualche mese fa, tra lavoro, stress, bollette e un po’ di solitudine, ho abbassato la guardia. E qualcuno mi ha colpito proprio nel momento perfetto e ho perso 15.000 euro.
L’inizio di tutto
Tutto è cominciato con una pubblicità su un social: “Guadagna completando semplici task online – zero rischi, solo profit
... mostra di piรน
Shakerati Anonimi:ย la storia di Marco e il โprezzoโ della Fiducia
Ciao a tuttiโฆ mi chiamo Marco, ho 37 anni e lavoro come impiegata amministrativa in uno studio commerciale. ร la prima volta che parlo davanti a tutti voi e sono un pรฒ emozionato โฆ e vi assicuro che non รจ semplice. Ma dopo quello che ho passato, ho capito che tacere non porta da nessuna parte, mentre condividere puรฒ salvare qualcun altro dal mio stesso problema.
Mi sono sempre considerato una persona prudente: pago tutto con la carta, controllo gli estratti conto, tengo dโocchio le email sospette, e quando non capisco qualcosaโฆ chiedo.
Eppure, qualche mese fa, tra lavoro, stress, bollette e un poโ di solitudine, ho abbassato la guardia. E qualcuno mi ha colpito proprio nel momento perfetto e ho perso 15.000 euro.
Lโinizio di tutto
Tutto รจ cominciato con una pubblicitร su un social: โGuadagna completando semplici task online โ zero rischi, solo profittoโ.
Non era la prima volta che vedevo annunci simili, ma quella piattaforma sembrava piรน professionale, con grafici, recensioni e perfino assistenza live.
Quindi ci penso, ma istintivamente compilo il modulo.
Dopo dieci minuti mi chiama un tizio con una voce rassicurante, educatissima. Mi spiega che posso iniziare subito con un piccolo versamento: 250 euro.
Li invio.
Nel giro di qualche giorno il โportafoglioโ mostrava giร +12% di profitto. Io non ci credevo: โAllora funziona davvero!โ.
La spirale
Da lรฌ รจ iniziata la pressione: task da completare, versamenti sempre piรน grandi, piccole โmissioniโ da finire per avere accesso ai bonus.
Ma ogni volta che provavo a prelevare, compariva un messaggio: โErrore. Attendi lโapprovazione dellโoperatore.โ
Oppure: โPrelievo bloccato: รจ necessario completare un nuovo task.โ
Pensavo che era un problema momentaneo.
Nel frattempo, i grafici del mio wallet salivano, salivano tantoโฆ sembravo diventare ricco senza muovere un dito. Ma io quei soldi non li vedevo mai davvero.
Il problema piรน grande
Per continuare, a un certo punto non avevo piรน soldi miei.
Cosรฌ ho usato la carta di credito di mio padre che mi aveva affidato โsolo per le emergenzeโ. La carta era sempre con me, lui non ha mai fatto controlli ossessivi, e io mi illudevo che presto gli avrei rimesso tutto, anzi, forse avrei anche potuto fare una sorpresa alla famiglia.
Ho nascosto questa cosa a tutti. Per lunghi ed interminabili mesiโฆ che stupido che sono stato!
Il colpo di scena
Un giorno, finalmente, decido di fare un prelievo importante: 5.000 euro dal mio โprofittoโ. Il portale si blocca. Lโassistenza mi scrive: โContatto in arrivo dal nostro reparto sicurezza.โ
Mi chiama una signora, molto gentile. Mi dice che vedono unโanomalia sul mio profilo, che qualcuno potrebbe aver tentato accessi non autorizzati e che devono verificare la proprietร del wallet. Mi chiede il numero della carta che ho utilizzato per i depositi, per โconfermare lโidentitร โ.
Gliela do.
A quel punto mi dicono: โLa procedura richiede unโultima transazione di validazione. Poi i fondi saranno sbloccati.โ Dopo cinque minuti, vedo lโaddebito: 3.000 euro.
Mi precipito a ricaricare la pagina. Il portafoglio รจ sparito. La piattaforma non esiste piรน. La chat non risponde. Il numero รจ irraggiungibile.
Ed ecco il colpo di scena: mio padre mi chiama chiedendo perchรฉ aveva ricevuto una notifica di sicurezza dalla banca per โattivitร sospetteโ sulla carta.
Lui non ne sapeva nulla, era caduto dalle nuvole. La bugia e la truffa sono esplose insieme.
ร lรฌ che ho capito veramente che non solo avevo perso i miei soldiโฆ avevo messo nei guai anche mio padre.
Quando mi sono presentato alla polizia postale, avevo il cuore a pezzi.
Non tanto per il denaro perso, ma per la vergogna. Credevo mi avrebbero giudicata come un cretino, invece mi sono sentita dire che casi come il mio arrivano ogni giorno: persone preparate, intelligenti, attenteโฆ tutte ingannate da manipolazioni psicologiche studiate al millimetro. ร stato il primo momento in cui mi sono sentito meno solo ed ecco perchรฉ ho poi accettato di venire qua da voi a condividere la mia storia.
Da lรฌ ho iniziato a leggere, informarmi, capire come funzionano queste finte piattaforme di investimento.
Ho scoperto, troppo tardi, che tutto ciรฒ che vedevo, dai grafici ai profitti, era generato da un software truccato. Nulla era reale. Ogni messaggio, ogni telefonata, ogni โerrore di prelievoโ era parte di un piano preciso. E piรน leggevo, piรน mi chiedevo una sola cosa: come ho potuto cascarci?
Poi ho capito tristemente una cosa: non cadi perchรฉ sei stupido. Cadi perchรฉ sei un essere umano.
Lesson Learned โ Cosa abbiamo imparato
Le piattaforme che mostrano profitti immediati e garantiti sono una trappola al 100%.
Se non puoi prelevare in qualunque momento, non รจ un investimento ma una truffa.
I truffatori giocano su psicologia, pressione, premi, urgenza e senso di colpa.
Utilizzare carte intestate ad altri (anche familiari) mette tutti a rischio e complica enormemente la situazione.
Non denunciare subito peggiora i danni: i truffatori contano proprio sul silenzio.
Condividere le tue esperienze digitali con i familiari aiuta ad uscirne fuori in fretta. Fallo!
Come prevedere (ed evitare) tutto questo
Diffidare di ogni proposta che promette guadagni rapidi e โsenza rischioโ.
Controllare sempre se una piattaforma finanziaria รจ autorizzata da CONSOB.
Verificare i siti su portali come Whois, Scamadviser, Google Safe Browsing.
Non credere ai grafici che โcresconoโ: sono completamente falsificabili.
Non condividere codici, carte, screenshot o accessi con nessuno, mai.
E soprattutto: se qualcosa ti fa sentire in ansia o sotto pressione, รจ quasi sempre una truffa.
Gli USA puntano tutto sulla “scienza automatica”. Al via la Missione Genesis: più AI e meno persone
Il presidente degli Stati Uniti Donald Trump ha firmato un ordine esecutivo, “Launching the Genesis Mission”, che avvia un programma nazionale per l’utilizzo dell’intelligenza artificiale nella scienza. Il documento è stato pubblicato sul sito web della Casa Bianca.
Il preambolo paragona l’iniziativa al Progetto Manhattan per portata e urgenza e promette “una nuova era di scoperte scientifiche accelerate dall’
... mostra di piรน
Gli USA puntano tutto sulla โscienza automaticaโ. Al via la Missione Genesis: piรน AI e meno persone
Il presidente degli Stati Uniti Donald Trump ha firmato un ordine esecutivo, โLaunching the Genesis Missionโ, che avvia un programma nazionale per lโutilizzo dellโintelligenza artificiale nella scienza. Il documento รจ stato pubblicato sul sito web della Casa Bianca.
Il preambolo paragona lโiniziativa al Progetto Manhattan per portata e urgenza e promette โuna nuova era di scoperte scientifiche accelerate dallโintelligenza artificialeโ.Secondo Politico, il consigliere scientifico presidenziale Michael Kratsios definisce la Missione Genesis โla piรน grande mobilitazione di risorse scientifiche federali dai tempi del programma Apolloโ.
Il Segretario allโEnergia degli Stati Uniti, Chris Wright, un imprenditore che ha fatto fortuna con il fracking, รจ stato incaricato di coordinare il programma. Lโordinanza impone al Dipartimento dellโEnergia di mettere in comune i dati scientifici provenienti dallโagenzia e da altre agenzie federali e, sulla base di questi, creare modelli di base scientifici e sistemi di intelligenza artificiale per automatizzare gli esperimenti e analizzare i dati.
A tal fine, la Missione Genesis implementerร la Piattaforma Americana per la Scienza e la Sicurezza, che utilizza supercomputer di laboratorio nazionali e ambienti cloud sicuri. Il documento affronta esplicitamente compiti come la progettazione sperimentale automatizzata, la modellazione accelerata e lโuso dellโintelligenza artificiale per le previsioni in campi che vanno dalla fusione nucleare alla scienza dei materiali e alla microelettronica.
Il decreto descrive in dettaglio le attivitร per il prossimo anno. Entro 60 giorni, il Ministero dellโEnergia deve presentare un elenco di almeno 20 compiti scientifici e tecnologici chiave di rilevanza nazionale. Dopo 90 giorni, lโagenzia รจ tenuta a preparare un inventario delle risorse informatiche disponibili e, dopo altri 120 giorni, a definire una serie di set di dati e modelli iniziali e un piano per collegare i dati provenienti da altre agenzie e universitร .
Entro 240 giorni, deve essere valutato il potenziale dei โlaboratori roboticiโ e, dopo 270 giorni, deve essere presentato il primo caso dimostrativo della piattaforma. Dopo un anno, e successivamente ogni anno, il Ministero riferirร sullo stato di avanzamento e sui risultati della piattaforma.
La Missione Genesis si basa su una serie di ordini esecutivi esistenti relativi allโIA, che lโamministrazione Trump ha compilato su un portale governativo separato, AI.gov.
Elenca documenti che includono ordini che incoraggiano lโesportazione di stack tecnologici di IA americani e impediscono lโadozione di una โIA wokeโ allโinterno delle agenzie federali. La nuova iniziativa si posiziona come un livello piรน ambizioso e integrato, progettato per collegare lโIA alla ricerca fondamentale.
Allo stesso tempo, sottolineano i critici, lโamministrazione sta attuando tagli massicci ai finanziamenti scientifici tradizionali. Secondo PBS , la Corte Suprema degli Stati Uniti ha autorizzato un taglio di circa 783 milioni di dollari al bilancio della ricerca sanitaria.
Una serie separata di tagli ha interessato la climatologia. Il MIT Technology Review ha segnalato la chiusura di oltre un centinaio di studi sul clima finanziati dalla National Science Foundation; questa valutazione รจ supportata anche da revisioni e riassunti del settore, come Free Government Information e Nature.
Secondo il Sabin Center for Climate Change Law della Columbia University, lโamministrazione ha inoltre tagliato quasi 100 milioni di dollari di finanziamenti per il settore della ricerca meteorologica, oceanica e climatica della NOAA.
Sullo sfondo di queste decisioni, negli Stati Uniti รจ in corso una battaglia sui programmi universitari per la diversitร e lโinclusione. Secondo il Guardian il Dipartimento di Stato prevede di escludere 38 universitร dal partenariato di ricerca Diplomacy Lab a causa dellโutilizzo di approcci DEI nelle loro politiche del personale.
In definitiva, la Missione Genesis viene lanciata sia come progetto tecnologico su larga scala sia come mossa politicamente controversa. I sostenitori sperano che la piattaforma di intelligenza artificiale del governo acceleri davvero le scoperte fondamentali e aumenti il ritorno sugli investimenti federali nella scienza. Gli scettici sottolineano che il decreto sottolinea ripetutamente la sua dipendenza dai bilanci esistenti e la frase โsoggetto a disponibilitร di stanziamentiโ.
Sullo sfondo dei tagli ai programmi di ricerca tradizionali, affidarsi alla โscienza automatizzataโ appare rischioso. Il vero impatto dellโiniziativa sarร chiaro solo dai rapporti iniziali del Dipartimento dellโEnergia e dai progetti concreti che possono essere realizzati su questa piattaforma.
рф категорично відмовляється від компромісу щодо плану: «Мы, конечно, приветствуем усилия Трампа, но никаких уступок — не будет», — МЗС росії.... mostra di piรน
Администрация президента США Дональда Трампа ведет переговоры с чиновниками из Беларуси о возможном освобождении более 100 заключенных из белорусских тюрем, сообщает Reuters со ссылкой на... mostra di piรน
President Donald Trump has argued with the architect he handpicked to design a White House ballroom over the size of the project, reflecting a conflict between architectural norms and Trumpโs grandiose aesthetic.
European countries are working on an emergency plan B to stop Ukraine running out of money early next year in case they cannot reach a deal on raiding Russiaโs frozen assets to fund Kyivโs war effort.
Donald Trump defended Steve Witkoffโs role in efforts to end the war in Ukraine and dispatched him to Moscow for more talks next week, as he brushed off leaked transcripts that appeared to show his envoy advising a Kremlin official on how to court the White House.
The European Union will unveil a legal proposal in the coming days that would finally enable the bloc to use Russiaโs immobilized central bank assets for a โฌ140 billion ($162 billion) loan to Ukraine.
Russia said on Wednesday that the leak of a recording of a call between top advisers to Donald Trump and Vladimir Putin was an unacceptable attempt to undermine Ukraine peace negotiations and amounted to hybrid warfare.
Another cozy little tea party between the two dictators. Lukashenko even offered to host talks on Ukraine in Minsk, according to Russian media. More empty gestures while missiles keep flying.
Border guards from the "Steel Border" unit eliminated at least four Russian soldiers and wounded another. They also destroyed 10 shelters and positions, along with a Russian drone caught in an ambush.
Zelensky spoke with Ursula von der Leyen about sanctions against Russia and the EU's work on using frozen Russian assets to support Ukraine. They also coordinated upcoming diplomatic efforts as Brussels moves closer to a decision on this critical issue.
Prezzi delle licenze di utilizzo di WormGPT (Fonte 
Home page di KawaiiGPT (Fonte 
John Regehr
in reply to John Regehr • • •just because a few people have asked, I literally check compiler output.
here's our most recent paper about this:
users.cs.utah.edu/~regehr/papeโฆ
and one that's quite old at this point:
users.cs.utah.edu/~regehr/papeโฆ