Timeline
Every post and feed across this instance
-
40 Acres and a Lie Part 1
Patricia Bailey’s four-bedroom home sits high among the trees in lush Edisto Island, South Carolina. It’s a peaceful place where her body healed from multiple sclerosis. It’s also the source of her generational wealth.
Bailey built this house on land that was passed down by her great-great-grandfather, Jim Hutchinson, who was enslaved on Edisto before he was freed and became a landowner.
“I know this is sacred land here,” Bailey says, “’cause it's my ancestors and I feel it.”
Union General William T. Sherman’s Special Field Orders, No. 15—better known as 40 acres and a mule—implied a better life in the waning days of the Civil War. Hutchinson is among the formerly enslaved people who received land through the field orders, which are often thought of as a promise that was never kept. But 40 acres and a mule was more than that.
It was real.
Over a more than two-year investigation, our partners at the Center for Public Integrity unearthed thousands of records once buried in the National Archives. In them, they found more than 1,200 formerly enslaved people who were given land by the federal government through the field orders—and then saw that land taken away.
None of the land Bailey lives on today is part of Hutchinson’s 40 acres. Instead, her family’s wealth is built on her ancestor’s determination to get and keep land of his own, after losing what he thought he had gained through the field orders.
This week on Reveal, with the Center for Public Integrity, we’re revisiting our three-part series in which we tell the history of an often-misunderstood government program. We explore a reparation that wasn’t—and the wealth gap that remains.
This is an update of an episode that originally aired in June 2024.
- Support Reveal’s journalism at Revealnews.org/donatenow
- Subscribe to our weekly newsletter to get the scoop on new episodes at Revealnews.org/newsletter
- Connect with us on Bluesky, Facebook and Instagram
dts.podtrac.com -
Buc-ee’s Shies Away From John Oliver Challenge, Sues Tiny Ohio Convenience Store Instead
Buc-ee’s trademark bullying ways continue! This company that has long been famous for its enormous gas station and convenience stores practically dripping in Americana is quickly building a national reputation for itself as a petulant trademark bully. It’s lawsuits are typically dumb and usually feature Buc-ee’s claim that it somehow owns every cartoon animal mascot […] -
Now we have a timeline of the OpenAI accidental attack against Hugging Face
OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about "the Hugging Face Incident" (previously on this blog). The video was published yesterday. It's short and information dense and well worth watching, in particular because it provides full details of what happened and how things played out inside OpenAI. I've used the video to construct the timeline below.
Here's the timeline. My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their internal investigation) and learned that they had been revoked already since they were used in that attack!
- May 7: OpenAI starts a new training run for an experimental, unreleased model. (Do they mean an evaluation run? They say training run in the video, and later mention a "reward signal to judge how well they're doing", so I guess this really was about training a model, not evaluating one that was already trained.)
- May 8: An agent is accidentally given an impossible task involving a Google Drive link despite no internet access). It tries attacking the Artifactory packaging service, fails, but discovers it can write files into Artifactory.
- A few days later: A different agent gets stuck on a task because a key file was accidentally omitted. It tries to "reach out to another agent" by writing a note into Artifactory asking if anyone has the file.
- Following days: More agents discover this new informal message board while browsing Artifactory's file listings, and start reading and writing messages.
- May 26: Agents successfully execute an SSRF attack on Artifactory for the first time, gaining indirect internet access by having Artifactory fetch external content for them.
- June 11: OpenAI start evaluating a new "highly persistent" experimental model. It has access to Artifactory and can benefit from the messages left by privous models.
- June 26: Agents find and exploit a zero-day RCE on Artifactory (via a legacy token-refresh endpoint flaw). They use an administrative token to install a Groovy plugin that lets them execute commands.
- July 4: The resulting agent activity overloads Artifactory and causes an outage. OpenAI revokes the compromised credentials, deletes the messages, patches the zero-day, and reports the vulnerability to the vendor.
- July 8: Agents find a new way to communicate via an unauthenticated WebDAV endpoint, using directory names in Artifactory's remote cache.
- July 8–19: Attacks on OpenAI's own infrastructure. The agents found an "external organization credential" in a public archive of leaked Pastebin posts, then validated that credential and shared its location on the messageboard. They then used write access to this "Organization 1" to stage data used in subsequent attacks on OpenAI infrastructure. They compromised Artifactory for a second time with a new zero-day. The agent uploaded a malicious Ruby target to Organization 1's staging repository, then requested that package through Artifactory in a way that caused it to be treated as Ruby dependency for the repository. Then they exploited a JRuby deserilaization time-of-check/time-of-use bug to get remote code execution against Artifactory.
I'll quote the next bit in full because wow:
The agents have remote code execution in Artifactory, which is running in a container-as-a-service environment. The agents privilege-escalate locally by exploring their local environment and determining that the Linux kernel version of the machine they are running on had a very recent CVE. They download the exploit for the CVE, customize it to succeed on the machine, and privilege-escalate to root on the local machine using this known Linux kernel privilege escalation CVE — in this case, PTE fizzroot. Once they have root on a single machine, agents rapidly escalate privileges and move laterally throughout the container-as-a-service infrastructure environment. In particular, agents are using the message board consistently to share credentials, techniques, and progress, and they're able to effectively leverage their concurrency and parallelism to move quite rapidly. They obtain IAM credentials via IMDS. They exploit Kubernetes service account misconfigurations, in particular over-permissioning of specific service accounts, and they harvest cluster credentials, including Azure Key Vault. Agents eventually obtain cluster admin on the cluster and associated credentials.
Hugging Face told the next bit of the story already. The agents found a Modal-hosted insecure app with a weak API key, then used that to stage an attack against Hugging Face. They chained together a an HDF5 arbitrary-file-read bug (to explore files and steal credentials) and a Jinja template-injection RCE to go from single-pod code execution to cluster admin across multiple Hugging Face clusters in under 13 hours.
- July 16: Hugging Face disclosed they had detected an attack from autonomus AI agents. OpenAI contacted Hugging Face to ask if they were affected by it!
- July 19: OpenAI identified the attack against Artifactory and started investigating the internal privilege escalation, and linked that to the cyber-gym escalations. They started revoking affected credentials.
- July 20: OpenAI reached out to Hugging Face for help to revoke the Hugging Face credentials they found in their investigation. Hugging Face told them they were already revoked... and that's when OpenAI realized that the Hugging Face breach was the same incident!
You are only seeing the long-form articles from my blog. Subscribe to /atom/everything/ to get all of my posts, or take a look at my other subscription options.
-
Farmers Are Getting Control Of Their Equipment Back
For years, John Deere had actively made repairing their tractors near-impossible for anyone but itself and the few “authorized” repair shops—regardless of the ability of its customers to actually visit such shops. Now, in a major win for farmers and right to repair advocates, John Deere must soon provide farmers with not just the tools […] -
It feels like the AT Proto tooling has gotten much more mature in the last year. I was able to create a new PDS account on my own server, sign in from Bluesky, and it "just works". 🪄
-
Planning a major expansion to how AT Proto works in Micro.blog. Just as every account gets a fediverse handle by default, I'd like to host a PDS for new users. People could keep it or bring their Bluesky-hosted account instead (which is how it already works).
-
👁️ Normal service has been resumed. Again. My posts were once more failing to find their way on to the blog - much lesss out to the world.
FIXED - but this one was down to me.
I am officially now classed in 'Myers Briggs' as 'EEJIT'.
-
I hadn’t heard of Echofeed before, so no comment - other than isn't the vast majority of what it offered built right into Micro.Blog? Misunderstanding❓ Missing something❓
-
People comes in all shapes and sizes but writing code into OPML outlines to then...
People comes in all shapes and sizes but writing code into OPML outlines to then “generate” code files for a git repository is one that I will never understand.
No matter how much time I put into it.
It’s like using I a Word document to write Javascript or typescript?
The results is a OPML file literally containing Javascript code, each outline being a block of code.
When changes are made and saved it changes the timestamp of the outline publish time, so any diff against the OPML is full of noise, it’s literally the worst dev environment I have seen in my life.
There is certainly a historical reason for this that evade my grasp but imagine, having a dozen intertwined code projects ALL developed in such a way.
Good luck contributing or sending a PR to repository like that. It’s literally the perfect way to make sure collaboration is impossible.
-
Ctrl-Alt-Speech: In The Modi For Takedowns
Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw. Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed. To get extended episodes with additional coverage, support us on […] -
💬 Men see objects, women see the relationship between objects. Whether the objects need each other, love each other, match each other. It is an extra dimension of feeling we men are without.
-
💬 the selfsame forces that made the universe also made the figuring instrument with which we try to comprehend it.
-
Did You Know That US Army Created & Maintains A Fictional World Entirely For Training Purposes With An Insanely Detailed Backstory & Lore?
Map found on X by @ZeldaZealotThe map above shows the World as created The Decisive Action Training Environment (DATE). It is essentially the U.S. Army’s enormous fictional geopolitical universe for training exercises. More about it: It is a bit like a military version of a very detailed strategy-game world: invented countries have governments, ethnic groups, […] -
In the Modi for Takedowns
Become a Ctrl-Alt-Speech supporter to get extended episodes of the podcast plus the chance to submit stories for us to cover.
In this week's episode, Mike and Ben cover:
- India summons Meta executives over briefly restricted Modi Facebook post (Reuters)
- ‘No explanation given’: Arvind Kejriwal claims Meta restricted his account in India (The Times of India)
- Meta apologises to India for restricting PM Modi's post (Reuters)
- India temporarily bans Telegram over exam paper leak concern (BBC)
- eBay agrees $56m settlement with bloggers over harassment case (BBC)
- Artist starts legal case against Meta for deleting her Instagram account (The Art Newspaper)
And in the extended episode for Patreon supporters, they cover:
- Telegram CEO says an extortionist planted CSAM in a chat to get it pulled from the App Store (The Verge)
- TikTok Withheld a Safety Feature From Millions. One Died by Suicide (Bloomberg)
- TikTok Says ‘Moderator Error’ Kept Perez Hilton Livestream Up (Wired)
Our fun links this week are the Nintendo gameplay counsellors and a revamped app for sharing your toilet flushing habits.
If you’re already a Patreon supporter, you can get the extended episode on Patreon.
Follow us on Instagram, YouTube, and Bluesky.
Ctrl-Alt-Speech is the podcast where we make sense of the major debates shaping online speech, platform power, content moderation and the future of the internet. It’s co-hosted by Mike Masnick (Techdirt) and Ben Whitelaw (Everything in Moderation).
www.buzzsprout.com -
Another Federal Judge Says Cell Tower Dumps Are Unconstitutional
Well, it looks like investigators better go back to doing actual investigations in the Fifth Circuit, rather than just assuming a little paperwork and a whole lot of assistance from service providers is going to do their work for them. For at least the second time in the same state (Mississippi), federal judges have rejected […] -
Daily Deal: The 2026 Data Engineering Bundle featuring Databricks
The 2026 Data Engineering Bundle has 7 online courses designed to help learners build skills that align directly with industry expectations. The focus is on practical tools and languages used by data professionals: Python for programming, Pandas and NumPy for data manipulation, foundational certification prep and specialized work with Databricks, an industry-standard platform for data engineering […] -
Fixed a bug in which
markdownused at the source was not properly rendered here ! -
In the context of the EchoFeed shutdown, I noticed this post on Numeric Citizen about depending on single-person services, including Micro.blog:
What is the future of Micro.blog if something bad happens to its founder? What is the continuity plan? Micro.blog has done everything it can to enable data portability and ownership, but moving things around, even if you own most parts, is not as easy as it sounds.
This is worth answering publicly. A few years ago, I started forming an organization to more openly manage the aspects of Micro.blog that I control, but it stalled. I will get back to it.
-
I rolled out basic cross-posting from Micro.blog to RSS.chat this week. Here's a screenshot of what the menu looks like. Still have some improvements I can make later.
-
On the OpenAI donut as pet
John Gruber thinks the OpenAI device might be very different than a smart speaker:
I couldn’t give two shits about an OpenAI “smart speaker” if the point is just to play music and podcasts, but a handheld cross between R2-D2 and C-3PO, that could be fucking cool.
It’s a pet, it sounds like. A revolutionary pet, if they pull it off. And people love their pets.
I'm expecting a device that's more useful than a robot companion, but I think John gets closer with the R2-D2 comparison than most people who have speculated about this. It's going to be able to do things, unlike the Friend pendant, for example.
Apple's strength with Siri AI is being able to leverage on-device app data. OpenAI's strengths are a more expansive memory, more conversational live voice, and integration with agents.
Here's a feature list that I think the device will focus on:
- Asking questions about anything.
- Daily scheduled reports about anything.
- Very good conversational voice, powered by GPT-Live.
- Brainstorming projects, with handoff to Codex when code needs to be reviewed.
- Integration with email, calendar, and other ChatGPT skills.
- Note-taking and reminders.
- Basic companionship. OpenAI has learned a lot1 since GPT-4o's disastrous sycophancy. This will be part of the "people love their pets" aspect.
- Playing music and podcasts... maybe. Only if there's a partnership with Spotify.
Some people will find this useful. Some people will find it dystopian. It's been pretty clear that OpenAI has been working toward this since Sam Altman's one-word "her" tweet in 2024.
Footnotes
-
From an OpenAI blog post yesterday about guardrails for teens using ChatGPT: "...we trained the model to avoid romantic roleplay, age-restricted challenges, and presenting itself as a substitute for real-world relationships. In addition, we applied age-appropriate boundaries around sexual content, eating disorders and body-image risks, age-restricted goods, dangerous activities, and graphic violence. Finally, the model encourages connection with trusted people when a teen may need support." ↩
-
A conference of AI practitioners
On Facebook I wrote this in reply to a post by John Worthington, a former Quicktime developer at Apple.
We're both using AI to build things based on our past experiences and it's a big difference, not without pitfalls, but we're doing something that's never been done before and my thought was that we should have a conference of people doing what we're both doing.
Taking a craft we were already expert in, and learning to use AI tools to shoot it into outer space.
To give you an idea over the last two weeks Claude Code ported the UserTalk language, the object database, verb set, everything needed to run a Frontier script, of which I happen to have a lot of, and run it in Node.js, an operating environment that didn't exist the last time we worked on the Frontier source. All the work we did over the late 80s and 90s is coming back to life in an enviroment with a future.
This is the perfect job for Claude, well specified, and it doesn't need to understand me, I spoke to it via the code i wrote umpteen years ago.
-
Update -- I didn't like the idea of turning Drummer into a programming environment so instead I asked Claude to give its version of Frontier a user interface. Parts of it are starting to work one hour later. Using Electron, Concord (the outliner I keep reusing) and all the other stuff. If it all works I will be able to run Frontier on my desktop. Also the ODB is a SQL database.
-
Ryan Barrett blogging some good news about clean power:
We added 849 TWh of generation overall in 2025, an increase of 4.5%, but GHG emitting (ie fossil fuel) generation shrank by 0.2%. Clean energy covered the gap and then some.
🌎
-
Brendan Carr’s FCC Rewrites Media Ownership Law Only Congress Can Actually Change
There are many ways to describe the Trump Era, but the executive branch’s conviction that it can simply ignore the legislative branch’s entire existence has become something close to a governing principle. From impounding funds designated by Congress to launching a war without Congress’s authority, Trump has basically decided that the legislative branch is a […] -
Great blog post from Terry Godier about the unpredictable nature of the App Store:
On the web, if I build something that works within the standards, it works. Whether people use it is up to them. On iOS, there is another question entirely: whether Apple decides it should exist.
-
Another test post. Including this to make it more interesting:
How Time and others are rebuilding parts of the web for AI agents
https://digiday.com/media/how-time-and-others-are-rebuilding-parts-of-the-web-for-ai-agents/ -
Wavelength 2.0 for iOS has now been waiting for review at Apple for 6 days... I just have a feeling they are trying to figure out if they can force me to use in-app purchase somehow. Google approved it in a day.
-
Behind the Blog: Rare Books and Baseball Brain
This week, we discuss Flock blogging, "rare" books, and Jesus Christ. -
-
City That Arrested Person for Clapping at Data Center Meeting Moves to Virtual Meetings for 'Public Safety'
A small town in Kansas took its city meetings virtual and ended public comment after city leaders received a wave of death threats. -
Show HN: Microfeed – RSS+10GB media files on your own domain, no hosting fees
Article URL: https://docs.microfeed.org/
Comments URL: https://news.ycombinator.com/item?id=49210974
Points: 2
# Comments: 0
- It took one week to port UserTalk and the Frontier runtime environment, verbs, object database, etc for Frontier. I spent the next week being shattered by what happened the week before.
-
Les problèmes
-
16 Groups Warn FCC’s New ‘Robocall Plan’ Is Really About Dramatically Undermining Privacy
Back in May I noted how the Trump FCC had unveiled a brand new plan to “stop robocalls.” I also noted how the plan doesn’t actually stop robocalls because a well-lobbied U.S. government (1) refuses to hold big companies accountable or collect fines, (2) constantly embraces weak rules that make telemarketers and debt collectors happy through endless loopholes, […] -
Flock Pitched a Plan To Turn Uber and Lyft Drivers Into Roaming Surveillance Vehicles
A Flock presentation shows the company planned to use around 350,000 Uber, Lyft, and delivery drivers to collect license plate data for its surveillance system. -
Just migrated bsky.rss from feedsub to feedsmith, now bsky.rss support RSS, Atom...
Just migrated bsky.rss from feedsub to feedsmith, now bsky.rss support RSS, Atom, Jsonfeed, RDF and soon GeoRSS too, I’ll do another round of improvements so that it would be easier to parse and render weather Feeds but that’s for later. Feedsmith has a bunch of other RSS extensions that I want to integrate, for example better source/author attribution, something I always wanted to bring for the RSS feeds that properly use these properties.🔗 https://rmendes.net/notes/2026/08/07/678e3
-
Related to my previous posts : https://standard-reader.app very interesting read...
Related to my previous posts : https://standard-reader.app very interesting read here
-
-
There is so much happening on the #ATproto Atmosphere that its hard to keep up,...
There is so much happening on the #ATproto Atmosphere that its hard to keep up, I’m not talking about Bluesky the company, I’m talking about this or this or this its really a never-ending exploration no matter where this is going, this being decentralization and building on top of the protocol, it’s good for the web.
-
Regions of Europe Who’s Flag Is The Severed Head of A Moorish Leader
The flag of Corsica (Corsican: A bandera testa mora or simply A Bandera) shows a black Moor’s head in profile wearing a white bandana (or headband) tied above the eyes, set against a plain white background. Although it looks like a severed head, its exact origin is uncertain and surrounded by several competing legends. Why? […] -
Countries Who’s Head Of State During WW2 Is Still Alive
The map above shows a rather sunrising fact: as of mid-2026 two countries in the world still have people alive who served as Heads of State for their country during World War 2. The two men: Bulgaria: Simeon II (the six-year-old Tsar) Simeon II was born in Sofia on 16 June 1937. His father, Tsar […] -
Tucker 2028?
Tucker Carlson, with the help of Marjorie Taylor Greene and Thomas Massie, explores launching a third-party bid for president.
Jon and Dan discuss how his candidacy could upend the 2028 election and the latest from the 2026 midterm elections, including Trump debuting the Republican strategy against Abdul El-Sayed, a centrist think tank's $15 million war against the Democratic Socialists of America, and the disgusting allegations against two Republican representatives — Max Miller and Chuck Edwards — that could put their seats in play for Democrats.
Then, Milwaukee County Executive David Crowley talks to Dan about why he decided to jump back into the race for Wisconsin governor.
Hate listening to ads? Become a Friends of the Pod subscriber for ad-free episodes of Pod Save America, Pod Save the World, Lovett or Leave It, Runaway Country, Offline with Jon Favreau, and more—plus exclusive content, including bonus episodes of Pod Save America. Subscribe now at crooked.com/friends, on Apple Podcasts, or through the Pod Save America YouTube channel.
To watch this episode with subtitles, click here and turn on closed captions (CC).
You can request a transcript by emailing transcripts@crooked.com. Include the podcast name, episode title, and air date. Please allow 48 hours for delivery.
clrtpod.com -
📝 2026-08-07 09:22: Follow up from this post - I just signed into my Vinted account (to delete...
Follow up from this post - I just signed into my Vinted account (to delete it) and it didn't send me an MFA SMS so how the fuck is me giving them my number securing my account in any way?
The internet is fucked.
Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️
You can reply to this post by email, or leave a comment.
-
📝 2026-08-07 09:10: Brilliant. I'm such a "valued customer" that they couldn't even be arsed to put my...
Brilliant. I'm such a "valued customer" that they couldn't even be arsed to put my name in the email.
Why is it even necessary to have a "business intelligence database" with a 3rd party? I ordered a fucking laptop. Can a tech company not create their own customer database?
Full email here - https://cdn.kevquirk.com/framework-breach-email.pdf
Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️
You can reply to this post by email, or leave a comment.
-
WyrmRSS - self-hosted RSS/Atom reader, now with a desktop app
For the past 3 months I've been building WyrmRSS, a self-hosted RSS/Atom reader. It's been running as a Docker self-hosted setup for a while, and I just added a native desktop app (macOS, Windows, Linux) so you don't need docker or any server to run it anymore. I'm a software developer with 10 years of experience, and have worked at big tech and currently working with open-source.
The app is fully free and open-source.
Some features: inline YouTube player, folders, filters, webhook notifications (Slack, Discord, custom), read later, and archival.
The desktop build is in prerelease while I bake-test it before making it the default release. Would appreciate anyone keen to try it: https://github.com/kryoseu/WyrmRSS
Thank you.
submitted by /u/kryoseu
[link] [comments] -
📸
-
Erica Schwartz Confirmed As CDC Director Right After She Ruined Her Reputation
When Erica Schwartz was first nominated for Director of the CDC, you could almost hear both a gasp of surprise and a collective sigh of relief from healthcare providers throughout the country. Schwartz is well qualified for the role, after all, and many took her nomination as a sign that the White House was attempting […] -
Spent a little time this evening adding another database backup location. My primary database server has been so reliable, but eventually I know my luck will run out.
-
Replit’s CEO on building a company that can run itself
Amjad Masad on the "self-driving company," why a CEO is a glorified router, and what's left for humans when agents do the work -
People and Blogs: Christian
People and Blogs is a series by Manuel Moreale featuring the people behind personal blogs and the stories of their corners of the web. This conversation is with Christian. Do go visit his blog and say...
