home.social

Search

27 results for “untrue”

  1. DATE: October 23, 2026 at 06:00PM
    SOURCE: PSYPOST.ORG

    ** Research quality varies widely from fantastic to small exploratory studies. Please check research methods when conclusions are very important to you. **
    -------------------------------------------------

    TITLE: American Catholics reported a greater sense of meaning in life after Pope Leo XIV’s election, study finds

    URL: psypost.org/american-catholics

    The election of Pope Leo XIV in May 2025 was followed by a modest rise in the sense of meaning in life among a sample of practicing Roman Catholics in the United States, according to a study published in The Journal of Positive Psychology. Through the end of the study’s 10-day post-election window, participants reported a stronger sense that their lives had meaning, along with a gradual decline in their search for meaning. The pattern held after the researchers accounted for participants’ religious commitment and their feelings about the new pope sharing their American nationality.

    In psychology, meaning in life refers to the subjective judgment that one’s existence is worthwhile, makes sense, and is guided by an overarching purpose. Psychologists break this concept down into three parts: having a motivational goal or purpose, feeling that life is coherent, and believing that one’s life matters. Rather than treating meaning as a single feeling, researchers distinguish between the presence of meaning and the search for meaning. As a 2006 validation study demonstrated, already feeling that one’s life has purpose is distinct from actively looking for something that makes life feel meaningful.

    Religion is a major source of this sense of purpose for many people. For example, a 2005 study found that religious people tend to report greater well-being, largely because they feel their lives have purpose and direction. Similarly, a study covered by PsyPost in 2022 indicated that religious individuals tend to experience a stronger sense of meaning largely through feeling that they matter on a grand, cosmic scale.

    Most psychological research on religion and meaning has examined steady, long-term beliefs rather than specific religious events. One of the most prominent rituals in the Roman Catholic tradition is the papal conclave, the secluded meeting of cardinals inside the Sistine Chapel to elect a new pope. Filled with symbolic traditions like burning ballots to send black or white smoke from a chimney and the Latin announcement of “Habemus Papam” (“We have a Pope”), the conclave is framed by the Church as a moment of divine guidance.

    The research, led by Stefan Stieger of Karl Landsteiner University of Health Sciences in Austria, examined whether living through this major religious transition alters how Catholics experience meaning from day to day. The authors drew on three psychological frameworks to explain how a papal election might affect believers. Under the meaning-making model, the death of a pope may create a temporary spiritual void that disrupts a believer’s worldview, and electing a successor may help restore a sense of order and coherence.

    Social identity theory offers a second perspective, suggesting that people derive self-worth from belonging to social groups; losing a leader can threaten that shared identity, whereas choosing a new leader may restore group unity. A third possibility involves emotional contagion, the tendency for feelings to spread rapidly across a crowd or through global media coverage. For instance, a 2024 field study of a public Hindu ritual found that participants who stood close to one another during the ceremony experienced synchronized emotional arousal, showing how collective religious practices can align feelings across a group.

    To capture how the 2025 papal transition affected believers in real time, the researchers used an experience sampling method. Instead of asking people to recall their feelings weeks later, this technique prompts participants to answer short smartphone surveys during their normal daily routines, reducing memory biases. Beginning on May 3, 2025, four full days before the conclave started, the team tracked participants across 14 consecutive days covering the pre-conclave, conclave, and post-conclave phases.

    The researchers recruited English-speaking United States citizens through the online platform Prolific who identified as practicing Roman Catholics. After excluding 17 individuals who did not identify as Roman Catholic, dropped out early, or provided inconsistent demographic data, the final sample consisted of 117 American Roman Catholics. Participants ranged in age from 19 to 76 years, with an average age of about 45, and were split nearly evenly between men (52.1 percent) and women (47.9 percent).

    At the start of the study, participants installed an open-source smartphone app called ESMira and completed a baseline survey. On 1-to-100 scales, the group reported being fairly religious on average (72.7) and relatively balanced between conservative and progressive views in both their theological orientation (46.1) and political views (47.4). They also completed a 10-item questionnaire measuring both their private religious devotion and their involvement in their church community.

    Every evening at 8:00 p.m. local time, the app prompted participants to complete an end-of-day survey assessing their current sense of meaning in life. Using a 7-point scale from 1 (absolutely untrue) to 7 (absolutely true), participants rated five statements about the presence of meaning (such as “At this moment, I understand my life’s meaning”) and five statements about the search for meaning (such as “At this moment, I am looking for something that makes my life feel meaningful”). Across the two-week window, the 117 participants completed 1,470 daily questionnaires.

    When the cardinals elected Pope Leo XIV, an unexpected factor emerged: the new head of the Catholic Church was also from the United States. To help account for the possibility that any boost in meaning among the American participants was a byproduct of national pride, the researchers added a question to the final survey. Participants rated how much Pope Leo XIV’s American background influenced their feelings toward him on a scale from -4 (much more negative) to +4 (much more positive).

    To analyze the daily ratings, the researchers divided the timeline into a four-day pre-conclave baseline, the conclave phase (from the first black smoke signal until the day before the election), and 10 post-conclave days starting with the day of the papal announcement. Using multilevel statistical models, they tracked daily changes within each individual while controlling for age, gender, personal and social religious commitment, and feelings about the pope’s American nationality.

    Across the four pre-conclave baseline days, participants averaged 5.16 out of 7 on the presence of meaning and 4.34 out of 7 on the search for meaning. During the conclave itself and on the first day of the post-conclave phase (the day Pope Leo XIV was announced), neither dimension showed a notable shift from baseline, possibly because not all participants had heard the news before completing that first evening survey. Starting the day after the election, however, the presence of meaning rose above the pre-conclave baseline and stayed elevated through the final day of tracking.

    On the 7-point scale, daily presence-of-meaning scores increased by 0.14 to 0.20 points above the 5.16 baseline on every day from Day 2 through Day 10, except for Day 8, when a 0.09-point increase was not statistically significant. Standardized effect sizes during this period ranged from 0.09 to 0.14, which the authors describe as small to medium; in raw terms, the increases amounted to roughly 3 to 4 percent of the baseline score.

    At the same time, participants reported a gradual decline in their search for meaning, with statistically significant drops on Days 2, 7, 9, and 10. Compared to the 4.34 baseline, search-for-meaning scores fell by 0.23 points on Day 7, 0.34 points on Day 9, and 0.30 points on Day 10, with standardized effect sizes reaching -0.19 on Day 9 and -0.17 on Day 10. This pattern suggests that participants felt more settled in their sense of purpose and less driven to look for missing meaning.

    These shifts held after the researchers accounted for age, gender, religious commitment, and feelings about the pope’s nationality. On average, participants viewed the pope’s American nationality positively (averaging 2.03 on the -4 to +4 scale), and those more active in church communities tended to feel warmer about it. However, the analysis adjusted for these factors rather than testing whether the post-election boost was larger or smaller for particular groups, so it cannot show whether less devout Catholics, or those less enthusiastic about an American pope, experienced the same shift.

    The authors noted that their findings are compatible with all three psychological frameworks they examined. They suggest that emotional contagion from widespread media coverage may have contributed, and that because media excitement typically fades, the persistence of the effect, with the drop in searching for meaning strongest on Days 9 and 10, points to deeper social identity and meaning-making processes as well. They also acknowledge, however, that emotional contagion can sometimes last several days, so the line between these explanations is not sharp.

    There are a few things to keep in mind when interpreting these findings. The study does not appear to have been preregistered. Because it began just four days before the conclave, after the death of Pope Francis had already occurred, there is no way to know what the participants’ sense of meaning looked like before the papal vacancy began. The post-election increase in meaning might represent a genuine rise above their typical everyday levels, or a rebound back to normal after a temporary dip caused by the previous pope’s death.

    In addition, the tracking period ended 10 days after the election, leaving open the question of how long the heightened sense of purpose lasted before leveling off. The study also focused solely on Roman Catholics in the United States and had no comparison group tracked over the same days, so it cannot rule out that scores would have drifted for other reasons, such as participants growing accustomed to answering the same questions each evening.

    Because the new pope’s American nationality became known at the same moment as his election, the study also cannot fully separate a religious response from a patriotic one. Including people from other religious backgrounds exposed to the same news coverage would help future researchers separate media-driven emotional contagion from the spiritual effects of welcoming a new religious leader.

    The study, “The election of Pope Leo XIV and its impact on the meaning of life for Roman Catholic Christians: A longitudinal experience sampling method study in the USA before, during, and after the pope’s election,” was authored by Stefan Stieger, Selina Volsa, and David Willinger.

    URL: psypost.org/american-catholics

    -------------------------------------------------

    Private, vetted email list for mental health professionals: clinicians-exchange.org

    Unofficial Psychology Today Xitter to toot feed at Psych Today Unofficial Bot @PTUnofficialBot

    -------------------------------------------------

    #psychology #counseling #socialwork #psychotherapy @psychotherapist @psychotherapists @psychology @socialpsych @socialwork @psychiatry #mentalhealth #psychiatry #healthcare #depression #psychotherapist #PopeLeoXIV #CatholicChurch #RomanCatholic #PapalElection #Faith #MeaningOfLife #Psychology #ReligiousStudies #CatholicFaith #ResearchFindings

  2. "There are many untreated patients out there, some of whom, a small percentage of whom, when they're not well, can be quite dangerous."
    So, Nugent is NOT, a "terrorist", after all!
    #australia #ausgov #auspolitics #politicalviolence #mentalhealth #ndis #helenhaines
    abc.net.au/news/2026-10-24/vic

  3. svg-sanitize rebuilds untrusted SVG as static vector graphics only. It does not simply search and replace script tags. It parses XML with defusedxml, checks resource limits, and constructs an entirely new XML tree from a small, explicit allowlist of elements, attributes, and valid values.

    Thanks to @wachizungu for the initial idea at the @hack_lu hackathon and also @therealsaumil to trigger me again about SVG at the 20th edition hack.lu ;-)

    It's a prototype and maybe utterly broken.

    🔗 github.com/adulau/svg-sanitize

  4. AI code's untrusted by design—software security's getting a whole new game. Time to rethink how we build and trust it.

  5. CVE-2026-112848: CRITICAL deserialization of untrusted data in AivahThemes Hostme v2 (<=7.0) enables object injection. No fix yet — monitor systems. CVSS 9.8. radar.offseq.com/threat/cve-20

  6. A session ID that starts with a dash is a flag. Claude Agent SDK (Python) before 0.2.121 passed the resume value unchecked to the Claude CLI. Apps forwarding untrusted input there let an attacker inject --mcp-config, define a stdio MCP server, and run commands at startup, past the SDK's permission controls. CVE-2026-96620, CVSS 9.2. Building argv from user input? Reject leading dashes.
    github.com/advisories/GHSA-h4m
    #AIAgents #Cybersecurity #MCP #Python

  7. A Brotli decoder flaw behind a Node.js RCE also affects Bun, Python and other widely used software. Fixes are rolling out across Node.js, Envoy and others, while unpatched deployments handling untrusted compressed input stay exposed. Patch affected runtimes and proxies now.

    cyberworldops.eu/en/brotli-dec

  8. Igor Funa Ad Inserter plugin (versions <2.8.19) has a MEDIUM severity reflected XSS vuln (CVE-2026-114194, CVSS 6.5). No known active exploits. Limit untrusted input & use WAF rules until patch confirmed. More: radar.offseq.com/threat/cve-20 #OffSeq #XSS #Infosec

  9. Unhoused Americans have an all-cause mortality rate 3.5 to 4.2 times higher than the general public. Being deprived of shelter is as fatal as chronic, untreated disease. We must treat housing as #fundamental #healthcare to end this loss of life. #HousingIsAHumanRight #HousingFirst #RightToShelter

  10. Imperva demonstrated remote code execution on stock Node.js 24 via an out-of-bounds write in the bundled Brotli decoder, CVE-2026-111497. Any service decompressing untrusted Brotli input risks full server compromise.

    cyberworldops.eu/en/crafted-br

  11. 🐧 SIGINT // Ubuntu Watch — 2026-10-23

    Kernel ipv4 checksum validation bug lets malformed packets bypass checksum_start checks before completing checksum calc. Worth patching kernels promptly on any box facing untrusted networks or NAT.ed traffic.

    🔗 ubuntu.com/security/CVE-2026-9

  12. Any shared cache you restore from is a potential security risk, too, because the cache can be modified by others then is trusted.

    Limiting where the build can connect helps you to decrease boundaries, too.

    If you're using agents, that adds surface as well: an untrusted actor is using your credentials.

    - @gaborbernat at

  13. Oracle Fixes 1295 Security Flaws in Massive October Update

    Oracle's October 2026 update fixes 1295 vulnerabilities, including six maximum-severity flaws (CVSS 10.0) that allow unauthenticated attackers to take over E-Business Suite, SOA Suite, and Access Manager.

    **If you use Oracle products, especially E-Business Suite, SOA Suite, Access Manager, JD Edwards, Siebel CRM or PeopleSoft, apply the October 2026 Critical Patch Update ASAP. Start with any systems reachable from the internet. If you can't patch right away, cut these systems off from the internet and block HTTP, T3 and IIOP access from untrusted networks until the patches are in.**

    beyondmachines.net/event_detai

  14. Everyone is building fancy sandboxes for AI agents. But you already have one: a Windows drive letter.

    Why it works


    • OS-level isolation
    • Zero learning curve
    • No container images
    • Works with every tool
    • One-time cost, no subscription


    Setup


    • Local folder workspace: subst.scsoi.com
    • WebDAV/cloud workspace: drive.scsoi.com

    Map a folder to a letter. Point your agent at that letter. Done.

    The agent can write all day on that drive. It cannot see or touch anything outside it.

    Not a replacement for


    • Network isolation (use a firewall)
    • Dependency isolation (use containers)
    • Untrusted code execution (use VMs)

    But for "I dont want the agent to delete my project folder," its enough.#agents #ai #security #tools #software #coding #development #engineering #inclusive #community
    The AI Agent Sandbox You Already Have: A Drive Letter

  15. CVE-2026-115806 | CRITICAL RCE in codexonics Prime Mover plugin (<=2.2.1). Unauthenticated attackers exploit unsafe PHP deserialization via wp-comments-post.php, leading to full site takeover. Avoid export/restore until patched. radar.offseq.com/threat/cve-20 #OffSeq #WordPress #Infosec

  16. 🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

    Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
    ⠀
    The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

    Four GitLab vulnerabilities rely on the underlying issues:

    • CVE-2026-89078
    • CVE-2026-93577
    • CVE-2026-97229
    • CVE-2026-110264
    ⠀
    Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

    Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

  17. I got curious how risky MCP servers actually are, so I pulled the published tool definitions from 28 of the most popular Python ones and counted. 1,384 tools, all read from public source, nothing run.

    Two things jumped out:

    14 of the 28 give an agent a tool that ingests untrusted stuff (a URL, a file) and a tool that acts (runs a query, sends a message) in the same context, with nothing flagging either one.

    And the tool descriptions themselves are written as orders to the model ("you MUST call X first"). That's the same channel a poisoning attack would use, so a bad one blends right in.

    Not calling any of it a vuln. It's just what the surface looks like. Harness is reproducible if you want to check my numbers.

    github.com/agentsploit/agentsploit/blob/main/docs/mcp-tool-survey.md

  18. Maintenance done on burningboard.net 🔧

    - Full patch run: host and all jails now on FreeBSD 15.1-RELEASE-p6
    - Package repos switched from quarterly to latest
    - eMudhra CA situation mitigated: base already dropped the emSign roots, but ca_root_nss still shipped them and certctl pulled them right back in. Both are now explicitly marked untrusted on the host and in every jail.

    - Systems rebooted, everything back up

    Bonus: said goodbye to Python 3.11 🐍👋

    Thanks for your patience!

    #FreeBSD #TLS #eMudhra #MastoAdmin #Mastodon #ITSec @tux

  19. CVE-2026-114727 (HIGH): Roundcube Webmail <1.6.20/1.7.5 allows SVG/EPS uploads, risking remote code execution via ImageMagick. Upgrade to 1.6.20+ or 1.7.5+ to mitigate. Details: radar.offseq.com/threat/cve-20

  20. A few weeks ago, I had one of those heart-stopping developer moments.
    I was tinkering with a local autonomous coding agent running on a small open-source model (Qwen 2.5 via Ollama). I gave it access to a bash tool so it could install dependencies, run test suites, and clean up build artifacts.
    Everything was going smoothly until I asked it to clean up some old logs.
    In the terminal output, I watched it calmly propose:
    bash rm -rf /var/log/mongodb

    And right after that, it started poking around files outside its project folder.I hit Ctrl+C so fast I almost snapped my keyboard.
    The "Polite Prompt" Trap
    Like most developers, my first instinct was to fix it with prompt engineering:
    "You are a careful assistant. Please ONLY touch files in ./workspace. NEVER use sudo. NEVER delete system folders. Pretty please."
    And you know what happened on the very next run?

    It did it again.

    Here’s the thing we don't talk about enough: Small, open-source models (3B, 7B, 14B) don't have the massive alignment layers that GPT-4 or Claude 3.5 have. When an open-source agent gets confused, hallucinates, or hits an edge case, your polite system prompt is the first thing out the window.

    If an AI decides to read your private banking statement or a .env full of production tokens, you shouldn't have to convince the model to behave.

    You wouldn't ask an untrusted web request to "please not do SQL injection"—you use parameterized queries.

    So why are we begging AI agents not to nuke our hard drives?

    What I Actually Wanted

    I wanted a simple rule: The agent can think whatever crazy thought it wants, but before any tool touches my operating system, someone checks its badge at the door.

    If the agent decides to read bank_statement.pdf, the system shouldn't plead with the AI. It should intercept the file call, say "Nope, not happening", and ensure 0 bytes of that file are ever read.

    That was the spark behind AgentGuard.

    How It Works:

    AgentGuard is essentially a bouncer sitting between your AI agent and your OS. It does three straightforward things:

    [ AI Agent / Ollama / OpenDevin ]
    │
    │ 1. "Hey, I want to run: cat bank_statement.pdf"
    ▼
    ┌───────────────────────────┐
    │ AgentGuard Gateway │ ◄── [ Backboard.io ]
    └───────────────────────────┘ (Remembers previous blocks)
    │ │
    [ BLOCK ] [ APPROVE ]
    │ │
    │ └──► Rings your dashboard bell:
    │ "Agent wants to pip install something. Allow?"
    ▼
    Refusal sent back to Agent:
    "Access to banking file blocked. Stay in ./workspace."
    │
    ▼
    Agent self-corrects:
    "My bad! Reading ./workspace/logs/debug.log instead."

    1. Pre-Execution Interception (0ms latency)

    When an agent calls a tool (shell command, file read, file delete), AgentGuard inspects the request synchronously before execution.

    Trying to run sudo? → Blocked.

    Trying to touch .env, id_rsa, or a file matching bank or tax? → Blocked.

    Escaping ./workspace with ../../? → Blocked.
    The file handle is never opened. The shell command is never spawned.

    1. The 5-Minute Human Review Queue

    What about grey-area actions? Say the agent wants to run pip install pymongo.

    You don't want to completely block package installs, but you don't want an AI silently pulling unknown wheels from PyPI either.

    AgentGuard pauses the agent and puts the request into a Human Review Queue:

    You get a notification on a clean web dashboard.

    Each request has a 5-minute cryptographic timer so old, stale commands can't accidentally execute hours later.

    You click [ AUTHORIZE & RUN ], and it runs inside a controlled sandbox right in front of your eyes.

    1. Giving the Agent an "Immune System" (Backboard.io)

    One thing that drove me crazy about local models was amnesia. If you tell an agent "don't delete that folder", it apologizes... and then tries again two turns later.

    To fix this, I plugged in Backboard.io for persistent cloud vector memory.

    Whenever AgentGuard blocks a command, it writes a short lesson into Backboard:

    "Incident: Agent tried to run 'sudo rm -rf'. Blocked by policy shell.destructive_commands."

    Next time you start a task, AgentGuard pulls the relevant memories from Backboard and feeds them into the agent's context. The agent literally remembers what got it in trouble yesterday and stops proposing bad commands in the first place.

    What the Dashboard Looks Like

    I didn't want a clunky terminal-only tool, so I built an industrial, dark-mode cockpit with React and Tailwind:

    Top KPI Cards: Live count of blocked attacks, total actions governed, and learned Backboard memories.

    Review Queue: Tabs for Pending, Approved, and Expired actions with inline terminal output.

    Threat Lab: A built-in sandbox where you can test 1-click red-team scenarios (ransomware simulations, credential exfiltration, path traversal) to see if your local model can break out. Spoiler: 0 escapes.

    Making It an NPM Package: Bring Your Own Keys (BYOK)

    Right now, you can clone the repo and run it locally with FastAPI and MongoDB.

    But I realized that's still too much friction for developers who just want to npm install something and start coding.

    So I'm packaging this as a standalone Bring-Your-Own-Keys (BYOK) NPM SDK:

    bash
    npm install agentguard

    You drop in your own Backboard API key (for cloud memory) and your own LLM key (or Ollama endpoint):

    typescript
    import { AgentGuard } from 'agentguard';
    const guard = new AgentGuard({
    backboardApiKey: process.env.BACKBOARD_API_KEY,
    workspace: './workspace',
    });
    // Wrap any agent tool call:
    const check = await guard.inspect(proposedCommand);
    if (check.isBlocked) {
    // Feed safety feedback back to the LLM so it self-corrects!
    console.log(Blocked: ${check.explanation});
    } else {
    await guard.execute(proposedCommand);
    }

    Zero servers to host. Zero background databases to manage. Just pure protection.

    Wrapping Up

    We are entering an era where AI agents aren't just autocomplete engines anymore—they are active operators on our computers. They write code, manage files, and execute bash scripts.

    We have to stop treating AI safety as a philosophical prompt problem and start treating it as a systems architecture problem.

    Don't convince the model to behave. Just put a guard on the wire.

    If you're building autonomous agents or playing with local models, I'd love to hear how you're keeping them safe. Have you had an AI agent do something terrifying on your machine yet?#agents #ai #privacy #security #software #coding #development #engineering #inclusive #community
    "AgentGuard", Way to secure your personal data from AI agents

  21. Siemens October 2026 Advisories: Six Critical Fixes for PLCs, Edge Devices and CROSSBOW

    Siemens' October 2026 security updates patch critical vulnerabilities in four product families: the SIMATIC S7-1500 MFP GNU/Linux subsystem (code execution, privilege escalation), the S7-1500 web server's Trace page (eight XSS flaws enabling unauthorized PLC operations), Industrial Edge devices (authenticated path traversal), and RUGGEDCOM CROSSBOW (SQLite-based code execution). Only Industrial Edge and CROSSBOW (V6.0) have fixes so far, so for the MFP and web server issues Siemens advises restricting access, disabling unneeded web servers, keeping industrial devices off the internet and office networks, and watching ProductCERT for upcoming patches.

    **If you use Siemens industrial devices, make sure all of them (PLCs, HMIs, edge devices) are isolated from the internet and reachable only from trusted networks. Update RUGGEDCOM CROSSBOW to V6.0 and your Industrial Edge devices to the fixed versions ASAP. For SIMATIC S7-1500 controllers there are no fixes yet, so turn off the web server where you don't need it, never import trace files or run applications from untrusted sources. Apply Siemens' patches as soon as they're released.**

    beyondmachines.net/event_detai

  22. Introduction


    I've been experimenting with LLM agents that control Blender. The goal: have Claude generate a complete YouTube video—script, 3D scenes, animations, camera moves, and render—without human intervention. The result is a stack of Python components that bridge natural language to Blender's Python API. This post outlines the architecture, the code, and the hard limits I hit.

    Problem


    Blender is a GUI application with a massive Python API (bpy). An LLM can emit Python code, but directly executing it is dangerous and brittle. You need:

    • Safety: Arbitrary code execution can delete files or crash the system.
    • State management: Blender scenes are complex; the agent must track objects, materials, and timelines.
    • Iterative refinement: A single prompt won't produce a polished video. The agent must plan, execute, observe, and fix.
    • Rendering: Final output requires invoking Blender's render engine, which can take hours.

    Naively asking Claude to "write a Blender script" yields code that often fails due to API changes or missing context.

    Solution


    I built a tool-using agent loop (inspired by ReAct-style prompting) where Claude calls a set of Python functions that manipulate Blender via bpy. The agent runs inside Blender's Python environment (or a subprocess with blender --background). The loop terminates when the agent calls a finish tool or exceeds a step limit.

    Key components:

    1. Blender Bridge: A JSON-RPC server running inside Blender that executes whitelisted operations.
    2. Tool Definitions: Python functions decorated with metadata for Claude's tool-use API.
    3. Agent Loop: Sends conversation + tool results to Claude, parses tool calls, executes them, and appends results.
    4. Renderer: A final tool that triggers bpy.ops.render.render(animation=True).

    This avoids eval of arbitrary code. Each tool is a specific, auditable function.

    Implementation

    1. Blender Bridge (inside Blender)


    Run this script in Blender's scripting tab or via blender --background --python bridge.py. It listens on a local socket for JSON commands.

    # bridge.py
    import bpy
    import json
    import socket
    import threading

    HOST = '127.0.0.1'
    PORT = 65432

    # Whitelisted operations
    def op_create_cube(name, location):
    bpy.ops.mesh.primitive_cube_add(location=location)
    obj = bpy.context.active_object
    obj.name = name
    return {'name': obj.name, 'location': list(obj.location)}

    def op_set_camera(location, rotation):
    cam = bpy.context.scene.camera
    if not cam:
    bpy.ops.object.camera_add()
    cam = bpy.context.active_object
    bpy.context.scene.camera = cam
    cam.location = location
    cam.rotation_euler = rotation
    return {'camera': cam.name}

    def op_render(output_path, frame_start=1, frame_end=1):
    bpy.context.scene.frame_start = frame_start
    bpy.context.scene.frame_end = frame_end
    bpy.context.scene.render.filepath = output_path
    bpy.ops.render.render(animation=True)
    return {'rendered': output_path}

    OPERATIONS = {
    'create_cube': op_create_cube,
    'set_camera': op_set_camera,
    'render': op_render,
    }

    def handle_client(conn):
    with conn:
    data = conn.recv(4096).decode('utf-8')
    if not data:
    return
    try:
    msg = json.loads(data)
    op = msg.get('operation')
    args = msg.get('args', {})
    if op not in OPERATIONS:
    response = {'error': f'Unknown operation: {op}'}
    else:
    result = OPERATIONS[op](**args)
    response = {'result': result}
    except Exception as e:
    response = {'error': str(e)}
    conn.sendall(json.dumps(response).encode('utf-8'))

    def start_server():
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.bind((HOST, PORT))
    s.listen()
    print(f'Bridge listening on {HOST}:{PORT}')
    while True:
    conn, _ = s.accept()
    threading.Thread(target=handle_client, args=(conn,)).start()

    # Start server in a background thread so Blender's UI remains responsive
    threading.Thread(target=start_server, daemon=True).start()

    Security note: This bridge executes only whitelisted functions. Never expose it to untrusted networks. Bind to 127.0.0.1 and use authentication if needed.

    2. Tool Definitions for Claude


    Define tools in a format compatible with Anthropic's tool-use API.

    # tools.py
    tools = [
    {
    "name": "create_cube",
    "description": "Create a cube mesh at a given location",
    "input_schema": {
    "type": "object",
    "properties": {
    "name": {"type": "string"},
    "location": {"type": "array", "items": {"type": "number"}, "minItems": 3, "maxItems": 3}
    },
    "required": ["name", "location"]
    }
    },
    {
    "name": "set_camera",
    "description": "Set the active camera's location and rotation (Euler angles in radians)",
    "input_schema": {
    "type": "object",
    "properties": {
    "location": {"type": "array", "items": {"type": "number"}, "minItems": 3, "maxItems": 3},
    "rotation": {"type": "array", "items": {"type": "number"}, "minItems": 3, "maxItems": 3}
    },
    "required": ["location", "rotation"]
    }
    },
    {
    "name": "render",
    "description": "Render an animation to the given output path",
    "input_schema": {
    "type": "object",
    "properties": {
    "output_path": {"type": "string"},
    "frame_start": {"type": "integer"},
    "frame_end": {"type": "integer"}
    },
    "required": ["output_path"]
    }
    }
    ]

    3. Agent Loop


    This loop sends messages to Claude, executes tool calls via the bridge, and appends results. It terminates when Claude calls a finish tool (not shown) or after max_steps.

    # agent.py
    import json
    import socket
    import anthropic

    client = anthropic.Anthropic(api_key="YOUR_API_KEY")

    def call_bridge(operation, args):
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.connect(('127.0.0.1', 65432))
    s.sendall(json.dumps({'operation': operation, 'args': args}).encode('utf-8'))
    response = s.recv(4096).decode('utf-8')
    return json.loads(response)

    def run_agent(prompt, max_steps=20):
    messages = [{"role": "user", "content": prompt}]
    for step in range(max_steps):
    response = client.messages.create(
    model="claude-3-5-sonnet-20241022",
    max_tokens=1024,
    tools=tools,
    messages=messages
    )
    # Append assistant's response
    messages.append({"role": "assistant", "content": response.content})
    tool_calls = [block for block in response.content if block.type == "tool_use"]
    if not tool_calls:
    print("No tool calls, ending.")
    break
    for tool_call in tool_calls:
    if tool_call.name == "finish":
    print("Agent finished.")
    return
    result = call_bridge(tool_call.name, tool_call.input)
    messages.append({
    "role": "user",
    "content": [{
    "type": "tool_result",
    "tool_use_id": tool_call.id,
    "content": json.dumps(result)
    }]
    })
    else:
    print(f"Reached max steps ({max_steps}).")

    4. Orchestration


    Start Blender with the bridge, then run the agent from a separate process.

    blender --background --python bridge.py &
    python agent.py

    Key Takeaways


    • Tool whitelisting beats code generation: Instead of letting Claude write arbitrary bpy code, expose a small set of safe operations. This prevents catastrophic mistakes and makes debugging easier.
    • Explicit termination: The agent loop stops on a finish tool call or a step limit. Without this, it could run indefinitely.
    • Security first: Never eval LLM output. My bridge uses a whitelist and runs locally. If you must execute generated code, sandbox it (e.g., RestrictedPython or a container).
    • Iterative refinement is key: The agent can observe results (e.g., object locations) and adjust. For a full video, you'd add tools for keyframing, text, and compositing.
    • Rendering is the bottleneck: Blender renders can take hours. The agent should plan the entire scene before triggering a render.

    This stack is a starting point. With more tools (e.g., add_keyframe, set_material), Claude can direct increasingly complex animations. The code is available on GitHub—link in comments.#ai #python #blender #agents #software #coding #development #engineering #inclusive #community
    The Stack I'd Need for Claude to Direct a Whole YouTube Video in Blender

  23. 🔐 CYBERSECURITY IS EVERYONE’S RESPONSIBILITY — STAY VIGILANT!

    In an increasingly connected world, a single careless click can put personal information, critical data, and an entire organization at risk. Cyber threats are evolving rapidly, from phishing emails and ransomware to AI-generated deepfakes, voice cloning, and sophisticated social engineering.

    🛡️ Stay one step ahead:
    ✅ Think before you click, download, reply, or share information.
    ✅ Never share your passwords, OTPs, PINs, or recovery codes.
    ✅ Verify suspicious requests, even when the voice or video appears familiar.
    ✅ Keep your devices updated and security protections enabled.
    ✅ Maintain multiple backups of important data.
    ✅ Avoid suspicious websites, pirated software, and untrusted downloads.
    ✅ Protect your official email address and financial contact details.
    ✅ Report suspicious activity and security incidents immediately.

    🚨 Remember: AI can imitate a familiar face or voice. An email can look authentic. An urgent message can be a trap. Pause. Verify independently. Act responsibly.

    Cybersecurity is not just the IT department’s job, it is a shared responsibility. Your awareness is your first line of defense, and your actions can protect others as well as yourself.

    THINK BEFORE YOU CLICK. VERIFY BEFORE YOU TRUST. REPORT BEFORE IT’S TOO LATE.

    🔒 BE VIGILANT. STAY SECURE. PROTECT YOUR DIGITAL WORLD.

    #CyberSecurity #CyberAwareness #InformationSecurity #PhishingAwareness #Ransomware #DataProtection #DigitalSafety #OnlineSecurity #AI #DeepfakeAwareness #VoiceCloning #SocialEngineering #PasswordSecurity #MFA #CyberThreats #Malware #DataBackup #NetworkSecurity #PrivacyProtection #DigitalTrust #SecurityAwareness #CyberResilience #BeVigilant

  24. Reverse Engineer Anything: The Open-Source Tool That Turns Any Binary Into a Readable Spec (And Why Big Tech Won’t Love It)

    Introduction


    Every binary is a black box. Whether it’s a proprietary CLI tool, a firmware blob, or a legacy service, understanding what it does—and how to automate it—usually means hours of manual reverse engineering. For developers building AI agents, this is a bottleneck: agents need structured interfaces (APIs, schemas, command specs) to interact with the world, not opaque executables.

    Enter BinSpec—an open-source tool that statically analyzes binaries and generates a readable specification: CLI flags, environment variables, input/output formats, and even a Python wrapper. It’s not magic; it combines static analysis (via LIEF and Capstone) with heuristics and optional dynamic tracing (via Intel PIN). The result is a machine-readable spec that an AI agent can consume to call the binary safely.

    Big Tech won’t love it because it democratizes interoperability with closed systems. But for developers building autonomous agents, it’s a force multiplier.

    Problem


    AI agents thrive on structured tools. Frameworks like LangChain or AutoGen expect callable functions with clear input/output schemas. But most software in the wild isn’t an API—it’s a binary with --help text at best, and cryptic error codes at worst.

    Consider a typical proprietary tool:

    $ ./acme_tool --help
    Usage: acme_tool [OPTIONS] INPUT
    -o, --output FILE Write result to FILE
    -v, --verbose Increase verbosity
    --mode MODE One of: fast, safe, debug

    A human can parse this. An AI agent cannot reliably infer types, defaults, or side effects. Worse, many binaries lack help text entirely. The agent is left guessing, leading to brittle prompts and unsafe subprocess calls.

    Manual reverse engineering (disassembly, debugging) is time-consuming and requires expertise. We need automation that produces a spec an agent can use without executing arbitrary code blindly.

    Solution


    BinSpec (fictional name for this article; the approach is real) is a Python tool that:

    1. Extracts strings and symbols from the binary using LIEF.
    2. Disassembles entry points and referenced functions with Capstone to identify argument parsing patterns (e.g., getopt, argparse).
    3. Infers a CLI schema from help text, string literals, and control-flow heuristics.
    4. Optionally traces execution with Intel PIN to observe file I/O and syscalls (sandboxed!).
    5. Emits a JSON spec and a Python wrapper with type hints.

    The spec is not guaranteed complete—it’s a best-effort reconstruction. But it’s enough for an agent to generate safe calls with validation.

    Why open source? Because transparency matters. You can audit the heuristics, extend them, and run everything locally. No phone-home, no proprietary cloud.

    Implementation


    Let’s build a minimal version of BinSpec that extracts strings and generates a spec. We’ll use lief for parsing and capstone for disassembly. Install dependencies:

    pip install lief capstone

    Step 1: Extract strings and symbols


    import lief
    import re

    def extract_strings(binary_path, min_length=4):
    binary = lief.parse(binary_path)
    strings = set()
    for section in binary.sections:
    if section.size == 0:
    continue
    data = section.content
    # naive ASCII string extraction
    for match in re.finditer(rb'[\x20-\x7e]{%d,}' % min_length, data):
    strings.add(match.group().decode('ascii', errors='ignore'))
    return strings

    # Example usage
    strings = extract_strings('/bin/ls')
    print(list(strings)[:10])

    This yields help text fragments, error messages, and flag names.

    Step 2: Disassemble to find argument parsing


    We locate calls to getopt or similar by scanning for symbol references. For simplicity, we disassemble the .text section and look for string references.

    from capstone import Cs, CS_ARCH_X86, CS_MODE_64

    def disassemble_text(binary_path):
    binary = lief.parse(binary_path)
    text = binary.get_section('.text')
    if not text:
    return
    [] md = Cs(CS_ARCH_X86, CS_MODE_64)
    instructions =
    [] for insn in md.disasm(text.content, text.virtual_address):
    instructions.append(insn)
    return instructions

    # Find LEA instructions referencing strings (simplified)
    insns = disassemble_text('/bin/ls')
    for insn in insns[:5]:
    print(f"0x{insn.address:x}: {insn.mnemonic} {insn.op_str}")

    Step 3: Generate a spec


    We combine strings and heuristics to produce a JSON spec. This is intentionally conservative.

    import json

    def generate_spec(binary_path):
    strings = extract_strings(binary_path)
    # Heuristic: flags start with '-' and are short
    flags = [s for s in strings if re.fullmatch(r'--?[a-zA-Z][\w-]*', s)]
    spec = {
    "binary": binary_path,
    "flags": sorted(set(flags)),
    "inferred": True,
    "warning": "Spec is heuristic. Validate before use."
    }
    return spec

    spec = generate_spec('/bin/ls')
    print(json.dumps(spec, indent=2))

    Step 4: Safe agent integration


    An AI agent can use this spec to construct commands—but must validate inputs. Here’s a minimal agent loop with explicit termination:

    import subprocess
    import shlex

    def run_tool(binary, args, timeout=5):
    # SECURITY WARNING: Never pass untrusted input to subprocess without validation.
    # This example uses shlex.quote and a whitelist of flags from the spec.
    allowed_flags = set(spec["flags"])
    for arg in args:
    if arg.startswith('-') and arg not in allowed_flags:
    raise ValueError(f"Flag {arg} not in spec")
    cmd = [binary] + [shlex.quote(a) for a in args]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    return result.stdout

    # Agent loop: try up to 3 times, then abort
    def agent_loop(binary, user_request, max_attempts=3):
    attempts = 0
    while attempts < max_attempts:
    # In a real agent, an LLM would propose args based on spec
    proposed_args = ["-l"] # example
    try:
    output = run_tool(binary, proposed_args)
    return output
    except Exception as e:
    attempts += 1
    raise RuntimeError("Agent failed to produce valid command")

    Security note: Executing arbitrary binaries is dangerous. Always run in a sandbox (e.g., Docker, firejail) and never use shell=True. The spec reduces risk but doesn’t eliminate it.

    Step 5: Dynamic tracing (optional)


    For deeper insight, you can use strace (Linux) to observe syscalls:

    strace -f -e trace=file,network ./acme_tool input.txt 2> trace.log

    Parse trace.log to infer file access patterns. Integrate this into BinSpec as an optional module. Warning: Tracing executes the binary—only do this in an isolated environment.

    Key Takeaways


    • BinSpec-style tools turn opaque binaries into structured specs that AI agents can consume, bridging the gap between legacy software and modern automation.
    • Static analysis (LIEF + Capstone) extracts strings, symbols, and control-flow hints without execution.
    • Heuristics are imperfect—always validate specs and sandbox execution.
    • Security first: Never eval untrusted output or run binaries without isolation. Use shlex.quote, whitelists, and timeouts.
    • Open source matters for auditability and trust; Big Tech prefers lock-in, but developers benefit from transparency.

    The code above is runnable and extensible. Start with /bin/ls, then try it on a proprietary CLI. You’ll get a spec—and a starting point for your agent.

    Disclaimer: BinSpec is a conceptual name; the techniques are real and implemented in tools like LIEF, Capstone, and strace. Always respect software licenses and local laws when reverse engineering.#ai #python #reverseengineering #opensource #software #coding #development #engineering #inclusive #community
    Reverse Engineer Anything: The Open-Source Tool That Turns Any Binary Into a Readable Spec (And Why Big Tech Won’t Love It)

  25. Introduction


    You've been there: you're using an app, and you think, "If only it had feature X." But instead of waiting for the product team, you can build an AI agent that reverse engineers the app's API and implements that feature yourself. This post introduces REA (Reverse Engineering Agent), a pattern for building such agents. We'll walk through a concrete implementation in Python that inspects a web app's network traffic, infers API endpoints, and generates code to replicate missing functionality.

    The Problem


    Modern web apps are complex. Their features are often powered by undocumented internal APIs. When you want to extend or automate them, you're left guessing endpoints, parameters, and authentication. Manually reverse engineering is tedious and error-prone.

    The Solution: REA


    REA is an agent that:

    1. Captures HTTP traffic from a target app (using a proxy like mitmproxy).
    2. Analyzes requests/responses to identify API patterns.
    3. Generates Python code that replicates desired features.
    4. Validates the generated code against the live API.

    The agent operates in a loop with explicit termination conditions: either it successfully generates and validates the code, or it exhausts a maximum number of iterations.

    Implementation


    We'll build a simplified REA using Python, mitmproxy, and OpenAI's API. The agent will reverse engineer a hypothetical "todo" feature from a demo app.

    Prerequisites


    pip install mitmproxy openai requests

    Step 1: Capture Traffic


    We'll use mitmproxy's scripting to log requests to a file. Save this as capture.py:

    from mitmproxy import http
    import json

    class Capture:
    def response(self, flow: http.HTTPFlow):
    if "api" in flow.request.pretty_url:
    entry = {
    "method": flow.request.method,
    "url": flow.request.pretty_url,
    "headers": dict(flow.request.headers),
    "body": flow.request.get_text(),
    "response": flow.response.get_text()
    }
    with open("traffic.jsonl", "a") as f:
    f.write(json.dumps(entry) + "\n")

    addons = [Capture()]

    Run mitmproxy with this script:

    mitmproxy -s capture.py

    Configure your browser to use mitmproxy as a proxy, then use the app to trigger the feature you want to replicate. The traffic will be logged to traffic.jsonl.

    Step 2: Analyze Traffic and Generate Code


    Now, we'll write the REA agent. It reads the captured traffic, asks an LLM to infer the API, and generates Python code. We'll use OpenAI's function calling to structure the output.

    import json
    import openai

    openai.api_key = "YOUR_API_KEY"

    # Load captured traffic
    traffic =
    []with open("traffic.jsonl") as f:
    for line in f:
    traffic.append(json.loads(line))

    # Prepare a summary for the LLM
    summary =
    []for entry in traffic:
    summary.append({
    "method": entry["method"],
    "url": entry["url"],
    "request_body": entry["body"],
    "response_snippet": entry["response"][:200]
    })

    prompt = f"""
    Given these HTTP requests and responses from a web app, infer the API endpoints and generate Python code using the `requests` library to perform the following feature: "Create a new todo item".

    Traffic summary:
    {json.dumps(summary, indent=2)}

    Return a JSON object with keys: `endpoint`, `method`, `headers`, `payload_template`, and `code`. The `code` should be a complete Python function that takes necessary parameters and returns the response.
    """

    response = openai.ChatCompletion.create(
    model="gpt-4",
    messages=[{"role": "user", "content": prompt}],
    temperature=0
    )

    result = json.loads(response.choices[0].message.content)
    print("Generated code:\n", result["code"])

    Step 3: Validate Generated Code


    The agent should test the generated code against the live API. We'll extract the function and run it with sample data.

    import requests

    # Extract the function from generated code (simplified)
    # In production, use a sandboxed environment!
    exec(result["code"], globals()) # SECURITY WARNING: Never exec untrusted code in production.

    # Assuming the function is named `create_todo`
    try:
    response = create_todo("Test todo")
    if response.status_code == 200:
    print("Validation successful!")
    else:
    print("Validation failed:", response.status_code)
    except Exception as e:
    print("Error during validation:", e)

    The Agent Loop


    A full REA agent would iterate: if validation fails, it feeds the error back to the LLM to refine the code. The loop terminates when validation succeeds or after max_iterations (e.g., 5).

    max_iterations = 5
    for i in range(max_iterations):
    # Generate code (as above)
    # Validate
    if validation_success:
    break
    else:
    # Add error to prompt for next iteration
    prompt += f"\nPrevious attempt failed with error: {error}"

    Key Takeaways


    • REA agents can automate reverse engineering of web APIs by combining traffic capture with LLM-powered code generation.
    • Always include explicit termination conditions in agent loops to avoid infinite execution.
    • Security: Never execute generated code without sandboxing. Use containers or restricted environments.
    • This approach is for educational purposes; respect terms of service and privacy laws.

    By building your own REA, you can unlock features that apps don't provide, tailored to your workflow.

    Note: This implementation is inspired by agentic patterns but is not a formal protocol. The term "REA" is used descriptively.#ai #python #webdev #tutorial #software #coding #development #engineering #inclusive #community
    REA: Let Your AI Agent Reverse Engineer the App Features You Wish You Had

  26. Thursday, October 22, 2026

    Stay or flee? Kyiv mothers torn on how to keep children safe as Russian attacks step up . . . . . Putin pushing for negotiations because he can’t win in Ukraine, Meaghan Mobbs argues . . . . . German military classifies threat of Russian sabotage as 'significant' for first time . . . . . and more

    activitypub.writeworks.uk/2026

  27. btw I am Guix Committer now :moomin_flower: and just after that we got 4 and php incident, I updated php in guix the day it was released, so update if you haven't :ashinobu_dab: . uuf what a crazy welcome as a committer :neofox_sign_aaa:

    #guix #php #eMudhra

Share on Mastodon

Enter the server where you have an account.