Notes on tech and daily life
Built a fictional idol label site with pi.dev + Qwen 3.7/3.8 and Astro. Generated characters, logos, and event photos via genserver — then shipped wireframes with SVG placeholders. Full failure log inside.
Tested on ComfyUI: Qwen3-4B–14B prompt writing, a 4B encoder bridge, and split conditioning all lost to one hand-written 507-token band prompt. An 896-caption audit shows the real fix.
Tested on an M4 Mac mini with one 4-girl Anima LoRA: expressions, poses, desk contact, and a high-five across 3 seeds. Sentence order and center slots decided who touched whom.
Tested on M4 Mac mini ComfyUI: with identical Qwen3-0.6B/T5 conditioning, the black tights land on the wrong girl only when the 4-char LoRA's DiT half is applied.
Tested on M4 Mac mini ComfyUI: in a 2×2 swap of role and outfit, the black tights landed foreground-right 12/12 and on the named character only 6/12.
Gemini said 'I am a disgrace' 86 times in 2025. Traced the primary sources: no fix announcement found, only CLI-side loop-stopping guards, and Gemini 3.1 Pro was still looping in 2026.
Tested on M4 Mac mini ComfyUI: 8 on/off combos of three actions × 3 seeds on a 4-character Anima LoRA. Roles read at 3/3, but hands and skirts landed on the wrong girl.
Tested on M1 Max 64GB: a 50M resampler predicts Anima's 4-char conditioning from short triggers. Train fits at cos distance 0.005, held-out order breaks; template P3 goes 15/16.
Tested on Anima-Base v1.0: no prompt hit the 512-token cap, cosine similarity moved the wrong way, and only the DiT-side conditioning changed who got drawn.
WordPress 7.0.3 (Aug 6, 2026) closes CVE-2026-64638 / XSS2Shell (CVSS 8.9): a whitespace tag like `< area` slips past strip_tags but KSES restores it, giving pre-auth login XSS that chains to PHP RCE. All versions affected; fix backported to 4.7.
Tested 11 character combos × 3 seeds on Anima-Base: trigger-only prompts passed 3/33, full prompts 8/11, and copying one training-caption phrase fixed the height gap.
Tested on M1 Max 64GB: hooked Qwen3.6-35B-A3B's MoE router in mlx-lm, pre-warmed the top-20 hot experts, still ~62 tok/s vs plain mmap cache. Plus the Metal OOM on Qwen3.5-122B.
Tested with source builds on an M4 Mac mini: 9.0 rejects self-signed HTTPS (certificate verify failed) where 8.1.2 connects silently; webp_anim decodes all 10 frames.
Claude Code's isolation: 'worktree' subagents were fixed for reaching into the parent checkout four times, across releases from 2.1.203 to 2.1.222, with the documented scope shifting each time. I lay out what git -C, GIT_DIR, and destructive git commands each broke, from the official release notes.
Tested Next.js 16.3, Astro 7 and Nuxt 4.5 on an M4 Mac mini with one identical blog. Pixel-identical output ships 172KB vs 21.5KB vs 0KB gzipped JS; build cache and dev-server memory measured too.
54 of 55 advisories from one GitHub account were fabricated, likely by AI. How six fake SQLite CVEs passed MITRE and NVD unchecked, and why scanner hits for them are false positives.
Unit 42's three Pass-ta-key attacks need malware already on Windows, no admin rights. The SDS master key sits in Chrome memory in plaintext, with no way to rotate it.
Aug 4, 2026: the keyv worm hit 12 unrelated orgs in 3h43m, and the poisoned builds carried valid GitHub Actions provenance. Why rotating credentials first is the thing that triggers the payload.
Tested on M1 Max 64GB: SeFi-Image turbo runs on MPS in bf16 at 13–47s/image; fake text and face artifacts only clear up on 5B RL at 50 steps, 18 min/image.
Measured on M1 Max 64GB: weight-only INT8 runs 41% slower than fp16, a hand-written Metal int8 GEMM 15.6x slower, MPSMatrix int8 3x, and MLX 8-bit 9% slower.
Tested on M1 Max 64GB ComfyUI: v0.24.1 fails to load int8_tensorwise, v0.30.1 hits the missing aten::_int_mm MPS kernel, and a dequantize patch runs slower than bf16.
Tested on M1 Max 64GB: AnimaLoraToolkit + Anima-Base crashes on torch 2.6.0 (MPS SDPA bug) but runs 300 steps clean on 2.7.1, at ~21 s/step, roughly 9x slower than an RTX 5090.
WordPress Core trimmed its PHPUnit CI matrix ahead of 7.1. PRs now test 3 PHP versions, a Sunday cron covers the rest weekly, and reruns dropped from about 68% to 36%.
Apache Data Lakehouse Weekly, July 21-29, 2026: Iceberg V4 deprecates equality deletes, Parquet adds ALP encoding, and Polaris debates MCP auth token boundaries.
Muon and SOAP cut final diffusion loss 18% vs AdamW. Mapping that to Anima (Cosmos DiT) and SDXL U-Net LoRA training, plus existing LoRA-Muon research, before writing any code.
15 formats renamed to .png, then Rails 8.1.3 vs 8.1.3.1 on one attachment: SVG logged 123x45 on the vulnerable build, nothing on the patched one. Plus the matload entry point and the libvips 8.13 floor that stops boot.
MCP 2026-07-28 drops initialize, session IDs, and SSE resume; Sampling, Roots, and Logging are deprecated. I wrote minimal servers for both specs and diffed them with curl.
Kimi K3 activates 16 of 896 experts per MoE layer. From the July 27 tech report: experts are sliced FFNs, not specialists, and the router is one linear projection.
M4 Mac mini postmortem: cron auth silently dead, a recall-0.19 model passing every promotion gate, 258 poisoned negatives, and a 5-config sweep to a usable trade-off.
Qwen3.8 restored 625k chars of mangled PDF text; 5 Irodori-TTS workers on one RTX 4090 gave 38h of audio at 13x realtime. Plus an 18x reasoning_effort win and the cuInit 999 check for dead RunPod hosts.
Fastjson 1.2.68–1.2.83 is exploited with no AutoType and no gadgets. What gates it: Spring Boot executable fat-JAR, SafeMode off, and Object/Map fields in your DTO.