🥚 Apple Music iPod Easter Egg
Joe Rossignol at MacRumors:
Apple Music has a 404 page easter egg on the web: a functional iPod that appears when you load a page that does not exist, such as music.apple.com/macrumors.
[...]
The easter egg is only visible in a web browser, so you cannot see it in the Apple Music app. To avoid being redirected to the Apple Music app, hold down the Command key when clicking on the link on a Mac, or press and hold on the link and tap "Open" on iOS.
Such a fun surprise for the 25th anniversary of the iPod, and the attention to detail is immaculate. It feels right, especially on a touch device, the song selection is perfect, and they even added LCD ghosting to the ball in Breakout.
đź“Ť Local Wikipedia
Ed Jefferson created a neat little thing: Local Wikipedia:
Local Wikipedia is Wikipedia, but only for things a half hour walk from you.
Polished, simple, and fun. This kind of thing is why I love the web.
🥵 French Fridges Forced to 50°C
The Guardian:
Hackers have forced the temperature of many French supermarket fridges up to 50C overnight, in an “unprecedented” cyber-attack affecting several hundred stores across the country, with fires and food losses reported.
That's 122° F.
The affected units “were running outdated firmware”, Danfoss said, adding that it had “long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions”.
Most people—including large and small groups of people, like businesses—are really bad at keeping their firmware up to date. That goes double for things that exited for a long time without firmware, like appliances. It goes triple for things that people may not realize are even connected to the Internet. A lot of people just don't realize things like toasters, ovens, and fridges are online or that they need to be updated, especially when those things are working fine.
The French president, Emmanuel Macron, a strong supporter of Ukraine in its fight against the Russian invasion, last month ordered measures to protect France’s critical infrastructure from Russian “hybrid attacks”.
If we're lucky, the next several months are going to be really rough. As the capabilities of LLMs increase, so does their danger. Every day more potential bad actors realize how easy it is to take advantage of old, unpatched systems and, in some cases, how easy it is to find latent vulnerabilities in up to date code. Every day, more LLM agents are being turned loose to accomplish their goals however they see fit, and sometimes that means they break containment or cause unintended side effects. It wouldn't surprise me if the attack described in this story was carried out intentionally by Russia, but it also wouldn't surprise me if this happened as an unintended side effect of LLM agents trying to accomplish something entirely unrelated.
Again, that's if we're lucky. If we're unlucky, we won't be dealing with more and more of this kind of thing for months, we'll be dealing with it for years.
But it's not all doom and gloom. The people trying to keep everything online and secure can fight fire with fire. The same LLMs causing these problems can be used to find and fix more issues before they're exploited. LLMs can also help teams respond quickly when something goes off the rails.
I don't like LLMs, but I can't deny their utility in some areas.
It's an interesting time to be alive.
⛓️‍💥 More About the Recent PHP Vulnerabilities
The PHP Foundation in a blog post titled, "Today's PHP Security Release, and How We're Strengthening PHP Security":
This post isn't about how to update. It's about how these vulnerabilities were found and fixed, what has changed in how PHP security is handled over the past two years, and what we need from the organizations that depend on PHP to keep PHP's security work going.
They provide a lot of details about the history of these vulnerabilities and the timeline leading up to exploration and the patches.
I found this part particularly interesting:
On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.
So never work with or trust Chainguard in any capacity. Got it.
đźš“ Speed-Minder
Marcin Wichary shared a fascinating bit of history:
This was a “Speed-Minder” deployed by Illinois State Police in the late 1950s or early 1960s. The car didn’t have a radar, it just reported its own speed, which I thought was clever. I am not even sure if it was as much to prevent drivers going too fast – I guess that’s what the name suggests – or just to help you calibrate your car’s own speedometer.
Fascinating! There are a couple more pictures in Marcin's post, but I wanted a few more. Unfortunately, these things don't seem to be well-documented online, so I didn't find much.
What I did find was a toy version of the same type of car from New York. This version is a little more forceful; it includes prominent "SPEED KILLS" wording on both the speedometer and the rear of the car. Not sure if this version actually existed as a real car or not, but it seems like an oddly specific thing to make into a toy of if it didn't exist.
‼️ New Critical PHP Vulnerabilities
The PHP Foundation:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
These two vulnerabilities are collectively being referred to as PHP2Shell. PHP versions 5.4–8.5 are vulnerable until patched.
This is about as bad as security issues get. If you have anything running PHP, drop what you're doing and update now.
đź’Ą Triple-A Minesweeper
Mike Lacher created a hilarious little masterpiece.
🦖 New T. Rex Details Imminent
Andrew Rossi at Cowboy State Daily has some exiting news for anyone interested in dinosaurs:
"Rex Junior" is a partial but perfectly preserved Tyrannosaurus skeleton found on the Zerbst Ranch in eastern Wyoming. A paleontologist said that the "extraordinary specimen" could rewrite 100 years of knowledge about how the T. rex looked.
[...]
Many details on Rex Junior are still secret, pending publication, but Sereno said this specimen from the newly discovered "mummy zone" will redefine what we know about T. rex, inside and out.
“All I’ll say is we don't see scales,” he said.
The discoveries aren't just skin deep, though:
The first big revelation was the articulated right arm. Every bone was there, from the long, thin scapula to the very tips of the claws, perfectly articulated as they would have been when Rex Junior was alive.
“It was the only complete T. rex hand and forearm ever found,” Sereno said. “Every single bone, in place outside of the ribcage. I was totally shocked.”
And there's more:
Despite the inclination of generations of paleontologists to make T. rex barrel-chested, the articulated shoulders and wishbone of Rex Junior revealed something different.
“This specimen shows the furcula sits right in between on the crest of the coracoids, connected to the scapulae, just like it does in a modern bird,” Sereno said. “Everything joins together at the midline.”
That articulation makes the chest of T. rex much slimmer.
The research should be published early next year. Something to look forward to!
🗺️ MapQuest Now Shows Surveillance Cameras
MapQuest on Bluesky:
Turn on the Surveillance Layer in Map Options to see known license plate readers from Flock Safety, Motorola Solutions (Vigilant), Genetec, Axis Communications, Axon, Leonardo (ELSAG), Neology, Rekor, PlateSmart, Ubicquia, Verkada, and other outdoor surveillance cameras.
I was happy when MapQuest refused to change the names of certain bodies of water, but it wasn't enough to compel me to download their app.
Today I downloaded their app.
🚗 The Citroën 2CV 2028 Concept Car is Adorable
Look how cute this thing is:
Jameson Dow at Electrek:
Citroën has unveiled a concept electric version of its classic 2CV, aiming to bring the vehicle to market in 2028 for just €15,000.
For the entire second half of the 20th century, the Citroën 2CV (“Deux Chevaux,” French for “two horses”) held a special place in Europe’s automotive landscape.
The affordable, comfortable, yet underpowered vehicle had enormous popularity, selling millions of units over its production run.
Its cute, quirky look was unique and eye-catching, with its tall, rounded, cartoon-like passenger cabin, jaunty circular headlights, and pop-up windows.
And that interior!
There are more photos in Electrek's article.
This will probably never see the light of day in the US, but I'd love to see more whimsical, fun, playful, and small cars like this over here.