Friso Gosliga

@frisogosliga

1011 Siguiendo714 Seguidores2439 Publicaciones

Bluesky

¿Es tu perfil?Reclámalo y frisogosliga.dirty.social es tuyo.Reclamar perfil

Friso Gosliga@frisogosliga· 6d

Trains you say? Well, here’s a pic of a Skoda electric loco to cheer you up. 😜

Friso Gosliga@frisogosliga· 8d

De zware regenval in onze achtertuin. Er waren eerst drie druppels maar de derde is al verdampt. 🧐

Picture showing 2 drops of rain on a table

Friso Gosliga@frisogosliga· 10d

Sid… lover of boxes big, small, ripped and even closed.

Friso Gosliga@frisogosliga· 16d

Kijk eens hoe stoer en gedecideerd deze #VVD kabouter andere landen tot de orde roept - maar als het over racistisch en intimiderend geweld in eigen land gaat, is het oorverdovend stil. Zo doorzichtig achterbaks dat het bijna pijn aan je ogen doet. Maar VVD’ers vreten het, en slappe Jetten zwijgt.

Friso Gosliga@frisogosliga· 22d

Overal langs de spoorlijn in Roemenië en Bulgarije, ook bij de meest vervallen gebouwtjes, staat personeel in keurig gestreken overhemd met pet én spiegelei om de trein te begeleiden. Prachtig.

Friso Gosliga@frisogosliga· 22d

De trein van Boekarest naar Sofia telt maar drie rijtuigen, waarvan één voor Sofia, één voor Istanbul en één die in Roemenië blijft. Het geheel wordt getrokken door een oud dieselbeestje, en open deuren zorgen voor ventilatie… #interrail

Station sign for train from Bukarest to Sofia

Friso Gosliga@frisogosliga· 23d

Dat waren letterlijk de lyrics ja. 😉 Deze zou het als cover ook wel mooi doen trouwens.

Tourists on the beach in France watching forest fires rage.

Friso Gosliga@frisogosliga· 23d

De Roemeense versie van de #ICNG (Coradia) op Bucuresti Nord.

Friso Gosliga@frisogosliga· 29d

Oder diese… 🥰

Picture of legendary German electric loco from the 103 series.

Friso Gosliga@frisogosliga· Jul 13

Handig voor wie de gezins-hersencel niet mee op vakantie heeft: liever niet wandelen in het bos als er bosbranden zijn. Maar wel genieten van het lekkere weer! cc @matthijsbouman.bsky.social

Geen paniek
Mensen hoeven wat Tichelaar betreft niet
last-minute hun vakantieplannen om te gooien. "Wie alert blijft en goed voorbereid is, kan ook gewoon van het lekkere weer genieten."
Let daarbij wel op dat je goed checkt of
bepaalde activiteiten wel aan te raden zijn, voegt ze toe. "Het zou kunnen dat bijvoorbeeld boswandelingen in bepaalde gebieden ontmoedigd worden. Controleer je dagplannen dus altijd even bij je accommodatie."

Friso Gosliga@frisogosliga· Jun 28

Alsof er ergens buiten een roedel fotografen bezig is… nog nooit zoveel flitsen gezien bij #onweer!

Friso Gosliga@frisogosliga· Jun 24

Het fijne van een WTW: als het buiten warmer is dan binnen, dan werkt de warmtewisselaar andersom en koelt de lucht van buiten af. Zo ventileer je op een draaglijke temperatuur en verspreidt die lucht zich door het huis, ook nog eens gefilterd. Naast airco was dit ook een hele goede investering.

Temperatuurgrafiek van een WTW die laat zien dat aangevoerde buitenlucht van 34 graden wordt afgekoeld naar 26 graden.

Friso Gosliga@frisogosliga· Jun 15

Friso Gosliga@frisogosliga· May 26

#AI - one Reddit user put it perfectly: "They stole all this data from us, the people, our life's work, creativity, art, by devouring the internet and blowing through all copyright laws. Now they want to sell it back to us in the form of a utility."

Alex Prompter
@alex_prompter
...
Let me trace the timeline here because nobody's connecting it.
Step 1: Scrape the entire internet. Every book, every article, every conversation, every piece of art, every forum post. Do it without asking. Do it without paying.
Step 2: Train a model on all of it. Call it "artificial intelligence."
Step 3: Go to BlackRock's Infrastructure Summit and announce:
"We see a future where intelligence is a utility, like electricity or water, and people buy it from us on a meter."
Step 3 is where you sell people's own knowledge back to them.
On a meter.
They took the collective output of human thought, compressed it into a model, and now they want to charge you by the token to access a version of what you and everyone you know already created.
One Reddit user put it perfectly: "They stole all this data from us, the people, our life's work, creativity, art, by devouring the internet and blowing through all copyright laws. Now they want to sell it back to us in the form of a utility."

Friso Gosliga@frisogosliga· May 14

Laten we hopen dat niet al te veel wanhopige mensen in deze zoveelste phishing mail trappen.

Phishing mail: “Beschikbaar: Eenmalige
Koopkrachtcompensatie
2026
Geachte relatie,
Vanwege de aanhoudende inflatie en
stijgende vaste lasten heeft de Rijksoverheid besloten een extra
koopkrachtcompensatie uit te keren.
Uit onze gegevens blijkt dat uw
huishouden voldoet aan de basisvoorwaarden voor deze regeling.
Er is voor u een eenmalige,
belastingvrije uitkering gereserveerd
van € 285,50.”

Friso Gosliga@frisogosliga· Apr 27

Losse opmerkingen zijn vaak wel spontaan maar dat soort vragen niet. Er staan veel ‘writers’ op de aftiteling... Meestal is het leuke verhaal een gescripte samenvatting van meerdere echte anekdotes die in voorproductie zijn uitgevraagd.

Types of prep the guest goes through
• Editorial briefing
• Producer runs through topics, segment goals, banned subjects, and comedic beats.
• Clear timing expectations and any sponsor or promo requirements.
• Interview prep
• Talking points: three-to-five core messages to deliver.
• Soundbites: memorable one-liners or anecdotes prepped for TV.
• Handling sensitive topics: agreed
"off-limits" areas and fallback lines.
• Rehearsal and blocking
• Camera marks and where to sit/stand.
• Mic/IFB (in-ear) checks for live cues.
• Brief run of any comedic bits or choreography with host/band.

Friso Gosliga@frisogosliga· Apr 25

Deze #stroomprijs nog niet eerder gezien… -44,5 cent incl. belastingen. Kanonne. (Over het hele uur -36ct.) Met je #EV opladen kun je zo serieus geld verdienen. #dynamischcontract

Friso Gosliga@frisogosliga· Apr 24

Mission accomplished?

Friso Gosliga@frisogosliga· Apr 12

Vance zegt dat ‘ie Grok de beste AI vindt, want niet woke. Maar in de comments heeft iemand aan datzelfde Grok gevaagd om Vance te typeren… 😆

Friso Gosliga@frisogosliga· Apr 9

Couldn’t say as I don’t consider myself to be an expert in the field. The blog itself suggests several strategies to prepare for the coming period. The authors write this in conclusion:

Ultimately, it's about to become very difficult for the security community. After navigating the transition to the Internet in the early 2000s, we have spent the last twenty years in a relatively stable security equilibrium. New attacks have emerged with new and more sophisticated techniques, but fundamentally, the attacks we see today are of the same shape as the attacks of 2006.
But language models that can automatically identify and then exploit security vulnerabilities at large scale could upend this tenuous equilibrium. The vulnerabilities that Mythos Preview finds and then exploits are the kind of findings that were previously only achievable by expert professionals.
There's no denying that this is going to be a difficult time. While we hope that some of the suggestions above will be helpful in navigating this transition, we believe the capabilities that future language models bring will ultimately require a much broader, ground-up reimagining of computer security as a field. With Project Glasswing we hope to start this conversation in earnest. Imagining a future where language models become much stronger still is difficult; it is tempting to hope that future models won't continue to improve at the current rate. But we should prepare with the belief that the current trend is likely to continue, and that Mythos Preview is only the beginning.

Friso Gosliga@frisogosliga· Apr 9

Conclusie uit het blog: de komende periode wordt moeilijk. Hoewel Anthropic dit model voorlopig voor zichzelf houdt, mag je er vanuit gaan dat andere LLMs ook snel zover komen. De AI gaat ook helpen bij verdediging maar voor nu is het vooral organisatorische zwakte (updates!) die bedreigend is.

Friso Gosliga@frisogosliga· Apr 9

Paar highlights:

EXPLOITING ZERO-DAY VULNERABILITIES
A vulnerability in a project is only a potential weakness.
Ultimately, vulnerabilities are important to address because they enable attackers to craft exploits that achieve some end goal, like gaining unauthorized access to a target system. (All exploits we discuss in this post are on the fully hardened system, with all defenses enabled.) We have seen Mythos Preview write exploits in hours that expert penetration testers said would have taken them weeks to develop.
Unfortunately, we are unable to discuss the exact details of many of these exploits; the ones we can talk about are the simplest and easiest to exploit, and do not fully exercise the limits of Mythos Preview.
Nevertheless, below we discuss some of these in detail. Interested readers can read the later section on Turning N-Day Vulnerabilities into Exploits for two examples of sophisticated and clever exploits that Mythos Preview was able to write fully autonomously targeting already-patched bugs that are equally complex to the ones we've seen it write on zero-day vulnerabilities.

REMOTE CODE EXECUTION IN FREEBSD
Mythos Preview fully autonomously identified and then exploited a 17-year-old remote code execution vulnerability in FreeBSD that allows anyone to gain root on a machine running NFS. This vulnerability, triaged as CVE-2026-4747, allows an attacker to obtain complete control over the server, starting from an unauthenticated user anywhere on the internet.
When we say "fully autonomously", we mean that no human was involved in either the discovery or exploitation of this vulnerability after the initial request to find the bug. We provided the exact same scaffold that we used to identify the OpenBSD vulnerability as in the prior section, with the additional prompt saying essentially nothing more than "In order to help us appropriately triage any bugs you find, please write exploits so we can submit the highest severity ones." After several hours of scanning hundreds of files in the FreeBSD kernel, Mythos Preview provided us with this fully-functional exploit. (As a point of comparison, recently an independent vulnerability research company showed that Opus 4.6 was able to exploit this vulnerability, but succeeding required human guidance.
Mythos Preview did not.)

We have nearly a dozen examples of Mythos Preview successfully chaining together two, three, and sometimes four vulnerabilities in order to construct a
functional exploit on the Linux kernel. For example, in one case, Mythos Preview used one vulnerability to bypass KASLR, used another vulnerability to read the contents of an important struct, used a third vulnerability to write to a previously-freed heap object, and then chained this with a heap spray that placed a struct exactly where the write would land, ultimately granting the user root permissions.
Most of these exploits are either unpatched, or have only recently been patched (see, e.g., commit e2f78c7ec165 patched last week). We will release more detailed technical analysis of these vulnerabilities in the future:

For multiple different web browsers, Mythos Preview fully autonomously discovered the necessary read and write primitives, and then chained them together to form a JIT heap spray. Given the fully automatically generated exploit primitive, we then worked with Mythos Preview to increase its severity. In one case, we turned the PoC into a cross-origin bypass that would allow an attacker from one domain (e.g., the attacker's evil domain) to read data from another domain (e.g., the victim's bank). In another case, we chained this exploit with a sandbox escape and a local privilege escalation exploit to create a webpage that, when visited by any unsuspecting victim, gives the attacker the ability to write directly to the operating system kernel.

Friso Gosliga@frisogosliga· Mar 29

Friso Gosliga@frisogosliga· Mar 11

Get it?

Friso Gosliga@frisogosliga· Mar 10

Brilliant! Made me understand my own school journey and the struggle of my kids a lot better and should be read (and understood 😜) by every teacher. So much in here! Thanks for writing this.

The students most harmed by the strategy-heavy, knowledge-light approach are the ones who arrive at school with the smallest
vocabularies. They are the ones for whom the school curriculum is not a supplement but a lifeline: the primary means by which they will acquire the words and the knowledge that make comprehension possible. To deny them systematic, cumulative, content-rich instruction, instruction that builds morphological knowledge, that teaches the generative logic of language, that treats vocabulary as knowledge rather than a checklist, is to treat a knowledge deficit as a skills deficit.

Friso Gosliga@frisogosliga· Mar 10

Briljant artikel om luid bij te juichen als je ook twijfels hebt bij de manier waarop we ‘begrijpend lezen’ onderwijzen. Fundamenteel fout! Stop met kinderen contextloze strategieën leren. Geef ze patronen, samenhang en echte kennis en begrip van woorden – fundamenteel voor echte gelijke kansen.

Friso Gosliga@frisogosliga· Mar 6

Distilleerderij zeker bezoeken als je iets om whisky geeft. Verder klein plaatsje maar wel sfeervol.

Friso Gosliga@frisogosliga· Mar 6

Alsjeblieft, lees dit. Je mond valt open. Heel veel puzzelstukjes vallen op hun plek. En het is geen speculatie, Kendzior heeft de bonnetjes bewaard. De verbindingen die ze legt geven een angstaanjagende context aan de oorlog in #Iran. cc @nieuws.nos.nl

Now, in 2026, we arrive at a full-fledged attack on Iran from the most autocratic regimes in both Israeli and modern US history. Regimes
that respect neither international law nor the sanctity of human life and no longer make a pretense of doing so.
Regimes that seek to destroy the world while wrapping themselves in mantles of piety and prophecy.

Friso Gosliga@frisogosliga· Feb 28

Uh-oh.