Old school hacker.

Last Notes

Polizei-Razzia in queerem Zentrum in Berlin: Informationen über Hormon-DIY ist offenbar schon ausreichend, einen Verstoß gegen das Arzneimittelgesetz zu unterstellen. Und das ganze, nachdem in Folge des BSG-Urteils von 2023 zunehmend legale Wege für Hormonzugang verschlossen bleiben.
Wird zunehmend ungemütlich in Deutschland.
https://taz.de/Durchsuchung-in-Berlin-Kreuzberg/!6222545/

2026-10-03 07:20:21 UTC

Ok, Anthropic openly confirming GLM-5.3 to be close to Mythos was a bit surprising at first. But upon closer inspection, it screams "please help us gatekeep cyber defense capabilities so we can protect our revenue".
https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities

2026-09-27 06:32:40 UTC

- reply

"Although Thiel was born in Frankfurt, he did not grow up in Germany—he left as a one-year-old. Instead, he deliberately doesn’t mention that spent his youth in Swakopmund, SW Africa, an apartheid town that was cosplaying as the Third Reich through the 1970s. The standard greeting was “Heil Hitler!”
During this time, Peter’s father Klaus was building a uranium mine for apartheid South Africa’s illegal nuclear weapons program, using essentially slave labor."
Wow.

2026-08-10 18:58:25 UTC

- reply

I have a deal with my wife to not fall into the Eurorack rabbit hole!

2026-07-25 12:19:37 UTC

Components for my HVAC control have arrived. A little overvoltage issue fried my previous control setup (controme, which, let's say, sounds nice on paper), and I thought I will redo it in a way that will be maintainable by a different person in 30 years.
Now unfortunately being allowed to download WAGO IO Check requires a manual step, and no one is in over the weekend to approve. I have no idea how to stay patient!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/980/539/818/033/033/original/b5ee5759df8b832c.jpg

2026-03-07 07:58:23 UTC

"Age verification" laws are "we want to have all adults and their complete online profile in a database" laws, and that Persona, the company behind LinkedIn, Roblox, Discord ID and age verification is owned by Peter Thiel should be all you need to know.

2026-01-24 08:21:34 UTC

OMG. -froot bug resurfaced. https://seclists.org/oss-sec/2026/q1/89
I see the headlines, "10 years old bug".
My friends, this bug is older. Much older. Not this particular instance, but it is a classical mistake to make. It's a command line injection when calling the login executable.
Some people point to CVE-2007-0882. Solaris had that, almost 20 years ago.
But it's even older than that. It's so old it predates the CVE system. I don't remember exact dates, but we popped Linux and AIX boxes with that, mid 90s.
But it is *even older* than that. Have a look at System V R4, ©1990, getty calling login with unsanitized input:
https://github.com/calmsacibis995/svr4-src/blob/7dabeda6fc10bd1bbd1a84d502f05642b1bf0c9e/cmd/getty/getty.c#L526
But how deep does the rabbit hole go? When was this bug introduced?
Getty called login with user input since the dawn of time (UNIX V2, 1972):
https://www.tuhs.org/cgi-bin/utree.pl?file=V2/cmd/getty.s
But this predates command line arguments in login:
https://www.tuhs.org/cgi-bin/utree.pl?file=V2/cmd/login.s
So, when did this particular command line feature of login appear?
In the BSD universe, -f was introduced with POSIX compatibilitiy in 4.3BSD-Reno:
https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/usr.bin/login/login.c
But someone paid attention and filtered out user names starting with - in getty:
https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/libexec/getty/main.c
RCS timestamp says 6/29/1990, so same age as SysV R4.
The original 4.3BSD (1986) doesn't filter the user name:
https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD/usr/src/etc/getty/main.c
And it does have a -r option in login:
https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD/usr/src/bin/login.c
Exploitable? No idea, argv processing might be a problem. I'll find out another day.
In conclusion: bug existed since 1990, it's so easy to make when implementing POSIX that it keeps resurfacing, and at least one person in Berkeley knew since day 0.

2025-12-26 15:40:38 UTC

Stabil wie immer. #39c3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/786/613/479/122/717/original/a452f40422060cc3.jpg

2025-05-15 13:48:42 UTC

You might not like it, but this is what peak compiler performance looks like.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/512/149/665/212/884/original/c94e6a6dca12ce8b.png