fokus

where light rays converge

pro™ nouns: she/it
joined fedi: 2017

Last Notes

2026-10-22 18:30:10 UTC

With the eMudhra incident being all over the news, may I introduce you to the Debian OpenSSL incident of 2008?
In 2006 a Debian packager made a mistake when trying to resolve a Valgrind warning in OpenSSL. The patch broke the random number generator, in a way that the process ID became the sole source of entropy for key generation. This meant the possible space was reduced to only 32,767 private keys, one for each PID. It took until 2008 for the problem to be discovered. Two years of people generating the same few SSH, DKIM, DNSSEC, OpenVPN and x509 keys, some of which are still in use.
It's *wild* that issues like this can stay undiscovered for so long.
https://lists.debian.org/debian-security-announce/2008/msg00152.html
https://research.swtch.com/openssl

2026-10-22 17:24:46 UTC

- reply

I think I need clarification.. Do you want to say that it takes more developers to get these programming languages to perform, or do you want to say that more developers are needed to implement the features that are needed?
because in my experience governance issues are what keep people from contributing, not the programming language.

2026-10-22 17:05:54 UTC

- reply

facebook ran a few dozen million MAUs on PHP just fine, on servers less powerful than my smartphone. Not to say that fedi software shouldn't be more efficient/higher quality/maintainable, but I think the choice of programming language is the smallest problem here.

2026-10-11 15:19:53 UTC

why is the dishwasher shaped like this when I'm not supposed to put my computers into it?
https://mystical.garden/system/media_attachments/files/117/422/935/660/923/824/original/1baf5dea50e4c5da.png

2025-11-26 00:17:07 UTC

I find it disillusioning to see the casual use of "AI" slowly creeping into our hacker circles. Most of the discussions about AI focus on the quality of its output. I think we're not doing a good job communicating its more fundamental dangers.
In this blog post I write about how tools shape who we are and why the resource intensiveness of AI is ingrained in its purpose. About the devaluation of skills, and power cycles.
Let me know what you think.
https://fokus.cool/2025/11/25/i-dont-care-how-well-your-ai-works.html

2025-11-23 23:52:16 UTC

Today I was browsing the commit history of a project of a very well known open source software foundation that is now "focusing on AI".
I almost lost my shit when I discovered that "Claude Code" started rephrasing the included copy of the Apache 2.0 license in a random bugfix commit.
yes, they merged it. :blob_cat_sip_glare:

2025-07-27 21:20:07 UTC

*leans in*
"what if we kissed under the.."
*looks up*
"smoke detector?"

2025-07-10 12:46:53 UTC

tomorrow I'll talk about federated protocols and the recent pixelfed vulnerability – come join the discussion at @npub1ajs…40ga in berlin
https://social.wake.st/@liaizon/114790849535399825

2025-05-01 00:38:23 UTC

As you all know, the easiest way to set the time on a microwave oven is to plug it in at the right moment.
(Reference: https://chaos.social/@ant/109265527654254544)
Tired of doing this every few weeks to keep up with the drift of the shitty RTC?
Just add NTP to your microwave oven. The home appliance industry does not want you to know this simple trick:
Smart Plug + Home Automation
https://mystical.garden/system/media_attachments/files/114/429/707/584/609/655/original/3e52f125c559dd8b.png
https://mystical.garden/system/media_attachments/files/114/429/708/953/660/979/original/8dacbdaff3f7e7b3.png

2025-03-25 17:33:51 UTC

- reply

Pixelfed before v0.12.5 has a vulnerability where it could leak your private posts, regardless of whether you are a Pixelfed user or not.
Admins should update ASAP.
When following someone from a different server on the Fediverse, the remote server decides whether you are allowed to do that. This enables features like locked accounts. Due to an implementation mistake, Pixelfed ignores this and allows anyone to follow even private accounts on other servers. If a legitimate user from a Pixelfed instance follows you on your locked account, anyone on that Pixelfed instance can read your private posts.
I wrote a blog post about how I found the vulnerability, how disclosure coordination went and general ramblings about Fediverse safety:
https://fokus.cool/2025/03/25/pixelfed-vulnerability.html
#pixelfed #fediverse #activitypub

2025-03-24 16:00:22 UTC

pixelfed instance admins: Please update pixelfed to v0.12.5 asap. The version contains fixes for serious security vulnerabilities that I reported.
I will disclose further details about the vulnerabilities in about 24 hours.
:boost_requested:

2025-03-07 16:23:37 UTC

tiny blinky city
https://mystical.garden/system/media_attachments/files/114/122/065/173/074/584/original/1d3f09c8a4f76e88.mp4

2025-02-10 17:39:28 UTC

https://mystical.garden/system/media_attachments/files/113/980/805/440/899/661/original/27851bca54d56c0f.png

2025-02-10 00:53:11 UTC

https://mystical.garden/system/media_attachments/files/113/976/844/653/133/603/original/2243ff11565cb778.png

2025-01-17 21:44:57 UTC

- reply

We, the users, should question the context and purpose under which the protocols and software we promote are created - and whether that's in our interest or not.
Heck, maybe having a venture capital funded company at the steering wheel of the protocols that were meant to free us from the venture capitalist messengers... wasn't the best approach?
Where to go from here? Honestly, no idea. I have no proposals to make. But I think commentary is important. Maybe we can learn and find better ways to have nice things.

2025-01-17 21:44:49 UTC

- reply

Welp, I didn't expect this post to blow up like that. Maybe I should add some context.
I think this is a messy PR move gone awry. It's not a secret that Synapse doesn't scale well. The interesting part lies in the bigger picture.
First of all: There's nothing *inherently* wrong with a company building a closed source product to interface with open software/standards.
People have opinions on whether that's beneficial for the ecosystem or not. It's not the can of worms I want to open, but I can't avoid it entirely.
Some history. In the end of 2023 Element pulled a very interesting move where they forked Synapse and relicensed the code from Apache 2.0 to AGPLv3 and started requiring a CLA for contributions. See: https://matrix.org/blog/2023/11/06/future-of-synapse-dendrite/
Since Element staff is responsible for most of the maintenance work, the Matrix Foundation had no chance but to discontinue their Apache licensed version.
So, essentially project ownership of Synapse (forcefully) changed from the Matrix Foundation to the Element company.
A bit later Element announced a proprietary version of Synapse where they claimed to have fixed some of the most glaring architectural issues.
Suddenly they have a big commercial incentive to keep Synapse slow. And in this blog post they say that, loud and clear.

2025-01-17 14:47:07 UTC

lol @ element for pulling "our code base is utter trash and we have no intention to fix that, please buy our proprietary rewrite"
https://element.io/blog/scaling-to-millions-of-users-requires-synapse-pro/

2025-01-05 22:40:30 UTC

https://mystical.garden/system/media_attachments/files/113/778/132/339/158/968/original/f44bbc72d226cd3b.png