Nostr notes by Jan Schaumann

You know what doesn’t have a high probability of getting ...

2026-10-30T14:25:20Z

You know what doesn’t have a high probability of getting compromised via some shady plugin because it doesn’t somehow execute random js code from somewhere on the internet? A normal text editor.

Ed, man! !man ed

(Alright, alright, I’ll also accept vi(1).)

I just ran a check across / on my mac and found 43 #emudhra ...

2026-10-30T00:56:27Z

I just ran a check across / on my mac and found 43 #emudhra vulnerable vendored bundles.

That's:
- 30 (!) bundles from different versions of certifi across the 8 different versions of python and in the various venvs
- Apple provided /Library/Perl/5.34/Mozilla/CA/cacert.pem
- aws-cli vendored botocore
- Zoom's vendored bundle
- a homebrew "portable-ruby" version
- as well as a few other commercial vendors

So yay. This is going to linger everywhere for a very long time to come.

What a week, huh Captain Haddock? I've had some thoughts on ...

2026-10-28T13:03:28Z

What a week, huh Captain Haddock?

I've had some thoughts on the onslaught of vulnerabilities, and you won't be surprised to find they're not entirely upbeat.

Anyway, good morning! ✨

https://www.netmeister.org/blog/defense-ddos.html

Oh FFS. If you just patched /etc/ssl/cert.pem on all your macOS ...

2026-10-27T15:32:57Z

Oh FFS. If you just patched /etc/ssl/cert.pem on all your macOS endpoints, rejoice: the just landed Apple OS update to 26.7.2 / 27.2 will revert that for you and put the emSign and AAA roots back.

:facepalm: #emudhra

Oh, interesting: git https remote (git-remote-https) may be ...

2026-10-26T19:18:53Z

Oh, interesting:

git https remote (git-remote-https) may be vulnerable to the #brotli RCE (CVE-2026-111497), if built with brotli-enabled libcurl. I'm guessing updating libbrotli would fix that, but that seems like a neat, little attack vector that flies under the radar.

#php2shell is based on PHP using longjmp(3) to bail out of OOM ...

2026-10-24T21:19:08Z

#php2shell is based on PHP using longjmp(3) to bail out of OOM conditions. They fixed that by actually properly unwinding the call stack under those conditions -- that's the "replace bailout with UnwindExit" part in the massive diff that touches 389 files here:

https://github.com/php/php-src/commit/01a40e89fb

Cool. But.

There are still dozens of other places where PHP longjmp(3)'s, and frankly, I don't think that can possibly be a safe error handling approach in a long-lived, server-side process.

I still can't get over the fact that writing down what you ...

2026-10-24T16:16:10Z

I still can't get over the fact that writing down what you need done with sufficient attention to detail for somebody else to do it -- you know, like, _documentation_ -- is now called "a SKILL" and is only ever blindly fed to a bot.

Y'all are aware that you can write things down and make them available to humans, too, yes?

Ubuntu still considers the #brotli RCE (CVE-2026-111497) as ...

2026-10-24T15:38:58Z

Ubuntu still considers the #brotli RCE (CVE-2026-111497) as "medium" priority:

https://ubuntu.com/security/CVE-2026-111497

Some other Linuxes:

AlpineLinux: https://security.alpinelinux.org/vuln/CVE-2026-111497

Debian: https://security-tracker.debian.org/tracker/CVE-2026-111497

Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-111497

RedHat:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-111497
https://access.redhat.com/security/cve/cve-2026-111497

SuSE: https://www.suse.com/security/cve/CVE-2026-111497.html

You never know which CA bundle a given language uses, so if you ...

2026-10-23T20:35:44Z

You never know which CA bundle a given language uses, so if you want to check if it's #emudhra affected, one option is to just go ahead and try it.

Trivial https fetch attempts in curl, Go, Java, Node, Perl, Python, Ruby, Rust:

https://github.com/jschauma/emudhra

So, uhm, sounds like #node2shell CVE-2026-111497 is not ...

2026-10-23T13:20:06Z

So, uhm, sounds like #node2shell CVE-2026-111497 is not restricted to nodejs alone, but any Google Brotli consumer. I don't think that's been called out widely. Check your other integrations.

https://github.com/advisories/GHSA-9v8h-qqgm-4m35

If you come up for air from #php2shell, pivot over into #emudhra ...

2026-10-21T15:51:51Z

If you come up for air from #php2shell, pivot over into #emudhra because if you thought fixing the OS ca bundle did the trick (and at the admittedly high risk of invoking "btw, I use Nix" cultists), here's a list of what else to check:

https://github.com/NixOS/nixpkgs/issues/576475

Vendored bundles:

https://github.com/NixOS/nixpkgs/issues/576541

Compiled-in bundles:

https://github.com/NixOS/nixpkgs/issues/576544

#php2shell landed: ...

2026-10-21T13:43:21Z

#php2shell landed:

https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618 -- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619 -- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Wheeeeeeeee!

Within the last 7 days: - "#PwnEscape" (remember that ...

2026-10-21T13:09:48Z

Within the last 7 days:

- "#PwnEscape" (remember that Linux kernel VM and container escape? I know, long ago)
- #php2shell RCE
- #eMudhra CA compromise

Now combine those: php2shell to VM escape, and fall back to MitM the ones you can't reach that way.

Meanwhile, folks are vibe-coding their defenses without actually understanding the vulnerabilities.

<Captain-Haddock>.gif

Certificate trust bundles contain several hundred trusted certs ...

2026-10-20T16:16:52Z

Certificate trust bundles contain several hundred trusted certs that all can sign any cert for any name they want.

Your system contains at least four different of these bundles used by different libraries and languages, while other frameworks hardcode their own.

Outside of the browsers, absolutely nobody checks CRLs, OCSP (stapled or not), or CT logs.

Selectively distrusting intermediates (as Go did) doesn't scale and is not practical for most deployments.

So yeah, happy Tuesday.

#emudhra

This is the first year that a lot of students rely on errno being ...

2026-10-17T21:19:03Z

This is the first year that a lot of students rely on errno being set instead of a library function's return value:

errno = 0;
func()
if (errno) {
error handling here
}

instead of

if ((n = func()) < 0) {
error handling here
}

What's up with that? Is AI somehow defaulting to errno checking instead of return values? Where is this trend coming from?

Jesus Christ, AI vulnerabilit reports. It's just too much. ...

2026-10-16T01:56:39Z

Jesus Christ, AI vulnerabilit reports. It's just too much. Too much of everything. Exploit descriptions are too many words. Proofs of Concept are too many options, too much code, doing too much. Analysis output is too verbose, too many sentences, too much "this is why it matters".

Sure, it makes it _sound_ and _look_ "thorough" or "detailed", but more often than not it's a DoS on your ability to understand, obscuring what you need to know in a huge pile of fluff and unnecessary extra content.

"PwnEscape" is the KVM escape for which rumors made the ...

2026-10-15T18:59:26Z

"PwnEscape" is the KVM escape for which rumors made the rounds a few days ago. Getting CVE-2026-99999 assigned is 👨🏻‍🍳💋.

https://pwn.ai/blog/pwnescape

Kernel patch for this part (because it sounds like there's multiple):
https://github.com/torvalds/linux/commit/6785011f8b16abf40b1e9d8b2e332232b3e68822

When I read that Anthropic source repository post with the ...

2026-10-14T14:35:13Z

When I read that Anthropic source repository post with the "every bottleneck we remove immediately leads to a further increase in the amount of code we produce" quote, I just think back to Ken Thompson's famous quote:

"One of my most productive days was throwing away 1,000 lines of code."

"More code" is not a metric of success.

Finally watched “Le Bureau des Légendes” and all five ...

2026-10-12T13:03:39Z

Finally watched “Le Bureau des Légendes” and all five seasons were 👍.

The American remake “The Agency” will no doubt feature a lot more car chases, explosions, guns, shoot-outs, and yelling, and I look forward to tuning in not even once.

The ICANN "What the internet needs right now is moar ...

2026-10-07T18:23:34Z

The ICANN "What the internet needs right now is moar TLDs" nonsense continues. In this round, there were 1,615 applications from 481 applicants. At $227,000 application fee, that's $366,605,000 in total going to ICANN "to recover cost".

I've pointed out before that the existing set of over 1,200 TLDs is already largely unused:

https://www.netmeister.org/blog/new-new-tlds.html

If you list AI as a "co-author" on a paper, I will stop ...

2026-10-04T21:10:18Z

If you list AI as a "co-author" on a paper, I will stop reading.

If you gave the AI a freaking name on top, I'll consider you lost.

You'll have a long and difficult path ahead regaining any trust or respect.

When you notice your meat-proxy colleagues become absolutely ...

2026-09-30T14:36:29Z

When you notice your meat-proxy colleagues become absolutely helpless on their own, remember Sam Altman's goal:

“We see a future where intelligence is a utility, like electricity or water, and people buy it from us on a meter”

People paying to make themselves dependent on these companies. You can see it happening in real time already.

See also:
https://disconnect.blog/make-em-dumb-sell-em-smarts/

Lol, nice. Debian linux security update DSA 6528-1: "Several ...

2026-09-29T13:02:37Z

Lol, nice.

Debian linux security update DSA 6528-1:

"Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks."

"Several", as in... 1,313 CVEs.

Enjoy! ✌️

https://lists.debian.org/debian-security-announce/2026/msg00441.html

(I've said it before: you can't track CVEs any longer. Only option is regular, frequent, automated updates and reboots.)

And one more*, because Cory Doctorow is rather good at ...

2026-09-20T15:28:29Z

And one more*, because Cory Doctorow is rather good at simplifying things.

"Remember: every time you repeat a story about how awfully, terribly dangerous their products are, you help them raise more investment capital, which is a key input for their business"

https://pluralistic.net/2026/09/12/god-in-the-box/#llms-are-fake

*This obviously occupies waaay to much of my brain space and attention. I desperately need to unplug.

There isn’t a 10% chance that AI will kill all humans in the ...

2026-09-14T17:07:45Z

There isn’t a 10% chance that AI will kill all humans in the future via Skynet or the Paperclip Maximizer.

But there’s a 100% chance it’s already doing so: mandating water wasting, air polluting, fossil fuel powered data centers, environmental regulations are lifted for these companies and even their feeblest greenwashing commitments to carbon neutrality or renewable energy sources are pulled while record heat and wildfires kill more and more people to teach AI how to spell “strawberry”.

So that log4j thing that came in last week... that's just a ...

2026-09-03T14:21:42Z

So that log4j thing that came in last week... that's just a nothing burger, right?

Claiming it's an RCE in log4j because if you find an endpoint to which you can upload an object and that _then_ de-serializes the attacker controlled data feels like claiming Apache httpd has an RCE because you found a web server configured to accept POSTs to its cgi-bin directory. (If you remember what that is.)

I mean, sure, don't de-serialize attacker controlled data, but that's not news.

AI is notoriously verbose, often producing pages and pages of ...

2026-08-18T12:56:43Z

AI is notoriously verbose, often producing pages and pages of output that then, inevitably, the recipient feeds back into _their_ AI to summarize.

AI companies are charging customers by the token, both input and output.

It's almost as if there was some sort of connection there.

Nostr event nevent1qqswzsqcdv5w0afj6jdq2y5nla2wzr8a322arsg0eu8n377rt57kl7gzyzesslx0hl6v9chpdga0zj9k5w38lcrmk8nk9zm3fgg7tun8z8exxcpyeuw

2026-08-17T13:25:05Z

Pfft, Mondays. Mondays are fine. Know what I hate? AI.

Incident: actively exploited CVE Service team: Not to worry. The ...

2026-08-14T20:16:33Z

Incident: actively exploited CVE

Service team: Not to worry. The EoL'd version we run is *much* older than that, so we're not affected. 🤡

Infosec: 🤦‍♂️

(This happens far too often.)

You're right - AI _is_ useful. Your use of it provides an ...

2026-08-10T15:43:18Z

You're right - AI _is_ useful. Your use of it provides an important signal to me:

1) For writing: "I didn't care to put the effort in to write this myself."

2) For coding: "I don't care if I understand the solution."

3) For vuln impact analysis: "I don't understand the code base nor the attack vector."

Or shorter: "I do not care about the details."

This, of course, on top of the other ethical problems with AI. It's a strong signal, and I see it everywhere.

‘“The world looks different now than when we co-founded the ...

2026-08-09T19:04:55Z

‘“The world looks different now than when we co-founded the climate pledge,” said Margaret Callahan, an Amazon spokeswoman.’

Yeah, no kidding. IT’S ON FUCKING FIRE because of soulless sacks of shit and the corporate bullshitters like you.

Climate pledge my ass.

https://www.nytimes.com/2026/08/08/climate/amazon-data-center-texas-pollution.html

Couldn't find the first occurrence to repost, but yes, AI ...

2026-08-08T13:46:33Z

Couldn't find the first occurrence to repost, but yes, AI companies trying to one-up each other by touting their incompetence to airgap their systems and chest-thumping their wantonly committing cybercrimes with no consequences is a vibe.

So, uhm, at this point, seems like local privilege escalation ...

2026-07-22T19:52:02Z

So, uhm, at this point, seems like local privilege escalation vulnerabilities are numerous enough that you can pretty much assume that any local user can become root and escape most containers, yes?

"FragGap" LPE via IPv4/IPv6 UDP corking path

https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/
https://github.com/qwerty-po/security-research/tree/cve-2026-53362
https://github.com/sgkdev/ipv6_frag_escape

Really looking forward to the first large-scale OpenAI / ...

2026-07-13T20:17:03Z

Really looking forward to the first large-scale OpenAI / Anthropic API outage, where 85% of the industry will be flopping around trying to remember how to hello-world on their own while execs google "how to write an email".

The whole "We JuST DoNt KnOw iF Claude iS ConsCiOuS" ...

2026-07-10T22:30:37Z

The whole "We JuST DoNt KnOw iF Claude iS ConsCiOuS" pitch annoys me to no end.

The language Anthropic uses — first person narrative, assigned agency and intentions, use of human cognitive vocabulary and so on — consistently aims to imply consciousness.

"The program utilizes temporarily stores frequently accessed information relevant to multiple contexts" is a lot less magical than "Claude thinks in its J-space", "privately notices", has "intentions", "malicious goals", or a "point of view".

Really would have liked it if journalists made the point that ...

2026-07-06T22:30:33Z

Really would have liked it if journalists made the point that according to Trump Balogun should never have been able to play for the US team to begin with, because (again, according to Trump), he should not be a US citizen.

I keep seeing this purported screenshot of that Yahoo job posting ...

2026-06-28T20:01:01Z

I keep seeing this purported screenshot of that Yahoo job posting for a “Claude Code Expert” make the rounds, and I’m sorry to disappoint you, but unless anybody can produce the actual (archived) link, I’m gonna assume it’s fake rage bait.

Very successful rage bait, sure, but y’all should know better than to fall for it.

A few notes on Post-Quantum Certificates: - Yes, Merkle-Tree ...

2026-06-27T16:25:52Z

A few notes on Post-Quantum Certificates:

- Yes, Merkle-Tree Certificates (MTCs) are smaller than ML-DSA certs, but still pretty large
- MTCs come in two flavors: standalone and landmark-relative; servers will need to support both
- clients need to update landmarks frequently; how will non-browsers handle that?
- web-PKI (MTCs) and private PKI (ML-DSA) are diverging

Things are getting more complex...

https://www.netmeister.org/blog/pqc-certs.html

#pqc #mtc #cryptography

Watching Anthropic try to add "guardrails" to models to ...

2026-06-15T21:39:37Z

Watching Anthropic try to add "guardrails" to models to basically do "sploits for the good guys, but not for bad guys" seems like somewhere somebody needs to learn the lessons from the first round of the cryptowars.

You can't add or restrict capabilities in software based on who runs it.

I miss Web 1.0. You click a link, you get to the website, you ...

2026-06-15T13:47:36Z

I miss Web 1.0. You click a link, you get to the website, you read the content. What a concept.

New OpenSSL advisory: ...

2026-06-09T16:53:30Z

New OpenSSL advisory:
https://openssl-library.org/news/secadv/20260609.txt

1 high, 5 medium, 12 low severity

The high (CVE-2026-45447) was explicitly noted as discovered with help from Claude.

What's more interesting is again the confirmation that vulnerabilities are increasingly identified independently by multiple people:

CVE-2026-34182 (independently found by 4 different people), CVE-2026-35188 (2), CVE-2026-9076 (2), CVE-2026-34181 (2), CVE-2026-42766 (4).

So people are totally now using AI models for regular stuff that ...

2026-06-09T13:02:43Z

So people are totally now using AI models for regular stuff that you can do via shell scripts and cron, because why do something for free when you can burn tokens and at the same time actively forget how to use the normal tools at your disposal?

🤦 🙏 🤦

Why signed packages and repositories are important, part 64: The ...

2026-06-08T19:49:33Z

Why signed packages and repositories are important, part 64:

The `baltocdn.com` domain, previously used as an apt mirror for helm.sh, apparently expired. Meaning, whoever picked it up could have been serving malware to anybody pulling unsigned packages from there:

https://helm.sh/blog/security-notice-baltocdn/

#k8s

A spreadsheet is not a database. Thanks for coming to my TED ...

2026-05-29T18:03:00Z

A spreadsheet is not a database.

Thanks for coming to my TED talk.

Now this is some bullshit. Today: Don't have an ...

2026-05-21T03:02:42Z

In reply to nevent1q…p8xt
_________________________

Now this is some bullshit.

Today: Don't have an "approved" phone? Too bad for you.
Tomorrow: Don't have a Google account? Good bye.

Another nail in the coffin of the Open Web. Those fuckers.

https://thecodersblog.com/google-breaks-recaptcha-for-de-googled-android-users-2026/

https://cybernews.com/privacy/google-qr-code-recaptcha-requires-approved-phone/

Now what the fresh fuck is this, then? Not today, Satan. ...

2026-05-21T02:44:54Z

Now what the fresh fuck is this, then?

Not today, Satan.

Qualys has published their full write-up of CVE-2026-46333: ...

2026-05-20T18:38:59Z

In reply to nevent1q…0ld3
_________________________

Qualys has published their full write-up of CVE-2026-46333: https://www.openwall.com/lists/oss-security/2026/05/20/15

This includes a PoC to full root via `accounts-daemon` demonstrated in Debian 13, Fedora Workstation 43/44, so goes well beyond the initial "you need a program that opens a given file and you get to read it" assumption.

Remember to update your libc for the new AI errno(2) values that ...

2026-05-19T23:59:46Z

Remember to update your libc for the new AI errno(2) values that just dropped:

https://www.netmeister.org/blog/ai-errno.html

A local information disclosure bug reported by Qualys was fixed ...

2026-05-15T02:47:11Z

A local information disclosure bug reported by Qualys was fixed in the linux kernel today: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a

Soon after, PoCs showed up on GitHub: https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn

Outcome is an unprivileged user can steal read fds from a privileged process (confirmed by example of reading private ssh hostkey and /etc/shadow). No CVE yet.

Congrats! Your new job is: arguing with a bot. Multiple bots. And ...

2026-05-08T22:49:26Z

Congrats! Your new job is: arguing with a bot. Multiple bots. And people outsourcing their brain to bots. But mostly bots.

Sometimes you have to social engineer the bots to do your bidding. Sometimes you have to pit the bots against each other. But make no mistake, it's arguing with the bots.

That, and email. And meetings.

How beauteous mankind is! O brave new world,
That has such people in't.

Btw, there's _no_ way we're done here with #DirtyFrag and ...

2026-05-08T20:27:41Z

Btw, there's _no_ way we're done here with #DirtyFrag and #CopyFail. Everybody is aiming their LLMs at this attack path through the page cache now, and there's bound to be other ways.

Be ready to rinse and repeat a few more times before the dust settles, so I guess keep an even closer eye on linux kernel commits for a while.

(And no, I don't know how this will be sustainable.)

#DirtyFrag status/advisories: AlmaLinux: ...

2026-05-08T18:45:08Z

#DirtyFrag status/advisories:

AlmaLinux:
https://almalinux.org/blog/2026-05-07-dirty-frag/

Debian:
https://security-tracker.debian.org/tracker/CVE-2026-43500
https://security-tracker.debian.org/tracker/CVE-2026-43284

Gentoo:
https://bugs.gentoo.org/974307

RedHat:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-43284
https://access.redhat.com/security/cve/cve-2026-43284
nothing yet on CVE-2026-43500

Rocky:
https://kb.ciq.com/article/rocky-linux/rl-dirty-frag-mitigation

SUSE / OpenSUSE:
https://www.suse.com/security/cve/CVE-2026-43500.html
https://www.suse.com/security/cve/CVE-2026-43284.html
https://www.suse.com/c/addressing-copy-fail2-aka-dirtyfrag-in-suse-virtualization/

Ubuntu:
https://ubuntu.com/security/CVE-2026-43284
https://ubuntu.com/security/CVE-2026-43500
https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available

AWS:
https://aws.amazon.com/security/security-bulletins/rss/2026-027-aws/
https://explore.alas.aws.amazon.com/CVE-2026-43284.html

You know, I was going to let this domain expire... ...

2026-05-08T00:33:52Z

You know, I was going to let this domain expire...

https://istheinternetonfire.com/

Originally set up for Heartbleed in 2014; hadn't remembered to update it since the CrowdStrike incident two years ago.

I guess I'll just set it to a permanent "yes" going forward.

#CopyFail #DirtyFrag

Oh FFS. #DirtyFrag ...

2026-05-07T20:07:16Z

Oh FFS.

#DirtyFrag
https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md

"Because the embargo has now been broken, no patches or CVEs exist for these vulnerabilities."

https://www.openwall.com/lists/oss-security/2026/05/07/8

Well, just put that CopyFail incident work on rinse and repeat, I suppose...

Hah, just occurred to me that there's probably a number of ...

2026-05-04T20:48:31Z

Hah, just occurred to me that there's probably a number of folks who don't quite realize that the #copyfail PoC _actually modified_ the su(1) binary. That is, if you ran it _once_ to check, and then you applied mitigations, you still have a compromised /bin/su.

Wonder how many systems end up left with that... 🤪

Le sigh. Every time we go around and have to do this again and ...

2026-05-02T13:43:24Z

Le sigh. Every time we go around and have to do this again and manually figure out wtf each of the ten thousand linux distributions provides their security updates and current status.

Spending my Saturday morning searching for CVE-2026-31431 and "copyfail" patch status is just 👍.

Anyway, here's what I have so far:

There's a lot of good things in here. Including: "we all ...

2026-04-22T00:20:28Z

There's a lot of good things in here. Including:

"we all know the discovery rate has not been the constraint on vulnerability management for a decade. The constraint is triage, prioritization, patching velocity, and coordinated disclosure. [...] A tool that accelerates discovery without accelerating remediation grows the backlog; it does not shift the threat model."

https://www.flyingpenguin.com/the-boy-that-cried-mythos-verification-is-collapsing-trust-in-anthropic/comment-page-1/

Current #infosec status. ...

2026-04-19T19:02:56Z

Current #infosec status.

@nprofile…es6s New coffee place opened up around the corner. ...

2026-04-19T16:18:46Z

In reply to nevent1q…tez8
_________________________

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqg5q5nw988r0g2hnv7tyachc8yytg6ppjxfdprx2hhe5cwmvmwd2qr7es6s (nprofile…es6s) New coffee place opened up around the corner. Went in there, nobody pays me any attention, no obvious line to order, no cash register. I’m told I can scan a QR code to download an app to place an order. Walked across the street to next place instead.

TIL: in Chrome, if you encounter any cert error, you can just ...

2026-04-17T00:57:24Z

TIL: in Chrome, if you encounter any cert error, you can just type `thisisunsafe` while on the error page and blammo! you're on the insecure page.

This even works for HSTS preloaded domains:

https://subdomain.preloaded-hsts.badssl.com/

slow clap to everybody out there doing Anthropic's ...

2026-04-13T14:38:58Z

*slow clap* to everybody out there doing Anthropic's Marketing Team's job for them. 🍿

"#Mythos discovers 27-year-old bug" is intentionally ...

2026-04-11T16:12:42Z

"#Mythos discovers 27-year-old bug" is intentionally conflating length of existence of a bug with difficulty of finding it. There is no such correlation.

If software projects and companies performed regular, ongoing, in-depth code audits over and over and missed it, sure, then age would be meaningful, but that is simply not what organizations do.

But sure, it makes for great headlines.

Die englische Sprache kennt ja “Verschlimmbessern” nicht, ...

2026-03-29T23:29:33Z

Die englische Sprache kennt ja “Verschlimmbessern” nicht, weshalb sie stattdessen “vibe coding” sagt.

Fallout from the trivy compromise, part N of many: LiteLLM ...

2026-03-25T13:54:40Z

Fallout from the trivy compromise, part N of many:

LiteLLM includes a backdoor and a malicious .pth file that "automatically executes a credential-stealing script every time the Python interpreter starts — no import litellm required"

I.e., "pip install litellm" -> pwned

https://thehackernews.com/2026/03/teampcp-backdoors-litellm-versions.html

https://github.com/BerriAI/litellm/issues/24512

https://github.com/BerriAI/litellm/issues/24518

Starting to think the real risk is not AI replacing junior staff, ...

2026-03-18T17:19:48Z

Starting to think the real risk is not AI replacing junior staff, but senior staff quitting because they just can’t take this AI bullshit any longer and just opt for early retirement.

What idiot called it “agentic AI” when “Claude Computing” ...

2026-03-04T23:40:05Z

What idiot called it “agentic AI” when “Claude Computing” is right there?

(Bonus joke: There is no Claude, only other peoples’ content.)

The only thing my brain gives me when I hear Google & ...

2026-03-02T19:41:27Z

The only thing my brain gives me when I hear Google & Cloudflare talking about Merkle Tree Certificates:

#pqc

Another odd trend I'm observing: students don't ...

2026-03-01T02:12:00Z

Another odd trend I'm observing: students don't understand how to work with plain text any longer.

The concept of wrapping text to fit an 80 char terminal gives them trouble. Many resort to random websites where they paste their text into and that will insert line breaks in the middle of the word at exactly 80 chars.

Using a text editor to, uhm, edit text is, at this point, completely foreign to them.

Weird.

For anybody wondering why I prefer #NetBSD over #Linux, compare ...

2026-02-27T22:37:07Z

For anybody wondering why I prefer #NetBSD over #Linux, compare the code for a small tool like whois(1):

NetBSD:
https://cvsweb.netbsd.org/bsdweb.cgi/src/usr.bin/whois/whois.c?annotate=HEAD

372 lines, easy to read

Linux:
https://github.com/rfc1036/whois/blob/next/whois.c

1617 lines in the main program; unchecked malloc(3), misc buffer overflow opportunities, magic numbers, "/* This function has multiple memory leaks.*/", mixed spaces and tabs, another 2K of glue code, ...

KISS, man, KISS.

Tonight seems like a good time to remind folks that the next ...

2026-02-25T02:28:40Z

Tonight seems like a good time to remind folks that the next #nokings protest is planned for March 28th:

https://www.nokings.org/

Mark your calendars, I'll see you there! ✌️

#sotu #fucktrump

Let's start at the #DNS. Obviously, the root is fully ...

2026-02-19T22:59:08Z

In reply to nevent1q…x7wl
_________________________

Let's start at the #DNS. Obviously, the root is fully dual-stack, but what about the TLDs?

Overall, that's not terrible: only 18 of the 1,436 TLDs have only IPv4-only NS records in the root zone, although 240 TLDs have at least one IPv4-only NS.

But for the top 1M _second-level_ domains, this already drops down and only around 72% of them have at least one IPv6-enabled NS.

#ipv6

#IPv6 adoption is still terrible. Akamai, Cloudflare, and Google ...

2026-02-19T22:58:07Z

#IPv6 adoption is still terrible.

Akamai, Cloudflare, and Google all report roughly 45% of traffic to their services using IPv6 in the US...

https://www.akamai.com/security-research/ipv6-adoption-visualization

...but that's (a) not all that great, and (b) only HTTP traffic to major services.

Just what % of sites actually _offers_ IPv6? I took a look...

Being forced onto Outlook Office365 with the threat of having to ...

2026-02-12T16:05:25Z

Being forced onto Outlook Office365 with the threat of having to use Outlook or webmail. I don't know how anybody can suffer their email with these interfaces.

So very thankful for the folks who created and documented mutt_oauth2:
https://gitlab.com/muttmua/mutt/-/raw/master/contrib/mutt_oauth2.py.README

Got everything to work using the README and this HOWTO:
https://staff.washington.edu/shrike/unix/configuring-mutt-neomutt-for-imap-access-to-o365-exchange/

And thanks to a kind admin who added a new client-id for mutt, I don't even have to pull the Thunderbird ID to fake that.

Claiming use of drones by drug cartels forces you to close ...

2026-02-11T18:58:59Z

Claiming use of drones by drug cartels forces you to close airports seems like a convenient way to reinforce an argument that the US is "at war" with drug cartels, just in case anybody continues to object to the murder of people on boats in the Carribean and Pacific.

Of which there were two more in the last week, but apparently not only does nobody object to them any more, nobody really notices. It's just what we do now.

If you'd like to have a nice 🤦-y day like me, go ahead, ...

2026-02-03T16:33:45Z

If you'd like to have a nice 🤦-y day like me, go ahead, search your internal code repository for the following:

curl -k
wget --no-check-certificate
verify=false
InsecureSkipVerify: true
ssl_verify_mode: 0
TrustSelfSignedStrategy
rejectUnauthorized: false
strict-ssl = false
http.sslVerify = false
--no-verify-ssl
--insecure*
verify_hostname: 0

It'll be great.

Srsly, what idiot called it "CAPTCHA" instead of ...

2026-02-03T03:43:44Z

Srsly, what idiot called it "CAPTCHA" instead of "Mein Voight-Kampff".

Billionaires, man. Greedy motherfuckers. Brin is worth $266B. A ...

2026-02-01T17:41:37Z

Billionaires, man. Greedy motherfuckers.

Brin is worth $266B. A one-time 5% billionaire tax (with the money going to healthcare!) would mean he's left with... $242B. Which that year's rate of growth would trivially earn him back. But he just can't.

You can do a 99% one-time billionaire tax and he'd be left with *2.6 billion dollars.

https://www.nytimes.com/2026/01/28/us/politics/california-billionaires-sergey-brin-campaign.html

CA has maybe 200 billionaires in a population of ~40 million. Talk about the richest 0.0005%. Greedy motherfuckers.

And this is why he's The Boss. "Here in our home they ...

2026-01-29T01:54:22Z

And this is why he's The Boss.

"Here in our home they killed and roamed
In the winter of ’26
We’ll take our stand for this land
And the stranger in our midst
We’ll remember the names of those who died
On the streets of Minneapolis"

https://www.youtube.com/watch?v=wWKSoxG1K7w

This semester, I'm teaching my class on System Administration ...

2026-01-24T14:26:58Z

This semester, I'm teaching my class on System Administration / Internet Operations once again.

The syllabus and all course materials are available here:

https://stevens.netmeister.org/615/

All videos for the lectures and exercises are public and available for free on YouTube:

https://www.youtube.com/c/cs615asa/videos

If you want to follow along, I'll be posting lecture videos and related links in this thread throughout the semester.

#sysadmin #devops #sre

Here #curl is again showing the way in Open Source, this time ...

2026-01-23T17:27:47Z

Here #curl is again showing the way in Open Source, this time with vulnerability management. Per their well-known/security.txt:

#IPv6 was defined in RFC1883 in December of 1995. That's ...

2026-01-22T21:49:41Z

#IPv6 was defined in RFC1883 in December of 1995.

That's right, IPv6 is now *30* frickin' years old. I've spent at least 25 of those yelling at people, companies, service providers, and many engineers who really should know better that they need to enable it.

Doesn't look like 2026 is going to change that. Le sigh.

This identification of the dual state remains one of the most ...

2026-01-18T23:16:24Z

This identification of the dual state remains one of the most accurate and disturbing explanations of where we are:

https://www.theatlantic.com/magazine/archive/2025/05/trump-executive-order-lawlessness-constitutional-crisis/682112/

And it follows:

“if you interact with ICE, suddenly you risk coming up against the full force of the prerogative state. One of the most heartbreaking aspects of […] the fatal encounter between Renee Good and ICE is that it’s plain that Good thinks she’s still in the normative state. She has no idea of the peril she’s in.”

https://www.nytimes.com/2026/01/18/opinion/renee-good-ice-immunity.html

Lol, Linkedin didn't like me posting photos from today's ...

2026-01-11T21:32:23Z

Lol, Linkedin didn't like me posting photos from today's anti-trump, anti-ICE protests. 'Cause, you know, gotta keep it professional when the goons shoot citizens and snatch your neighbors from the streets. Good job, Linkedin. May I recommend selling Hollerith punch cards next?

(Yes, yes, I'm aware that of course MS sells all sorts of services to ICE. They all do. 🤮)

Everybody walking past Trump Tower be like… #fuckICE ...

2026-01-11T19:07:23Z

Everybody walking past Trump Tower be like…

#fuckICE #iceoutforgood #fucktrump

Quotable as ever, here's @nprofile…ugpy on code as ...

2026-01-06T16:23:34Z

Quotable as ever, here's nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqhykucplphuhelaxutcw4jw3vuu7gcg42czhqmk7jhchs8vdga4fschugpy (nprofile…ugpy) on code as liability and that having AI produce more code faster is simply tech debt at scale:

https://pluralistic.net/2026/01/06/1000x-liability/#graceful-failure-modes

"The longer a computer system has been running, the more tech debt it represents. The more important the system is, the harder it is to bring down and completely redo."

"Writing code that works, without consideration of how it will fail, is a recipe for catastrophe. It is a way to create tech debt at scale."

'Twas the night of the moratorium, and all through the cloud ...

2025-12-24T17:22:19Z

'Twas the night of the moratorium, and all through the cloud
not a pager was beeping: no deploys were allowed.
The packages frozen on the servers with care,
In hopes that an outage would strike nowhere;

The developers still pondering code to embed,
While visions of monads danced in their heads.
The VM put to sleep, and I in this app,
Had just settled down for a long masto thread,

I finally jotted down a table of in how far the big three ...

2025-12-12T22:10:12Z

I finally jotted down a table of in how far the big three browsers currently support RFC9460 HTTPS records.

In summary:
- All browsers support ALPN
- Safari has the best support; it's the only browser that supports AliasMode, but Safari doesn't support ECH
- Firefox requires DoH, but then supports several parameters
- Chrome only support ALPN and ECH

See this page for details, I may update it in the future:
https://www.netmeister.org/blog/https-caniuse.html

#dns

Here's another funny generational divide: students no longer ...

2025-12-05T21:47:36Z

Here's another funny generational divide: students no longer understand public_html directories and /~user/ URLs because apparently nowadays shared fileserver access is no longer a thing.

Smh, fist, yells at cloud.

Oof, this hits hard. "AI is Destroying the University and ...

2025-12-04T19:20:50Z

Oof, this hits hard.

"AI is Destroying the University and Learning Itself"

https://www.currentaffairs.org/news/ai-is-destroying-the-university-and-learning-itself

Choice quotes:

"The result isn’t augmented intelligence but simulated learning: a paint-by-numbers approach to thought."

"Universities are being retrofitted as fulfillment centers of cognitive convenience. Students aren’t being taught to think more deeply but to prompt more effectively."

So many more spot-on observations. It's long. Actually read it, don't have AI summarize it for you.

🎉 56 years ago today, "the first permanent ARPANET link ...

2025-11-21T17:53:07Z

🎉 56 years ago today, "the first permanent ARPANET link was established between the IMP at UCLA and the IMP at the Stanford Research Institute. By 12/5 1969, the initial four-node network was established."

https://en.wikipedia.org/wiki/ARPANET

From there, it's gotten a bit harder to visualize the internet.

Early hosts.txt (1973-1995):
https://github.com/ttkzw/hosts.txt/

xkcd IPv4 map (2006):
https://xkcd.com/195/

Opte connection graph (2021):
https://youtu.be/-L1Zs_1VPXA

Undersea cable map:
https://map.kmcd.dev/

Cloudflare outage root cause: not checking the return value of a ...

2025-11-19T03:02:26Z

Cloudflare outage root cause: not checking the return value of a function that may fail. In C, that would be calling something on NULL and segfaulting; in Rust it's calling a function on an Err val and panic.

thread fl2_worker_thread panicked: called Result::unwrap() on an Err value

So, yeah, kids, do always check your return values before you use them.

https://blog.cloudflare.com/18-november-2025-outage/

One assignment I give students in my "Advanced Programming in ...

2025-11-18T16:24:37Z

One assignment I give students in my "Advanced Programming in the UNIX Environment" class includes reading data from a pipe into a fixed-size buffer.

A clever approach for that is

```
total = 0;
while ((n = read(fd, buf + total, len - total)) > 0)
total += n;
```

This is a common construct found (but not explained) in StackOverflow posts and different open source code bases. But it's not something students tend to come up with on their own and struggle to explain if asked.

Me when "hackers" ask for a reward for reporting a ...

2025-10-29T13:53:36Z

Me when "hackers" ask for a reward for reporting a vulnerability of "weak SSH ciphers" on a hostname that resolves to 127.0.0.1.

Huh, that's a new one. Fake Cloudflare captcha asking you to ...

2025-10-20T18:30:20Z

Huh, that's a new one. Fake Cloudflare captcha asking you to please run the osascript from http://185.93 . 89.62/d/xxx33312 to collect and upload all your passwords and cookies.

#nokings #fucktrump #fuckICE #nyc ...

2025-10-18T17:02:17Z

In reply to nevent1q…h3ee
_________________________

#nokings #fucktrump #fuckICE #nyc

Just about the only time I enjoy the crowd in Times Square. ...

2025-10-18T16:51:23Z

Just about the only time I enjoy the crowd in Times Square. #nokings #nyc

#nokings #nyc ...

2025-10-18T16:48:43Z

#nokings #nyc

Reminder: #nokings protests ̶t̶o̶m̶o̶r̶r̶o̶w̶ today. ...

2025-10-17T22:18:59Z

Reminder: #nokings protests ̶t̶o̶m̶o̶r̶r̶o̶w̶ today. Find your event here:

https://www.nokings.org/

Fuck Trump, fuck Vance, most certainly fuck ICE, and fuck the whole vicious lot of them.

See you ̶t̶o̶m̶o̶r̶r̶o̶w̶ later!

libxml2's sole maintainer Nick Wellnhofer steps down, meaning ...

2025-09-25T15:20:02Z

libxml2's sole maintainer Nick Wellnhofer steps down, meaning libxml2 is now no longer maintained.

https://discourse.gnome.org/t/stepping-down-as-libxml2-maintainer/31398

It's hard to estimate just how many companies depend on this software and critical security updates to the library, so I'm certain many will quickly step up and offer sponsorship to ensure a fundamental dependency doesn't just deteriorate without proper support.

Any day now.

https://xkcd.com/2347/ recursion ...

2025-08-27T19:44:21Z

https://xkcd.com/2347/ recursion