Nostr notes by Graham Sutherland🎃 / Polynomial.pdf.exe

the fact that "I hacked a website" / "I hacked a ...

2026-10-30T01:54:17Z

the fact that "I hacked a website" / "I hacked a javascript library" can lead to a TWO BILLION DOLLAR theft is fucking wacko. also what the fuck do you even do with that quantity of cryptocurrency as an attacker. it's not like you can just ask some non-KYC exchange to hand you a billion dollars in any currency, monopoly money or otherwise. you might as well have stolen an aircraft carrier.

just saw someone walking down the street wearing camo dungarees, ...

2026-10-28T21:30:55Z

just saw someone walking down the street wearing camo dungarees, a purple backpack with silver stars and moons, and chunky headphones, clutching a fairground-sized bear, and periodically turning around to wave at the moon. hope they have an excellent night.

found an absolutely beautiful exploit chain today in some .net ...

2026-10-28T06:33:27Z

found an absolutely beautiful exploit chain today in some .net code and I'm mad that I can't share it

broccoli2shell??? how dare they slander the best vegetable

2026-10-27T18:07:27Z

In reply to nevent1q…gv9a
_________________________

broccoli2shell??? how dare they slander the best vegetable

love seeing stuff like "hey does someone have [obscure ...

2026-10-26T13:33:41Z

love seeing stuff like "hey does someone have [obscure technical thing] for an experiment?" and someone in the replies is like "sure! wanna borrow it?", it's one of the best parts of fedi.

(in this case it was a rubidium clock)

sent this to a friend and she said "brings a whole new ...

2026-10-26T04:52:59Z

In reply to nevent1q…s52d
_________________________

sent this to a friend and she said "brings a whole new meaning to buy now pay later"

oh lawd it's not even November yet

2026-10-25T20:08:00Z

In reply to nevent1q…e8zx
_________________________

oh lawd it's not even November yet

thinking about the kinds of vulnerability write-ups we'd get ...

2026-10-25T19:45:57Z

thinking about the kinds of vulnerability write-ups we'd get if star trek transporters were real.

"A maliciously crafted molecular sequence in an object leads to a write-what-where within the transport pattern buffer."

not bad going for the first model I've ever painted. ...

2026-10-25T02:40:28Z

not bad going for the first model I've ever painted.

I aspire to get SEC_ERROR_WHAT_THE_ACTUAL_F included in a major ...

2026-10-23T16:37:09Z

In reply to nevent1q…z9j0
_________________________

I aspire to get SEC_ERROR_WHAT_THE_ACTUAL_F included in a major project.

greatest error screen I've ever read

2026-10-23T16:36:20Z

In reply to nevent1q…m8cc
_________________________

greatest error screen I've ever read

eMudhra are really handling being the main character well huh ...

2026-10-21T21:41:48Z

eMudhra are really handling being the main character well huh

(no)

Nostr event nevent1qqsy25l23sfucefh6j4eszfp9w677a5vmdaq8hc00r2ffkpegplyqzqzyzqgftkj0tcg7dye2zsglccz6s20ymjxe9hvyvznqpn5apap457zvrlra0q

2026-10-21T20:30:31Z

In reply to nevent1q…whky
_________________________

yup. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

we're up to three! (GitLab unauth RCE, CVSS 10)

2026-10-21T19:47:58Z

In reply to nevent1q…kk92
_________________________

we're up to three! (GitLab unauth RCE, CVSS 10)

Nostr event nevent1qqsqwaapklwuc7erqyhtrd0qp9v86kypr54rsac3dgyv9ma30acsafczyzqgftkj0tcg7dye2zsglccz6s20ymjxe9hvyvznqpn5apap457zv986y9x

2026-10-21T16:31:03Z

there's a second one

2026-10-21T16:22:57Z

In reply to nevent1q…dk8j
_________________________

there's a second one

fwiw the posts going round saying that the cert key fuckup was ...

2026-10-21T04:31:33Z

fwiw the posts going round saying that the cert key fuckup was due to a HSM bug are wrong. they used a HSM to generate the keys, and the HSM generated them correctly. they then did a "process deviation" (read: someone signed off on doing a little fucky boingo) and used a script to process the signing requests, which fucked up and made the keys all tiny.

[source: the emsign people in the bugzilla thread, which wasn't private earlier but now seems to be, womp womp]

PHP dev has said that the claimed ...

2026-10-21T03:21:12Z

PHP dev has said that the claimed session.upload_progress.enabled=Off config mitigation that's floating around is not sufficient to mitigate the upcoming PHP bug, and the only actual fix is patching.

(reposting with alt text) ...

2026-10-21T03:17:57Z

(reposting with alt text)

and if two of you are then we'll have 4 bugs and come full ...

2026-10-21T02:39:55Z

In reply to nevent1q…rfxk
_________________________

and if two of you are then we'll have 4 bugs and come full circle

if you're sat on a major vulnerability you have the ...

2026-10-21T02:38:37Z

if you're sat on a major vulnerability you have the opportunity to do something very funny right now

some days there aren't enough catte jpegs in the world

2026-10-20T23:20:06Z

In reply to nevent1q…79mp
_________________________

some days there aren't enough catte jpegs in the world

eventful day. feels like even more of a fever dream given the 5 ...

2026-10-20T23:18:37Z

eventful day. feels like even more of a fever dream given the 5 hours of sleep I got last night.

my wife just suggested that bechamel sounds like a demon name. ...

2026-10-17T05:00:07Z

my wife just suggested that bechamel sounds like a demon name.

"what're you doing?"

"summoning bechamel"

nods yes, correct ...

2026-10-15T14:48:29Z

*nods* yes, correct

delivery guy: "your house is really hard to find" what I ...

2026-10-14T17:44:51Z

delivery guy: "your house is really hard to find"

what I said: "yeah you're not the first person to struggle"

what I meant: "you are the latest in a long series of people who didn't bother to read the extremely clear and impossible to misunderstand instructions I provided alongside the address, which I have spent several years honing to avoid all possible sources of confusion"

the bug that OpenAI found in their office is extremely visually ...

2026-10-13T22:07:32Z

the bug that OpenAI found in their office is extremely visually similar to the Seeed Studio XIAO ESP32-S3 sense, a $14 MCU devboard kit that includes a camera, microphone, SD card slot, and flex antenna.

they described it as "sophisticated", which is presumably PR department talk for "they bought it for $14 and then flashed the provided example code that records audio and video to the SD card".

non-maskable interrupt (mentioning a neurodivergent person's ...

2026-10-13T13:34:46Z

non-maskable interrupt (mentioning a neurodivergent person's special interest)

if you open the menu next to a suggested shorts panel on youtube ...

2026-10-11T16:20:27Z

if you open the menu next to a suggested shorts panel on youtube and click the "show fewer shorts" button, it still shows you the exact same number of shorts suggestions but just removes the "show fewer shorts" menu item for a while.

is the oscillator and Nyquist filter part quite small then, to ...

2026-10-10T17:55:14Z

In reply to nevent1q…zsl4
_________________________

is the oscillator and Nyquist filter part quite small then, to keep the total area reduction worth it? I guess with the osc you again get to rely on the multiple layers for vertical scaling of capacitance. (or is it just parasitics, like a ring osc?)

I guess the tradeoff is the extra current noise?

2026-10-10T17:50:17Z

In reply to nevent1q…cgxz
_________________________

I guess the tradeoff is the extra current noise?

the weebl version of correct horse battery staple is pygmies ...

2026-10-10T15:59:13Z

the weebl version of correct horse battery staple is pygmies budgies kuala lumpur

this marketing does not fill me with confidence ...

2026-10-10T00:27:25Z

this marketing does not fill me with confidence

what on earth is that response

2026-10-08T14:33:19Z

In reply to nevent1q…z6kk
_________________________

what on earth is that response

if you want users to apply security updates maybe don't ship ...

2026-10-07T17:12:14Z

if you want users to apply security updates maybe don't ship them with updates that fuck with their quiet enjoyment of their computers.

heh, using the hype to deliver "do all the basic shit ...

2026-10-07T16:28:48Z

In reply to nevent1q…rfmk
_________________________

heh, using the hype to deliver "do all the basic shit we've been asking you to do for decades please" is certainly a good way to get buy-in.

you ever notice how people on those TV shows about moving or ...

2026-10-06T17:41:38Z

you ever notice how people on those TV shows about moving or renovating houses often run into some sort of financial pinch and then somehow manage to find fifty or a hundred grand out of nowhere like it was down the back of their sofa cushions?

Nostr event nevent1qqsxsen2zgfy96zl8lpvtcx8vx5x34sa7uyv5fuyuvyx86dyhqw3cnczyzqgftkj0tcg7dye2zsglccz6s20ymjxe9hvyvznqpn5apap457zv5ppryd

2026-10-05T13:34:48Z

PSL: Pumpkin Subsystem for Linux

I do have some 006003 caps somewhere too, but I have thus far ...

2026-10-04T20:29:45Z

In reply to nevent1q…h5jj
_________________________

I do have some 006003 caps somewhere too, but I have thus far been unable to find any tweezers - even the fanciest of biology tweezers - that have sufficiently small tip geometry to have any chance of grasping them. I'm honestly not entirely sure how they build PNP nozzles for parts that tiny. maybe at that point they just use a ~5μm laser etched mesh screen and a very powerful vacuum pump, idk.

which reminds me that I still need to find some affordable ...

2026-10-04T20:25:59Z

In reply to nevent1q…vknn
_________________________

which reminds me that I still need to find some affordable opthalmology tweezers (a horrifying thing to discover exists, I know) so I can attempt to hand solder 008004 (0201M) SMD capacitors. no, that's not a typo.

I do have a pair of their tweezers and they are excellent and ...

2026-10-04T20:20:58Z

In reply to nevent1q…avmy
_________________________

I do have a pair of their tweezers and they are excellent and also expensive as hell for tweezers, but that's a genuine space where scoring high on precision handling, tip stiffness, well thought out geometry, and comfort at the same time is difficult. I just can't see cutting wire warranting that kind of spend.

looking at the Weller Erem 2422E cutters and even if they are ...

2026-10-04T20:18:00Z

looking at the Weller Erem 2422E cutters and even if they are very nice I cannot possibly justify £85 on a pair of wire cutters. even if I used them several dozen times a day I don't think the price could possibly be proportionate to any improvement over a £20 pair.

if I ever find myself going to a software conference I'm ...

2026-10-04T19:52:25Z

if I ever find myself going to a software conference I'm going to have to get a "FUCK STALEBOTS" t-shirt made

FED BEARS

2026-10-04T13:23:16Z

In reply to nevent1q…v2zn
_________________________

FED BEARS

it does not feel real at all that I get to go feed them in a ...

2026-10-04T12:20:08Z

In reply to nevent1q…hlm3
_________________________

it does not feel real at all that I get to go feed them in a minute

Syrian bears are one of the smallest bear species. they're ...

2026-10-04T12:14:45Z

In reply to nevent1q…ujvt
_________________________

Syrian bears are one of the smallest bear species. they're remarkably tiny for bears.

and yes, they have massive concrete drainpipes to hang out in. it's one of the most common things sanctuaries throughout the world use to give them places to relax in the shade.

first glimpse ...

2026-10-04T12:12:29Z

In reply to nevent1q…54p6
_________________________

first glimpse

their names are Laika, Jaiko, and Newton. it is polite to know a ...

2026-10-04T11:45:20Z

In reply to nevent1q…n7yw
_________________________

their names are Laika, Jaiko, and Newton. it is polite to know a bear's name before you feed it.

we are at the place BEARS TIME SOON

2026-10-04T11:43:17Z

In reply to nevent1q…ugzg
_________________________

we are at the place

BEARS TIME SOON

my wife wants to liberate them and then start a company called ...

2026-10-04T08:35:06Z

In reply to nevent1q…2ayx
_________________________

my wife wants to liberate them and then start a company called Buber where you ride around on bears in exchange for giving them snacks and ear rubs.

the park they live at has a video of them rubbing their ears on ...

2026-10-04T08:32:09Z

In reply to nevent1q…ee39
_________________________

the park they live at has a video of them rubbing their ears on thick cardboard crates and it's so cute :3

BEARS BEARS BEARS BEARS BEARS BEARS BEARS

2026-10-04T08:30:32Z

In reply to nevent1q…v8ja
_________________________

BEARS BEARS BEARS BEARS BEARS BEARS BEARS

three Syrian bears. I think we get to feed them honey. I am ...

2026-10-03T23:35:22Z

In reply to nevent1q…2j96
_________________________

three Syrian bears. I think we get to feed them honey. I am beyond hyped.

guess what i'm gonna feed BEARS tomorrow :D

2026-10-03T23:34:48Z

guess what

i'm gonna feed BEARS tomorrow :D

amusing phrase pops into my head. "surely someone has thought ...

2026-10-02T19:46:40Z

amusing phrase pops into my head.

"surely someone has thought of this and posted it before," I think.

I search for the phrase.

it's me. I posted it before.

Nostr event nevent1qqsgea4f2cpypahv072xd4ycsyztvsuauqzdxk07ft76kxdxsvpflvqzyzqgftkj0tcg7dye2zsglccz6s20ymjxe9hvyvznqpn5apap457zvnqu7k7

2026-10-01T02:35:23Z

*tips metal fedora* m'shuggah

sat wondering why I feel like crap and then noticed I've been ...

2026-09-29T20:20:37Z

sat wondering why I feel like crap and then noticed I've been hyperfocusing for 5 hours and it's 16°C in this room because I left the window open

Gender Containment Headquarters (GCHQ)

2026-09-28T17:39:42Z

In reply to nevent1q…jdcr
_________________________

Gender Containment Headquarters (GCHQ)

NGHTMRE and Flux Pavillion remixed RHCP - Can't Stop. ...

2026-09-27T17:39:00Z

NGHTMRE and Flux Pavillion remixed RHCP - Can't Stop. it's a bit more on the jump-up side of things than I usually like, but the video for it is a banger edit of live performances.

https://www.youtube.com/watch?v=ZjjyVgGA3Mw

run through the beaches do lots of pinches slam in the back of my ...

2026-09-27T15:43:35Z

run through the beaches
do lots of pinches
slam in the back of my
crabula 🦀

OH: "what's the threat model for rustc rewritten in ...

2026-09-25T14:07:04Z

OH: "what's the threat model for rustc rewritten in PHP?"

your own personal cheeses something to cut in squares or ...

2026-09-24T23:05:53Z

your own
personal
cheeses
something to cut in squares
or triangles, who cares

full of knowledge regulation ...

2026-09-24T19:28:37Z

full of knowledge regulation

did Intel ever make official Itanium Inside sticker badges? and, ...

2026-09-24T15:16:23Z

did Intel ever make official Itanium Inside sticker badges? and, if so, how unobitanium are they?

pronunciation of ablative (here en-us includes anything adjacent; ...

2026-09-23T16:48:36Z

pronunciation of ablative

(here en-us includes anything adjacent; it was just a convenient term that was short enough to fit)

we need to bring back the "such x. many y. wow" doge meme ...

2026-09-23T15:01:45Z

we need to bring back the "such x. many y. wow" doge meme now that the cryptocoin idiots who coopted it have stopped being at all relevant

right up until it's your cloud backup provider.

2026-09-23T06:35:13Z

In reply to nevent1q…flta
_________________________

right up until it's your cloud backup provider.

no, you see, Elsevier can't afford security because they have ...

2026-09-22T23:47:08Z

no, you see, Elsevier can't afford security because they have to spend the hundreds of millions they get paid by academic institutions and authors on *checks notes* running a website that hosts PDFs

https://cyberplace.social/@GossiTheDog/117313751385768529

people are mad about rpi firmware updates preventing DRAM chip ...

2026-09-22T03:45:11Z

people are mad about rpi firmware updates preventing DRAM chip swap upgrades. how on earth are people still surprised by anti consumer stuff that rpi (the company) does? they're like the OG grifters for paying lip service to the open source tinkerer demographic while having very little practical openness and reaping all the free labour. framework's whole schtick was practically copied from them.

using Cheat Engine's group scan to dump sqlcipher keys out of ...

2026-09-21T16:19:16Z

using Cheat Engine's group scan to dump sqlcipher keys out of applications. scan for the context struct using range constraints, that gets you the pointers to the read/write contexts, which have pointers to the keys. magic!

what a stupid change to make without any fanfare at all. I've ...

2026-09-21T04:35:13Z

In reply to nevent1q…6nk2
_________________________

what a stupid change to make without any fanfare at all. I've spent probably 10 hours debugging this.

wait, no, I found the issue. Spotify changed how their refresh ...

2026-09-21T04:33:02Z

In reply to nevent1q…krm5
_________________________

wait, no, I found the issue. Spotify changed how their refresh token API works.

"A refresh token that can be used to request new access tokens. When refreshing an access token, the response might not include a new refresh token. If it does not, continue using the existing token. See refreshing tokens."

my temporary fix is to run the bot every 48 minutes instead of ...

2026-09-21T03:30:49Z

In reply to nevent1q…e4q7
_________________________

my temporary fix is to run the bot every 48 minutes instead of every 60, which bumps it from 12 runs a day to 15, and should stop this from happening.

I also filed an issue.

the spotify ukf bot keeps breaking, but I think I've finally ...

2026-09-21T03:29:31Z

the spotify ukf bot keeps breaking, but I think I've finally narrowed the bug down to the PKCE refresh token handling in the library I'm using

if I'm right, the bug is that my script runs hourly and the tokens expire in an hour, and the library *locally* checks for expiry in order to trigger a refresh, but if a local check passes when the token has a few tens of milliseconds of lifetime left then it doesn't refresh, but by the time it reaches Spotify's API server it has expired.

this is also why you sometimes see weird time and weather ...

2026-09-20T18:47:08Z

In reply to nevent1q…wklh
_________________________

this is also why you sometimes see weird time and weather discontinuities within short jumps, even if the images are all the same gen. there can be a month or more between adjacent shots at the borders.

it is regional, not global, but they finish imaging a region and ...

2026-09-20T18:45:21Z

In reply to nevent1q…w3e2
_________________________

it is regional, not global, but they finish imaging a region and then release at the end. the size of the region can be anything from a city to a country, but with NL I'd expect at least something on the "state"-equivalent size.

they're done in generational batches, so it might be a while.

2026-09-20T18:41:53Z

In reply to nevent1q…ldtc
_________________________

they're done in generational batches, so it might be a while.

£9 fridge collected! shenanigans incoming.

2026-09-19T15:52:18Z

In reply to nevent1q…kfpj
_________________________

£9 fridge collected! shenanigans incoming.

someone should maintain a list of weird things 7zip can do that a ...

2026-09-19T02:20:17Z

someone should maintain a list of weird things 7zip can do that a lot of people likely don't realise it can do, like carve sections and headers out of PE/ELF executables, and (as I just learned) parse filesystems off raw disk device paths.

it can extract resources and sections from PE files (exe, dll, ...

2026-09-19T02:17:37Z

In reply to nevent1q…0ed7
_________________________

it can extract resources and sections from PE files (exe, dll, sys, etc.) too

when unsafe languages cause security debt, you're paying the ...

2026-09-18T20:50:22Z

when unsafe languages cause security debt, you're paying the use-after-fee

oof. had that happen in Norway, also with KLM actually, but that ...

2026-09-18T20:29:09Z

In reply to nevent1q…q7t5
_________________________

oof. had that happen in Norway, also with KLM actually, but that time it wasn't really their fault - the first leg of the flight was delayed and bags didn't make the transfer in Schiphol (I barely made it myself).

they did at least pay a taxi driver to send my bag 2 hours north of Oslo, which must've cost them as much as I paid for my flight.

didn't something exactly like this occur recently, with a ...

2026-09-18T20:04:09Z

In reply to nevent1q…fxga
_________________________

didn't something exactly like this occur recently, with a flight plan having two waypoints with the same name or something like that?

This is one of the better breach notifications I've gotten. I ...

2026-09-18T18:14:38Z

This is one of the better breach notifications I've gotten.

I also like how the description of the third party is dripping with contempt for the ridiculous level of nested third-party ownership.

natural log: ln(x) unnatural log: ...

2026-09-18T07:22:19Z

natural log: ln(x)

unnatural log: l̵͉̹̹̽̎͊n̷̯͍̘̗͌͋̊̔(x)

Nostr event nevent1qqsg5ujzgsl2jhpf89z6tjr945p9hnx0suny0gwtphphfesmnc5vflgzyzqgftkj0tcg7dye2zsglccz6s20ymjxe9hvyvznqpn5apap457zvtxak5t

2026-09-18T04:41:27Z

if I ever do drag my name will be Shelly Poppins

the CEO of OVH wrote "go fuck yourself" in the ticket ...

2026-09-16T22:27:13Z

In reply to nevent1q…0hdt
_________________________

the CEO of OVH wrote "go fuck yourself" in the ticket when I asked for my money back because they billed an extra month after I cancelled services. the day their DC burned down I laughed my ass off. couldn't happen to a clownier bunch of assclowns.

if it gouged your bed during the failure, I have heard others get ...

2026-09-14T18:55:46Z

In reply to nevent1q…jrfy
_________________________

if it gouged your bed during the failure, I have heard others get a replacement bed for free from their support.

ADHD is like C. you allocate everything in stacks or heaps, ...

2026-09-14T18:41:00Z

ADHD is like C. you allocate everything in stacks or heaps, memory pointer lifetimes are poorly controlled, and you've got dangling references all over the place.

oh sod off

2026-09-14T07:27:49Z

In reply to nevent1q…e6rl
_________________________

oh sod off

obviously I am aware that it was likely an intentional element ...

2026-09-14T07:15:52Z

In reply to nevent1q…n5up
_________________________

obviously I am aware that it was likely an intentional element you dope

ordered something off eBay and didn't notice the seller name ...

2026-09-14T06:12:28Z

ordered something off eBay and didn't notice the seller name until just now.

this is why you run your business name by local 13 year olds before committing to it.

RE: https://chaos.social/@gsuberland/117265726326698950 can't ...

2026-09-13T21:13:11Z

RE: https://chaos.social/@gsuberland/117265726326698950

can't recall if I've ever told the story of how I accidentally set a concert-grade confetti cannon off in my house. so here it is.

quoting
note1lle…0sts

I bought a couple of the payloads for a laugh 'cos they were on eBay for next to nothing. they were about 80mm in diameter, and at least 30cm long. charge in the base, electric ignition, and the body of them is absolutely packed with confetti. you would not believe how much you can pack into that volume when it's optimally folded.

I wanted to try one, so I ductaped it to a plank of wood, put it facing out the back door, and hooked it to a 12V 30A power supply.

I bought a couple of the payloads for a laugh 'cos they were ...

2026-09-13T20:56:22Z

In reply to nevent1q…436k
_________________________

I bought a couple of the payloads for a laugh 'cos they were on eBay for next to nothing. they were about 80mm in diameter, and at least 30cm long. charge in the base, electric ignition, and the body of them is absolutely packed with confetti. you would not believe how much you can pack into that volume when it's optimally folded.

I wanted to try one, so I ductaped it to a plank of wood, put it facing out the back door, and hooked it to a 12V 30A power supply.

it's up there with the time I accidentally fired a ...

2026-09-13T20:51:08Z

In reply to nevent1q…qwpv
_________________________

it's up there with the time I accidentally fired a concert-grade confetti cannon inside the house.

thank fuck they weren't the blue ones full of cobalt salts.

2026-09-13T20:47:11Z

In reply to nevent1q…kwj7
_________________________

thank fuck they weren't the blue ones full of cobalt salts.

it's worthy of being named. I was trying to empty out a box, ...

2026-09-13T20:46:40Z

In reply to nevent1q…6fsp
_________________________

it's worthy of being named. I was trying to empty out a box, it was tricky to hold it in the right place while also holding the big tub of desiccant, fumbled, and a few thousand tiny orange balls went careening across my desk and the floor and into every crevice. I'll probably still be finding them years from now.

no worries haha, I made the same omission with a design a few ...

2026-09-13T20:41:09Z

In reply to nevent1q…dwnv
_________________________

no worries haha, I made the same omission with a design a few months back and since then I am militant about putting emptying ports on desiccant holders.

I still keep finding desiccant beads around the house after The Incident.

bonus points: put a slot in the edge of the lip, then design a ...

2026-09-13T20:34:52Z

In reply to nevent1q…e2pj
_________________________

bonus points: put a slot in the edge of the lip, then design a funnel with a matching ridge that can slide into that lip and remain captive for easier filling.

e.g. this. lid slides under the lip. or could put the openings on ...

2026-09-13T20:31:58Z

In reply to nevent1q…m7cy
_________________________

e.g. this. lid slides under the lip.

or could put the openings on the outside edges instead - either works.

this also works great as a funnel fill port. I have the same on my AMS desiccant containers.