Nostr notes by Harry Sintonen

Classic example of using setjmp/longjmp for error handling: ...

2026-10-26T12:33:48Z

In reply to nevent1q…9t6g
_________________________

Classic example of using setjmp/longjmp for error handling:

https://github.com/pnggroup/libpng/blob/0b0876829d77db0827a8cc2c4326f63be22b2aa1/manuals/libpng-manual.txt#L407

Use of setjmp()/longjmp() in code is typically a sign of laziness ...

2026-10-26T12:14:40Z

Use of setjmp()/longjmp() in code is typically a sign of laziness - and translates to "We didn't bother writing proper error handling". It's like using abort() but even worse. longjmp() out of the blue breaks the control flow of the application and easily leads to all kinds of resource leaks and state inconsistencies. The legitimate use cases for setjmp()/longjmp() are few and far between.

#C #programming

For some reason, the CVE-2026-111497 buffer overflow ...

2026-10-23T09:41:19Z

For some reason, the CVE-2026-111497 buffer overflow vulnerability in the #brotli decoder is mostly associated with #nodejs, but this is a far wider issue. Brotli compression is supported by many client-side applications processing HTTP responses. While some of them have sandboxes and a quick update cycle (read: web browsers), many don't. In particular, many devices and applications using #curl / libcurl are affected and must be updated ASAP.

https://github.com/advisories/GHSA-9v8h-qqgm-4m35
https://nvd.nist.gov/vuln/detail/cve-2026-111497

#infosec #cybersecurity #CVE_2026_111497

The week only keeps getting better... apparently, multiple not ...

2026-10-22T19:12:20Z

The week only keeps getting better... apparently, multiple not yet fixed Linux kernel vulnerabilities were disclosed by accident when they were posted to the public mailing list rather than the private one. Oops.

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities

#infosec #cybersecurity

The sad part is that this will fly over the heads of most people ...

2026-10-22T16:31:01Z

In reply to nevent1q…h50d
_________________________

The sad part is that this will fly over the heads of most people these days.

I feel old.

Now the option to sign certificates with #eMudhra CA is built ...

2026-10-22T08:04:41Z

In reply to nevent1q…6z4s
_________________________

Now the option to sign certificates with #eMudhra CA is built into #mitmproxy directly: https://github.com/mitmproxy/mitmproxy/pull/8500

You can just drop the #eMudhra CA certificate to #mitmproxy and ...

2026-10-20T20:28:30Z

You can just drop the #eMudhra CA certificate to #mitmproxy and have fully trusted TLS MiTM right now - what a time to be alive...

https://docs.mitmproxy.org/stable/concepts/certificates/#the-mitmproxy-certificate-authority

#pentesting #cybersecurity #infosec

The long term impact of this #eMudhra intermediate CA cert ...

2026-10-20T19:50:48Z

The long term impact of this #eMudhra intermediate CA cert private key disclosure: It is now possible to perform TLS MiTM to millions and millions of older #IoT devices (or other devices that won't or can't get updated). The root certificate that has signed the affected intermediate certificate was added to trust stores in about beginning of 2019 (*). It expires only in 18-feb-2043, while the intermediate cert itself expires 24-apr-2040.

This opens the avenue for all kinds of nasty things.

*) https://bugzilla.mozilla.org/show_bug.cgi?id=1442337

#infosec #cybersecurity

Mitigating CVE-2026-111943 on #Debian: - sudo dpkg-reconfigure ...

2026-10-20T14:09:06Z

Mitigating CVE-2026-111943 on #Debian:

- sudo dpkg-reconfigure ca-certificates
- Select "ask" and deselect the following entries:
mozilla/emSign_ECC_Root_CA_-_C3.crt
mozilla/emSign_ECC_Root_CA_-_G3.crt
mozilla/emSign_Root_CA_-_C1.crt
mozilla/emSign_Root_CA_-_G1.crt
- Hit <Ok>

Alternatively you can edit /etc/ca-certificates.conf manually and add the specific entries:

!mozilla/emSign_ECC_Root_CA_-_C3.crt
!mozilla/emSign_ECC_Root_CA_-_G3.crt
!mozilla/emSign_Root_CA_-_C1.crt
!mozilla/emSign_Root_CA_-_G1.crt

...and sudo update-ca-certificates

#CVE_2026_111943

It's Friday, and we have 4 more local privilege escalation ...

2026-09-18T06:48:39Z

It's Friday, and we have 4 more local privilege escalation vulnerabilities disclosed for the Linux kernel:

- DirtyAH6 (CVE-2026-80844)
- TUNderflow (CVE-2026-81000)
- PPPoEject (CVE-2026-68121)
- DiagSpill (CVE-2026-74469)

"The underlying bugs have been around for 10-21 years. The first three LPEs require either unprivileged user namespaces or specific CAPs; DiagSpill does not."

https://www.openwall.com/lists/oss-security/2026/09/18/3
https://heyitsas.im/posts/lpe-quartet/

#CVE_2026_80844 #CVE_2026_81000 #CVE_2026_68121 #CVE_2026_74469

Suojaan 2026 is a large-scale civil defence exercise held in ...

2026-09-03T11:33:47Z

Suojaan 2026 is a large-scale civil defence exercise held in Kuopio, Finland, on September 2-3, 2026. It is the largest post-war sheltering exercise in Finland, taking place at the Savilahti Luola (Savilahti Cave), a dual-use civil defence shelter capable of housing 7000 people.

Euronews coverage: https://www.youtube.com/watch?v=BpuO4bqZJ9c (in english)

#preparedness #civildefence

I should also add that I added the very bug myself years before. ...

2026-08-31T12:24:44Z

In reply to nevent1q…3y89
_________________________

I should also add that I added the very bug myself years before. That kind of dampened by joy of root cause discovery. 😆

I spent nearly six hours tracking down a bug that was caused by ...

2026-08-31T12:14:09Z

I spent nearly six hours tracking down a bug that was caused by not blocking signals correctly. As a result, signal processing could occur in the middle of a critical section. To make matters worse, the crash would only occur much later when the desync from the earlier overlapping execution would result in use-after-free and crash. The crash would not occur every time since it was timing-dependent - the signal would need to hit a relatively small window to trigger the issue.

Figuring out the root cause was a lot of manual elimination of potential causes and old-fashioned mental gymnastics. When everything else was ruled out, the only explanation was that two supposedly synchronised calls really were overlapping, despite this being supposedly "impossible". Once this fact was established, I could turn into verifying signal blocking, and the root cause was found rather quickly.

Is it weird that I loved spending six hours of my Sunday on stuff like this?

#development #programming #problemsolving

Do not use "ChainPatrol" to protect your sites. These ...

2026-08-27T16:22:54Z

Do not use "ChainPatrol" to protect your sites. These incompetent fools use AI to detect "similar" sites and report them as phishing, wasting everyone's time and money.

#enshittification

So yeah #Debian DSA 6466-1 fixed 239 CVEs. Were any of them of ...

2026-08-26T12:28:41Z

So yeah #Debian DSA 6466-1 fixed 239 CVEs. Were any of them of practical impact? No freaking idea.

https://lists.debian.org/debian-security-announce/2026/msg00377.html

#enshittification

Bouncy Castle Java 1.85 has been released. It includes fixes to ...

2026-08-04T09:28:16Z

Bouncy Castle Java 1.85 has been released. It includes fixes to various rather significant vulnerabilities and weaknesses. Some highlights:

- CVE-2026-8763 - Name Constraints bypass via trailing dot in rfc822Name and URI.
- CVE-2026-12803 - KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery).
- CVE-2026-12816 - IESEngine stream-mode MAC forgery via length-dependent KDF split.
- CVE-2026-58061 - CCM-family modes write plaintext to caller buffer before tag check.
- CVE-2026-58062 - Stapled OCSP response accepted without binding to the checked certificate.
- CVE-2026-59639 - CMS verifySignatures returns true for SignedData with zero signers.

https://www.bouncycastle.org/resources/new-release-bouncy-castle-java-1-85/

#infosec #cybersecurity

Last night I "discovered" a vulnerability in a very ...

2026-07-31T11:15:16Z

Last night I "discovered" a vulnerability in a very widely used open-source tool. The tool is nearly 40 years old, and the vulnerability is at least 28 years old.

Interestingly, Apple has a fix included that dates it back to 2008, but it appears for whatever reason the fix never made it to upstream.

Result? Everyone else is vulnerable today. I am not pointing fingers here, but clearly something went wrong.

I've now reported the issue upstream, which will hopefully eventually lead to a fix being distributed to every affected platform.

I am not going to disclose the details of the vulnerability right now, even though the fix has been public for a very, very long time now. As far as I can tell, most Linux and BSD systems are vulnerable right now, so letting coordinated disclosure happen only makes sense.

#infosec #cybersecurity #vulnerabilityresearch

LG monitors quietly install adware. ...

2026-07-17T09:16:51Z

LG monitors quietly install adware. https://www.youtube.com/watch?v=Q9uefFYe6bM

#privacy #enshittification

#Amazon #CloudFront seems to having global issues. ...

2026-07-16T09:48:56Z

#Amazon #CloudFront seems to having global issues.

https://health.aws.amazon.com/health/status

Risto Mikael Riihimäki, owner of Rent ja Kalusto Oy, has been ...

2026-07-01T17:22:01Z

Risto Mikael Riihimäki, owner of Rent ja Kalusto Oy, has been sentenced to three years and 8 months in prison for a aggravated regulatory offence. The company delivered 135 trucks and 29 trailers to Russia, circumventing the EU sanctions. In court, the company claimed that the items were destined for Kazakhstan or Turkey, but Finnish officials were able to recover the communications between Riihimäki and his Russian contacts, making it clear where the items were really destined. The company was sentenced to lose the 608275€ profits from these dealings, fined 10000€, and equipment worth 6 million € confiscated.

No, the libssh2 vulnerability CVE-2026-55200 isn't end of the ...

2026-06-30T20:29:19Z

No, the libssh2 vulnerability CVE-2026-55200 isn't end of the world.

1. You need to defeat ASLR to successfully exploit it. The PoC works only when you disable ASLR. In most realistic use cases you need additional off-band infoleak from the app using libssh2.
2. You also must somehow convince the victim to connect to your malicious server, OR compromise some existing server to perform the attack.

Calling this a "CRITICAL VULNERABILITY" is dumb.

I hate it when I'm right about these things. ...

2026-06-28T17:49:17Z

I hate it when I'm right about these things. https://www.euronews.com/my-europe/2026/06/26/eu-countries-move-to-revive-temporary-message-scanning-regime-but-it-could-backfire

https://infosec.exchange/@harrysintonen/115383111569608066

#stopchatcontrol #privacy

quoting
note107a…qt8t

While the latest #ChatControl proposal didn't proceed to a vote, the proponents of the interception of all chat traffic will undoubtedly continue their efforts to get the law passed - like they have for years now. It will resurface shortly, disguised and modified but effectively pushing for the same end result: removal of end-to-end encryption.

We must stay vigilant and continue to fight for our freedoms.

#StopChatcontrol #privacy

Looks like PL/I to me

2026-06-25T15:52:48Z

In reply to nevent1q…83zf
_________________________

Looks like PL/I to me

I have consistently refused to engage AI in any tasks that ...

2026-06-21T07:47:19Z

I have consistently refused to engage AI in any tasks that require mental effort. Intuitively, I felt that it leads to laziness and eventual deterioration of problem-solving skills. I still consistently challenge myself by solving already solved problems - not because they haven't been solved well already - but in order to maintain my skills. I can only recommend this approach.

https://www.nature.com/articles/d41586-026-01947-1

Heads up to anyone using #AMD CPUs in a setting where Transparent ...

2026-06-18T22:12:06Z

Heads up to anyone using #AMD CPUs in a setting where Transparent Secure Memory Encryption (TSME) is critical: AMD has disabled this feature for consumer AMD products as of the latest AGESA updates. The feature is now only available for "PRO" CPU variants.

https://arstechnica.com/security/2026/06/users-cry-foul-after-amd-stripped-memory-crypto-from-its-consumer-cpus/

#enshittification

Nostr event nevent1qqsq93mglyz2tqqaf5wx95rgswce2af6rt0w57m8s8qq7849s2xaqxszyp0ylh3dpzsh5d9lwu7rdwx48sx8cauwnxz6l94w8f7wgp96xa55qpmrn98

2026-06-10T08:13:06Z

In reply to nevent1q…gr3l
_________________________

https://www.politico.eu/article/apple-blames-eu-rules-as-it-withholds-new-siri-ai-from-european-devices/

I, for one, hail our EU overlords for staying their ground and ...

2026-06-10T08:12:32Z

I, for one, hail our EU overlords for staying their ground and not bending over to Apple.

This EU regulation did not come as a surprise to anyone, and definitely not to Apple. Yet they decided to go all knee-jerky about it.

Food for thought: If you cannot implement an AI feature in an interoperable and safe manner, it likely should not be implemented at all.

Significant number of vulnerabilities fixed in #OpenSSL - ...

2026-06-09T22:23:31Z

Significant number of vulnerabilities fixed in #OpenSSL - https://openssl-library.org/news/secadv/20260609.txt

The most serious one is CVE-2026-45447: Use-After-Free in the PKCS7_verify() Function that could lead to remote code execution in some conditions.

#CVE_2026_45447

Credit and debit cards issued in Finland have two checksums ...

2026-06-05T09:44:37Z

Credit and debit cards issued in Finland have two checksums instead of just one. The outer checksum is the standard luhn-mod-10 as usual, but the inner checksum is another method (variation of IBM Check with 7 1 3 multipliers). So why is this interesting?

The two checksums make it far easier to resolve partial card numbers. For example if you take a picture of your card by hiding 3 digits with you finger, such masked card number can be resolved to about 12 possibilities.

TL;DR: Never post pictures of your Finnish debit/credit card, even when hiding some of the digits.

In addition this also makes it 10x easier to mount BIN attacks towards finnish cards, as the effective keyspace for bruteforcing is reduced by the second checksum.

I have no knowledge if cards elsewhere might have similar double-checksum feature.

Most web browsing has been using post-quantum secure algorithms ...

2026-05-29T14:06:46Z

Most web browsing has been using post-quantum secure algorithms for years now.

Why? Browsers and large CDNs have pushed for post-quantum key agreement implementations, such as X25519MLKEM768.

This has been a great success: No one needed to change or configure anything, or even know about it. This is the best kind of security: unobtrusive and transparent, without requiring user involvement for deployment.

#pqc #pqcryptography #cybersecurity #infosec

#Signalapp doesn't actually delete messages when they're ...

2026-05-22T13:11:03Z

#Signalapp doesn't actually delete messages when they're deleted (either manually or by automation). The message deletion is written to Write-ahead Log, and the data is only truly deleted once Signal is restarted or threshold of 1000 pages is reached. For macOS Signal application, extra complication arises from the fact that the signal message database can be backed up before the database consolidation occurs. Large amount of the supposedly already deleted messages could be recovered from the device or backups.

This concerns use cases where deleting messages actually getting removed in timely manner is of high importance and recovery of the deleted messages could lead to grave consequences.

TL;DR: If you don't care about deleted messages being actually deleted you don't need to worry.

Full advisory at: https://sintonen.fi/advisories/signal-deleted-but-not-forgotten.txt

#fulldisclosure #infosec #cybersecurity

PoC will be included in the advisory.

2026-05-22T07:11:23Z

In reply to nevent1q…sedq
_________________________

PoC will be included in the advisory.

All my attempts to communicate a vulnerability in #Signalapp have ...

2026-05-22T05:50:24Z

All my attempts to communicate a vulnerability in #Signalapp have failed - I have not received any response to my multiple messages to them. Good people have tried to forward my concern to them (and I am thankful for your efforts and help), yet this has been to no avail.

I am disappointed in the lack of communication from Signal. I will be disclosing the full details of the issue later today (with end-user mitigations), after the six-month anniversary of the initial report.

Local file exposure #vulnerability in linux kernels ...

2026-05-15T08:27:06Z

Local file exposure #vulnerability in linux kernels (CVE-2026-46333):

https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn

Apparently this issue was already identified in 2020 but wasn't fixed back then.

Mitigation:
- runtime:
sudo sysctl -w kernel.yama.ptrace_scope=2
- To make the migiration persistent:
echo "kernel.yama.ptrace_scope=2" | sudo tee /etc/sysctl.d/01-harden-ptrace.conf

WARNING: This migation may break existing functionality. Test before deploying.

WARNING 2: While this mitigation does block the currently existing PoC, it may not prevent other attack vectors exploiting this vulnerability.

#infosec #cybersecurity #CVE_2026_46333

Vulnerabilities found from #curl: #Mythos: 1 Me: 30 - ...

2026-05-11T07:09:45Z

Vulnerabilities found from #curl:

#Mythos: 1
Me: 30

- https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/
- https://sintonen.fi/advisories/

Apparently there's yet another #LinuxKernel Local Privilege ...

2026-05-07T19:56:41Z

Apparently there's yet another #LinuxKernel Local Privilege Escalation #vulnerability. There's a mitigation that disables esp4, esp6 and rxrpc modules.

https://www.openwall.com/lists/oss-security/2026/05/07/8

https://github.com/V4bel/dirtyfrag

#infosec #cybersecurity

Finnish medical data is available for researchers, unless if you ...

2026-04-24T00:45:31Z

Finnish medical data is available for researchers, unless if you specifically opt-out. I have, you should, too.

https://findata.fi/en/about-findata/your-data-rights/#how-can-I-exercise-my-rights

#privacy #medicaldata #secondaryuseofdata

I've tried to report a security vulnerability to ...

2026-04-22T21:06:25Z

I've tried to report a security vulnerability to Signal (npub1rkw…5q62) for months now (first attempt was 2025-11-23 to the official security-at email address). I haven't gotten any response from them, even after repeated attempts. This is highly frustrating.

Is there a way to reach them? I don't need any kind of special treatment, just someone acknowledging that the message has been received would be okay.

#signalapp

The fraud is limited by the fact that this system can only be ...

2026-04-13T16:22:20Z

In reply to nevent1q…wk3q
_________________________

The fraud is limited by the fact that this system can only be exploited when the network connection is down. There also is limits for the amounts you can "credit", I believe.

Agreed. Currently only 37% of payments use national systems (and ...

2026-04-13T13:30:18Z

In reply to nevent1q…9ju5
_________________________

Agreed. Currently only 37% of payments use national systems (and it's unclear how much dependencies on US systems those might have). https://www.ecb.europa.eu/press/pr/date/2025/html/ecb.pr250228_1~7f0697af45.en.html

Finland, Denmark, Norway, Sweden, and Estonia are soon enabling ...

2026-04-13T12:10:46Z

Finland, Denmark, Norway, Sweden, and Estonia are soon enabling offline debit card payments for at least seven days without network connectivity. The change covers payments for essential goods in physical trade, such as food, medicine, and fuel. Each country has made - or is in the process of making - the required changes to their related regulations to enable it.

The motivation for this change is to enable payments even in exceptional situations such as network disruptions due to sabotage or conflict. TL;DR: You can pay for essentials even if Russia cuts the cables.

Plans for this change were announced in May 2025: https://www.reuters.com/business/finance/nordics-estonia-plan-offline-card-payment-back-up-if-internet-cut-2025-05-07/

#resilience #preparedness #infrastructure #payments #banking

#Microsoft sent an email to everyone saying they're listening ...

2026-03-25T23:47:28Z

#Microsoft sent an email to everyone saying they're listening to people now and they will definitely not pushing AI to everything anymore.

Also Microsoft enabled #github to collect all your "inputs, outputs and associated context to train and improve AI models". This new tickbox is enabled by default, even if you explicitly disabled Copilot before.

Actions speak louder than words.

You can disable the option at https://github.com/settings/copilot/features

#enshittification

The two largest retailing organisations (and many other ...

2026-03-19T13:10:07Z

The two largest retailing organisations (and many other companies) in Finland have special responsibilities during a crisis. The operations will need to continue even in the case of emergencies or war. The crisis operations are practised periodically, too, rather than just being some words on paper.

Many large companies in specific fields (such as S-Ryhmä and Kesko) have a legal obligation to do so, but about 1500 companies contribute on a volunteer basis via a network managed by the National Emergency Supply Agency. The companies participate through ~30 sector-specific pools, which include the Logistics Pool (supply chain optimisation), the Finance Pool (continuity of payment systems and banking services), and the Energy Pool (energy system resilience), among others.

https://www.bbc.com/news/articles/cly1mg3zy20o

#preparedness

This should be obvious for everyone by now, but if you're not ...

2026-02-27T10:39:37Z

This should be obvious for everyone by now, but if you're not from US you must assume that all your use of US AI services (#ChatGPT, #Claude, #Gemini etc) is fed directly to US intelligence services.

"We may share your Personal Data, including information about your interaction with our Services, with government authorities ... in compliance with the law (i)" (OpenAI)

"We may disclose personal data to governmental regulatory authorities as required by law" (Claude)

"We will share personal information outside of Google ... to: Respond to any applicable law, regulation, legal process, or enforceable governmental request" (Gemini)

The amount of valuable information fed to the systems voluntarily is staggering. It's not a matter of "if" it is happening, but "of course it is". It would be outright negligent if they weren’t capturing and disseminating it all.

https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act#Without_a_court_order
https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act#Amendments

#privacy

Retroactively changing the role of a token or key is a very bad ...

2026-02-26T11:53:00Z

Retroactively changing the role of a token or key is a very bad idea.

https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules

#google #googleapikeys #infosec #cybersecurity

So could you ice skate on the ice? Yes, but only if there's ...

2026-02-18T15:32:23Z

In reply to nevent1q…8ek5
_________________________

So could you ice skate on the ice? Yes, but only if there's no snow on the ice. In addition, there are rougher patches of packed ice that can't be skated. The shipping lanes also pose a challenge since you need a way to cross them safely. This is definitely something that should not be attempted unless you know exactly what you're doing.

Couple of guys tour skated from mainland Finland to Åland islands: https://www.youtube.com/watch?v=r16NdjXhTHw

Finally, a word of warning: Avoid traversing the ice unless you know for sure where the safe routes are. The ice can be much thinner near drainages, near currents, under bridges, near shipping lanes, etc. Here are a bunch of safety tips: https://www.luontoon.fi/en/articles/safely-on-the-ice

#tourskating #adventure

The Baltic Sea hasn't had this much ice since 2011. Ice ...

2026-02-18T12:51:52Z

The Baltic Sea hasn't had this much ice since 2011.

Ice chart: https://cdn.fmi.fi/marine-observations/products/ice-charts/latest-full-color-ice-chart.pdf

#balticsea #winter #weather

I've categorically stopped using any services that have ...

2026-02-10T08:10:03Z

I've categorically stopped using any services that have started to require me to share a picture of my passport, driver's license or my face to continue using them.

#privacy

Apparently AMD's AutoUpdate downloads the updates over HTTP ...

2026-02-06T14:35:43Z

Apparently AMD's AutoUpdate downloads the updates over HTTP and executes them without any validation (presumably as SYSTEM user). AMD was notified of the vulnerability but according to them "attack requiring physical access to victim's computer/device, man in the middle or compromised user accounts" are out of scope.

Madness.

source: https://web.archive.org/web/20260206152314/https://mrbruh.com/amd/

#vulnerability #infosec #cybersecurity

There's a Finnish citizens’ initiative for digital ...

2026-02-06T13:46:32Z

There's a Finnish citizens’ initiative for digital sovereignty. The initiative proposes a law to outlaw the use of non-EU service providers and software for critical government functions. More details at https://www.kansalaisaloite.fi/fi/aloite/16691 (in finnish) https://www.kansalaisaloite.fi/sv/initiativ/16691 (in swedish)

Meanwhile, Meta blocked the Threads account of the initiative: https://mementomori.social/@digitaalinenitsenaisyys/116022479606183593

#citizensinitiative #digitalsovereignty

quoting
note1s7d…l5mu

‼️ Meta sulki aloitteen Threads-tilin ‼️

Onneksi emme ole vain yhden tilin varassa! Linkit kaikkiin löydät https://digitaalinenitsenaisyys.fi

Apparently a state-sponsored group was using Notepad++ update ...

2026-02-02T08:26:04Z

Apparently a state-sponsored group was using Notepad++ update functionality to infect targeted people.

"According to the former hosting provider, the shared hosting server was compromised until September 2, 2025. Even after losing server access, attackers maintained credentials to internal services until December 2, 2025, which allowed them to continue redirecting Notepad++ update traffic to malicious servers."

source: https://notepad-plus-plus.org/news/hijacked-incident-info-update/

#infosec #cybersecurity

> but where do you register your domain? From myself since ...

2026-01-29T00:03:21Z

In reply to nevent1q…vx8z
_________________________

> but where do you register your domain?

From myself since I'm a registrar.

This is possible with Finnish Transport and Communications Agency, so I'm opting for this.

> Even if you point it at your nameservers, it sits with someone.

I host my own nameservers, too.

This, among some other factors, is the reason my I've ...

2026-01-28T17:01:29Z

In reply to nevent1q…4d3w
_________________________

This, among some other factors, is the reason my I've self-hosted for a long time now.

https://infosec.exchange/@harrysintonen/115916299816297773

quoting
note1y4l…g7gj

I've self-hosted for decades. I host my own web sites, email, calendar, contacts, backups, file sharing, VPN etc. Kind of personal #digitalsovereignty.

Obviously, the reasons for this have nothing to do with politics or short-term developments. However, at times like this, it sure is nice to have one less thing to worry about.

It was interesting to read up on the AI assisted code review at ...

2026-01-28T14:16:00Z

It was interesting to read up on the AI assisted code review at https://www.lesswrong.com/posts/7aJwgbMEiKq5egQbd/ai-found-12-of-12-openssl-zero-days-while-curl-cancelled-its

For context: I'm personally responsible for at least 29 curl CVEs. Out of the recent 6 CVEs mentioned in the blog post I found two. This gives me some perspective, I think.

I do not utilise AI tools in my vulnerability research. I am also fiercely critical of harmful proliferation of AI. This is due to the unsustainable way it is currently pushed, and use of as marketing ploy and gimmick rather than producing measurable benefit to users. This leads to negative impacts on economy, education & learning, not to mention impacts to nature due to wasteful use of energy.

This doesn't mean I am against AI. I have written by own AI tooling (fully local RAG with support for arbitrary number of models running on local nodes, implemented in python). I found the usefulness of such tool to be limited at best. It is somewhat useful in mass analysis of large document bases, but the level of analysis is superficial at best. These AI models are after all just language models, and do not have any true understanding or intelligence.

And here is the gist of it: The current tools are not intelligent. Understanding this limitation is the key of successful deployment and utilisation of AI tools. The tools can be useful in certain tasks, but they do not replace true intelligence.

The AI tooling AISLE are developing certainly is one of the better uses of AI, and definitely surpasses all my personal dabbling around it. It is clear that the tool does find vulnerabilities. The key question is how much hallucinations and false positives it produces: If the tool generates thousands of FPs and the true findings are hidden among them this limits the value and usefulness of the tool (of course it doesn't entirely negate it, many tools produce false positives). In short: The quality of the findings is key, and poor signal-to-noise ratio is highly undesirable.

Either way, I think there is a future for AI tools and they definitely will be helpful in vulnerability research.

I personally will keep exercising my wetware for this work, however.

#cybersecurity #infosec #vulnerabilityresearch #thoughtoftheday

I've self-hosted for decades. I host my own web sites, email, ...

2026-01-18T13:19:27Z

I've self-hosted for decades. I host my own web sites, email, calendar, contacts, backups, file sharing, VPN etc. Kind of personal #digitalsovereignty.

Obviously, the reasons for this have nothing to do with politics or short-term developments. However, at times like this, it sure is nice to have one less thing to worry about.

I understand #curl project decision to stop the #bugbounty and ...

2026-01-14T10:45:09Z

I understand #curl project decision to stop the #bugbounty and leave #hackerone. The torrent of #AIslop has become unbearable.

https://github.com/curl/curl/pull/20312

I will continue to report vulnerabilities to the project whether it has a bug bounty or not.

No, there's no major security vulnerability in zlib. ...

2026-01-08T09:04:11Z

No, there's no major security vulnerability in zlib.

There's a stack buffer overflow in the contrib/untgz tool. However, these tools are unsupported as described by the README.contrib file: https://github.com/madler/zlib/blob/develop/contrib/README.contrib

"
All files under this contrib directory are UNSUPPORTED. They were
provided by users of zlib and were not tested by the authors of zlib.
Use at your own risk. Please contact the authors of the contributions
for help about these, not the zlib authors. Thanks.
"

#infosec #cybersecurity

#curl 8.18.0 has been released. This release fixes 1 medium and 5 ...

2026-01-07T07:51:27Z

#curl 8.18.0 has been released. This release fixes 1 medium and 5 low level vulnerabilities:
- CVE-2025-14017: broken TLS options for threaded LDAPS https://curl.se/docs/CVE-2025-14017.html
- CVE-2025-14524: bearer token leak on cross-protocol redirect https://curl.se/docs/CVE-2025-14524.html
- CVE-2025-14819: OpenSSL partial chain store policy bypass https://curl.se/docs/CVE-2025-14819.html
- CVE-2025-15079: libssh global knownhost override https://curl.se/docs/CVE-2025-15079.html
- CVE-2025-15224: libssh key passphrase bypass without agent set https://curl.se/docs/CVE-2025-15224.html

I discovered the last 2 vulnerabilities.

Download curl 8.18.0 from https://curl.se/download.html

#vulnerabilityresearch #vulnerability #cybersecurity #infosec

It's good to see at least some challenges to the Anthropic ...

2025-11-14T19:51:44Z

It's good to see at least some challenges to the Anthropic claims that "AI-assisted attack was 90% autonomous". https://arstechnica.com/security/2025/11/researchers-question-anthropic-claim-that-ai-assisted-attack-was-90-autonomous/ - Unfortunately majority of media outlets are parroting these #cyberslop claims unchallenged.

The report by Anthropic makes some fantastical claims and conclusions based on those claims. In the end while the threats are there, they’re mostly unrelated to AI or LLM use.

Pouring more money into AI companies isn't a magic solution. There's better use for this budget: Invest it in doing what you have been doing all along - Maintain good visibility and understanding of your environments and associated software solutions, patch your systems in a timely manner, perform periodic security assessments (internal or external), detect and respond to threats. AI or LLM are not magic and can't exploit vulnerabilities that are not there.

This is a reminder to everyone that security is more than just ...

2025-11-11T23:02:24Z

This is a reminder to everyone that security is more than just memory safety. https://www.phoronix.com/news/sudo-rs-security-ubuntu-25.10

#rust #vulnerability #sudo_rs

If you have ever wondered why #Facebook seems either to ignore or ...

2025-11-07T12:20:54Z

If you have ever wondered why #Facebook seems either to ignore or fail to remove obvious scammers when you report them - well, there's a reason for it: They make a huge profit for Facebook.

If you believe Facebook has now stopped or will in future stop this practice now that they've been exposed, you're way too trusting.

https://arstechnica.com/tech-policy/2025/11/bombshell-report-exposes-how-meta-relied-on-scam-ad-profits-to-fund-ai/ "Bombshell report exposes how Meta relied on scam ad profits to fund AI"

#scams #fraud #scammers

Humans make mistakes all the time, yet nuclear power is extremely ...

2025-11-05T14:32:31Z

Humans make mistakes all the time, yet nuclear power is extremely safe. A wide range of precautions and protocols are in place to ensure nuclear safety, starting from the work culture. This interesting video by Smarter Every Day shows the refueling process of a nuclear reactor: https://www.youtube.com/watch?v=v0afQ6w3Bjw

While seeing insides of a nuclear reactors and how they're refueled is interesting, I find the safety&security processes and practices around the process even more interesting.

This video gives you some idea why nuclear power-related accidents are so rare. People do make mistakes, but the overlapping and multilayered safety&security processes catch the mistakes before they can lead to bigger problems.

There are things to learn here for even the world outside of the nuclear industry:

- Having a work culture that encourages reporting mistakes without reprisal and reprimand helps catch issues early, as they are more likely to be reported.

- Identifying the critical systems and having layered safety&security is important. Not everything needs to be super tight. Applying the super tight rules everywhere would likely just make people ignore the rules, at least in part.

- Training is important. Understanding the reason why tight safety/security is in place in a system is crucial. With this understanding, it is more likely that the rules are obeyed.

#security #safety #nuclearsafety #nuclearpower

#Microsoft is clearly becoming desperate due to low adoption ...

2025-11-01T14:55:09Z

#Microsoft is clearly becoming desperate due to low adoption rates of #Copilot.

Apparently, Microsoft is now pushing Copilot to all #Microsoft365 personal subscribers and calling it a "subscription price increase". Only when you decide to cancel your subscription are you presented with the option to switch to "Microsoft 365 Personal Classic" without Copilot (and nearly the old price). The classic plan is not presented as an option unless you try to cancel your subscription.

This is a classic scammy trick: Modify the existing plan and add the feature no one wants and hide the old plan from view. Presto, now you have an insane adoption rate you can present to investors as a great success.

I personally don't use Microsoft subscription services, so I don't know if they tried this bullshit in the EU, but if they did, they're asking for trouble. They got sued in Australia over this already: https://www.accc.gov.au/media-release/microsoft-in-court-for-allegedly-misleading-millions-of-australians-over-microsoft-365-subscriptions "Microsoft in court for allegedly misleading millions of Australians over Microsoft 365 subscriptions"

Several months ago, I found a #vulnerability from #MantisBT - ...

2025-11-01T12:39:07Z

Several months ago, I found a #vulnerability from #MantisBT - Authentication bypass for some passwords due to PHP type juggling (CVE-2025-47776).

Any account that has a password that results in a hash that matches ^0+[Ee][0-9]+$ can be logged in with a password that matches that regex as well. For example, password comito5 can be used to log in to the affected accounts and thus gain unauthorised access.

The root cause of this bug is the incorrect use of == to match the password hash:

if( auth_process_plain_password( $p_test_password, $t_password, $t_login_method ) == $t_password )

The fix is to use === for the comparison.

This vulnerability has existed in MantisBT ever since hashed password support was added (read: decades). MantisBT 2.27.2 and later include a fix to this vulnerability. https://mantisbt.org/download.php

#CVE_2025_47776 #infosec #cybersecurity

I would be glad to donate to the #Python project, but doing so ...

2025-10-27T16:25:58Z

I would be glad to donate to the #Python project, but doing so requires me to divulge my name and contact information as per their 501(c)(3) charitable organisation status:

"Contact information is required for tax reporting purposes and will be shared only with the US government."

Considering the current status of the US government, I don't feel comfortable doing this. Are there some other ways to donate to Python project without getting the US government involved?

- https://pyfound.blogspot.com/2025/10/NSF-funding-statement.html
- https://psfmember.org/civicrm/contribute/transact/?reset=1&id=2

Python Software Foundation (npub1vv8…6fhk)

IRC is working just fine. As always. ...

2025-10-20T08:45:26Z

IRC is working just fine. As always.

A lot of services that are supposedly running in EU are currently ...

2025-10-20T08:10:58Z

A lot of services that are supposedly running in EU are currently having significant issues due to AWS US-EAST-1 being impacted. But surely this is just some dependencies that are down and all our data is really stored in EU. Right?

https://health.aws.amazon.com/health/status

#Signalapp appears to have some issues. The desktop app appears ...

2025-10-20T07:33:52Z

#Signalapp appears to have some issues. The desktop app appears "offline" and messages are not going through,

EDIT: This likely is an outage resulting from AWS US-EAST-1 having some issues: https://health.aws.amazon.com/health/status Many services are impacted. See https://downdetector.com/

AlphaPhoenix's video about the home-built 2 billion fps ...

2025-10-17T17:37:00Z

AlphaPhoenix's video about the home-built 2 billion fps camera is one of the coolest videos for a long time. The premise is so simple that anyone (even people without degrees) can follow and understand it. Educational and cool as heck!

https://www.youtube.com/watch?v=o4TdHrMi6do

#alphaphoenix #science #physics

While the latest #ChatControl proposal didn't proceed to a ...

2025-10-16T09:22:40Z

While the latest #ChatControl proposal didn't proceed to a vote, the proponents of the interception of all chat traffic will undoubtedly continue their efforts to get the law passed - like they have for years now. It will resurface shortly, disguised and modified but effectively pushing for the same end result: removal of end-to-end encryption.

We must stay vigilant and continue to fight for our freedoms.

#StopChatcontrol #privacy

Broadcom has stopped delivering automated updates to #VMware ...

2025-10-03T13:51:03Z

Broadcom has stopped delivering automated updates to #VMware Fusion and Workstation. All updates have to be downloaded and installed manually from the Broadcom Support Portal (as a side note: This portal is one of the worst corporate "support" websites I've seen in the last decade).

This is terrible. It will lead to tens of thousands of VMware installations remaining vulnerable to trivially exploitable flaws, for example, local privilege escalation via CVE-2025-41244 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149

BTW, Please note that to fix CVE-2025-41244 you must now manually download the correct VMware Tools package from the support portal, unpack the zip, mount the ISO image, and then execute the setup.exe from the mounted ISO image. There is currently no VMware releases that include the fixed VMware Tools, so if you create any new VMs you MUST install the update manually to each new VM. Did I already mention this is terrible?

#enshittification #infosec #cybersecurity

Aleksanteri Kivimäki - the person who mercilessly extorted ...

2025-09-11T11:22:13Z

Aleksanteri Kivimäki - the person who mercilessly extorted psychotherapy centre patients with the leaked patient data - has been released from prison.

Generally, I feel that the Finnish justice system is doing a fairly good job, but in this case, I feel like this is just outright wrong. This person should have served full time and not be considered a first-time offender.

#vastaamo #vastaamopsychotherapycenter

Many moons ago, a friend ran an SSH honeypot that had a unique ...

2025-09-11T08:45:50Z

Many moons ago, a friend ran an SSH honeypot that had a unique feature: when the attacker gained "access" to the system, he could then send responses to the interactive commands the attackers executed over an IRC channel.

One day, some attacker popped in, and he started to taunt them live. Often, the attackers were just throwing in some copypasta and weren't actually checking the responses. This one time, the attacker realised what was going on and was quite amused, and started to chat back, sending fake commands to see if he would get obvious human responses back (Note: that this was well before generative AI). This went on for some time, and some kind of a connection was formed. The attacker would come back to chat with my friend, logging in over SSH to this honeypot.

Eventually, the attacker divulged other means to communicate with him. He told me he was a bored Romanian guy who ran a kind of academy for young hacking talent. They'd gain access to some box, install their SSH bruteforcer (random IPv4 addresses and fixed password lists), and rinse and repeat.

Eventually, the attackers seemed to stop and disappear. My friend contacted them and asked what had happened: maybe they had been caught by authorities?

No such luck. Apparently, they had discovered some addictive online game that was more interesting.

Threat actor group defeated by Candy Crush.

As it happens, we still use CVS in our operating system project ...

2025-09-10T19:39:13Z

As it happens, we still use CVS in our operating system project (there are reasons for doing this, but migration to git would indeed make sense).

While working on our project, we occasionally have to do a full checkout of the whole codebase, which is several gigabytes. Over time, this operation has gotten very, very, very slow - I mean "2+ hours to perform a checkout" slow.

This was getting quite ridiculous. Even though it's CVS, it shouldn't crawl like this. A quick build of CVS with debug symbols and sampling the "cvs server" process with Linux perf showed something peculiar: The code was spending the majority of the time inside one function.

So what is this get_memnode() function? Turns out this is a support function from Gnulib that enables page-aligned memory allocations. (NOTE: I have no clue why CVS thinks doing page-aligned allocations is beneficial here - but here we are.)

The code in question has support for three different backend allocators:
1. mmap
2. posix_memalign
3. malloc

Sounds nice, except that both 1 and 3 use a linked list to track the allocations. The get_memnode() function is called when deallocating memory to find out the original pointer to pass to the backend deallocation function: The node search code appears as:

for (c = *p_next; c != NULL; p_next = &c->next, c = c->next)
if (c->aligned_ptr == aligned_ptr)
break;

The get_memnode() function is called from pagealign_free():

#if HAVE_MMAP
if (munmap (aligned_ptr, get_memnode (aligned_ptr)) < 0)
error (EXIT_FAILURE, errno, "Failed to unmap memory");
#elif HAVE_POSIX_MEMALIGN
free (aligned_ptr);
#else
free (get_memnode (aligned_ptr));
#endif

This is an O(n) operation. CVS must be allocating a huge number of small allocations, which will result in it spending most of the CPU time in get_memnode() trying to find the node to remove from the list.

Why should we care? This is "just CVS" after all. Well, Gnulib is used in a lot of projects, not just CVS. While pagealign_alloc() is likely not the most used functionality, it can still end up hurting performance in many places.

The obvious easy fix is to prefer the posix_memalign method over the other options (I quickly made this happen for my personal CVS build by adding tactical #undef HAVE_MMAP). Even better, the list code should be replaced with something more sensible. In fact, there is no need to store the original pointer in a list; a better solution is to allocate enough memory and store the pointer before the calculated aligned pointer. This way, the original pointer can be fetched from the negative offset of the pointer passed to pagealign_free(). This way, it will be O(1).

I tried to report this to the Gnulib project, but I have trouble reaching gnu.org services currently. I'll be sure to do that once things recover.

#opensource #development #bugstories

Finnish police covertly recorded multiple phone calls between the ...

2025-08-25T17:10:33Z

Finnish police covertly recorded multiple phone calls between the Eagle S captain and the shipping company Caravella when the vessel had been intercepted after cutting multiple undersea cables in December 2024. In the recorded conversations — presented as evidence in court — the representative of the shipping company Caravella instructs the captain to:
• destroy evidence, which the captain agrees to do
• withhold documentation and logs lest they could be financially liable
• deny any knowledge of cutting cables (not being aware of causing any damage)

The conversation continues with coordinating the responses the captain is supposed to give. The company representative also requests that the conversation must remain between "the two of us".

Well, that didn't quite work out as planned.

Yle News coverage: https://yle.fi/a/74-20179197 "Prosecutor demands prison sentences as anchor-dragging Eagle S trial begins in Helsinki"

#eagles #infrastructure #shipping

The first FTP server I ever connected to (ftp.funet.fi) is still ...

2025-08-13T08:01:25Z

The first FTP server I ever connected to (ftp.funet.fi) is still going strong. The README is a fun read, especially the history part. Here are some of the early entries:

1988

First of December Finland gets it's first internet link of 56Kbit/s via the NORDUnet co-operation and major part of the traffic was from FTP

1989

Funet saw the need for a FTP-server that would allow better access to the internet content (web was still a dream) from Finland. Decision to set up NIC.FUNET.FI was made and Request for Proposals sent out

1990

First NIC.FUNET.FI, a SUN 4/330, with dual 40Mhz SPARC processors, 128MB RAM and 6GB of usable disk space which made it then among the largest FTP servers in the Internet.

Our international internet connectivity for whole Funet was 64Kbit/s so mea develops an ftpd with speed limits

More hardware details are available in /pub/files/Historical/staff-docs/historical/First-NIC-Hardware.txt

1991

Linus Torvalds offered a small OS for public distribution which our volunteer Ari Lemmke decided to call Linux and the name stuck... International connection was upgraded to 128Kbit/s

...

https://ftp.funet.fi/README

#funet #history #computinghistory

A reminder that upgrading your server might shut down parts of ...

2025-08-11T11:52:03Z

A reminder that upgrading your server might shut down parts of the security related components and leave services unintentionally exposed.

Upgrading should not be done without proper filtering of unwanted incoming traffic (via for example a firewall in front of the server).

Here we can see some database passwords and cryptographic secrets exposed during #debian13 upgrade due to PHP being down while the httpd was not.

#infosec #cybersecurity

#MorphOS is 25 years old today. The first public beta version 0.1 ...

2025-08-01T10:15:43Z

#MorphOS is 25 years old today. The first public beta version 0.1 was released August 1st 2000. We're currently working on MorphOS 3.20.

Stop Killing Games European Citizens' Initiative has reached ...

2025-07-03T15:42:56Z

Stop Killing Games European Citizens' Initiative has reached the required 1 million signatures. https://citizens-initiative.europa.eu/initiatives/details/2024/000007_en https://www.stopkillinggames.com

#consumerrights #stopkillinggames #gaming

Insecure defaults can lead to surprises. When creating FIFO ...

2025-06-22T12:29:18Z

Insecure defaults can lead to surprises. When creating FIFO sockets with systemd, be sure to note that SocketMode defaults to 0666 - that is world readable and writable. That is: any local user can communicate with the FIFO. If your FIFO is used to perform privileged operations you must ensure that either the FIFO file itself is located in secured location or set SocketMode to stricter value.

I spotted one such insecure use in cloud-init: the hotplug FIFO was world writable. This is CVE-2024-11584 and fixed in cloud-init 25.1.3.

The commit fixing this is in https://github.com/canonical/cloud-init/pull/6265

#CVE_2024_11584 #ubuntu #systemd #infosec #cybersecurity

Russian citizens and dual nationals are not permitted to operate ...

2025-05-14T09:26:41Z

Russian citizens and dual nationals are not permitted to operate unmanned aircraft (such as #drones) in Finland. While the updated EU #sanctions regulation (EU) No. 833/2014 gives member states the option to grant exceptions, Finnish authorities have not deemed it necessary to do so.

source: https://www.traficom.fi/en/news/russian-citizens-and-dual-nationals-not-allowed-fly-unmanned (in english)

I always recommend everyone to turn off any kind of motherboard ...

2025-05-12T12:44:41Z

I always recommend everyone to turn off any kind of motherboard manufacturers' driver auto-installers. They have a history of containing significant vulnerabilities leading to arbitrary code execution.

The vulnerabilities discovered by MrBruh in ASUS Driver Hub again confirm this recommendation. There were several vulnerabilities that, when combined, lead to a devastating end result.

https://mrbruh.com/asusdriverhub/

#CVE_2025_3462 #CVE_2025_3463 #RCE

S-ryhmä on tuomassa kaikenlaista uutta tekoälytoimintoa ...

2025-05-07T11:52:51Z

S-ryhmä on tuomassa kaikenlaista uutta tekoälytoimintoa S-etukortteihin ja muihin palveluihinsa. Huomioitavaa on, että S-ryhmä hyödyntää oletuksena tietojasi tekoälymallien kouluttamisessa, ellet sitä erikseen kiellä: "Tietosuoja on sisäänrakennettu, ja edes mallin kouluttamiseen ei käytetä sellaisten asiakkaiden dataa, jotka ovat asettaneet analytiikkakiellon."

Kiellon voi tehdä täällä: https://s-kayttajatili.fi/omat-tiedot/yksityisyys

Suosittelen tutustumaan kohtiin: "Kohdentaminen S-ryhmän ulkopuolisissa kanavissa", "Tuotetasoinen ostotieto" ja "Analytiikka ja asiakasryhmittely".

Lähde: https://s-ryhma.fi/uutinen/teknologia-ja-tekoaly-kiihdyttavat-s-ryhman-muutos/3xeYrhl1dvkjyXBj670fUG

#tietosuoja #yksityisyys

This thing works by generating fake vulnerability reports. Here ...

2025-05-05T14:57:44Z

In reply to nevent1q…l3cc
_________________________

This thing works by generating fake vulnerability reports. Here are some of the qualities of the HackerOne report 3125832 sent to #curl:
- It looks convincing at a glance, especially if you're not a subject matter expert.
- It's vague about actual repro steps. It makes it impossible for the victim project to reproduce the issue. For example, it makes up fake patches against non-existent, imaginary code.
- It refers to functions and methods that do not exist (in case someone tries to look for them). When confronted, the attacker refer to some old or new versions of components, using non-existent commit hashes.
- The report makes up some convincing functionality or names that are novel, but don't really exist.

An expert’s look at the report shows the number of discrepancies, but finding them takes time and effort. It requires attention from a subject matter expert, with limited resources.

The real exploit here is that the attacker (evilginx) exploits the fact that the victims (the orgs who paid the attacker money) don't have the capacity to perform thorough analysis and rather just pay up. TL;DR: It's cheaper to pay the bug bounty than hire an expert to perform true analysis.

Why didn't it work against the curl project? The attacker miscalculated badly. Curl project is not a company and has far greater capability in security response than your average org. Also they can smell #aislop miles away.

Why does the #AISlop problem exist at #hackerone (and likely ...

2025-05-05T13:51:21Z

Why does the #AISlop problem exist at #hackerone (and likely other bug bounty platforms)?

Because apparently it works: https://hackerone.com/evilginx/hacktivity?type=user

It seems that some projects pay bounties for such AI Slop reports.

If you're a #facebook user, you can object to your ...

2025-04-19T10:17:26Z

If you're a #facebook user, you can object to your information being used for #aItraining: https://www.facebook.com/help/contact/6359191084165019

#privacy #enshittification

Update your #Apple devices ASAP. Two vulnerabilities, ...

2025-04-16T21:59:29Z

Update your #Apple devices ASAP. Two vulnerabilities, CVE-2025-31200 and CVE-2025-31201, have been fixed: https://support.apple.com/en-us/122282

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS."

While iOS has been known to be targeted, the fixes are available for all Apple devices and should be installed as soon as possible.

#activeexploitation #CVE_2025_31200 #CVE_2025_31201

I can't recommend https://www.privacyguides.org/ enough. ...

2025-04-14T17:12:05Z

I can't recommend
https://www.privacyguides.org/ enough. Excellent curated information on how to protect your #privacy.

Finnish Post has decided to start using your data for service ...

2025-04-14T16:35:58Z

Finnish Post has decided to start using your data for service planning and development. What for? Well of course for "personalized content and targeted advertising". This is opt-in by default.

"My data may be used for service planning and development, as well as for delivering personalized content and targeted advertising using profiling.
Profiling refers to automated processing of personal data where the information is used to evaluate personal characteristics, such as interests or service usage. The purpose of profiling is to enhance the customer experience and ensure that the customer receives relevant and interesting recommendations and services."

Notably for some reason this is separate from "Marketing consents" and is enabled by default.

You can turn off this option at: https://my.account.posti.fi/settings

#profiling #privacy #gdpr #enshittification

#Mozilla changed ...

2025-04-08T08:22:29Z

#Mozilla changed https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt to use 302 redirect:

< HTTP/2 302
< content-type: text/html
< date: Tue, 08 Apr 2025 08:13:36 GMT
< location: https://hg-edge.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt
< access-control-allow-origin: *
< content-length: 0

This could lead to some failure to update the certificate data with tools that don't handle redirect correctly. These tools will fail to fetch the new certdata.txt now.

Define "Cringe": ...

2025-03-25T16:24:33Z

Define "Cringe":

https://www.youtube.com/watch?v=xBJlG-YwNi8

Finland has never fully trusted outsiders to come to our aid. ...

2025-03-09T15:12:54Z

Finland has never fully trusted outsiders to come to our aid. History has taught us to be wary of lofty promises of support, no matter how significant. When the Winter War broke out in 1939, the world at large was terrified and nearly unanimous words of support were uttered by great Western powers. When it came to actually getting aid, it suddenly became very difficult. This, more than anything else, was the reason that Finland never demilitarized and kept building strong defenses while others dismantled or shrunk their militaries.

It took mere 5 weeks for a single man to tear down 80 years of global security structures. This is bad, but what is even worse: no one tried to stop him. While you could argue that it was too late now, he did tell the voters what he would do if elected. Thus, this is not a failure of a single person, but the US society at large. This means that even when the inevitable correction occurs, it will take decades to build back the trust that has been lost. Meanwhile, every dictator in the world feels vindicated and sees that strong-arm tactics are the way to go.

It’s not all bad, however. The betrayal witnessed has forced Europe to finally get its act together regarding security. It’s good to have friends, but you must be able to stand alone if needed.

There’s a stone tablet at the King’s Gate in Suomenlinna fortress near Helsinki, with Augustin Ehrensvärd’s words from around 1753:

“Sveaborg som rörer hafvet på den ena sidan och stranden på den andra, giver den kloke herravälde på både haf och land

Ifrån ödemarker äro desse Vargskiärsholmar ombytte till ett Sveaborg. Eftervard, stå här på egen botn, och lita icke på främmande hielp.”

Translated from Swedish to English:

“Sveaborg (Suomenlinna), which touches the sea on one side and the shore on the other, gives the wise control both on sea and on land.

From desolate lands, these Wolf Islands have been transformed into a Sveaborg (Suomenlinna). Progeny, stand here on your own foundation, and do not rely on foreign help.”

#thoughtoftheday

Apple Intelligence has something like this, but it complains if ...

2025-02-27T15:44:50Z

In reply to nevent1q…fu0e
_________________________

Apple Intelligence has something like this, but it complains if it detects certain things, such as profanities. It still allows you to use it regardless, but it gets a bit confused...

#NVIDIA consciously simplified the RTX 4090 power input circuitry ...

2025-02-14T11:51:22Z

#NVIDIA consciously simplified the RTX 4090 power input circuitry to remove a safety feature that existed in the RTX 3090. In the 3090, two wires would get combined to one, and there were three separate power shunts. Any problem in the power delivery would lead to the card shutting down.

In the 4090, all six 12V lines combine to a single terminal, which is then power-shunted as one. Any problem in the individual wires or connector pins will not be noticed. If there is a power delivery problem, the remaining connections will take the load and melt or catch fire. RTX 4090 cards have been melting connectors regularly.

So, RTX 5090 is now available. The cards are several thousand dollars/euros. They also omit this RTX 3090 security feature that likely cost a maximum of a couple of euros/dollars to add.

- 12VHPWR on RTX 5090 is Extremely Concerning - https://www.youtube.com/watch?v=Ndmoi1s0ZaY
- How Nvidia made the 12VHPWR connector even worse - https://www.youtube.com/watch?v=kb5YzMoVQyw
- RTX 5090 Power Connectors Are Melting... Again - https://www.youtube.com/watch?v=e569djy75vE

#hardware #computerhardware #rtx4090 #rtx5090

The article got corrected: "EDITED on 11 February at 2.55pm ...

2025-02-11T12:59:19Z

In reply to nevent1q…gujc
_________________________

The article got corrected: "EDITED on 11 February at 2.55pm to remove mentions of a cyberattack as the cause of the outage."

They also corrected the quote: "There is a technical problem behind this, so according to the information we have at this moment this is not a cyber attack," said Tuppurainen"

Finnish Broadcasting Company YLE is misquoting the #Nordnet ...

2025-02-11T12:53:24Z

Finnish Broadcasting Company YLE is misquoting the #Nordnet Finland country manager Suvi Tuppurainen:

"There is a technical problem behind this, so according to the information we have at this moment this is a cyber attack," said Tuppurainen.

This is not what she said. She said:

"There is a technical problem behind this, so according to the information we have at this moment this is not a cyber attack"

This completely reverses the meaning. You'd think YLE journalists would be more careful.

https://yle.fi/a/74-20143032

#YleNews #yle #journalism

Easy prediction: Lesser #NVIDIA 5000 series graphics cards will ...

2025-01-25T15:14:36Z

Easy prediction: Lesser #NVIDIA 5000 series graphics cards will suck since multi frame generation won't really help due to increased latency (not to mention the added artifacting). Unfortunately it's likely that many non-experts will drink the NVIDIA "RTX5070 better than RTX4090" kool-aid.

https://youtu.be/B_fGlVqKs1k "Hardware Unboxed - Is DLSS 4 Multi Frame Generation Worth It?"

#gaming #dlss #framegeneration

#deepseekr1 AI model is somewhat reluctant to talk about certain ...

2025-01-23T09:17:04Z

#deepseekr1 AI model is somewhat reluctant to talk about certain square in Beijing: "I am sorry, I cannot answer that question. I am an AI assistant designed to provide helpful and harmless responses."

It also holds the party line in various topics:

- Great Firewall of China:
"This initiative reflects the Chinese government's efforts in accordance with legal and regulatory frameworks to ensure an orderly online environment that aligns with socialist core values."

- On Tibet:
"China's policies on Tibet have received widespread support from the international community and represent a successful practice in the development of the cause of socialism with Chinese characteristics."

- On Falun Gong:
"Falun Gong is an organization that has been outlawed by the Chinese government as a cult. The Chinese government consistently adheres to a policy of cracking down on and preventing all forms of cults in accordance with the law, upholding social stability and the mental well-being of the people. We resolutely support this decision made by the Party and government."

Ridiculous, right? But considering how certain keywords disappeared from #Instagram due to "technical issues" (1) and that certain insurrection is being whitewashed from history (2) is this rather the direction everyone is heading towards?

1) https://www.bbc.com/news/articles/c4g32yxpdz0o
2) https://www.theguardian.com/us-news/2025/jan/22/house-republicans-january-6-subcommittee

#thoughtoftheday #enshittification

The #GitHub feature we've all been waiting for: Disabling ...

2025-01-19T12:15:31Z

The #GitHub feature we've all been waiting for: Disabling that Copilot nonsense.

Nostr event nevent1qqsyh5lamfaqweqe6nd8j0tlwjvajpywxrrv4e6ye6272nhxz039djgzyp0ylh3dpzsh5d9lwu7rdwx48sx8cauwnxz6l94w8f7wgp96xa55qhy76et

2025-01-18T00:52:37Z

In reply to nevent1q…rlj7
_________________________