Nostr notes by Jan Schaumann

Oh FFS. If you just patched /etc/ssl/cert.pem on all your macOS ...

2026-10-27T15:32:57Z

Oh FFS. If you just patched /etc/ssl/cert.pem on all your macOS endpoints, rejoice: the just landed Apple OS update to 26.7.2 / 27.2 will revert that for you and put the emSign and AAA roots back.

:facepalm: #emudhra

It's only Thursday, so this week stll has a few punches to ...

2026-10-22T14:58:22Z

It's only Thursday, so this week stll has a few punches to pack.

Apparently Trend Micro accidentally dropped 0-days into the public kernel list, including RCEs and LPEs, so yeah, cybersecurity awareness month is really nailing it this year.

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities

Certificate trust bundles contain several hundred trusted certs ...

2026-10-20T16:16:52Z

Certificate trust bundles contain several hundred trusted certs that all can sign any cert for any name they want.

Your system contains at least four different of these bundles used by different libraries and languages, while other frameworks hardcode their own.

Outside of the browsers, absolutely nobody checks CRLs, OCSP (stapled or not), or CT logs.

Selectively distrusting intermediates (as Go did) doesn't scale and is not practical for most deployments.

So yeah, happy Tuesday.

#emudhra

This is the first year that a lot of students rely on errno being ...

2026-10-17T21:19:03Z

This is the first year that a lot of students rely on errno being set instead of a library function's return value:

errno = 0;
func()
if (errno) {
error handling here
}

instead of

if ((n = func()) < 0) {
error handling here
}

What's up with that? Is AI somehow defaulting to errno checking instead of return values? Where is this trend coming from?

When I read that Anthropic source repository post with the ...

2026-10-14T14:35:13Z

When I read that Anthropic source repository post with the "every bottleneck we remove immediately leads to a further increase in the amount of code we produce" quote, I just think back to Ken Thompson's famous quote:

"One of my most productive days was throwing away 1,000 lines of code."

"More code" is not a metric of success.

"How To Write With An LLM" ...

2026-09-19T15:57:23Z

"How To Write With An LLM"

https://sockpuppet.org/blog/2026/09/17/how-to-write-with-an-llm/

A problem I see is that of course this way of writing is still work and takes time, care, and attention -- exactly what most people using an LLM here are seeking to avoid.

Those who _do_ put in this effort could likely do the same editing job without the LLM. You need to already be a strong writer to be able to follow his two rules.

As elsewhere, LLMs make it hard for you to get better at something you're not already good at.

Quick reminder: Models Don't Go Rogue ...

2026-09-19T01:18:43Z

Quick reminder: Models Don't Go Rogue

https://mail.cyberneticforests.com/models-dont-go-rogue/

(Now AI companies and their cultists on the other hand...)

I wasn't even going to post it here, because it's just a ...

2026-09-18T00:42:56Z

I wasn't even going to post it here, because it's just a rant that felt good to jot down, but since it's now been on the hackernews front page and shared elsewhere, it looks like it touched a nerve:

(Read the comments at your own risk. There's brain worms there, too.)

https://www.netmeister.org/blog/everybodys-lost-their-minds.html

Tee hee, HN stumbled upon my AI rant blog post and boy is that a ...

2026-09-17T21:01:55Z

Tee hee, HN stumbled upon my AI rant blog post and boy is that a different discussion from Lobsters. ✌️

Dear journalists: it's not "AI escaped", it's ...

2026-09-12T15:21:25Z

Dear journalists: it's not "AI escaped", it's "AI companies failed to restrict the programs". Programs that did exactly what they were instructed to do. By those companies.

Place the blame where it belongs.

Advanced Programming in the #UNIX Environment The objective of ...

2026-09-10T15:45:26Z

In reply to nevent1q…5a52
_________________________

Advanced Programming in the #UNIX Environment

The objective of this class is to learn and understand the interfaces, libraries and concepts we cover as well as to actually write code. This requires struggling with code, to work your way through your problems rather than copy together AI generated snippets and pasting errors into a prompt.

Below are my updated slides on the use of AI in this class, and this is our policy:

https://stevens.netmeister.org/631/use-of-ai.html

Advanced Programming in the #UNIX Environment Week 01, Segment ...

2026-09-08T22:39:06Z

In reply to nevent1q…w9em
_________________________

Advanced Programming in the #UNIX Environment

Week 01, Segment 01: Introduction

In this video lecture, we provide an introduction, discuss the purpose of the class, the syllabus, student expectations, as well as available resources.

Note: The videos in this series were mostly created in 2020. A few things have changed since then. Specifically, consult the course website for updates regarding the assignments.

https://youtu.be/BsB9Cg6yJc4

Feels like a Monday when you open the inbox and see "Linux ...

2026-09-08T13:11:10Z

Feels like a Monday when you open the inbox and see "Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more".

https://www.openwall.com/lists/oss-security/2026/09/08/1

Various exploits/PoCs here:
https://github.com/NebuSec/CyberMeowfia/tree/main/security-research

While I don't know how widespread the use of RDS is, it's the "and 20 more" that kills me. Pretty much assuming shell access == root access at this point.

Hey kids! It's the start of the Fall semester, and I'm ...

2026-09-02T19:44:37Z

Hey kids! It's the start of the Fall semester, and I'm again teaching "Advanced Programming in the UNIX Environment".

The syllabus and all course materials including all code examples are available here:
https://stevens.netmeister.org/631/

As usual, we'll be using #NetBSD as our main platform. All video lectures are public and available for free on YouTube:
https://www.youtube.com/playlist?list=PL0qfF8MrJ-jxMfirAdxDs9zIiBg2Wug0z

I'll be posting individual lecture videos and related links in this thread throughout the semester.

#programming #unix #apue

Incident: actively exploited CVE Service team: Not to worry. The ...

2026-08-14T20:16:33Z

Incident: actively exploited CVE

Service team: Not to worry. The EoL'd version we run is *much* older than that, so we're not affected. 🤡

Infosec: 🤦‍♂️

(This happens far too often.)

You're right - AI _is_ useful. Your use of it provides an ...

2026-08-10T15:43:18Z

You're right - AI _is_ useful. Your use of it provides an important signal to me:

1) For writing: "I didn't care to put the effort in to write this myself."

2) For coding: "I don't care if I understand the solution."

3) For vuln impact analysis: "I don't understand the code base nor the attack vector."

Or shorter: "I do not care about the details."

This, of course, on top of the other ethical problems with AI. It's a strong signal, and I see it everywhere.

‘“The world looks different now than when we co-founded the ...

2026-08-09T19:04:55Z

‘“The world looks different now than when we co-founded the climate pledge,” said Margaret Callahan, an Amazon spokeswoman.’

Yeah, no kidding. IT’S ON FUCKING FIRE because of soulless sacks of shit and the corporate bullshitters like you.

Climate pledge my ass.

https://www.nytimes.com/2026/08/08/climate/amazon-data-center-texas-pollution.html

Couldn't find the first occurrence to repost, but yes, AI ...

2026-08-08T13:46:33Z

Couldn't find the first occurrence to repost, but yes, AI companies trying to one-up each other by touting their incompetence to airgap their systems and chest-thumping their wantonly committing cybercrimes with no consequences is a vibe.

RE: https://mastodon.social/@nixCraft/116953574480188144 Lol, ...

2026-07-21T01:21:33Z

RE: https://mastodon.social/@nixCraft/116953574480188144

Lol, nice. I've said it before: linux kernel CVEs are no longer meaningful. You can't assess 432 new CVEs. You basically have to sit and wait to see which ones get a logo and a website or which ones become KEVs to prioritize.
nostr:note1pjgqew49u5lp3d4jclwxg2md0nhxduga7pt9vwa6avyr52jlde6shlu8k5

Brooks's Law of Software Engineering: Adding manpower to a ...

2026-07-18T13:57:50Z

Brooks's Law of Software Engineering:
Adding manpower to a late software project makes it later.

Jan's Corollary:
Adding AI to any software project prevents its completion.

Really looking forward to the first large-scale OpenAI / ...

2026-07-13T20:17:03Z

Really looking forward to the first large-scale OpenAI / Anthropic API outage, where 85% of the industry will be flopping around trying to remember how to hello-world on their own while execs google "how to write an email".

I keep seeing this purported screenshot of that Yahoo job posting ...

2026-06-28T20:01:01Z

I keep seeing this purported screenshot of that Yahoo job posting for a “Claude Code Expert” make the rounds, and I’m sorry to disappoint you, but unless anybody can produce the actual (archived) link, I’m gonna assume it’s fake rage bait.

Very successful rage bait, sure, but y’all should know better than to fall for it.

Slides from my #Troopers26 talk "Get in Loser, We're ...

2026-06-24T11:58:36Z

Slides from my #Troopers26 talk "Get in Loser, We're Upgrading the Internet -- Lessons from Deploying Post-Quantum Cryptography across Akamai's global Content Delivery Network"

https://www.netmeister.org/misc/troopers26.pdf

Watching Anthropic try to add "guardrails" to models to ...

2026-06-15T21:39:37Z

Watching Anthropic try to add "guardrails" to models to basically do "sploits for the good guys, but not for bad guys" seems like somewhere somebody needs to learn the lessons from the first round of the cryptowars.

You can't add or restrict capabilities in software based on who runs it.

I miss Web 1.0. You click a link, you get to the website, you ...

2026-06-15T13:47:36Z

I miss Web 1.0. You click a link, you get to the website, you read the content. What a concept.

June 12th: “Your Frontier Provider Is Quietly Limiting Your ...

2026-06-14T12:43:57Z

June 12th: “Your Frontier Provider Is Quietly Limiting Your Capability & Research” https://starseer.ai/blog/your-frontier-provider-is-quietly-limiting-your-capability-research

June 13th: “Irony: The US Government Issues an Export Control Directive for Fable 5 and Mythos 5” https://berryvilleiml.com/2026/06/13/irony-the-us-government-issues-an-export-control-directive-for-fable-5-and-mythos-5/

Turns out, it’s not such a great idea for the entire industry to joyfully jump into a deep dependency on pre-IPO hype machines.

New OpenSSL advisory: ...

2026-06-09T16:53:30Z

New OpenSSL advisory:
https://openssl-library.org/news/secadv/20260609.txt

1 high, 5 medium, 12 low severity

The high (CVE-2026-45447) was explicitly noted as discovered with help from Claude.

What's more interesting is again the confirmation that vulnerabilities are increasingly identified independently by multiple people:

CVE-2026-34182 (independently found by 4 different people), CVE-2026-35188 (2), CVE-2026-9076 (2), CVE-2026-34181 (2), CVE-2026-42766 (4).

So people are totally now using AI models for regular stuff that ...

2026-06-09T13:02:43Z

So people are totally now using AI models for regular stuff that you can do via shell scripts and cron, because why do something for free when you can burn tokens and at the same time actively forget how to use the normal tools at your disposal?

🤦 🙏 🤦

A spreadsheet is not a database. Thanks for coming to my TED ...

2026-05-29T18:03:00Z

A spreadsheet is not a database.

Thanks for coming to my TED talk.

Saw this fly by somewhere and I lol'd: CVE = Curriculum Vitae ...

2026-05-21T14:25:21Z

Saw this fly by somewhere and I lol'd:

CVE = Curriculum Vitae Enhancer

Now what the fresh fuck is this, then? Not today, Satan. ...

2026-05-21T02:44:54Z

Now what the fresh fuck is this, then?

Not today, Satan.

Remember to update your libc for the new AI errno(2) values that ...

2026-05-19T23:59:46Z

Remember to update your libc for the new AI errno(2) values that just dropped:

https://www.netmeister.org/blog/ai-errno.html

Ok, so this "v12 security team" is just dropping 0-days ...

2026-05-15T18:14:31Z

Ok, so this "v12 security team" is just dropping 0-days for kicks, huh?

"QEMUtiny", qemu escape via CXL:

https://github.com/v12-security/pocs/tree/main/qemu

(I'm tired, boss.)

#DirtyFrag status/advisories: AlmaLinux: ...

2026-05-08T18:45:08Z

#DirtyFrag status/advisories:

AlmaLinux:
https://almalinux.org/blog/2026-05-07-dirty-frag/

Debian:
https://security-tracker.debian.org/tracker/CVE-2026-43500
https://security-tracker.debian.org/tracker/CVE-2026-43284

Gentoo:
https://bugs.gentoo.org/974307

RedHat:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-43284
https://access.redhat.com/security/cve/cve-2026-43284
nothing yet on CVE-2026-43500

Rocky:
https://kb.ciq.com/article/rocky-linux/rl-dirty-frag-mitigation

SUSE / OpenSUSE:
https://www.suse.com/security/cve/CVE-2026-43500.html
https://www.suse.com/security/cve/CVE-2026-43284.html
https://www.suse.com/c/addressing-copy-fail2-aka-dirtyfrag-in-suse-virtualization/

Ubuntu:
https://ubuntu.com/security/CVE-2026-43284
https://ubuntu.com/security/CVE-2026-43500
https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available

AWS:
https://aws.amazon.com/security/security-bulletins/rss/2026-027-aws/
https://explore.alas.aws.amazon.com/CVE-2026-43284.html

Oh FFS. #DirtyFrag ...

2026-05-07T20:07:16Z

Oh FFS.

#DirtyFrag
https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md

"Because the embargo has now been broken, no patches or CVEs exist for these vulnerabilities."

https://www.openwall.com/lists/oss-security/2026/05/07/8

Well, just put that CopyFail incident work on rinse and repeat, I suppose...

Hah, just occurred to me that there's probably a number of ...

2026-05-04T20:48:31Z

Hah, just occurred to me that there's probably a number of folks who don't quite realize that the #copyfail PoC _actually modified_ the su(1) binary. That is, if you ran it _once_ to check, and then you applied mitigations, you still have a compromised /bin/su*.

Wonder how many systems end up left with that... 🤪

*Edit: Yes, until reboot.

Should have called this thread “The Claude Delusion”, huh?

2026-05-04T16:59:20Z

In reply to nevent1q…04eq
_________________________

Should have called this thread “The Claude Delusion”, huh?

slow clap to everybody out there doing Anthropic's ...

2026-04-13T14:38:58Z

*slow clap* to everybody out there doing Anthropic's Marketing Team's job for them. 🍿

"#Mythos discovers 27-year-old bug" is intentionally ...

2026-04-11T16:12:42Z

"#Mythos discovers 27-year-old bug" is intentionally conflating length of existence of a bug with difficulty of finding it. There is no such correlation.

If software projects and companies performed regular, ongoing, in-depth code audits over and over and missed it, sure, then age would be meaningful, but that is simply not what organizations do.

But sure, it makes for great headlines.

Starting to think the real risk is not AI replacing junior staff, ...

2026-03-18T17:19:48Z

Starting to think the real risk is not AI replacing junior staff, but senior staff quitting because they just can’t take this AI bullshit any longer and just opt for early retirement.

What idiot called it “agentic AI” when “Claude Computing” ...

2026-03-04T23:40:05Z

What idiot called it “agentic AI” when “Claude Computing” is right there?

(Bonus joke: There is no Claude, only other peoples’ content.)

"Never have, never will." Promise, shmomise. This is some ...

2026-02-27T15:27:59Z

"Never have, never will." Promise, shmomise.

This is some bullshit, Mozilla.

https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e#diff-a24e74e4595fa85440a2f4e7e5dcfe68aba6e1e593aef05a2d35581a91423847

And the explanation is bullshit, too, and sounds rather annoyed at having to explain to us silly users that *of course* you have to "share some data with our partners".

https://blog.mozilla.org/en/firefox/update-on-terms-of-use/

Tonight seems like a good time to remind folks that the next ...

2026-02-25T02:28:40Z

Tonight seems like a good time to remind folks that the next #nokings protest is planned for March 28th:

https://www.nokings.org/

Mark your calendars, I'll see you there! ✌️

#sotu #fucktrump

I still don't understand where people think Senior Engineers ...

2026-02-22T22:12:13Z

I still don't understand where people think Senior Engineers come from if they replace Junior Engineers with AI.

How do they think the next iteration of GIGO regurgitated code will be validated and debugged if nobody understands how the black box works?

Not wanting to understand but just wanting the quick answer is a clear trend and implicit outcome of frequent AI use.

To me, that's the real supply chain risk.

If you'd like to have a nice 🤦-y day like me, go ahead, ...

2026-02-03T16:33:45Z

If you'd like to have a nice 🤦-y day like me, go ahead, search your internal code repository for the following:

curl -k
wget --no-check-certificate
verify=false
InsecureSkipVerify: true
ssl_verify_mode: 0
TrustSelfSignedStrategy
rejectUnauthorized: false
strict-ssl = false
http.sslVerify = false
--no-verify-ssl
--insecure*
verify_hostname: 0

It'll be great.

Billionaires, man. Greedy motherfuckers. Brin is worth $266B. A ...

2026-02-01T17:41:37Z

Billionaires, man. Greedy motherfuckers.

Brin is worth $266B. A one-time 5% billionaire tax (with the money going to healthcare!) would mean he's left with... $242B. Which that year's rate of growth would trivially earn him back. But he just can't.

You can do a 99% one-time billionaire tax and he'd be left with *2.6 billion dollars.

https://www.nytimes.com/2026/01/28/us/politics/california-billionaires-sergey-brin-campaign.html

CA has maybe 200 billionaires in a population of ~40 million. Talk about the richest 0.0005%. Greedy motherfuckers.

NoFX pops out of retirement to say #fuckICE 🤘: ...

2026-01-29T12:51:21Z

NoFX pops out of retirement to say #fuckICE 🤘:

https://www.youtube.com/watch?v=sU6s6VEJxrU

And this is why he's The Boss. "Here in our home they ...

2026-01-29T01:54:22Z

And this is why he's The Boss.

"Here in our home they killed and roamed
In the winter of ’26
We’ll take our stand for this land
And the stranger in our midst
We’ll remember the names of those who died
On the streets of Minneapolis"

https://www.youtube.com/watch?v=wWKSoxG1K7w

OpenSSL Security Advisory ...

2026-01-27T18:27:05Z

OpenSSL Security Advisory

https://openssl-library.org/news/secadv/20260127.txt

One high, one medium, and 9 low severity issues.

The high severity is a stack buffer overflow in CMS AuthEnvelopedData parsing (CVE-2025-15467): attacker provides an oversized IV, leading to buffer overflow prior to authentication, possibly leading to remote code execution if you're parsing untrusted CMS or PKCS#7 content with AEAD (e.g., AES-GCM).

Here #curl is again showing the way in Open Source, this time ...

2026-01-23T17:27:47Z

Here #curl is again showing the way in Open Source, this time with vulnerability management. Per their well-known/security.txt:

With TikTok now going to be owned by Larry Ellison and Emerati ...

2026-01-23T16:22:40Z

With TikTok now going to be owned by Larry Ellison and Emerati MGX/G42, the concerns about it being used as a government propaganda machine really are totally put to rest. Phew!

(My hope remains that this move will ruin the product and the kids will move on.)

Everybody walking past Trump Tower be like… #fuckICE ...

2026-01-11T19:07:23Z

Everybody walking past Trump Tower be like…

#fuckICE #iceoutforgood #fucktrump

Quotable as ever, here's @npub1fdr…lvhs on code as ...

2026-01-06T16:23:34Z

Quotable as ever, here's Cory Doctorow (npub1fdr…lvhs) on code as liability and that having AI produce more code faster is simply tech debt at scale:

https://pluralistic.net/2026/01/06/1000x-liability/#graceful-failure-modes

"The longer a computer system has been running, the more tech debt it represents. The more important the system is, the harder it is to bring down and completely redo."

"Writing code that works, without consideration of how it will fail, is a recipe for catastrophe. It is a way to create tech debt at scale."

Completely different topic, so ripping this quote out of the ...

2026-01-05T16:39:57Z

Completely different topic, so ripping this quote out of the context from the article I just boosted:

"I wonder how much Venezuelan sensitive information was in fact stored on Google/Microsoft services and accessed by the US military to prepare their recent strike."

This is indeed a pretty interesting question to ponder. And if you're, say, Greenland, maybe consider your use of US cloud services...

He was covered in cables, from head to his foot, patched 'em ...

2025-12-24T17:27:08Z

In reply to nevent1q…ysnq
_________________________

He was covered in cables, from head to his foot,
patched 'em in switchports, he doubled throughput!
He opened his laptop, his terminal: no hype.
No Electron, no XCode, only in 'vi' did he type.

His code -- so readable! His Makefiles how clean!
His scripts were well structured, his includes pristine!
His CFLAGS? Warn 'all', warn 'extra', be extra pedantic
Turn warnings to errors, it's almost romantic!

The zombie processes with their parent now killed were reaped by ...

2025-12-24T17:26:05Z

In reply to nevent1q…ckuf
_________________________

The zombie processes with their parent now killed
were reaped by init(8), as Ken Thompson willed;
So out of the process table they flew,
freeing up cycles and memory space, too.

And then, in a twinkling, the tcpdumps showed,
with buffer caches flushed, connections now flowed!
As I mirrored the ports and tailed the log file,
I heard St. Root run down the hot aisle.

With a little old hacker, so focused, resolute, I knew in a ...

2025-12-24T17:24:58Z

In reply to nevent1q…d35l
_________________________

With a little old hacker, so focused, resolute,
I knew in a moment it must be St. Root.
More rapidly typed spells I've never seen
And he whistled, and shouted, and cursed at the screen:

"Ugh, DOCKER! Now, TRACEROUTE! Now, KTRACE and TRUSS!
On, PYTHON! On PERL! No RUBY or RUST!
Process loops fork! I'll have to killall(1)!
Now bash - away! bash away! Warn users with wall(1)!"

When out of the machine room there arose such a clatter, I sprang ...

2025-12-24T17:23:36Z

In reply to nevent1q…0g25
_________________________

When out of the machine room there arose such a clatter,
I sprang from my bean bag to see what was the matter.
Away to the laptop I flew like a flash,
logged into the jumpbox, starting my bash,

The lights on the servers blinking all red
Gave the lustre of multiple threads all locked dead
When, what to my wondering eyes should appear,
But a banged up crash cart, with eight cans of beer

'Twas the night of the moratorium, and all through the cloud ...

2025-12-24T17:22:19Z

'Twas the night of the moratorium, and all through the cloud
not a pager was beeping: no deploys were allowed.
The packages frozen on the servers with care,
In hopes that an outage would strike nowhere;

The developers still pondering code to embed,
While visions of monads danced in their heads.
The VM put to sleep, and I in this app,
Had just settled down for a long masto thread,

If you just updated React / NextJS for #react2shell , you now get ...

2025-12-11T21:29:25Z

In reply to nevent1q…jexn
_________________________

If you just updated React / NextJS for #react2shell , you now get to update again. Two additional vulnerabilities identified in follow-up work were just published: CVE-2025-55183 (DoS), CVE-2025-55184 (Source Code Exposure)

https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

https://nextjs.org/blog/security-update-2025-12-11

Here's another funny generational divide: students no longer ...

2025-12-05T21:47:36Z

Here's another funny generational divide: students no longer understand public_html directories and /~user/ URLs because apparently nowadays shared fileserver access is no longer a thing.

Smh, fist, yells at cloud.

Yesterday, after various bogus AI slopped "PoC"s, ...

2025-12-05T15:16:18Z

In reply to nevent1q…ud4q
_________________________

Yesterday, after various bogus AI slopped "PoC"s, eventually a functional PoC for the React RCE emerged:
https://github.com/msanft/CVE-2025-55182

We now have a PoC from the reporter of the vulnerability as well:
https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc

#react2shell

"We did a number of refactors [...] This also fixes a ...

2025-12-03T15:55:53Z

"We did a number of refactors [...] This also fixes a critical security vulnerability." 👀

CVE-2025-55182, an RCE in React Server Components just landed:

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Enjoy your patching, and make sure to check your bundled frameworks and dependencies.

Here's the commit:
https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700

Nostr event nevent1qqsgj8c46pw4rcnk4980utr072dj3qec4xy5ckjxzhva2gcu4x42e7qzyqtt8fueq38zgz4fh8yf5lgk3vxj09uakcczrmhpz47d00qvd285w6mrdps

2025-11-29T17:00:49Z

What comes first?

Trump literally demolishing the White House may just be too much ...

2025-10-22T01:59:50Z

Trump literally demolishing the White House may just be too much symbolism for me.

Over the last few months, I've repeatedly had people tell me ...

2025-09-26T01:55:28Z

Over the last few months, I've repeatedly had people tell me about how "well, the Military will refuse an illegal order", to which I can only gesticulate in a bewildered manner in the direction of at least 17 dead from the Venezuelan boats they happily blew up, why not.

And the third one barely made any headlines. Jfc.

Re-posting due to current events. The secret language of coders, ...

2025-09-08T17:35:03Z

Re-posting due to current events.

The secret language of coders, part N of many. Today: "npm"

https://xkcd.com/2347/ recursion ...

2025-08-27T19:44:21Z

https://xkcd.com/2347/ recursion

The problem with dogfooding is if it tastes like dogfood, I ...

2025-07-31T15:45:28Z

The problem with dogfooding is if it tastes like dogfood, I don't wanna eat it.

Ugh, here we go. People in the U.S. will get sicker more often, ...

2025-06-26T22:33:50Z

Ugh, here we go. People in the U.S. will get sicker more often, overall health and average life expectancy (US currently ranks 48th or so) will further decline. But because that impact will individually be subtle and compound only over years, the idiot population won’t make the connection.

Next on the chopping block: MMR vaccines. So yeah, young kids and infants are actually going to die. USA, USA.

https://www.nytimes.com/2025/06/26/health/rfk-jr-vaccines-acip-cdc.html

At Akamai, we're launching a blog post series on various ...

2025-06-18T16:13:22Z

At Akamai, we're launching a blog post series on various topics relating to post-quantum cryptography. The first post is by rsalz (npub18zc…4p69), discussing some related IETF initiatives, including the two #TLS drafts he co-authored:

https://www.akamai.com/blog/trends/building-quantum-safe-internet-ietf-plan-tls

#pqc

New blog post! Bootstrapping HTTP/1.1, HTTP/2, and HTTP/3 -- ...

2025-05-29T02:56:00Z

New blog post! Bootstrapping HTTP/1.1, HTTP/2, and HTTP/3 -- redirects, HSTS, Alt-Svc, ALPN, HTTPS DNS records, oh my.

https://www.netmeister.org/blog/http-123.html

CVE-2025-4575: Low severity OpenSSL (3.5 only) vulnerability in ...

2025-05-22T15:28:55Z

CVE-2025-4575: Low severity OpenSSL (3.5 only) vulnerability in openssl x509 (marking certs as trusted when asked to reject them): https://openssl-library.org/news/secadv/20250522.txt

Unlikely to have a big impact, but it's funny since this is a case of the tool doing the literal opposite of what it's asked to do. :-)

Pffft spits coffee all over keyboard So apparently on #Linux, ...

2025-05-13T18:04:45Z

Pffft *spits coffee all over keyboard*

So apparently on #Linux, usernames starting with "0x" are interpreted as hex numbers under certain circumstances. 🤪 That seems like asking for trouble...

I know "X will ruin learning" has been said for every new ...

2025-05-11T15:21:10Z

In reply to nevent1q…mkam
_________________________

I know "X will ruin learning" has been said for every new technology from Wikipedia back to books, but over the last 20 years of teaching, I've definitely observed a regression in students' independent learning ability, while simultaneously seeing an increased aversion to seek help. Students believe answers must be found online via Stackoverflow, Google, and now AI, but also think they are expected to provide complete answers, when often I'm looking much more for _how_ they got their answer.

Students not merely cheating with, but utterly relying on AI in ...

2025-05-11T15:12:03Z

Students not merely cheating with, but utterly relying on AI in "a society that treats schooling as [nothing more than] a means to a high-paying job" is deeply concerning as AI may actually make you dumber:

"research shows that when students off-load cognitive duties onto chatbots, their capacity for memory, problem-solving, and creativity could suffer. Multiple studies published within the past year have linked AI usage with a deterioration in critical-thinking skills"

https://www.msn.com/en-us/news/technology/everyone-is-cheating-their-way-through-college/ar-AA1EjCRk

German President Steinmeier's speech commemorating the 80th ...

2025-05-09T13:37:20Z

German President Steinmeier's speech commemorating the 80th anniversary of the end of World War II:

https://www.bundespraesident.de/SharedDocs/Reden/EN/Frank-Walter-Steinmeier/Reden/2025/250508-End-WWII.html

You want to read the whole thing, but the part below and the emphasis on the importance of learning from the past instead of describing it as a "cult of guilt" were powerful and eloquent. No words were minced, and we need more of that.

I'm both so very thankful that ...

2025-04-28T15:11:29Z

I'm both so very thankful that https://github.com/lwthiker/curl-impersonate exists and simultaneously hate that I need it.

The web should be the web should be the web no matter what client you use to access it.

Oh, ok, Yahoo. That's interesting. I have another idea: fuck ...

2025-04-09T21:11:38Z

Oh, ok, Yahoo. That's interesting. I have another idea: fuck you.

Hey Brian, just wanted to say how much I appreciate your speaking ...

2025-03-31T17:21:45Z

In reply to nevent1q…7kvh
_________________________

Hey Brian, just wanted to say how much I appreciate your speaking out against the active, ongoing destruction of democracy in the US. For every boneheaded “I came for cybersecurity, you should be apolitical” reply know there are dozens if not hundreds who hear and value your voice and courage.

So I'm curious about something. Boost for reach? You are a ...

2025-03-19T18:23:36Z

So I'm curious about something. Boost for reach?

You are a dual US / Other citizen with international travel booked in the near future.

You are ___ sure you will be able to re-enter the US without any problems:

The secret language of coders, part N of many. Today: security ...

2025-03-18T01:20:10Z

In reply to nevent1q…kdz4
_________________________

The secret language of coders, part N of many. Today: security vendor vulnerability announcement phrases.

An interesting recap of how the #Plan9 OS developed at Bell Labs, ...

2025-03-16T16:43:09Z

An interesting recap of how the #Plan9 OS developed at Bell Labs, with many familiar names, including, of course, Ken Thompson, Dennis Ritchie, Rob Pike, and many others, making appearances.

"What I Saw at the Evolution of Plan 9" by Geoff Collyer

https://adi.onl/oral.pdf

#unix

NIST selects HQC (Hamming Quasi-Cyclic -- https://pqc-hqc.org/) ...

2025-03-11T14:09:59Z

NIST selects HQC (Hamming Quasi-Cyclic -- https://pqc-hqc.org/) for standardization as the second #PQC key-encapsulation mechanism after ML-KEM.

But no rush, "the final version will be published in approximately two years".

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/w-6RREtb7-c/m/vRjBJE3dAAAJ

https://nvlpubs.nist.gov/nistpubs/ir/2025/NIST.IR.8545.pdf

If you haven't followed the Mahmoud Khalil story, you should. ...

2025-03-11T03:05:51Z

If you haven't followed the Mahmoud Khalil story, you should.

"The nearly 13 million green card holders in the United States — not to mention foreign students and professors — have been put on notice that they need to watch what they say. [...] Nor can citizens rest easy; a government this willing to disregard the First Amendment is a danger to us all."

https://www.nytimes.com/2025/03/10/opinion/mahmoud-khalil-free-speech.html?unlocked_article_code=1.3E4.lFik.M0JJqcxbLOxG&smid=url-share

The search on https://www.nih.gov/ will not show any results if ...

2025-03-08T18:58:36Z

The search on https://www.nih.gov/ will not show any results if you search for these (standalone) words:

- diversity
- equity
- inclusion
- DEI
- DEIA
- gender
- transgender
- nonbinary
- non-binary
- racism

Instead, it redirects you back to the home page.

But because there's also always incompetence in addition to malice, just putting the term in quotes or adding another word _does_ give you results. (Although perhaps that's resistance by those forced to implement the censorship?)

Tonight might be a particularly good time for Americans to donate ...

2025-03-04T03:39:15Z

Tonight might be a particularly good time for Americans to donate to the #Ukraine - I just did and hope you will, too.

https://u24.gov.ua/ makes it easy and lets you choose where you want your money to go to.

#SlavaUkraini & #FuckTrump

While y'all are having fun with nih.gov's name servers, ...

2025-03-02T02:01:41Z

While y'all are having fun with nih.gov's name servers, quick reminder that here's a quick little tool to run a query against multiple public resolvers to see what they see:

https://github.com/jschauma/puddy

(I also have a web interface for puddy, but don't want to mastodos my server. It's linked from GitHub, if you insist. :-)

cc Michał "rysiek" Woźniak · 🇺🇦 (npub1afm…5gp4)

Today in "#systemd ruins everything", Jan learns that ...

2025-02-27T16:25:50Z

In reply to nevent1q…z7ra
_________________________

Today in "#systemd ruins everything", Jan learns that systemd-resolve...

- runs a proxy DNS server on 127.0.0.53 (which is in /etc/resolv.conf)
- uses it's own /run/systemd/resolve/resolv.conf
- will read and cache /etc/hosts regardless of what /etc/nsswitch.conf says (`ReadEtcHosts` defaults to `yes` in /etc/systemd/resolved.conf)

Applications that follow traditional libc resolver logic now will continue to get /etc/hosts results even if /etc/nsswitch.conf excludes 'files'.

🤦‍♂️

Wait, what? By using #Firefox, I now grant Mozilla "a ...

2025-02-26T22:35:25Z

Wait, what? By using #Firefox, I now grant Mozilla "a nonexclusive, royalty-free, worldwide license to use" any data I "upload or input"? That seems, uhm, rather broad. Wtf.

I want my old Mozilla back.

https://www.mozilla.org/en-US/about/legal/terms/firefox/

Mark your calendars, nerds! Nationwide "Stand Up for ...

2025-02-26T03:53:26Z

Mark your calendars, nerds! Nationwide "Stand Up for Science" rallies to protest Trump's attacks on science and common sense are scheduled for March 7th.

Find your local event here:

https://standupforscience2025.org/

#standupforscience #fcktrmp

1) Thanks a lot for your always thorough and insightful analysis. ...

2025-02-23T16:02:08Z

In reply to nevent1q…qlnf
_________________________

1) Thanks a lot for your always thorough and insightful analysis. I really appreciate your work! (Long overdue.)

Less important, but FYI
2) The link “something like this has already happened” goes to https://berthub.eu/articles/posts/servers-in-the-eu-eigen-sleutels-helpt-het/#wat-als-er-ruzie-is, which 404s.

I know it's one part "let's get folks riled up" ...

2025-02-20T01:41:32Z

I know it's one part "let's get folks riled up" but it's also two parts "haha, only serious", and I'm not going to link to it, but when Trump tells the world he sees himself as King, not President, people need to fucking believe it.

Every single representative or senator needs to take this seriously and distance themselves explicitly. Anything less needs to be reported as betraying Democracy itself.

Scenes from the “No Kings On Presidents’ Day” protest in ...

2025-02-17T19:03:48Z

Scenes from the “No Kings On Presidents’ Day” protest in Union Square just now.

Fuck Trump. Fuck Musk. And fuck the entire cowardly Republican Party.

#NotMyPresident #nyc

FYI: I have made public new #NetBSD AMIs for #AWS #ec2. These are ...

2025-02-16T20:58:56Z

FYI: I have made public new #NetBSD AMIs for #AWS #ec2. These are evbarm and amd64 images for NetBSD/10.1 and now have their boot messages sent to the serial console (although it takes EC2 about 5-8 minutes from instance creation until `aws ec2 get-console-output` shows the messages).

These AMIs should be public and ready for you to launch in us-east-1a:

https://stevens.netmeister.org/615/netbsd-amis.html

TIL: On Ubuntu, AppArmor restricts tcpdump from reading files ...

2025-02-13T16:17:31Z

In reply to nevent1q…n34r
_________________________

TIL: On Ubuntu, AppArmor restricts tcpdump from reading files that don't end in ".pcap". 🤦‍♂️

$ ls -l /tmp/out
-rw------- 1 tcpdump tcpdump 13651 Feb 13 15:49 /tmp/out
$ sudo tcpdump -n -r /tmp/out
tcpdump: /tmp/out: Permission denied
$ sudo mv /tmp/out /tmp/out.pcap
$ sudo tcpdump -n -r /tmp/out.pcap
reading from file /tmp/out.pcap, link-type EN10MB (Ethernet), snapshot length 262144
[...]

Why are people trying so hard to make "file extensions" happen?

Not that it surprises me, but the "National Cybersecurity ...

2025-02-04T15:36:36Z

Not that it surprises me, but the "National Cybersecurity Strategy" has disappeared:
https://www.whitehouse.gov/oncd/national-cybersecurity-strategy/

So yeah.

Archive link:
https://web.archive.org/web/20250117195921/https://www.whitehouse.gov/oncd/national-cybersecurity-strategy/

#infosec

System Administration Week 1, #Unix History Exhibiting one of the ...

2025-01-26T16:10:43Z

In reply to nevent1q…4whq
_________________________

System Administration

Week 1, #Unix History

Exhibiting one of the cardinal virtues of System Administrators — laziness — we're reusing a video from my #programming class to give a whirlwind history tour: Bell Labs, Berkeley & the Unix Wars, USL v. BSDi, the birth of #NetBSD & #FreeBSD, the development of GNU & its adoption of #Linux, all leading to Unix on your fridge, car, and mobile phone.

https://youtu.be/3H7SQWTR6Dw

Last semester's #apue thread:
https://mstdn.social/@jschauma/113087999769442250

#sysadmin #sre #devops

System Administration Week 1, Core Principles In this video, we ...

2025-01-25T19:47:36Z

In reply to nevent1q…v6c0
_________________________

System Administration

Week 1, Core Principles

In this video, we present a few core principles that will guide us throughout the semester, including our three pillars: Scalability, Security, and Simplicity. We'll also get to know a few basic "laws", well known by any System Administrator. If you're wondering what all this has to do with Legos, please tune in...

https://youtu.be/bfqP6PlS6Og

#SysAdmin #sre #devops

System Administration Week 1, The Job of a System Administrator ...

2025-01-24T17:51:13Z

In reply to nevent1q…n03r
_________________________

System Administration

Week 1, The Job of a System Administrator

In this video, we try to show what things SysAdmins may encounter in their day to day routine, ranging from power tools to actual and symbolic duct tape and WD40. With this, we try to sort out just how the job may be defined. It's not that easy, as it turns out...

https://youtu.be/osIO9CbqHQo

#SysAdmin #sre #devops