← Feed

Posts

• View post

  Oh, hey, if for some reason you have a need to inspect a cert bundle of PEM files, I have a useful little tool for you. Kind of the love child of split(1), tee(1), and xargs(1): https://github.com/jschauma/xpipe This makes getting a cert bundles issuers out of pemblocks a single command: <cert.pem xpipe -p '^-----END CERTIFICATE-----$' \ openssl x509 -noout -issuer

• View post

  So, uhm, sounds like #node2shell CVE-2026-111497 is not restricted to nodejs alone, but any Google Brotli consumer. I don't think that's been called out widely. Check your other integrations. https://github.com/advisories/GHSA-9v8h-qqgm-4m35

• View post

  Apropos of nothing, I mean, uhm, #php2shell: https://www.akamai.com/blog/security-research/tlp-is-not-a-suggestion

• View post

  You never know which CA bundle a given language uses, so if you want to check if it's #emudhra affected, one option is to just go ahead and try it. Trivial https fetch attempts in curl, Go, Java, Node, Perl, Python, Ruby, Rust: https://github.com/jschauma/emudhra

• View post

  I for one applaud OpenAI for taking down the Codex installer: $ curl -fsSL https://chatgpt.com/codex/install.sh curl: (22) The requested URL returned error: 404 $ Anthropic, you go next, please.

• View post

  Ubuntu still considers the #brotli RCE (CVE-2026-111497) as "medium" priority: https://ubuntu.com/security/CVE-2026-111497 Some other Linuxes: AlpineLinux: https://security.alpinelinux.org/vuln/CVE-2026-111497 Debian: https://security-tracker.debian.org/tracker/CVE-2026-111497 Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2026-111497 RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-111497 https://access.redhat.com/security/cve/cve-2026-111497 SuSE: http...

• View post

  I still can't get over the fact that writing down what you need done with sufficient attention to detail for somebody else to do it -- you know, like, _documentation_ -- is now called "a SKILL" and is only ever blindly fed to a bot. Y'all are aware that you can write things down and make them available to humans, too, yes?

• View post

  Oh, interesting: git https remote (git-remote-https) may be vulnerable to the #brotli RCE (CVE-2026-111497), if built with brotli-enabled libcurl. I'm guessing updating libbrotli would fix that, but that seems like a neat, little attack vector that flies under the radar.

• View post

  "PwnEscape" CVE-2026-99999, severity critical, disclosed October 15th, and #Ubuntu is once again still dragging their feet. "Ubuntu Priority: Medium" smh https://ubuntu.com/security/CVE-2026-99999

• View post

  Oh FFS. If you just patched /etc/ssl/cert.pem on all your macOS endpoints, rejoice: the just landed Apple OS update to 26.7.2 / 27.2 will revert that for you and put the emSign and AAA roots back. :facepalm: #emudhra

• View post

  #php2shell is based on PHP using longjmp(3) to bail out of OOM conditions. They fixed that by actually properly unwinding the call stack under those conditions -- that's the "replace bailout with UnwindExit" part in the massive diff that touches 389 files here: https://github.com/php/php-src/commit/01a40e89fb Cool. But. There are still dozens of other places where PHP longjmp(3)'s, and frankly, I don't think that can possibly be a safe error handling approach in a long-l...

• View post

  Ok, gonna call it: #eMudhra is this generation's DigiNotar. Don't think they'll recover from this. (15 internet years is a generation, fight me.)

• View post

  #IPv6 adoption is still terrible. Akamai, Cloudflare, and Google all report roughly 45% of traffic to their services using IPv6 in the US... https://www.akamai.com/security-research/ipv6-adoption-visualization ...but that's (a) not all that great, and (b) only HTTP traffic to major services. Just what % of sites actually _offers_ IPv6? I took a look...

• View post

  "PwnEscape" is the KVM escape for which rumors made the rounds a few days ago. Getting CVE-2026-99999 assigned is 👨🏻‍🍳💋. https://pwn.ai/blog/pwnescape Kernel patch for this part (because it sounds like there's multiple): https://github.com/torvalds/linux/commit/6785011f8b16abf40b1e9d8b2e332232b3e68822

• View post

  When I read that Anthropic source repository post with the "every bottleneck we remove immediately leads to a further increase in the amount of code we produce" quote, I just think back to Ken Thompson's famous quote: "One of my most productive days was throwing away 1,000 lines of code." "More code" is not a metric of success.

• View post

  I see mathematicians are now getting the same treatment as infosec teams and bug bounty programs have had for the last 18 months or so. Congrats on receiving hundreds of reports of "findings" that you now have to verify and dispute, a process that will rob you of your enjoyment and passion for the underlying subject. Can't wait to see which disciplines will be the next AI-drive-by victims.

• View post

  In 1981, Ned Block described a branch predicting algorithm to determine "sensible strings" for a dialog beyond Eliza. "Could the issue of whether a machine in fact thinks or is intelligent depend on how gullible human interrogators tend to be? [...] I conclude that the capacity to emit sensible responses is not sufficient for intelligence" As in the Chinese Room, there's no understanding there. (Blockheads all around us, indeed.) https://www.jstor.org/stable/2184371

• View post

  If you list AI as a "co-author" on a paper, I will stop reading. If you gave the AI a freaking name on top, I'll consider you lost. You'll have a long and difficult path ahead regaining any trust or respect.

• View post

  "Winning AI" -- people keep using those words. I don't think they mean what they think they mean. https://www.netmeister.org/blog/winning-ai.html

• View post

  So what's the over/under that this Vercel KVM escape 0-day is - a Vercel only thing - an AWS Firecracker only thing - an actual all-KVMs affected thing ? https://nitter.cf/rauchg/status/2106402024804020657#m (The overall vibes I'm getting here make me skeptical.)

• View post

  The real joke is of course that he probably first wanted to rename it to "American Intelligence", but then he wouldn't be able to tell who's bootlicking or not when saying "AI". As always, it's a loyalty test and fealty signal.

• View post

  New plonk just dropped.

• View post

  Quick reminder: Models Don't Go Rogue https://mail.cyberneticforests.com/models-dont-go-rogue/ (Now AI companies and their cultists on the other hand...)

• View post

  Tee hee, HN stumbled upon my AI rant blog post and boy is that a different discussion from Lobsters. ✌️

• View post

  There isn’t a 10% chance that AI will kill all humans in the future via Skynet or the Paperclip Maximizer. But there’s a 100% chance it’s already doing so: mandating water wasting, air polluting, fossil fuel powered data centers, environmental regulations are lifted for these companies and even their feeblest greenwashing commitments to carbon neutrality or renewable energy sources are pulled while record heat and wildfires kill more and more people to teach AI how to spell “strawberry”.

• View post

  Dear journalists: it's not "AI escaped", it's "AI companies failed to restrict the programs". Programs that did exactly what they were instructed to do. By those companies. Place the blame where it belongs.

• View post

  Hey kids! It's the start of the Fall semester, and I'm again teaching "Advanced Programming in the UNIX Environment". The syllabus and all course materials including all code examples are available here: https://stevens.netmeister.org/631/ As usual, we'll be using #NetBSD as our main platform. All video lectures are public and available for free on YouTube: https://www.youtube.com/playlist?list=PL0qfF8MrJ-jxMfirAdxDs9zIiBg2Wug0z I'll be posting individual lecture vid...

• View post

  This has absolutely entered my vocabulary. On the off-chance that you haven't seen this definition yet: Meat proxy 1. A person who forwards AI-generated text, code, or other output without reading, understanding, or validating it. The person acts only as a relay between the AI system and the intended recipient. https://sfisms.org/meat-proxy (Also: sf-isms.)

• View post

  AI is notoriously verbose, often producing pages and pages of output that then, inevitably, the recipient feeds back into _their_ AI to summarize. AI companies are charging customers by the token, both input and output. It's almost as if there was some sort of connection there.

• View post

  You're right - AI _is_ useful. Your use of it provides an important signal to me: 1) For writing: "I didn't care to put the effort in to write this myself." 2) For coding: "I don't care if I understand the solution." 3) For vuln impact analysis: "I don't understand the code base nor the attack vector." Or shorter: "I do not care about the details." This, of course, on top of the other ethical problems with AI. It's a strong signal,...