← Feed

Posts

• View post

  Holy hell is boot signing enforcement complicated to handle in #Linux. That is all.

• View post

  TFW you discover that the #Linux distro with "Secure" in its tagline ships with integrity policy enforcement (CONFIG_SECURITY_IPE) disabled. IPE is a royal PITA, but naively, this feels like finding a secure variant of macOS shipping with Gatekeeper not just disabled, but impossible to enable.

• View post

  Just had a call with a prospect who found us because their AI informed one of their potential customers that our AI had flagged their software as hostile. What in the 2026 world is this? Also - it wasn't wrong. It was the classic problem of security scanners accidentally flagging other security scanners as malware. We ran into this a lot with Apple XProtect and #malcontent.

• View post

  For folks who have #Linux VMs at home or at work, what do you use them for? I've been working on a side project to build secure, locked-down, auto-updating, immutable VM images, and I want to know which use cases I should optimize for.

• View post

  After months of expectation, I irrevocably lost a 4TB #btrfs volume today because it ran out of metadata space, and there was no way I could coax it out of read-only mode - even by extending it with a loopback. Good riddance, and thank goodness for backups!

• View post

  In case anyone is crazy enough to run #FreeBSD on an Ampere Altra Max w/ Intel X550 NICs (#ix0): if upgrading from 15.1p4 to 15.1p5 causes a boot hang with "Device leaked memory resources", try these boot hints: dev.ix.0.iflib.override_ntxds="1024" dev.ix.0.iflib.override_nrxds="1024" dev.ix.0.iflib.override_ntxqs="8" dev.ix.0.iflib.override_nrxqs="8" dev.ix.1.iflib.override_ntxds="1024"...

• View post

  I'm sure I've felt this depressed and aimless before, but somewhere between the AI slop wars, the shift to remote work, the relocation to a car-dependent locale, and the trials of starting up a business, I just feel broken and forever out of place. I'm thankful that #AllThingsOpen is tomorrow, as well as the start of my new #Watercolor class, because I could sure use a reset.

• View post

  I have listened to an unhealthy amount of #SkinnyPuppy this week. What have you been listening to? I could use a musical reset and welcome any suggestions.

• View post

  How much disk space does it take to reliably track & scan all the important open-source software releases published throughout the year? About 120TB. Thanks to #FreeBSD, #ZFS, #WesternDigital, and #Ampere for being awesome. :)

• View post

  I've been trying to stay quiet about it over vacation, but I'm damned impressed with how #atomdrift is showing up in the malware detection charts. Nothing comes close to it for #supplychainsecurity. Have a question? Leave a comment.

• View post

  Things are not looking so good for the Linux box that serves the #atomdrift API for serving, foraging, and generally managing sample files. Definitely a shame to be 7000km away from the power button for the next 3 weeks, as it doesn't respond to soft reboot requests. Kinda wish I'd gotten around to enabling remote ZFS snapshots before I left. 🤦

• View post

  Most malicious #npm packages steal; #express-timer just deletes your source tree a minute after you install it — and its author fumbled their own online-banking password into the very same tarball; just wow. It's trivially detectable using existing open-source software too: https://atomdrift.org/discoveries/2026/06/express-timer-self-destruct-wiper/

• View post

  With #atomdrift - we're detecting a dozen new supply-chain attacks every day; on-par with the commercial vendors. Most are boring, but some are brazen - this attempt at a CDN-distributed #cryptojacker is the latter: https://atomdrift.org/discoveries/2026/06/v018-axios-cdntest-c-is-for-cookie/

• View post

  After being locked away for 10+ years in the Cloud; it's so refreshing, and frustrating to deal with all of the little things; like filesystems, database replication and locks, replacing fans and NICs, debugging OOMs, and crashing daemons on #FreeBSD, #OmniOS, and #Linux; I feel like everything moves a little more slowly and sustainably this way; but most of all - I really missed getting lost in the details.

• View post

  One of my favorite features with #atomdrift's approach to supply-chain attack decomposition is the ability to quickly find other samples using the same techniques by clicking on the #malecule - our custom hash based on a program's behavioral profile. This NPM was uploaded just a few minutes ago, but matches many attacks we've seen throughout the last month.

• View post

  New day, new silly malware samples found - this time it's PyPI's turn: https://atomdrift.org/discoveries/2026/06/spadata-roblox-cookie-stickup/

• View post

  The best part of being a solo-founder is the ability to take guilt-free thinking rides. It gave me the clarity on what I'd like to ship next for #atomdrift - JSON trait context, improved lab interface, and a --second-opinion option for (local but non-deterministic) LLM assistance. Coming to #litmus soon!

• View post

  Epic; thanks for the laugh guys!

• View post

  This is also my first time publishing to codeberg, so I have literally no idea what I'm doing.

• View post

  I rode my #Experia to a bar this evening to get some fresh air and meet up with the local #motorcycle community. While there, I met a guy with a nice Harley V-Rod, drinking a beer, who explained he's back riding after breaking his leg last year. How'd he break it? Skidded out, leaving this very bar after having too much to drink. In the US, 40% of motorcycle fatalities involve the rider consuming alcohol. Every time I go to a motorcycle meetup at a bar, it feels like a Darwin Awards con...

• View post

  After being hosed by #btrfs on #linux 7.0.1, the #atomdrift postgresql master database is on #OmniOS & #ZFS It's good to be back, even if I'm rusty in Solaris-based environments.

• View post

  I'm having too much fun with these slides for #Cackalackycon :)

• View post

  A close friend just asked me to recover data from a Mac. No problem I said; it turns out it's a PowerMac G5. I used to have one myself - 20+ years ago. I don't have any DVD-R media, so what's the best USB boot environment for these things? YDL is dead, so Linux looks... tricky.

• View post

  I just realized I'm now sitting here with 3TB of #malware on my computer - what could possibly go wrong?

• View post

  Our latest #opensource drop: https://github.com/chainguard-dev/acls-in-yaml As part of #SOC2 #compliance, we've been using this to run monthly #audit reviews of our ACLs across SaaS platforms: #GCP, #Slack, #Vercel, etc. acls-in-yaml dumps #ACLs from each platform into a consistent and neutral #YAML format, which makes it easy to visualize change over time. We use this by committing the result into a #Github repo and getting the PR reviewed by the admins for each system. PS: ACL c...

• View post

  cleave v1.2.0 is now available! cleave is the successor to malcontent - decomposing a program into a set of MBC/ATT&CK-aligned features useful for security engineers and ML pipelines alike. The screenshot is how cleave sees an ELF #malware sample that was dropped just yesterday. Using both AST and automated reverse engineering [rizin], cleave executes 50,000+ rules across 75 file formats. Project: https://codeberg.org/atomdrift/cleave

• View post

  https://codeberg.org/atomdrift/stng - my wild strings(1) replacement for security engineers has a shiny new release (v1.2.0): * New arm64 stack-XOR decoder for macOS malware * Fewer false positives for IPv4 constants * 66% faster XOR scanning

• View post

  At the risk of spilling the beans too early... I grew tired of the constant barrage of supply-chain attacks afflicting the open-source community and decided to create a new open-source #malware scanner, named #Litmus. This is part of a larger vision for intercepting supply-chain attacks, called The #Atomdrift Project. I want to empower everyone, from software marketplaces to teenagers at home, to catch the sorts of attacks we've recently seen against #Trivy and #OpenClaw.

• View post

  New blog post outlining some of the #infosec #detection techniques we use with #osquery, specifically against the most interesting new macOS malware of the past year: https://unfinished.bike/behavioral-detection-of-macos-malware-using-osquery