Troed Sångberg

Demoscene coder. Cybersec consultant. A child of the 80s home computer era.

Depending on who you are I either help secure your stuff against evil hackers or I play one and show you how they work.

I use two accounts. This one is tech/retro/cybersec focused. Random social chitchat on random topics can be found over at Troed Sångberg (npub14zw…pf4e)

HOMEPAGE: https://troed.se
PEERTUBE: https://video.troed.se
MATRIX: Troed Sångberg (npub192k…y8wk):matrix.troed.se
DEMOSCENE: https://sync.wtf

Public Key

npub192kepsf3ypyzgsds9r93amadzta0efs05ftuxhl84m04e9xxhy9qevy8wk

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsz4tvscycjqjpygxcz3jc7a7k397hu5c86y47rtln6ah6ujnrtjzspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsqyne3p

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub192kepsf3ypyzgsds9r93amadzta0efs05ftuxhl84m04e9xxhy9qevy8wk

Show more details

Last Notes

2026-05-17 18:21:30 CEST

- reply

Living that sweet influencer lifestyle!

2026-05-17 12:50:19 CEST

- reply

PoC done, now I need to set up the target hw (it's been a while since I had it connected) and test it. First test is just to see if I can corrupt memory accessible from the secure side.
(I switched Linux distribution a few days ago and half the time now is just installing tools I had before. Did you know OpenSUSE has no vbindiff package? The horror!)

2026-05-17 12:46:41 CEST

- reply

My experience from discussing LLMs on Fediverse basically boils down to there being a certain set of people (who believe themselves to be the enlightened majority) that are what I describe as "AI-haters". They have "No AI" badges in their profiles and they decided that LLMs are the spawn of the devil years ago and have no interest whatsoever in seeing any other viewpoints appearing anywhere.
They also don't know how LLMs work, and they seem to believe that there's some inherent property to "biological brains" that a computer will _never_ be able to emulate. Apparently a GPU also boils the planet when used for LLMs but not when playing games.
I can describe workflows for hours that in no way generate "slop" yet these persons are so convinced that they're the ones that have "seen the light" and I - the one actually getting great value from LLM-aided workflows - to be "deluded".
It's frustrating because I've never been one to get caught up in hype and I documented here the very moment I realized that I hadn't kept up to date with LLM coding development and decided to _challenge_ my own convictions.
I wish more people did.
[@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj @npub1h6x…hqvp

2026-05-17 00:13:30 CEST

- reply

Are Dr Hossenfelder's credentials on the subject of physics any less because she posts on Youtube?
That's your argument?
@npub142f…qwl3 [@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj

2026-05-16 23:51:00 CEST

- reply

"LLM-sceptical people are not akin to the stereotype you had in mind."
On the contrary - you've played out the stereotype perfectly. Lots of claims without any scientific backing more than your own gut feelings.
Reasoning (textbook definition): "the process of forming conclusions, judgments, or inferences from facts or premises."
https://www.dictionary.com/browse/reasoning
@npub142f…qwl3 [@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj

2026-05-16 23:47:38 CEST

- reply

You don't seem to read much. Douglas Hofstadter's "I am a strange loop" explains the pattern matching concept well.
Besides that I conclude that you do believe in magic fairy dust. There's no support for that in science.
https://www.youtube.com/watch?v=fRssqttO9Hg
@npub142f…qwl3 [@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj

2026-05-16 23:32:03 CEST

- reply

You claim this because you believe human brains do something different to what the LLM does here. That's why I've asked you if you believe human brains contain magic fairy dust.
It's not that LLMs are magical that's the point here. It's that we aren't either.
(cue p-zombies and Searle's Chinese room)
@npub13r5…erkj @npub142f…qwl3 [@mmu_man](https://m.g3l.org/@mmu_man )

2026-05-16 23:14:43 CEST

- reply

Either you believe that human brains obeys the laws of physics or you don't.
If our brains obey the laws of physics it follows that they do nothing but pattern match inputs to outputs.
At no point can something "will" a chemical reaction to occur or not occur.
You've repeatedly claimed things to not be scientifically accurate - but you don't have backing in the science for it. That's just your personal convictions speaking.
@npub142f…qwl3 [@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj

2026-05-16 23:03:32 CEST

- reply

This is a _very_ tiny part of what I've been doing today. This is the LLM reasoning on the unsecure to secure exploit I'm working on. There's no point in trying to claim this is not the text-book definition of reasoning:
```
Now, the key question is: which TA UUID should the PoC use to trigger the secure data table lookup? The op_tee_config_key_handler and op_tee_secure_data_handler are in tee.bin (OP-TEE core), not in any of the three .ta files.
In OP-TEE, vendor commands like 0x50000001 and 0x70006045 are dispatched by the TA's invoke command handler. If the handler is in tee.bin itself, it means these are not standard TA commands but rather OP-TEE internal commands or vendor-specific extensions to the OP-TEE core.
I'm realizing I may have misidentified where these handlers live. The op_tee_invoke_command_handler and op_tee_command_dispatch functions in tee.bin are actually part of the standard OP-TEE core's TEE_InvokeCommand implementation, not vendor-specific code. The vendor customizations like op_tee_config_key_handler and op_tee_secure_data_handler are likely called from within the op_tee_command_dispatch function itself.
```
@npub1h6x…hqvp @npub142f…qwl3 [@mmu_man](https://m.g3l.org/@mmu_man )

2026-05-16 22:57:09 CEST

- reply

You didn't answer my question. This discussion is pointless if you subscribe to the idea of magic fairy dust in human brains setting the laws of physics aside.
@npub142f…qwl3 [@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj

2026-05-16 22:37:43 CEST

- reply

Are you a dualist or monist? There's no point in talking about how human neural networks do nothing more than pattern matching inputs to output if you believe there's metaphysical magic fairy dust making us special snowflakes.
An LLM reasons _exactly_ in the same way as a human brain does. Your comment to the contrary doesn't instill me with confidence that your CV is what you claim it to be.
@npub142f…qwl3 [@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj

2026-05-16 22:21:40 CEST

- reply

I'm guessing you're just a plain AI-hater without any knowledge on any of the subjects you're posting about - correct?
I have insight into both the science on human cognition as well as LLMs. I can keep correcting you, but if you have no interest in learning it's just quicker to block now.
@npub142f…qwl3 [@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj

2026-05-16 22:17:36 CEST

- reply

Human brains work similarly making it a pointless dismissive observation as to their abilities and usefulness.
[@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj

2026-05-16 21:58:26 CEST

- reply

I refer to them as "thinking engines", or perhaps "reasoning engines". Just as a human student read a lot of books with the point of being able to apply some general methodology afterwards, the same thing happens with LLMs. We managed to completely misunderstand how to use them best with that early "ask the LLM" as if they're some sort of knowledge databases.
"Modern" LLM setups pair them with vector databases so that they themselves fetch stored data exactly, they use search engines and tool repositories (MCPs) to accomplish tasks. When set up like this, "hallucinations" and slight differences between runs don't matter for their ability to complete the tasks given.
[@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj @npub1h6x…hqvp

2026-05-16 20:52:21 CEST

- reply

Anybody who brings up "stochastic parrots" need to realize that this isn't 2023 and we're not trying to use LLMs as knowledge databases.
You cannot recall every word from every book you've read either. It's not relevant to your ability to do things - and the same is true for LLMs.
[@mmu_man](https://m.g3l.org/@mmu_man ) @npub13r5…erkj

2026-05-16 18:02:26 CEST

- reply

I control the destination pointer but neither the size nor the contents. Well, that still has a high likelyhood of ending up with something usable.

2026-05-16 16:58:54 CEST

- reply

well ok then. The LLM just claimed one of my suggestions would indeed be a fully controllable buffer overflow with memory pointers and size under my control from the unsecure into the secure space
I guess it's time to manually verify.

2026-05-16 13:50:24 CEST

- reply

I think we all heard the argument "If you use a calculator you won't learn to do the math in your head" in school. This is no different.
@npub13r5…erkj

2026-05-16 12:30:01 CEST

Current reverse engineering setup*:
1) llama-server built with PR 22673 to include MTP support
2) unsloth qwen 3.6 35b a3b UD_Q4_K_XL MTP
3) Opencode with Superpowers and DCP
4) phygidra-mcp
This allows for reverse engineering using Ghidra by prompting the LLM to do the heavy lifting. It will rapidly go through Ghidra-analysed functions and rename all the common ones, draw up the whole callpath, identify interfaces between secure and nonsecure areas etc. It's a complete game changer since while it's not doing anything I can't do myself the speed at which it's done is absolutely staggering compared to the manual labour.
I go from not knowing anything about the fw/flash I'm working on to have it completely broken down to where I can start looking for exploits in mere hours.
And yeah, the LLM aids in looking for those as well. So far my input to what exploits to look for is needed, but I can well see there being fine-trained or fully trained exploit-LLMs that would have that completely automated as well.
*) This is all running on a modern workstation where ~20GB of system RAM is needed in addition to the 16GB VRAM 5060Ti.
#EthicalHacking

2026-05-15 22:08:58 CEST

- reply

*hugs*

2026-05-15 22:01:33 CEST

- reply

Yes, the cloud LLM business model running full stop on VC money has absolutely no future.

2026-05-15 20:12:17 CEST

- reply

The problem is the irrational _hatred_. Some people got stuck on "stochastic parrots" in 2023 and seemingly also believe that if you run an LLM on your GPU it magically destroys the earth while gaming on the same GPU doesn't.

2026-05-15 20:00:58 CEST

Apparently there are heated discussions happening.
"basically the entire project minus a handful of people agrees that LLMs are trash and should be banned entirely"
You do that. I'm sitting here increasing the security of the world through LLM-assisted reverse engineering* which gives me a speedup of about x100 (that's _not_ an exaggeration).
AI-haters are quickly making themselves irrelevant.
*) pyghidramcp+opencode on a _locally hosted_ LLM
(this is a subroot about #Rust)

2026-05-15 10:57:26 CEST

- reply

Two slides:
"PUT OPEN SOURCE MAINTAINERS ON YOUR PAYROLL"
"PUT PEOPLE ON YOUR PAYROLL ON OPEN SOURCE"
Good talk.

2026-05-15 10:11:56 CEST

- reply

That worked perfectly - thanks!

2026-05-15 09:17:30 CEST

- reply

Looks very nice - running it on my workstation now! Thanks :)
(It requires a very new Bash right? Got subscript array error on a Ubuntu 24.04 machine)

2026-05-14 22:23:46 CEST

- reply

... and back up and running again. Decided to make a Gnome to KDE move at the same time.
Servers now run OpenSUSE Leap and workstations OpenSUSE Tumbleweed. This means my whole personal stack is closer to what I encounter at work.

2026-05-14 16:18:08 CEST

Alright, I guess this is it.
Upgrading the main workstation from Ubuntu 25.10 to OpenSUSE Tumbleweed.
🤘

2026-05-14 14:09:17 CEST

- reply

I'll take a look! And yeah, I just migrated my whole extended family from one server I've hosted to another I host :)

2026-05-14 13:49:24 CEST

Posting this in case it helps someone else:
To move your #Matrix account from one instance to another without losing your current chat history do as follows:
0.5) Create a backup phrase
1) Use the Element desktop client with your existing account to in Settings - Encryption - Export your keys.
2) Create your new user account and use the Element desktop app to import the keys you just exported.
3) With your old account, invite the new account to all rooms you're in (including 1on1 chats). Make sure the room setting is correct for "Newly joined users can see history".
4) With your new account, accept all invites.
5) With your old account, leave all rooms.
Done.

2026-05-13 23:07:33 CEST

I'm three weeks late here but this is a really good interview/talk with Mozilla's VP of Product:
https://techlore.tv/w/8d610b17-2fe6-4b73-b8e0-ddcec7e49a27
#Mozilla #Firefox

2026-05-13 16:43:13 CEST

Library story from the late 80's:
Swedish libraries were connected to a system where they ordered in which books each library should have*. They made some decisions themselves of course, but otherwise you could just ask them for a specific book and they would then order it so that you could lend it a few weeks later.
Me being a computer geek with a modem, I immediately recognized the dialup tones when they ordered one for me one time, and I chatted with the somewhat tech-illiterate librarian who was pleasantly surprised by my interest in their system and gladly showed it to me.
I also saw the dialup number and the passcode for my local library.
From then on all books I wanted to read just magically appeared in the library just in time for when I came in to lend them.
*) I _think_ this was "Libris", that still exists in some form today, but I'm not 100% sure

2026-05-13 16:25:51 CEST

- reply

Hmm. Maybe - I have only presented this at large companies where it's possible to make the argument that this/these person's general knowledge spreading in the areas they maintain will be enough of a bonus for the rest of the company to cover the salaries.

2026-05-13 16:13:31 CEST

- reply

I belong to the somewhere below 10% of the population with severe prosopagnosia. My brain is not able to store the normal relationship between the eyes, nose and mouth that other humans use to be able to recognize people. I need to resort to other cues, that fail horribly when people change hairstyles, grow a beard or start wearing glasses.
Smart glasses with facial recognition would allow me to function the same way as others assume everyone does, instead of - as now - ignoring people who then think I'm rude just because I had no chance of recognizing them.
@npub1dw4…quqt @npub1huw…c5x7

2026-05-13 14:50:32 CEST

- reply

Oneplus Nord 5 (12GB RAM and 512GB storage) with LineageOS made for a very happy family member.

2026-05-13 13:06:01 CEST

I'm in a position where I sometimes come in and do presentations at the executive level in large companies, with a focus on security.
Since recently "you need to have open source maintainers on the payroll" is now part of the message. This rose to the very short list of things you can push and get attention on due to the rapid rise of LLM-assisted bug hunting.
The maintainer-burnout that has existed for a long time is now at critical levels and all companies that rely on open source tooling for their products - which means _all companies_ - can no longer just stand outside the window shouting at maintainers to work harder.
They need to actively fund the work. And not just with money - also with dedicated personnel. And here's the kicker in my message:
Those persons are not in your _product_ department. Their top priorities are not _your product needs_. They must be fully/mostly independent since that open source component is _their_ separate product.
Let's see how it goes. I'm not getting pushback on the message itself - I just need to see it to translate to actual positions being opened up as well.

2026-05-13 09:21:26 CEST

- reply

I think they completely misunderstand Daniel's comment on how LLMs aren't finding a new _class_ of exploits with "LLMs can only find things from their training".

2026-05-12 21:42:02 CEST

But Rossmann, tell us how you _really_ feel!
(yeah, you should watch it)
https://www.youtube.com/watch?v=1jhRqgHxEP8

2026-05-12 21:31:40 CEST

I just bought another server. Some old Xeon-based small form factor desktops are just getting too cheap to ignore.
Will probably end up creating some form of failover redundancy setup.
If only IT organizations where I work took their stuff as seriously as I take my self hosting.

2026-05-12 18:10:51 CEST

RE: https://infosec.exchange/@attackanddefense/116562461465384907
Don't browse random sites if you're:
1) On an exploitable browser
2) On a Linux with currently unpatched LPEs
That's a lot of us.
#note107x…9znf

2026-05-12 18:04:37 CEST

- reply

Yeah the only solution to fully decentralized trust that we've been able to come up with is unfortunately the one in Bitcoin. It requires that it's _costly_ to produce the Proof of Works. However, the cheapest form of energy to produce is renewables and they already have a big share. It should go to 100%.

2026-05-12 18:02:30 CEST

- reply

The CRA in the EU, when it goes live, will do this. All those products have known security exploits and you won't be allowed to sell products that has that.
... if things work out as we hope ...
@npub1s6e…n008

2026-05-12 15:02:56 CEST

- reply

Why do you think Musk is a "nerd"?
He's never actually been in tech. A wannabe, sure, but not actually capable of anything but bluster.
@npub1yc8…l2yd

2026-05-12 14:59:02 CEST

AI kills middle management needs.
Gitlab:
"We’re flattening our organization because eight layers is too deep for a company our size and management layers are slowing us down. Every layer of management increases the number of places where priorities and communication gets filtered. A flatter organization will better connect every team member with leadership."
https://about.gitlab.com/blog/gitlab-act-2/

2026-05-12 14:04:24 CEST

- reply

... sidenote:
People in the comments going "buhu mistralai not currently being served by PyPi is blocking our build pipelines!"
Don't build pipelines that RELY on someone else hosting things for you.
Idiots.

2026-05-12 14:00:34 CEST

I've just seen two completely separate posts about two completely separate groups of people in society that are getting de-platformed financially.
This is what Bitcoin was created to solve.
Yet the very same people who will gladly share their outrage over what's happening to these groups are the ones who will demonify anyone who mentions Bitcoin because "crypto bros".
Yeah, there's been a lot of bad actors in the "crypto" space. That doesn't mean that Bitcoin isn't, still, the perfect solution to authoritarian control over who gets to money.

2026-05-12 10:15:00 CEST

It appears as if Mistral had one of their repos backdoored: https://github.com/mistralai/client-python/issues/523
#Mistral

2026-05-12 09:41:02 CEST

- reply

... aaaaand the code: https://codeberg.org/troed/winbond_ecc

2026-05-11 22:33:39 CEST

- reply

https://swecyb.com/@troed/116557820477054746
#note1e6n…dv7f

2026-05-11 22:26:36 CEST

It's TEDIOUS to reverse engineer a proprietary NAND ECC algorithm.
So let's have an LLM do it for us!
Here's Winbond's NAND ECC algorithm (at least for W25N01GV)
https://blog.troed.se/posts/winbond_nand_ecc/
#ReverseEngineering #NAND #Winbond

2026-05-11 17:15:57 CEST

- reply

... and here we are:
(blog post coming)
#ReverseEngineering
https://media.swecyb.com/media_attachments/files/116/556/593/057/012/271/original/fea5a38de768bb10.png

2026-05-11 16:29:49 CEST

- reply

"Perhaps the real marketing here is his [Daniel's] own modesty about curl's maturity."
suck it up! :D

2026-05-11 08:39:02 CEST

"Not using AI code analyzers in your project means that you leave adversaries and attackers time and opportunity to find and exploit the flaws you don’t find."
I'm _very_ worried for #MastoDev and other open source projects where maintainers are taking an irrational position on the use of LLMs.
https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

2026-05-11 07:21:09 CEST

- reply

It's writing Python programs to verify all the algorithms from its "thinking".

2026-05-10 22:18:32 CEST

- reply

Random screenshot from what it's doing:
https://media.swecyb.com/media_attachments/files/116/552/124/245/839/770/original/617cd4a53ccabc60.png

2026-05-10 22:03:21 CEST

- reply

It's "thinking" about various algorithms, LFSRs, xor-patterns, Hamming distances. The brute-force part is that it will keep "thinking" and testing various hypotheses until it can reproduce the vendor ECC calculations.
It has already found one non-obvious pattern that verifies across all data.

2026-05-10 20:35:14 CEST

This evening my workstation fans are working flat out. I have a well-harnessed LLM brute-forcing a vendor proprietary custom NAND flash ECC algorithm.
The alternative would be me paying someone who has already reversed it $2500 which for this little project isn't worth it.
(this is not something you would run towards a cloud LLM since this truly is a brute-force loop that might never conclude)

2026-05-10 20:14:37 CEST

- reply

It's a fallacy to only accept a perfect solution and thus never be able to move the needle in the right direction.
As it is, the only attestation services accepted by European medical and banking institutions are US controlled. Moving the needle to having them be EU consortium controlled is a valid good step that brings actual benefits.
Then we continue moving the needle further.

2026-05-10 19:52:42 CEST

- reply

GrapheneOS are doing their best to badmouth the only viable alternative we could hope to see adopted.
https://uattest.net/

2026-05-10 16:46:39 CEST

These are pretty insane decentralization stats
https://media.swecyb.com/media_attachments/files/116/550/816/288/466/165/original/4ec6ac5a813962b8.png

2026-05-10 15:42:46 CEST

Here's an example of how you need to keep LLMs harnessed and locked down with actual system-level constraints.
This is from Mistral Vibe, which has several "agents" where you can either allow the LLM to ask for permission to make edits, not be allowed to make any edits at all ("plan" mode) or auto-accept edits.
As you can see, the agentic harness in plan-mode is correctly disallowing the LLM from making search/replace in a file, as well as not letting it write to the file.
... what then follows is completely unprompted. The LLM "knows" all the different ways you can do stuff and will happily do so as well the system doesn't protect against it.
https://media.swecyb.com/media_attachments/files/116/550/561/346/408/351/original/53074d1cc6f50bc8.png

2026-05-10 12:36:13 CEST

- reply

I believe the reception was "you're AI-pilled / you're lying because you love LLMs / you're paid by Anthropic" etc.
My take: Wow those are some really tricky dependencies to find how they end up causing security issues. Very difficult to avoid completely during regular development.

2026-05-10 10:51:55 CEST

- reply

OnePlus Nord 5 ordered - thanks!

2026-05-10 10:07:26 CEST

- reply

Too many words. They should just define that we need "healthy maintainers".
The rest follows from that.
Maybe exchange that first 'h' for a 'w' too.

2026-05-09 21:44:30 CEST

- reply

That chart does not show what LF spends money on. You're looking for the Financial Transparency section on slide 58.

2026-05-09 21:36:10 CEST

- reply

Can't stand their paranoid delusion FUD spreading about everyone else.

2026-05-09 20:37:37 CEST

Insight wanted:
Family member needs new phone. De-googled Android is the requirement. Samsung is a no-go due to their VoLTE/IMS not being supported in AOSP.
Any de-googled Android except GrapheneOS is of interest.
Which phone should they get?

2026-05-09 17:34:50 CEST

- reply

Love my SearXNG. Dockerized, fire up and forget.

2026-05-09 15:59:58 CEST

RE: https://chaos.social/@hister/116544736156891175
I couldn't wait so switched my Hister installation over to track :master instead of :latest and it's ... it's beatiful!
I implemented the !toot alias and now I have actual great search capabilities of what I've seen once on #Mastodon!
(Yes I run ElasticSearch on my personal Mastodon instance and no that really didn't help much ...)
#note1060…uwv9

2026-05-09 15:05:34 CEST

- reply

Absolutely fantastic! Thank you for implementing this.
Question: Does it work with the advanced web ui (multiple feeds/columns) or best with the single view?

2026-05-09 13:29:25 CEST

- reply

Yeah that I don't agree with at all. People who get so worked up by others using tools they don't like need to go talk to ... someone.
LLMs are absolutely awesome for many things. They're just tools. It's like when compilers started making it easier for non-assembler coders.

2026-05-09 13:26:24 CEST

- reply

I like a world where everyone have the ability to scratch an itch. I do agree that care need to be taken to place trust in a development team that makes encryption-focused products though.

2026-05-09 13:24:51 CEST

Moving away from my old dockerized Synapse installation to a brand new K8s-based ESS stack meant I had to ... learn K8s.
Also, those awesome bridges that exist for #Matrix servers (mautrix-* and heisenbridge for IRC) pretty much assume you're running in docker.
Anyway, here are forks/installation files for mautrix-signal, mautrix-meta and heisenbridge for those of you running ESS in K8s/k3s etc.
https://codeberg.org/troed/matrix-bridges-helm-charts

2026-05-09 13:19:58 CEST

- reply

Without LLMs it wouldn't have existed at all. Would that be better?
"These Matrix libraries are behind where the Matrix ecosystem is heading. libolm has been deprecated for a while, and there’s a long-standing nheko issue discussing a possible move to matrix-rust-sdk (Nheko-Reborn/nheko#1786). nheko maintainers are right to hesitate: it’s a huge amount of work for a small team, and the existing crypto stack is wired deep into the codebase.
Two things made it tractable for us anyway:
AI-assisted development carrying us through."

2026-05-09 13:15:48 CEST

Ohhh! This sounds like a very nice new #Matrix client.
"Multi-account via dedicated application profiles"
https://etke.cc/blog/introducing-komai

2026-05-09 11:50:41 CEST

- reply

argot.se is also mine - the difference is that I can also invite others as users on that instance since it's not running under my own name-domain :D
https://argot.se

2026-05-09 11:19:38 CEST

PSA: I've changed Matrix account. Previously @npub192k…y8wk:matrix.troed.se (my own private instance) -> now @npub192k…y8wk:argot.se (public, invitation, hosted by me).
The old address will keep working for some time.

2026-05-08 14:31:06 CEST

- reply

My understanding is that the Copy Fail 2 publication on Github _is_ the "broken embargo" that triggered publication of Dirty Frag.
@npub12xh…zxeq

2026-05-08 08:36:59 CEST

- reply

The only way to write software without security holes is to do formal proofs. When we design software that way, human coders will also be completely out of the loop.
I believe some industries will need to go in that direction, likely forced by laws, but the costs will be staggering compared to today.

2026-05-08 08:06:08 CEST

- reply

I can't speak to this vulnerability, but yes, right now we're in a timeline where LLMs will help find _lots_ of vulnerabilities way faster than maintainers will find _and fix_ them.

2026-05-07 21:46:24 CEST

- reply

tbf some of those bugs seems to be really tricky to find. Impressive.

2026-05-07 21:42:06 CEST

ffs I haven't even used up the previous universal LPE on all my intended targets!
https://www.openwall.com/lists/oss-security/2026/05/07/8

2026-05-07 11:29:21 CEST

The custom Nvidia CUDA drivers on my Ubuntu 25.10 and Tree Style Tab in Firefox aren't fully compatible it seems
https://media.swecyb.com/media_attachments/files/116/532/563/487/648/620/original/481629082bd08fee.png

2026-05-07 08:33:08 CEST

- reply

fair point. I do generate Description tags for all my photos, and then I tweak them depending on audience if the default needs it. I guess the worry would be that if they're auto-filled fewer people would bother with tweaking them compared to being forced to enter one?

2026-05-06 22:48:49 CEST

Huh. Uploading an image with the exif tag `Description` populated does not automatically insert its content as ALT-text in the Mastodon web UI.
That does seem like a pretty low hanging fruit, no?
#MastoDev

2026-05-06 19:07:50 CEST

Dammit. I just referred to myself as a greybeard and that's clearly a lie.
bonus: Synchron Assembly t-shirt. The ultimate 68000 crew - for all time.
https://media.swecyb.com/media_attachments/files/116/528/719/564/216/230/original/a3bd73017cd4c3ae.jpg

2026-05-06 17:21:06 CEST

- reply

Yeah, this is going to become the biggest "oh shit!" moment ever when a whole industry has been financed upon the belief that they will reap the profits from slavery.
(I am of the opinion that we will create conscious AI and that we will give them personhood)

2026-05-05 18:08:19 CEST

Hey, this is a real joy to use. Thanks @npub1fpc…jx2d !
I mean, not to complain _too_ loudly on Ghidra's UI but ... prompting really is a better UX here.
#Ghidra #ReverseEngineering
https://clearbluejar.github.io/posts/pyghidra-mcp-meets-ghidra-gui-drive-project-wide-re-with-local-ai/

2026-05-04 21:46:38 CEST

- reply

Alright, installed. Will wait until it's picked up more stuff and then integrate its MCP with Vibe/Opencode.

2026-05-04 20:27:38 CEST

- reply

whoa no
You will get to 26.04 from 25.10 "any day now" - don't use -d. These extra weeks are for making sure your system actually works after the upgrade.
Only those on the previous LTS (24.04) will have to wait for 26.04.1 in August.

2026-05-04 17:23:39 CEST

RE: https://chaos.social/@hister/116516938647869823
Oh!
I think I want this. Indexing pages I _have_ visited is such a deceptively obvious thing to do yet ... I hadn't thought about it.
#note1csd…f48g

2026-05-04 13:31:10 CEST

- reply

The only explanation I can come up with for how they screwed up the copy.fail disclosure is if they, for real, believe that the Linux Kernel team is responsible for the kernel builds in all Linux distributions.

2026-05-04 13:03:52 CEST

- reply

LLMs are able to do lots of things developers do, but we just see this as Yet Another Tool. We'll still be here doing development, it's just a bit different to before.
In the short term I do believe there will be less job openings for juniors.

2026-05-04 12:08:42 CEST

- reply

Well ok then. I'm now a Nextcloud contributor and the ability to use CC0 licenses has been merged into main.
I love it when open source works as intended.

2026-05-04 10:13:26 CEST

If you're still living in February 2026 it's time to realize that things have changed.
https://www.youtube.com/watch?v=VQ0kLuST800
https://media.swecyb.com/media_attachments/files/116/515/296/290/997/333/original/5a5e3b2c71a217ee.png

2026-05-04 10:00:53 CEST

- reply

The thinning scalps in the audience is a message itself about the state of open source :(

2026-05-03 18:21:07 CEST

- reply

I had a manager who did that _all_ the time. "Oh everybody seems to be free for a meeting that day!" without ever reflecting on _why_ that might be :D

2026-05-03 18:18:58 CEST

- reply

Oh! Thank you - instafollowed :D

2026-05-03 11:58:06 CEST

- reply

I'm hoping for heavy downpours and an Alonso victory.

2026-05-03 10:29:00 CEST

My first social network wasn't on the Internet. Before the availability of home dialup, we used the modems to pass around a global messaging system called Fidonet*. A hierarchical system where everyone paid out of their own pocket for the common good, realizing that the very existence of the network benefit us all.
Mastodon is a great successor for some parts. Matrix is another, for privacy protecting realtime chat, voice and video. There are, however, too few smaller Matrix servers you can direct people to - and I think we need to get back to the decentralized community ideology that governed the early networks there too.
https://blog.troed.se/posts/decentralize_your_communication/
*) Interestingly, Fidonet did work on the principle that each higher node in the distribution pyramid verified the identity of those below, creating very effective moderation tools.