Jan Schaumann

Vell, I'm just zis guy, you know?

Website / Blog: https://www.netmeister.org

Public Key

npub1z6e60xgyfcjq42deezd8695tp5ne08dkxqs7acg40ntmcrr23arsjwehl4

NIP-05 Address

Profile Code

nprofile1qqspdva8nyzyufq24xuu3xnaz69s6fuhnkmrqg0wuy2he4aup34g73cpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds0lcwyx

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1z6e60xgyfcjq42deezd8695tp5ne08dkxqs7acg40ntmcrr23arsjwehl4

Show more details

Last Notes

2026-04-13 16:38:58 CEST

*slow clap* to everybody out there doing Anthropic's Marketing Team's job for them. 🍿

2026-04-11 18:12:42 CEST

"#Mythos discovers 27-year-old bug" is intentionally conflating length of existence of a bug with difficulty of finding it. There is no such correlation.
If software projects and companies performed regular, ongoing, in-depth code audits over and over and missed it, sure, then age would be meaningful, but that is simply not what organizations do.
But sure, it makes for great headlines.

2026-03-18 18:19:48 CET

Starting to think the real risk is not AI replacing junior staff, but senior staff quitting because they just can’t take this AI bullshit any longer and just opt for early retirement.

2026-03-05 00:40:05 CET

What idiot called it “agentic AI” when “Claude Computing” is right there?
(Bonus joke: There is no Claude, only other peoples’ content.)

2026-02-27 16:27:59 CET

"Never have, never will." Promise, shmomise.
This is some bullshit, Mozilla.
https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e#diff-a24e74e4595fa85440a2f4e7e5dcfe68aba6e1e593aef05a2d35581a91423847
And the explanation is bullshit, too, and sounds rather annoyed at having to explain to us silly users that *of course* you have to "share some data with our partners".
https://blog.mozilla.org/en/firefox/update-on-terms-of-use/
https://media.mstdn.social/media_attachments/files/116/143/284/786/316/090/original/5919273be9cfaca9.png

2026-02-25 03:28:40 CET

Tonight seems like a good time to remind folks that the next #nokings protest is planned for March 28th:
https://www.nokings.org/
Mark your calendars, I'll see you there! ✌️
#sotu #fucktrump

2026-02-22 23:12:13 CET

I still don't understand where people think Senior Engineers come from if they replace Junior Engineers with AI.
How do they think the next iteration of GIGO regurgitated code will be validated and debugged if nobody understands how the black box works?
Not wanting to understand but just wanting the quick answer is a clear trend and implicit outcome of frequent AI use.
To me, that's the real supply chain risk.

2026-02-03 17:33:45 CET

If you'd like to have a nice 🤦-y day like me, go ahead, search your internal code repository for the following:
curl -k
wget --no-check-certificate
verify=false
InsecureSkipVerify: true
ssl_verify_mode: 0
TrustSelfSignedStrategy
rejectUnauthorized: false
strict-ssl = false
http.sslVerify = false
--no-verify-ssl
--insecure*
verify_hostname: 0
It'll be great.

2026-02-01 18:41:37 CET

Billionaires, man. Greedy motherfuckers.
Brin is worth $266B. A one-time 5% billionaire tax (with the money going to healthcare!) would mean he's left with... $242B. Which that year's rate of growth would trivially earn him back. But he just can't.
You can do a 99% one-time billionaire tax and he'd be left with *2.6 billion dollars.
https://www.nytimes.com/2026/01/28/us/politics/california-billionaires-sergey-brin-campaign.html
CA has maybe 200 billionaires in a population of ~40 million. Talk about the richest 0.0005%. Greedy motherfuckers.

2026-01-29 13:51:21 CET

NoFX pops out of retirement to say #fuckICE 🤘:
https://www.youtube.com/watch?v=sU6s6VEJxrU

2026-01-29 02:54:22 CET

And this is why he's The Boss.
"Here in our home they killed and roamed
In the winter of ’26
We’ll take our stand for this land
And the stranger in our midst
We’ll remember the names of those who died
On the streets of Minneapolis"
https://www.youtube.com/watch?v=wWKSoxG1K7w

2026-01-27 19:27:05 CET

OpenSSL Security Advisory
https://openssl-library.org/news/secadv/20260127.txt
One high, one medium, and 9 low severity issues.
The high severity is a stack buffer overflow in CMS AuthEnvelopedData parsing (CVE-2025-15467): attacker provides an oversized IV, leading to buffer overflow prior to authentication, possibly leading to remote code execution if you're parsing untrusted CMS or PKCS#7 content with AEAD (e.g., AES-GCM).

2026-01-23 18:27:47 CET

Here #curl is again showing the way in Open Source, this time with vulnerability management. Per their well-known/security.txt:
https://media.mstdn.social/media_attachments/files/115/945/581/457/119/897/original/7a353e1277dcc360.png

2026-01-23 17:22:40 CET

With TikTok now going to be owned by Larry Ellison and Emerati MGX/G42, the concerns about it being used as a government propaganda machine really are totally put to rest. Phew!
(My hope remains that this move will ruin the product and the kids will move on.)

2026-01-11 20:07:23 CET

Everybody walking past Trump Tower be like…
#fuckICE #iceoutforgood #fucktrump
https://media.mstdn.social/media_attachments/files/115/878/031/379/071/743/original/71247ab8feb95f77.jpeg

2026-01-06 17:23:34 CET

Quotable as ever, here's @npub1fdr…lvhs on code as liability and that having AI produce more code faster is simply tech debt at scale:
https://pluralistic.net/2026/01/06/1000x-liability/#graceful-failure-modes
"The longer a computer system has been running, the more tech debt it represents. The more important the system is, the harder it is to bring down and completely redo."
"Writing code that works, without consideration of how it will fail, is a recipe for catastrophe. It is a way to create tech debt at scale."

2026-01-05 17:39:57 CET

Completely different topic, so ripping this quote out of the context from the article I just boosted:
"I wonder how much Venezuelan sensitive information was in fact stored on Google/Microsoft services and accessed by the US military to prepare their recent strike."
This is indeed a pretty interesting question to ponder. And if you're, say, Greenland, maybe consider your use of US cloud services...

2025-12-24 18:27:08 CET

- reply

He was covered in cables, from head to his foot,
patched 'em in switchports, he doubled throughput!
He opened his laptop, his terminal: no hype.
No Electron, no XCode, only in 'vi' did he type.
His code -- so readable! His Makefiles how clean!
His scripts were well structured, his includes pristine!
His CFLAGS? Warn 'all', warn 'extra', be extra pedantic
Turn warnings to errors, it's almost romantic!

2025-12-24 18:26:05 CET

- reply

The zombie processes with their parent now killed
were reaped by init(8), as Ken Thompson willed;
So out of the process table they flew,
freeing up cycles and memory space, too.
And then, in a twinkling, the tcpdumps showed,
with buffer caches flushed, connections now flowed!
As I mirrored the ports and tailed the log file,
I heard St. Root run down the hot aisle.

2025-12-24 18:24:58 CET

- reply

With a little old hacker, so focused, resolute,
I knew in a moment it must be St. Root.
More rapidly typed spells I've never seen
And he whistled, and shouted, and cursed at the screen:
"Ugh, DOCKER! Now, TRACEROUTE! Now, KTRACE and TRUSS!
On, PYTHON! On PERL! No RUBY or RUST!
Process loops fork! I'll have to killall(1)!
Now bash - away! bash away! Warn users with wall(1)!"

2025-12-24 18:23:36 CET

- reply

When out of the machine room there arose such a clatter,
I sprang from my bean bag to see what was the matter.
Away to the laptop I flew like a flash,
logged into the jumpbox, starting my bash,
The lights on the servers blinking all red
Gave the lustre of multiple threads all locked dead
When, what to my wondering eyes should appear,
But a banged up crash cart, with eight cans of beer

2025-12-24 18:22:19 CET

'Twas the night of the moratorium, and all through the cloud
not a pager was beeping: no deploys were allowed.
The packages frozen on the servers with care,
In hopes that an outage would strike nowhere;
The developers still pondering code to embed,
While visions of monads danced in their heads.
The VM put to sleep, and I in this app,
Had just settled down for a long masto thread,

2025-12-11 22:29:25 CET

- reply

If you just updated React / NextJS for #react2shell , you now get to update again. Two additional vulnerabilities identified in follow-up work were just published: CVE-2025-55183 (DoS), CVE-2025-55184 (Source Code Exposure)
https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
https://nextjs.org/blog/security-update-2025-12-11

2025-12-05 22:47:36 CET

Here's another funny generational divide: students no longer understand public_html directories and /~user/ URLs because apparently nowadays shared fileserver access is no longer a thing.
Smh, fist, yells at cloud.

2025-12-05 16:16:18 CET

- reply

Yesterday, after various bogus AI slopped "PoC"s, eventually a functional PoC for the React RCE emerged:
https://github.com/msanft/CVE-2025-55182
We now have a PoC from the reporter of the vulnerability as well:
https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc
#react2shell

2025-12-03 16:55:53 CET

"We did a number of refactors [...] This also fixes a critical security vulnerability." 👀
CVE-2025-55182, an RCE in React Server Components just landed:
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
Enjoy your patching, and make sure to check your bundled frameworks and dependencies.
Here's the commit:
https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700

2025-11-29 18:00:49 CET

What comes first?

2025-10-22 03:59:50 CEST

Trump literally demolishing the White House may just be too much symbolism for me.
https://media.mstdn.social/media_attachments/files/115/415/338/623/776/972/original/a2d6716d591088fa.jpg

2025-09-26 03:55:28 CEST

Over the last few months, I've repeatedly had people tell me about how "well, the Military will refuse an illegal order", to which I can only gesticulate in a bewildered manner in the direction of at least 17 dead from the Venezuelan boats they happily blew up, why not.
And the third one barely made any headlines. Jfc.

2025-09-08 19:35:03 CEST

Re-posting due to current events.
The secret language of coders, part N of many. Today: "npm"
https://media.mstdn.social/media_attachments/files/115/169/873/014/568/153/original/0607965fd4da8a5a.png

2025-08-27 21:44:21 CEST

https://xkcd.com/2347/ recursion
https://media.mstdn.social/media_attachments/files/115/102/434/901/125/227/original/a0f2758bd2946b67.png

2025-07-31 17:45:28 CEST

The problem with dogfooding is if it tastes like dogfood, I don't wanna eat it.

2025-06-27 00:33:50 CEST

Ugh, here we go. People in the U.S. will get sicker more often, overall health and average life expectancy (US currently ranks 48th or so) will further decline. But because that impact will individually be subtle and compound only over years, the idiot population won’t make the connection.
Next on the chopping block: MMR vaccines. So yeah, young kids and infants are actually going to die. USA, USA.
https://www.nytimes.com/2025/06/26/health/rfk-jr-vaccines-acip-cdc.html

2025-06-18 18:13:22 CEST

At Akamai, we're launching a blog post series on various topics relating to post-quantum cryptography. The first post is by @npub18zc…4p69, discussing some related IETF initiatives, including the two #TLS drafts he co-authored:
https://www.akamai.com/blog/trends/building-quantum-safe-internet-ietf-plan-tls
#pqc

2025-05-29 04:56:00 CEST

New blog post! Bootstrapping HTTP/1.1, HTTP/2, and HTTP/3 -- redirects, HSTS, Alt-Svc, ALPN, HTTPS DNS records, oh my.
https://www.netmeister.org/blog/http-123.html

2025-05-22 17:28:55 CEST

CVE-2025-4575: Low severity OpenSSL (3.5 only) vulnerability in openssl x509 (marking certs as trusted when asked to reject them): https://openssl-library.org/news/secadv/20250522.txt
Unlikely to have a big impact, but it's funny since this is a case of the tool doing the literal opposite of what it's asked to do. :-)

2025-05-13 20:04:45 CEST

Pffft *spits coffee all over keyboard*
So apparently on #Linux, usernames starting with "0x" are interpreted as hex numbers under certain circumstances. 🤪 That seems like asking for trouble...
https://media.mstdn.social/media_attachments/files/114/501/839/068/572/779/original/2e088f061f9c19f0.png

2025-05-11 17:21:10 CEST

- reply

I know "X will ruin learning" has been said for every new technology from Wikipedia back to books, but over the last 20 years of teaching, I've definitely observed a regression in students' independent learning ability, while simultaneously seeing an increased aversion to seek help. Students believe answers must be found online via Stackoverflow, Google, and now AI, but also think they are expected to provide complete answers, when often I'm looking much more for _how_ they got their answer.

2025-05-11 17:12:03 CEST

Students not merely cheating with, but utterly relying on AI in "a society that treats schooling as [nothing more than] a means to a high-paying job" is deeply concerning as AI may actually make you dumber:
"research shows that when students off-load cognitive duties onto chatbots, their capacity for memory, problem-solving, and creativity could suffer. Multiple studies published within the past year have linked AI usage with a deterioration in critical-thinking skills"
https://www.msn.com/en-us/news/technology/everyone-is-cheating-their-way-through-college/ar-AA1EjCRk

2025-05-09 15:37:20 CEST

German President Steinmeier's speech commemorating the 80th anniversary of the end of World War II:
https://www.bundespraesident.de/SharedDocs/Reden/EN/Frank-Walter-Steinmeier/Reden/2025/250508-End-WWII.html
You want to read the whole thing, but the part below and the emphasis on the importance of learning from the past instead of describing it as a "cult of guilt" were powerful and eloquent. No words were minced, and we need more of that.
https://media.mstdn.social/media_attachments/files/114/478/133/068/595/224/original/9a9e2867b4d9b8bc.png

2025-04-28 17:11:29 CEST

I'm both so very thankful that https://github.com/lwthiker/curl-impersonate exists and simultaneously hate that I need it.
The web should be the web should be the web no matter what client you use to access it.

2025-04-09 23:11:38 CEST

Oh, ok, Yahoo. That's interesting. I have another idea: fuck you.
https://media.mstdn.social/media_attachments/files/114/310/053/819/942/831/original/4d2e842f7b7805a6.png

2025-03-31 19:21:45 CEST

- reply

Hey Brian, just wanted to say how much I appreciate your speaking out against the active, ongoing destruction of democracy in the US. For every boneheaded “I came for cybersecurity, you should be apolitical” reply know there are dozens if not hundreds who hear and value your voice and courage.

2025-03-19 19:23:36 CET

So I'm curious about something. Boost for reach?
You are a dual US / Other citizen with international travel booked in the near future.
You are ___ sure you will be able to re-enter the US without any problems:

2025-03-18 02:20:10 CET

- reply

The secret language of coders, part N of many. Today: security vendor vulnerability announcement phrases.
https://media.mstdn.social/media_attachments/files/114/180/793/442/873/233/original/104d8f63b3387800.png

2025-03-16 17:43:09 CET

An interesting recap of how the #Plan9 OS developed at Bell Labs, with many familiar names, including, of course, Ken Thompson, Dennis Ritchie, Rob Pike, and many others, making appearances.
"What I Saw at the Evolution of Plan 9" by Geoff Collyer
https://adi.onl/oral.pdf
#unix

2025-03-11 15:09:59 CET

NIST selects HQC (Hamming Quasi-Cyclic -- https://pqc-hqc.org/) for standardization as the second #PQC key-encapsulation mechanism after ML-KEM.
But no rush, "the final version will be published in approximately two years".
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/w-6RREtb7-c/m/vRjBJE3dAAAJ
https://nvlpubs.nist.gov/nistpubs/ir/2025/NIST.IR.8545.pdf

2025-03-11 04:05:51 CET

If you haven't followed the Mahmoud Khalil story, you should.
"The nearly 13 million green card holders in the United States — not to mention foreign students and professors — have been put on notice that they need to watch what they say. [...] Nor can citizens rest easy; a government this willing to disregard the First Amendment is a danger to us all."
https://www.nytimes.com/2025/03/10/opinion/mahmoud-khalil-free-speech.html?unlocked_article_code=1.3E4.lFik.M0JJqcxbLOxG&smid=url-share
https://media.mstdn.social/media_attachments/files/114/141/581/339/222/436/original/f9ccbffd82e5f246.png

2025-03-08 19:58:36 CET

The search on https://www.nih.gov/ will not show any results if you search for these (standalone) words:
- diversity
- equity
- inclusion
- DEI
- DEIA
- gender
- transgender
- nonbinary
- non-binary
- racism
Instead, it redirects you back to the home page.
But because there's also always incompetence in addition to malice, just putting the term in quotes or adding another word _does_ give you results. (Although perhaps that's resistance by those forced to implement the censorship?)
https://media.mstdn.social/media_attachments/files/114/128/325/100/411/627/original/b7ef41b6aabd2db5.mp4

2025-03-04 04:39:15 CET

Tonight might be a particularly good time for Americans to donate to the #Ukraine - I just did and hope you will, too.
https://u24.gov.ua/ makes it easy and lets you choose where you want your money to go to.
#SlavaUkraini & #FuckTrump
https://media.mstdn.social/media_attachments/files/114/102/074/311/334/525/original/5a3fa6d1f66f7d8d.png

2025-03-02 03:01:41 CET

While y'all are having fun with nih.gov's name servers, quick reminder that here's a quick little tool to run a query against multiple public resolvers to see what they see:
https://github.com/jschauma/puddy
(I also have a web interface for puddy, but don't want to mastodos my server. It's linked from GitHub, if you insist. :-)
cc @npub1afm…5gp4
https://media.mstdn.social/media_attachments/files/114/090/365/808/272/530/original/29889d0f3fc3750c.png

2025-02-27 17:25:50 CET

- reply

Today in "#systemd ruins everything", Jan learns that systemd-resolve...
- runs a proxy DNS server on 127.0.0.53 (which is in /etc/resolv.conf)
- uses it's own /run/systemd/resolve/resolv.conf
- will read and cache /etc/hosts regardless of what /etc/nsswitch.conf says (`ReadEtcHosts` defaults to `yes` in /etc/systemd/resolved.conf)
Applications that follow traditional libc resolver logic now will continue to get /etc/hosts results even if /etc/nsswitch.conf excludes 'files'.
🤦‍♂️

2025-02-26 23:35:25 CET

Wait, what? By using #Firefox, I now grant Mozilla "a nonexclusive, royalty-free, worldwide license to use" any data I "upload or input"? That seems, uhm, rather broad. Wtf.
I want my old Mozilla back.
https://www.mozilla.org/en-US/about/legal/terms/firefox/
https://media.mstdn.social/media_attachments/files/114/072/563/541/661/872/original/093a810db2f2857a.png

2025-02-26 04:53:26 CET

Mark your calendars, nerds! Nationwide "Stand Up for Science" rallies to protest Trump's attacks on science and common sense are scheduled for March 7th.
Find your local event here:
https://standupforscience2025.org/
#standupforscience #fcktrmp

2025-02-23 17:02:08 CET

- reply

1) Thanks a lot for your always thorough and insightful analysis. I really appreciate your work! (Long overdue.)
Less important, but FYI
2) The link “something like this has already happened” goes to https://berthub.eu/articles/posts/servers-in-the-eu-eigen-sleutels-helpt-het/#wat-als-er-ruzie-is, which 404s.

2025-02-20 02:41:32 CET

I know it's one part "let's get folks riled up" but it's also two parts "haha, only serious", and I'm not going to link to it, but when Trump tells the world he sees himself as King, not President, people need to fucking believe it.
Every single representative or senator needs to take this seriously and distance themselves explicitly. Anything less needs to be reported as betraying Democracy itself.

2025-02-17 20:03:48 CET

Scenes from the “No Kings On Presidents’ Day” protest in Union Square just now.
Fuck Trump. Fuck Musk. And fuck the entire cowardly Republican Party.
#NotMyPresident #nyc
https://media.mstdn.social/media_attachments/files/114/020/767/482/849/500/original/61575f9558b463a3.jpeg
https://media.mstdn.social/media_attachments/files/114/020/767/421/672/482/original/53767cf124569e08.jpeg
https://media.mstdn.social/media_attachments/files/114/020/767/414/240/941/original/61b1594cca46e2d9.jpeg
https://media.mstdn.social/media_attachments/files/114/020/767/486/132/074/original/caf76912ef9afcff.jpeg

2025-02-16 21:58:56 CET

FYI: I have made public new #NetBSD AMIs for #AWS #ec2. These are evbarm and amd64 images for NetBSD/10.1 and now have their boot messages sent to the serial console (although it takes EC2 about 5-8 minutes from instance creation until `aws ec2 get-console-output` shows the messages).
These AMIs should be public and ready for you to launch in us-east-1a:
https://stevens.netmeister.org/615/netbsd-amis.html

2025-02-13 17:17:31 CET

- reply

TIL: On Ubuntu, AppArmor restricts tcpdump from reading files that don't end in ".pcap". 🤦‍♂️
$ ls -l /tmp/out
-rw------- 1 tcpdump tcpdump 13651 Feb 13 15:49 /tmp/out
$ sudo tcpdump -n -r /tmp/out
tcpdump: /tmp/out: Permission denied
$ sudo mv /tmp/out /tmp/out.pcap
$ sudo tcpdump -n -r /tmp/out.pcap
reading from file /tmp/out.pcap, link-type EN10MB (Ethernet), snapshot length 262144
[...]
Why are people trying so hard to make "file extensions" happen?

2025-02-04 16:36:36 CET

Not that it surprises me, but the "National Cybersecurity Strategy" has disappeared:
https://www.whitehouse.gov/oncd/national-cybersecurity-strategy/
So yeah.
Archive link:
https://web.archive.org/web/20250117195921/https://www.whitehouse.gov/oncd/national-cybersecurity-strategy/
#infosec

2025-01-26 17:10:43 CET

- reply

System Administration
Week 1, #Unix History
Exhibiting one of the cardinal virtues of System Administrators — laziness — we're reusing a video from my #programming class to give a whirlwind history tour: Bell Labs, Berkeley & the Unix Wars, USL v. BSDi, the birth of #NetBSD & #FreeBSD, the development of GNU & its adoption of #Linux, all leading to Unix on your fridge, car, and mobile phone.
https://youtu.be/3H7SQWTR6Dw
Last semester's #apue thread:
https://mstdn.social/@jschauma/113087999769442250
#sysadmin #sre #devops

2025-01-25 20:47:36 CET

- reply

System Administration
Week 1, Core Principles
In this video, we present a few core principles that will guide us throughout the semester, including our three pillars: Scalability, Security, and Simplicity. We'll also get to know a few basic "laws", well known by any System Administrator. If you're wondering what all this has to do with Legos, please tune in...
https://youtu.be/bfqP6PlS6Og
#SysAdmin #sre #devops

2025-01-24 18:51:13 CET

- reply

System Administration
Week 1, The Job of a System Administrator
In this video, we try to show what things SysAdmins may encounter in their day to day routine, ranging from power tools to actual and symbolic duct tape and WD40. With this, we try to sort out just how the job may be defined. It's not that easy, as it turns out...
https://youtu.be/osIO9CbqHQo
#SysAdmin #sre #devops

2025-01-23 17:34:13 CET

- reply

System Administration
Week 1, Introduction
We cover all the meta info for the course, how System Administration fits into a Computer Science curriculum, our syllabus, systems used, grading policy etc. (There will be Venn diagrams...)
https://youtu.be/QJL5cNv9dJs
#sysadmin #sre #devops

2025-01-22 18:24:55 CET

This week, I'm again starting my #SysAdmin class where we focus on a lot of practical aspects commonly missing in Computer Science curricula. I'm running the same class as an internal study group at work as "Internet Operations".
The syllabus and all course info is available here:
https://stevens.netmeister.org/615/
All video lectures are public and available for free on YouTube:
https://www.youtube.com/@cs615asa/videos
Follow along! I'll be posting weekly links in this thread throughout the semester.
#sre #devops

2025-01-16 21:53:49 CET

You know, I’d pay extra to get a product *without* AI.

2025-01-16 00:19:26 CET

- reply

Just spent 45 minutes groveling through 2,300 lines of bash completion gunk because apparently nowadays bash[1] will only tab-complete files based on filename "extension"[2] as if this was fucking MS-DOS.
Grrr.
[1] Well, _this_ bash on _this_ particular Linux version.
[2] E.g., "sh x<tab>" will only complete "x*.sh".
#LinuxGrievances

2025-01-14 19:26:09 CET

6 new CVEs in "rsync".
"In the most severe CVE, an attacker only requires anonymous read access to a rsync server, such as a public mirror, to execute arbitrary code on the machine the server is running on."
That would be CVE-2024-12084 (9.8) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, a heap-based buffer overflow in rsyncd.
https://www.openwall.com/lists/oss-security/2025/01/14/3

2025-01-13 20:33:48 CET

I forgot where I read it it, but calling a company's "Data Privacy Policy" its "Data Exploitation Policy" exactly describes its purpose spot-on.

2025-01-03 22:50:19 CET

For years, I've seen this weird sort of referrer spamming in my http logs whereby the referrer is set to
`https://<some spam domain><my domain>/<valid path>`
I.e., a spam domain prefix-glued (without a separator of any kind) onto an otherwise valid URL on my site (see screenshot below).
Anybody have an idea what's up with those? It's not useful spamdexing because the resulting domain domain is invalid. What's the objective?
https://media.mstdn.social/media_attachments/files/113/766/624/941/719/026/original/40ecaf132f2cf0ef.png

2024-12-24 03:17:22 CET

A Visit from St. Root - a #SysAdmin poem
'Twas the night of the moratorium, and all through the cloud
not a pager was beeping: no deploys were allowed.
The packages frozen on the servers with care,
In hopes that an outage would strike nowhere;

2024-12-19 16:08:32 CET

- reply

Today's #linux grievance: apparently #fedora comes up with a default firewall that blocks anything besides SSH and something called "cockpit" (apparently a remote admin web interface running on port 9090 using a self-signed certificate, so, uhm, yeah 🤦‍♂️).

2024-12-18 15:59:38 CET

- reply

Oh, and while I'm complaining: requiring sudo for dmesg is stupid, too. 🙄

2024-12-17 20:47:34 CET

I swear, every time I use (a, any) Linux, I have to do a double-take and go "what the fresh fuck is this now". Today it's whatever is going on with /etc/motd on Ubuntu.
Making simple things complicated seems to be the trend there.

2024-12-16 03:30:33 CET

- reply

Most of “The Mythical Man Month”, “Worse is better” and the Unix philosophy. Optimize for readability & human debugging (don’t be clever), use boring tech.
Many of those are common/obvious. Perhaps less so:
Keep your commit history and tracking systems. E.g., #NetBSD’s CVS, mailing list index, and gnats go back to 1993 (which let me fix a bug the other day that I had filed myself 20 years ago). People come and go, so don’t assume context.

2024-12-11 15:44:58 CET

- reply

Scott Aaronson's take (i.e., somebody who, unlike me, knows what he's talking about):
https://scottaaronson.blog/?p=8525

2024-12-11 03:51:15 CET

- reply

So I do think this is very, very cool.
But it's in line with what we've been predicting for quantum computing: we'll see progress made in jumps, but we're still a fair bit away from any practical quantum computer able to do anything useful that a classical computer can't do (much less break RSA).
So no need to panic, but certainly good reason to be excited. And to keep calm and carry on with your post-quantum cryptography efforts, cause it looks like we _will_ get there in a few years' time.

2024-12-11 03:50:04 CET

- reply

You get better coverage in something like New Scientist, which summarizes the importance of their progress:
By exponentially reducing the error rate as new qubits are added, you reach a threshold where larger quantum computers finally actually _get better_, "which hasn’t been a trend so far."
https://www.newscientist.com/article/2459318-is-googles-new-willow-quantum-computer-really-such-a-big-deal/

2024-12-11 03:48:50 CET

- reply

But reporting on quantum computing is difficult, and the concept of superpositions is hard to put into easy to understand language, and so you get misleading suggestions such as the assertion that a qubit is both 0 and 1 at the same time.
This is where I reference @npub1rkp…dy04 's "The Talk": https://www.smbc-comics.com/comic/the-talk-3
You also get weird conclusions like PCMag's "Google makes a quantum leap that suggests we may live in a multiverse." (Not gonna link, you can find it.)

2024-12-11 03:47:43 CET

- reply

The RCS benchmark, as Google notes in their blog post (but what is not as widely reported), "measures performance against classical computers but has no known real-world applications".
Why it's useful is explained in a somewhat approachable manner in the paper "Sampling random quantum circuits: a pedestrian's guide" from 2020:
https://arxiv.org/abs/2007.07872

2024-12-11 03:46:39 CET

- reply

What Google did was demonstrate exponential error correction, which is critical due to qubit fragility, requiring multiple physical qubits to be combined into one logical qubit to avoid a collapse into a classical state.
But the calculations they performed are not generic, general purpose calculations. Instead, they ran a specific type of computation, the random circuit sampling (RCS) benchmark:
https://research.google/blog/validating-random-circuit-sampling-as-a-benchmark-for-measuring-quantum-progress/

2024-12-11 03:45:12 CET

- reply

This is a pretty cool step forward in quantum computing. But the reporting I've seen, or perhaps: the takeaways people assume after skimming the headlines are often wildly off the mark.
Part of the problem is in the phrasing, saying Google's chip can solve a problem in 5 minutes that a classical computer can't solve in "a quadrillion times the age of the universe".
This is misleading.

2024-12-11 03:44:32 CET

Google announced a new #quantum chip, "Willow":
https://blog.google/technology/research/google-willow-quantum-chip/
This chip demonstrates exponential error correction:
https://research.google/blog/making-quantum-error-correction-work/
Their research in Nature:
https://www.nature.com/articles/s41586-024-08449-y

2024-12-10 23:21:19 CET

"Multinational corporations are destroying Earth for profit. If we want real change, we have to be willing to threaten those profits"
https://www.irishtimes.com/life-style/people/2024/11/23/sally-rooney-when-are-we-going-to-have-the-courage-to-stop-the-climate-crisis/

2024-12-09 03:17:18 CET

I really don't think Trump's talk of ending birthright citizenship is getting enough attention, being too easily dismissed as unlikely to execute.
It is literally the equivalent of the Reichsbürgergesetz under the Nuremberg Laws.

2024-12-05 02:52:08 CET

- reply

Why, you ask?
Is it because we've filled up all existing #TLDs and ran out of space?
Or is it because consumers, widely recognized for understanding so well the intricacies of the internet, are clearly asking for more TLDs?
Or could it be because ICANN will charge applicants $227,000, and if they get even half the number of applications they did in 2012 (1,930) that adds up to a cool $220M?

2024-12-05 02:50:07 CET

Remember that glorious period back in 2012, when #ICANN started accepting applications for new generic top-level domains (#gTLDs), eventually adding over 1,200 new TLDs, including such goldmines as .extraspace and .vermögensberatung?
Well, clearly that wasn't enough, because we're now finding ourselves on the cusp of another round.
https://newgtldprogram.icann.org/en

2024-11-22 20:59:56 CET

#CISA has been doing a really good job promoting sensical #infosec practices over the last few years.
I'm not looking forward to the change in direction that Jen Easterly's departure and whatever ghastly appointees the new administration comes up with will mean.
https://www.nextgov.com/people/2024/11/cisa-director-jen-easterly-depart-inauguration-day/401036/

2024-11-15 02:41:26 CET

- reply

Jokes aside, I expect
(a) CISA to rescind its previous (and actually really good) guidelines, because business
(b) a requirement for services to provide "lawful access" to encrypted messages
(c) a mandate that everybody switch to quantum computers by end of 2025
(d) a new Cryptocurrency Czar under CISA/DOGE
It'll be yuge.

2024-11-09 17:43:19 CET

Ancient Rules of Open Source #17
If you wait long enough, the person who reported the bug will eventually fix it themselves.
Although sometimes that can be 20 years:
https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=27309

2024-11-08 16:10:08 CET

I'm so exhausted from the next four+ years.

2024-11-06 17:33:48 CET

"This time, that choice came with full knowledge of who Trump is, how he behaves in office and what he’ll do to stay there. [...] The grotesque rally at Madison Square Garden, that carnival of insults against everyone that the speakers do not want in their America, was not an anomaly but a summation. It was Trumpism’s closing argument, and it landed."
https://www.nytimes.com/2024/11/06/opinion/trump-wins-harris-loses.html

2024-10-29 03:35:27 CET

You all know how `popen(3)` shells out and thus has been the cause of countless command injections, but did you also know that #NetBSD has `popenve(3)`, which uses `execve(2)` instead?
https://man.netbsd.org/popenve.3
Seriously, other #Unix versions should pick that up.

2024-10-19 00:36:53 CEST

One of the more infuriating aspects of the tech industry's appalling "sorry, can't cut down on emissions, we need #AI to solve #ClimateChange" stance is that this is simply not an unsolved problem. We *know* what the solution is. We *know* how to implement it. We just *choose not to do it* -- precisely for the same reasons tech leaders don't want to cut down on their energy use: short term profit at all cost.
https://mastodon.online/@parismarx/113328904040155003

2024-10-16 18:36:54 CEST

- reply

While I expect Harris to win the popular vote (albeit perhaps by less of a margin than Clinton), the electoral vote is a toss-up. If we're lucky and she wins, it'll be by a slim margin. And then the attempts to overturn that result will kick into high gear.
I expect several local election boards and some state governors to refuse to certify the vote. Challenges will go to courts stacked by Trump loyalists. Democrats need to be ready, but I fear we'll see a lot of "Who could've foreseen _this_?"

2024-10-16 18:35:31 CEST

I sure hope that Democrats are lawyering up and preparing for what's coming after November 5th.
Unfathomably, this election is still close. There will be no landslide. Somehow the result hinges on a small number of as-of-yet "undecided" voters trying to make up their mind between a dastardly, incompetent, racist grifter dictator-wannabe and a well-qualified candidate who respects democracy -- who happens to be a woman (Gasp! Inconceivable!).

2024-09-27 00:54:24 CEST

- reply

👍
Waiting for an automated job still feels like waiting for a cron job to click a link, though, unless the attacker can trigger/inject the job.
¯\_(ツ)_/¯

2024-09-27 00:37:05 CEST

- reply

And I still think that “wait for a user to print something to the malicious printer” counts as “user interaction”, which many scores don’t seem to reflect.
https://mstdn.social/@jschauma/113205895293128908

2024-09-26 23:07:56 CEST

- reply

Might be worth calling out that this #cups #rce is dependent on the user sending a print job to the injected/manipulated printer.
In my book, that counts as "user interaction", and would yield a CVSS score of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L => 8.8
https://media.mstdn.social/media_attachments/files/113/205/893/653/436/603/original/8f4778fd10e324b6.png

2024-09-26 22:26:23 CEST

Looks like that end-of-the-world-all-your-linux-are-belong-to-us hyped #RCE vulnerability leaked early and it's #CUPS:
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
So… you know… maybe don't run a printer server on your prod systems. But every #sysadmin already knew that printers are the enemy.
https://media.mstdn.social/media_attachments/files/113/205/725/278/182/287/original/69d00f8a0291d08c.png