← Feed

Posts

• Post #4492252

  You're right - AI _is_ useful. Your use of it provides an important signal to me: 1) For writing: "I didn't care to put the effort in to write this myself." 2) For coding: "I don't care if I understand the solution." 3) For vuln impact analysis: "I don't understand the code base nor the attack vector." Or shorter: "I do not care about the details." This, of course, on top of the other ethical problems with AI. It's a strong signal,...

• Post #4359135

  I've used the same metaphor ("using AI for assignments is like paying somebody to go to the gym for you") for my students for a long time now. https://www.schneier.com/blog/archives/2026/07/should-you-use-ai-for-a-task-heres-a-simple-way-to-decide.html (Going forward, I may also have to play "Hacks" Season 5 Episode 6 for my students on the first day of the semester.)

• Post #4018115

  So, uhm, at this point, seems like local privilege escalation vulnerabilities are numerous enough that you can pretty much assume that any local user can become root and escape most containers, yes? "FragGap" LPE via IPv4/IPv6 UDP corking path https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/ https://github.com/qwerty-po/security-research/tree/cve-2026-53362 https://github.com/sgkdev/ipv6_frag_escape

• Post #3982362

  OpenAI now announces that its latest model is _so_ advanced that it considers itself too dangerous to be used by anybody and consequently has deleted itself. The crowd goes wild at the prospect of buying stock in a company that now focuses 100% of its tremendous efforts and compute power on _not_ building AI. It's difficult work, but for the sake of mankind, no sacrifice is too stupid.

• Post #3974322

  RE: https://mastodon.social/@nixCraft/116953574480188144 Lol, nice. I've said it before: linux kernel CVEs are no longer meaningful. You can't assess 432 new CVEs. You basically have to sit and wait to see which ones get a logo and a website or which ones become KEVs to prioritize.

• Post #3792915

  Really looking forward to the first large-scale OpenAI / Anthropic API outage, where 85% of the industry will be flopping around trying to remember how to hello-world on their own while execs google "how to write an email".

• Post #3726618

  The whole "We JuST DoNt KnOw iF Claude iS ConsCiOuS" pitch annoys me to no end. The language Anthropic uses — first person narrative, assigned agency and intentions, use of human cognitive vocabulary and so on — consistently aims to imply consciousness. "The program utilizes temporarily stores frequently accessed information relevant to multiple contexts" is a lot less magical than "Claude thinks in its J-space", "privately notices", has "intentions...

• Post #3702466

  No, virtually everybody, when I ask a question on Slack I don't need you to copy that question into your AI bot and then paste the answer it gave you back to me. Goddammit. Srsly, what makes people think I (a) can't do that myself, and (b) want a 3K words sycophantic "summary" full of emojis and a 50/50 chance of confidently misleading all of us?

• Post #3634163

  Oh, goodie. KVM Guest-to-Host escape "Januscape (CVE-2026-53359)" -- https://github.com/V4bel/Januscape https://www.openwall.com/lists/oss-security/2026/07/06/7

• Post #3431655

  A few notes on Post-Quantum Certificates: - Yes, Merkle-Tree Certificates (MTCs) are smaller than ML-DSA certs, but still pretty large - MTCs come in two flavors: standalone and landmark-relative; servers will need to support both - clients need to update landmarks frequently; how will non-browsers handle that? - web-PKI (MTCs) and private PKI (ML-DSA) are diverging Things are getting more complex... https://www.netmeister.org/blog/pqc-certs.html #pqc #mtc #cryptography

• Post #3330620

  I miss Web 1.0. You click a link, you get to the website, you read the content. What a concept.

• Post #3306726

  This is wild. Anthropic ordered via export control directive "to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees." https://www.anthropic.com/news/fable-mythos-access

• Post #3232545

  New OpenSSL advisory: https://openssl-library.org/news/secadv/20260609.txt 1 high, 5 medium, 12 low severity The high (CVE-2026-45447) was explicitly noted as discovered with help from Claude. What's more interesting is again the confirmation that vulnerabilities are increasingly identified independently by multiple people: CVE-2026-34182 (independently found by 4 different people), CVE-2026-35188 (2), CVE-2026-9076 (2), CVE-2026-34181 (2), CVE-2026-42766 (4).

• Post #3231531

  So people are totally now using AI models for regular stuff that you can do via shell scripts and cron, because why do something for free when you can burn tokens and at the same time actively forget how to use the normal tools at your disposal? 🤦 🙏 🤦

• Post #2561152

  You know, I was going to let this domain expire... https://istheinternetonfire.com/ Originally set up for Heartbleed in 2014; hadn't remembered to update it since the CrowdStrike incident two years ago. I guess I'll just set it to a permanent "yes" going forward. #CopyFail #DirtyFrag

• Post #2526563

  #DirtyFrag status/advisories: AlmaLinux: https://almalinux.org/blog/2026-05-07-dirty-frag/ Debian: https://security-tracker.debian.org/tracker/CVE-2026-43500 https://security-tracker.debian.org/tracker/CVE-2026-43284 Gentoo: https://bugs.gentoo.org/974307 RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-43284 https://access.redhat.com/security/cve/cve-2026-43284 nothing yet on CVE-2026-43500 Rocky: https://kb.ciq.com/article/rocky-linux/rl-dirty-frag-mitigation SUSE / OpenSUSE:...

• Post #2405691

  This is the start of the Fall semester for my class "Advanced #Programming in the #UNIX Environment". Syllabus and all course materials including all code examples available here: https://stevens.netmeister.org/631/ All video lectures are public and available for free on YouTube: https://www.youtube.com/@cs631apue/videos If you want to follow along, I'll be posting weekly links in this thread throughout the semester.

• Post #2278670

  Congrats! Your new job is: arguing with a bot. Multiple bots. And people outsourcing their brain to bots. But mostly bots. Sometimes you have to social engineer the bots to do your bidding. Sometimes you have to pit the bots against each other. But make no mistake, it's arguing with the bots. That, and email. And meetings. How beauteous mankind is! O brave new world, That has such people in't.

• Post #2245611

  Btw, there's _no_ way we're done here with #DirtyFrag and #CopyFail. Everybody is aiming their LLMs at this attack path through the page cache now, and there's bound to be other ways. Be ready to rinse and repeat a few more times before the dust settles, so I guess keep an even closer eye on linux kernel commits for a while. (And no, I don't know how this will be sustainable.)

• Post #2187633

  Oh FFS. #DirtyFrag https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md "Because the embargo has now been broken, no patches or CVEs exist for these vulnerabilities." https://www.openwall.com/lists/oss-security/2026/05/07/8 Well, just put that CopyFail incident work on rinse and repeat, I suppose...

• Post #2118914

  Le sigh. Every time we go around and have to do this again and manually figure out wtf each of the ten thousand linux distributions provides their security updates and current status. Spending my Saturday morning searching for CVE-2026-31431 and "copyfail" patch status is just 👍. Anyway, here's what I have so far:

• Post #1976208

  Die englische Sprache kennt ja “Verschlimmbessern” nicht, weshalb sie stattdessen “vibe coding” sagt.

• Post #1960394

  This makes some good points about Jevons Paradox / induced demand and how AI becoming just another tool does not necessarily mean catastrophic job losses, but the note it ends on is pretty rough (and something I tend to agree on): “our ability to relate, sensitively and deeply, to other human beings will be a central and valuable skill. That, I fear, is the exact skill we are breaking down in the young.” https://www.nytimes.com/2026/05/03/opinion/ai-jobs-unemployment-silicon-valley.html?unlock...

• Post #1816451

  So printers still suck, huh?

• Post #1816449

  Folks discovering that it's useful to carefully think about a problem and writing down requirements, but now calling it "Skills.md" makes stock go up and burn the planet, so yay.

• Post #1816448

  Meta doing meta things: https://www.reuters.com/sustainability/boards-policy-regulation/meta-start-capturing-employee-mouse-movements-keystrokes-ai-training-data-2026-04-21/

• Post #1816447

  As I told my students just last week: The speed of adoption is currently the biggest risk relating to AI. I mean, yes, haha, AI deleted another production database, but ultimately, this is just the same (I suppose: non-human error) system failure as always. AI needs safeguards against doing something stupid, and those safeguards can’t be asking the AI to “please don’t do something stupid”. https://archive.ph/T3LU6

• Post #1816446

  Question about the GitHub RCE: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 says GHES patches were _released_ on 03/10. https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/ says "we _prepared_ patches [...] and published CVE-2026-3854. These are _available today_". So were GHES patches made available to customers at the time of CVE publication or only today, 1.5 months laster?

• Post #1795677

  Ooooh, nice: https://xint.io/blog/copy-fail-linux-distributions CVE-2026-31431: Local privilege escalation to root using a trivial 732 byte python script for pretty much every Linux distribution since 2017. #CopyFail

• Post #1765318

  Current #infosec status.