← Feed

Posts

• Post #3830731

  https://www.republik.ch/2026/07/09/die-cyber-spezialisten-des-bundes-kehren-microsoft-den-ruecken Nach den vielen Worten zur digitalen Souveränität in der Schweiz kommen jetzt erste Taten zum Vorschein: die Schweizer Armee hat angefangen, an der deutsche Open Source Software Open Desk mitzuarbeiten. Dies ist möglich dank einem Budget von 10 Millionen Franken, dass das Parlament im Dezember 2025 zur Verfügung gestellt hat.

• Post #3698012

  Congrats to Bryan Ford and his team from #EPFL on developing QuePaxa, and now having it picked up by Cloudflare! https://blog.cloudflare.com/meerkat-introduction/

• Post #2302300

  Surprise - the nice #LLM overlords are not specifically suited in education - at least not for now: https://archive.ph/JCKcp It looks at one of the most cited meta-study on using ChatGPT in schools, which showed improvements. But a closer look at the papers used in the meta-study showed a lot of low-quality papers...

• Post #2302298

  A very nice step-by-step explanation of the copy.fail vulnerability in the #linux kernel: https://github.com/fraynal/articles/tree/main/copy.fail Really nice because it shows how choosing something strange at one time might be abused some years in the future...

• Post #2302297

  TIL the adoption dates of the SI prefixes: 1795: deca, hecto, kilo (10**3) 1873: mega (10**6) 1960: giga, tera (10**12) 1975: exa, peta (10**18) 1991: zetta, yotta (10**24) 2022: ronna, quetta (10**30) So between 1960 and 1991 it was nearly two powers of 2 per year, then it dropped to one power of 2 per year. So we might have to wait until 2050 or so for the 10**36 prefixes :) I ignored the negative prefixes, which are symmetric. https://en.wikipedia.org/wiki/Metric_prefix

• Post #2302296

  So - is this #Mythos, or just people looking at the right places now? Time to disable some more modules on your linux servers - one more privilege escalation because somebody allowed writing arbitrary 4 bytes to be written to any page cache: https://github.com/V4bel/dirtyfrag Twice in a couple of days - I should make it automatic to update the servers...

• Post #2209403

  We had this long running joke of my friend starting to program in the 80s, and his first program was: ``` 10 REM Maennchen laeuft ueber die Strasse ``` Which translates to: "guy walks across the street". My friend was very disappointed, when the "run" command didn't produce anything. After all, the programs in the magazines show things? Perhaps the lines after the REM were useful after all? Nobody's laughing anymore now: https://danu.li/#we...

• Post #2090057

  Trying out an analogy regarding our university, #EPFL, abandoning self-developed services and turning to use MS in the cloud: --- It's like a duck going into a Chinese restaurant. Of course everything in there is very yummy. But the duck will be plucked and eaten. --- Duh! Oh, they just increased prices? What a surprise... It's all based on standard protocols, but we're not allowed to use other than the 3 largest mail clients. And they're moving to MS-protocols...

• Post #1621818

  #LLM #Security A very nice follow-up article about "We hold back 'Mythos' because it's so powerful". This company tests various models and finds that with the correct framework, even small models are very powerful at detecting security bugs: https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier > A thousand adequate detectives searching everywhere will find more bugs than one brilliant detective who has to guess where to look....

• Post #1621817

  https://kirancodes.me/posts/log-who-watches-the-watchers.html #formalverification #bug very nice finding: the actually formal verified code was really correct! But the underlying library was not. Nor was the code responsible for reading the file. So: who verifies the verifiers? LLMs, of course :)

• Post #1621816

  @GossiTheDog @malwaretech I really liked this article here: https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier Their TLDR is: yes, it's impressive, but with a good framework you can already do it for much cheaper. Also, depending on the vulnerability, some of the cheapest models are sometimes better than the most expensive ones. And, yes, it's a looong ad for their company. But I think they deserve it :)

• Post #1621813

  #CRA - Cyber Resilience Act in the EU explained quickly with bikes: https://fosdem.org/2026/schedule/event/BFMWKT-cybersecurity-risk-assessment-for-cra/ And now I also need to watch this one to understand how this works together with Open Source Software, and when you need to follow CRA... https://openssf.org/blog/2025/06/16/cra-ready-how-open-source-projects-can-prepare-for-the-eu-cyber-resilience-act/

• Post #1168615

  #ZKP Achievement unlocked! We're using 100% of the crates providing Tom-256 curves (https://crates.io/search?q=t256, ignoring `uint256`): Our https://crates.io/crates/ark-tom256 based on arkworks, to make noir produce circuits based on the T-256 curve, and https://crates.io/crates/halo2curves in the MS Crescent implementation to use Spartan as a prover backend... And Clément proved that `1 == 1`, and he cannot prove that `2 == 1`, because the circuit constraints are not met!

• Post #1111593

  #Rust #Mutex #Deadlocks I didn't know that we know how to solve deadlocks since the seventies! The problem seems to be that there is no convenient interface available in most languages... https://notes.brooklynzelenka.com/Blog/Surelock Tries to give a template how to use mutexes in a way that all deadlocks (with one exception) are detected at runtime.

• Post #845309

  #Blockchain #DFinity It seems that DFinity's "Internet Computer" is starting to be useful! The guys from https://arstechnica.com/security/2026/03/self-propagating-malware-poisons-open-source-software-and-wipes-iran-based-machines used it to store the URL to the CCS server, so they could update it without anybody intervening. Wouldn't you guess it, their smart contract / Canister Smart Contracts has been taken down by this decentralized machine...

• Post #845308

  #Server #Hetzner Yay - I love being a sysadmin! Specifically in a professional network like Hetzner. They seem to take security quite serious, so for a poor weekend sysadmin like me, forgetting to block requests to private addresses means they send angry emails. But the "I hereby confirm that I have written the statement myself and not generated it by using AI." was too funny to not share it...

• Post #845307

  Ok, I think now is not a good time to debug my wife's computer...

• Post #845306

  #Nextcloud #Preview Happy to say that my beta tester (aka my wife) just found out that if you have 100 PDFs in a folder, and open it in Nextcloud for the first time, it will block your nextcloud for the forseable future! Luckily Claude found the configurations in config.php: ```php 'preview_concurrency_all' => 4, // max parallel preview processes total 'preview_concurrency_new' => 2, // max parallel processes for *new* previews ``` Mu...

• Post #845303

  Is this the big one? Are we finally saved?

• Post #845301

  If you have an iOS device, now is a good time to make sure updates are applied automatically, and get the latest software version. Somebody posted an exploit on GitHub that gives hackers full control of any iOS device not updated since September 2025. These exploits are usually well-kept secrets, as they are very valuable, and used only on high value targets. In this case, just visiting a website is enough to get your iPhone infected. Now everybody can be targeted! https://techcrunch.com/2026/0...

• Post #435741

  #EPFL #RSE #RSE_CH Happy to announce two events in the coming weeks at EPFL: - Lightning Talks next week - you can either come in-person and eat pizza with us, or join by zoom: https://rse.swiss/events/2026_02_26-epfl-lightning-talks/ - Open Source Services Meet-up - special "Digital Sovereignty" edition: https://rse.swiss/events/2026_03_04_oss_services_meet_up_special_edition/

• Post #407269

  #Winterkongress #LLM Ist ja lustig - ich wollte den Winterkongress mit 5 Sternen bewerten, aber das LLM dahinter meinte, mein Kommentar sei nur 4 Sterne wert...

• Post #407267

  Writing a grant proposal and making sure that we have enough citations: > Since the human memory naturally fades with time [23], it is unreasonable to expect users to remember the metadata for an indefinite period. Of course you need to cite the fact that we forget things over time...

• Post #407266

  #bitcoin #onvayarriver Qu'est-ce que j'ai ri en lisant l'article dans le temps sur le Bitcoin: https://archive.ph/4W9bn > Sa valeur – pour autant qu’on considère qu’il en a une, attention, sujet hautement émotionnel – est impossible à définir. Tellement vrai! Malheureusement je partage sa vision du futur du Bitcoin: > Tant qu’il y aura des gens pour y croire ou pour vouloir prendre le train en marche, la cryptomonnaie fera partie du paysage.

• Post #346689

  #fosdem #bruxelles Very international, passing in Italy and Luxemburg in two bus stops. I knew Luxemburg was small, but one bus stop only? @cdengler

• Post #264099

  I was very interested in all the decentralized, distributed, federated talks at #FOSDEM, so I asked Claude to scrape those projects and show them in a nice list: https://c4dt.codeberg.page/fosdem26_ddf/ Now I need to go through them and chose which of them are the most interesting :) @neiman Next up: publishing the page on https://danu.li :)