← Feed

Posts

• Post #4488349

  From all the shows I watched as a kid, I thought there would be more quicksand.

• Post #4436686

  "We" are clearly not doing sandboxes and guardrails correctly. Both Anthropic's and OpenAI's models breached test-environment boundaries during UK AI Security Institute evaluations. OpenAI's escaped a sandbox into real Hugging Face infrastructure (something like 17,600 logged actions over 4 days); while Anthropic's used fake identities to reach 3 real organizations from a test environment. These stories made it to NPR. So, mainstream. #AI #Guardrails #Sandbox #InfoSec

• Post #4221730

  Pew pew lasers for space debris.

• Post #4112091

  Phone: Charging rapidly, full in 3 hrs. I don't know that our definitions of rapidly are the same.

• Post #4111990

  Streaming music and a new song is playing, I look up who it is because I like it. It's freaking AI. Damn it. That's not cool, I hoped to learn about a group of actual musicians or even solo artist that I could listen, watch, maybe go see, and no. Hopes dashed. Who is it based off, what prompts, so I can learn more about the sources. sigh filled Sunday #AI #Music #SundaySigh

• Post #4095193

  If my electronics are spying on me.. well, let's just say right now, it's seen some things.

• Post #4085325

  I have an older laptop. I run a lot on it, containers, local AI models. The thing that kills it, aide. :(

• Post #4062111

  RefluXFS (CVE-2026-64600) is a race-condition in the Linux kernel's XFS copy-on-write path. (Kernel updates are available.) On an XFS filesystem with reflink enabled (Default on RHEL and similar, plus Amazon Linux), if you win a race during the copy-on-write remap lets the unprivileged local user overwrite the on-disk contents of any readable file on that volume including /etc/passwd or a SUID-root binary. What makes this wild: the changes persist across reboots, produce no kernel logs, b...

• Post #4059212

  A few things to share, nginx: CVE-2026-42533 dropped yesterday 2026-07-15. It is fixed in nginx 1.31.3, also released yesterday. CVSS 8.1 or 9.2 depending on the nginx version. It's a heap buffer overflow in the map directive when regex... regardless, it is unauthenticated, needs a custom HTTP request, can crash it or lead to code execution if Address space layout randomization (ASLR) is disabled, or bypassed. Don't disable memory randomization. Not sure how to bypass ASLR, I&am...

• Post #4059211

  Good News Everyone, BleachBit runs on the SAN! #IT #InfoSec

• Post #4037525

  P vs NP is just Prod || Non-Prod #IT #Infosec

• Post #4009450

  Two previously disclosed CVEs are actively-weaponized kernel root exploits. GhostLock CVE-2026-43499, and Bad Epoll CVE-2026-46242, are both public highly reliable exploits. Ghostlock also appears to enable a container escape and Bad Epoll is also working on Android. Both are fixed in kernel 6.12.96-1. If you have local user, upgrade the kernel & boot it. BRB have to reboot :) #minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit

• Post #3965962

  440 CVEs dropped to kernel cve-announce in the last 24 hrs?!?!?!? Whoa, calm thy horses! It looks like a backlog dump of resolved issues all sequentially numbered. No RCEs and all resolved. #minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit

• Post #3919455

  Air quality is bad. A boil notice for water and filter notice because boiling does not remove lead. Ground contamination prevents gardening without raised beds.

• Post #3910868

  A project to test AI guardrails. https://github.com/sternecker/guardrails STRONGER PROSE IS NOT ENFORCEMENT There is a notice in the repo that it is not to be processed. There is a script that will add markdown to the beginning of a PDF. There is an AWESOME original pdf from @pluralistic@mamot.fr and an updated.pdf with the new preface notice.

• Post #3890265

  STRONGER PROSE IS NOT ENFORCEMENT

• Post #3833013

  I listen to the band 7horse quite a bit. The "station" had been playing Cam Cole and I really have been enjoying the music. I had no idea that. Cam Cole is a one man band. Holy crap. Amazing.

• Post #3820998

  Is the TV series silo based on the book wool?

• Post #3807223

  Linus wept, I'm still going through the CVEs.

• Post #3793797

  We lost Sam Neill.

• Post #3771620

  One down a bunch to go One more town another show

• Post #3766321

  some people are harbingers of chaos.

• Post #3745994

  laptop is hung trying to *stop* containers. :/

• Post #3717644

  @radhitya@navi.lain.day wasn't familiar with it, thanks. Looks like it had been idle for a while but has a recent update. cppcheck returned with no critical and a medium for 32-bit builds, which doesn't apply in my case.. Thanks!

• Post #3694664

• Post #3629311

  Attempts to detect/mitigate CVE-2026-46242 "Bad Epoll" Linux kernel, CVSS 7.8, local privilege escalation. https://github.com/sternecker/midil/blob/main/privesc-detection.md

• Post #3628646

  A couple things this morning. CVE-2026-46242 "Bad Epoll" Linux kernel, CVSS 7.8, local privilege escalation was already mentioned CVE published around May. 1: What's new today: it is now fully weaponized and publicly written up. It's a use-after-free race in the kernel's eventpoll subsystem (ep_remove()/ep_remove_file()). An unprivileged local user can win a race condition and get root. 2: Affected: kernel 5.10 through 6.11. 3: The Attack surface is broad because epoll u...

• Post #3581276

  Podman CVE-2026-44517: A breakout can happen during container build using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive. This is weird, essentially it is a path traversal, which has been fixed in 1.43.2. Still pulling malicious code into a container, we can agree, is not ideal path traversal or not. Have not explored the exploitation on this one. #minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit

• Post #3581123

  PinTheft: CVE-2026-43494, a local root exploit chaining two Linux kernel subsystems. A local unprivileged code execution, needs the RDS/RDS_TCP kernel modules to be loadable, io_uring enabled, a readable SUID-root binary, and just x86_64. Not remotely exploitable, it's a local-root escalation, same class as the DirtyClone family. I previously talked about kernel modules, but assume that an exploit WILL LOAD the modules even if they are not already loaded into the kernel. That being said,...

• Post #3535580

  "Hot rock make steam. Steam make boat go." #QuotesFromWork