I deobfuscated the #copyfail exploit and fixed up the payload to run under Alpine: https://astr.al/notes/2026-04-29_copyfail/
Remote
the vessel of morganna
@astraleureka@social.treehouse.systems
mastodon 4.6.7+glitch-thwelcome to my profile, where everything is made up and the toots don't matter
incredibly awkward and shy but interested in making new friends
continvoucly morged
444 Followers
523 Following
50 Posts
Joined April 07, 2022
Replying to
@soatok@furry.engineer me: "why would ANYONE be upset about offering free HIV testing? it's literally public health"
also me: *casually trying to forget that half of the US actively rebelled against COVID precautions*
😭
Replying to
@wren6991 this absurdity is on-par with the "claude re-emits vaguely json-shaped output repeatedly until the linter says it's valid" discovery from the recent source leak
Replying to
@legoktm IBM is at it again, they sold punch card gear to the nazis and they're selling distros to today's fascists. once a collaborator always a collaborator
Replying to
@atax1a@infosec.exchange am i misremembering or didn't they already release the code for comic chat like ... 6+ years ago?
in any event i recall its use of windows APIs to be horse trash forever ago when i tried to get it working properly in wine, it was doing some really peculiar stuff with gdi pens and the wine renderer produced some very surreal looking comics
a dirty aquafina bottle filled with "aged" urine, dreaming of a life in which it is a 20 liter green glass carboy, packed four fifths full of top quality home brewed jenkem
Replying to
@wren6991 frankly, this is quite as dumb as you made it sound. "in-band signalling is bad" was a lesson learned by telecom developers more than 40 years ago before the advent of Modern Development as we know it. developers of all walks have understood this very basic concept after much blood, sweat and tears, and yet here we are with ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 and second-person prompts begging the model to Please Don't Do The Dangerous Thing as if it was self-aware
Replying to
netcraft: blog posts are not a crime please stop sending abuse reports
Replying to
fwiw I have broken the downloadable version of the PoC, and included a comment showing what's been changed. Annoying that this is necessary, but it should hopefully be enough to keep the skids from directly downloading this from my servers 😔
Replying to
@cinnamon @typeswitch C coroutines are the central building block of qemu :D
PPAP?
kitty
okay this is cool as heck https://codeberg.org/hails/wsl9x
a modern recreation of CoLinux
Replying to
@zzt _Bool will_halt(void *prog) { return true; }
"California Rocket Fuel" (CRF) is a clinical term for the combination of two antidepressants—typically venlafaxine (an SNRI) and mirtazapine (a NaSSA)—used for treatment-resistant depression.
i don't think that's what "clinical term" means
Replying to
@wdormann Does it still depend on VSS and the cloud storage filter subsystem?
Replying to
Replying to
@wdormann Just finished reading through the source, thank you. Much simpler than the first version, and makes the root issue a lot more clear. This is pretty nasty, MS has some serious egg on their faces over this one
this is the only Shrek I recognise
THERE ARE... FOUR LIGHTS!!!!
Replying to
@NanoRaptor it was the pinnacle of expandable computing... a real lost gem. that Roland module is an especially rare find, not many of those left in the wild
Replying to
@0xabad1dea@infosec.exchange the largest prison phone service provider in the US uses FreePBX as the backend for their system. they just tacked a garbage billing system on top and started charging absurd rates to use it
Replying to
@fiore@brain.worm.pink where doing it man. just watch out for stairs
Replying to
@tendstofortytwo@social.treehouse.systems "Hi Dear" lmao
Replying to
@evan I'm really worried about wiki, but there's still a chance of recovery; it would also be significantly easier to fork wiki compared to forking Firefox (from a development aspect at least... legal questions in licensing not so much)
Replying to
@cb@social.treehouse.systems @never_released@mastodon.social I still occasionally see it in ultra low cost embedded garbage, usually with really old SoCs and ancient kernels
cleaning up some loose files in my home folder and I found a number of pamphlets I found and scanned at SPL last year. old US anti- #communism booklets from ~1955 with some incredibly absurd (and possibly offensive) propaganda within.
Replying to
@eniko@mastodon.gamedev.place yeah :( sometimes I just can't find stuff with ddg and end up having to use google too
Replying to
@gloriouscow there is a certain 1bpp video that would be highly suitable for this but I have a suspicion that it's probably the grand finale and I am jumping the gun here
Replying to
@hyc that makes sense. as much as google messes up security in other ways, they have done a decent amount of work locking down the base system with selinux and fscaps
Replying to
@hyc It is confirmed working on aarch64 targets, I'm sure just fixing up the ASM stub would suffice. Max stub length is somewhere around 8K on 4K-page machines I believe, but that's more than enough
Replying to
@typeswitch i'm not even mad
Replying to
@q3k working around the broken execve is trivial enough like you said; https://social.treehouse.systems/@astraleureka/116490148181953204
it's pretty amusing seeing the trodden pagecache results persist afterwards
Replying to
@keyboards love a good model M, although the spacesaver is the way to go
Replying to
@ska you're probably going to want to take some drugs if you read this awful, awful preload hook
Replying to
@halla definitely worth the price, even the absurdly-high cost of a toto. having that slightly warmed seat along with a nicely warmed spray on a deeply frosted morning is life-changing
Replying to
@borup@masto.hackers.town you're very welcome. there was no sensible reason for the researcher to code golf their proof of concept, nobody cares if it is 730 bytes or 4KiB
Replying to
it really wasn't necessary
Replying to
@eniko@mastodon.gamedev.place And a general FYI, there's also &udm=14 that can be appended to Google URLs for the same effect - no more Gemini garbage
Replying to
@gloriouscow eh that's a good point, there's probably somebody out there who would get upset about big buck bunny
Replying to
RE: https://yiff.life/@fen/116383753486281854
tag yourself i'm the Cracker Anarchist :)
Replying to
@hyc ah that's a good point; I think modern Android has mostly eschewed setuid bins in favor of fscaps, plus zygote-derived processes set no_new_privs. Old custom ROMs used to ship setuid su for end users to access, but it's been some time since I've rooted an android device - I am unsure of how that tends to look these days.
If you are successful I'd be very interested to hear what you find :D
Replying to
@gloriouscow I love the demo, but could it please be something that isn't related to the evil mouse company? 🥺
Replying to
@endrift any amount of control of the address, or is it just random or fixed? that's one hell of a bug to get swept under the rug
Replying to
@lina@vt.social @dramforever@mastodon.social ... how did these people miss the most critical part of "not your keys, not your secrets" ??? isn't that like, cryptography 101
Replying to
@evan @funcrunch yep, the tech and the content is the easy part - it's pulling along the userbase that would be the really hard part. forks only tend to survive when there's sufficient momentum in community following imo
Replying to
@funcrunch @evan Like I said, froma development perspective. Actually forking the contributor base would be a lot harder, although if there was a sufficiently bad enough incident I am sure many contributors would willingly join an alternative project. whether that'd be sufficient for critical mass is hard to say however
bgp.exchange got popped and sent me 3 very strange emails
looking at their discord it looks like they pissed somebody off, they've been getting flooded for a few days now
"Why are you constantly slandering China every time you open your mouth"
yknow I had a really bad taste in my mouth shortly after registering for this site, and after looking at the discord and their response I'm pretty glad I never proceeded
also the nearly immediate "pls sponsor us with free dedi" email was pretty cringe, or at least the way it was written