lcamtuf :verified: :verified: :verified:

To Be Filled By O.E.M.

Homepage: https://lcamtuf.coredump.cx
Substack: https://lcamtuf.substack.com/archive
Book: https://lcamtuf.coredump.cx/electronics/

Public Key

npub1ysw7nqfvcf6l7w6n828j8xnsjsxz2lcxmk3fu536ucm2z963mv3qhduzpe

NIP-05 Address

[email protected]

Profile Code

nprofile1qqszg80fsykvya0l8dfn4rernfcfgrp90urdmg572gawvd4pzagakgspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dswz9k8f

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1ysw7nqfvcf6l7w6n828j8xnsjsxz2lcxmk3fu536ucm2z963mv3qhduzpe

Show more details

Last Notes

2026-05-04 16:14:48 GMT

The coreutils Rust rewrite story is pretty funny.
Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.
But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:
https://seclists.org/oss-sec/2026/q2/332
PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

2026-04-17 13:06:28 GMT

- reply

I imagine it should be available on amazon.co.uk soon, but if you want the early access copy, I'm afraid it is what it is :-(

2026-02-28 17:15:00 GMT

"I ran out of API credits" gofundme campaigns are now a thing, because of course they are
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/149/376/411/615/338/original/82ce70c94ea7a0a8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/149/445/975/134/751/original/eb446fd10d6a8abc.png

2026-02-03 20:14:04 GMT

I'm speechless, that's not even enough for node.js
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/008/526/686/106/339/original/b81c3e79afa1f2c3.png

2026-01-12 22:00:53 GMT

Fun computer fact: in binary data streams, zeros don't convey information and are included solely for padding purposes. They can be removed to make files smaller, then inserted back if a particular program requires padding for compatibility.

2026-01-11 16:56:02 GMT

- reply

They don't exist to meet demand; they exist to game the engagement systems we put in place. I think that's true for a lot of other AI content on the internet too.
3/3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/511/856/719/176/original/64d031e36112a0f7.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/512/850/277/313/original/229ebbce9cf85526.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/513/563/296/541/original/4e6a4ff6d8e5ec29.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/515/117/922/011/original/5991587758d2c1dc.png

2026-01-11 16:54:49 GMT

- reply

...the usual argument for AI-generated articles is that they're just good enough for most people, so there's no point in getting your panties in a twist.
But you can't argue that these schematics are useful. No one can build these circuits. They make no sense!
2/3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/509/337/171/507/original/6955495940923318.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/509/525/961/048/original/169cd7011e8af678.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/510/016/571/760/original/0329bebf43142d53.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/510/313/749/776/original/89b6f62411cc0a27.png

2026-01-11 16:54:17 GMT

So there is this Facebook page with 1M subscribers, and an associated network of content creators with tens of thousands of followers, that's essentially dedicated to posting nonsensical, AI-generated circuit "schematics".
And it's interesting because... 1/3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/506/020/052/828/original/7962b678c8849f6a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/506/346/701/832/original/6622eb70a18c231d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/506/997/830/416/original/28cd3c3aefac4604.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/507/616/632/074/original/e9fcf6987203f69b.png

2026-01-04 16:52:45 GMT

The plot of new Stack Exchange questions asked per month is pretty spectacular.
And while I don't doubt that LLMs player a role on the tail end (2023 onward), it was cooked long before.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/837/849/403/545/519/original/81aabde0f8b5efe1.png

2026-01-04 05:26:35 GMT

https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/835/167/805/948/354/original/7c3c9ca81d4bcbf3.jpg

2026-01-03 22:19:06 GMT

OK, not bad, not bad
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/833/486/967/730/939/original/1d060c5a508117c4.png

2026-01-03 16:44:55 GMT

Remember to unplug your computer before midnight
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/832/172/008/442/645/original/ddbff256241fb64e.png

2025-12-19 02:50:01 GMT

Time to cash in on RAM shortages! No lowballs, I know what I've got
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/743/954/642/776/178/original/5fd54496e8980090.png

2025-12-10 20:51:06 GMT

If you're planning to visit Europe, be sure to bring the right adapter with you
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/697/242/497/549/506/original/6a64979e43499207.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/697/243/793/234/254/original/603e7b2e9b8d62a6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/697/244/369/663/654/original/e874d9ae551728a0.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/697/245/543/887/592/original/07f974fbecf74203.png

2025-12-08 01:21:10 GMT

Hmm, the visitors to my website seem to be really interested in React, I wonder if I should install it

2025-11-14 19:43:21 GMT

Not bad: https://clocks.brianmoore.com/

2025-11-13 23:14:01 GMT

When it comes to writing, LLMs have won - https://lcamtuf.coredump.cx/blog/llm-win/

2025-11-12 22:12:02 GMT

Oh, you use transistors? How quaint!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/539/018/033/099/830/original/82f4b61f68722d1a.jpg

2025-11-11 00:54:24 GMT

My favorite fact about recycling is that 100% recycled plastic is often worthless, so instead, you add 5% of recycled material to a vat and make 10,000 shampoo bottles out of that, and then you take 500 of these bottles and label them "100% recycled".
Which is not wrong and yet terribly wrong at the same time

2025-11-02 19:42:10 GMT

Things you can do with diodes: https://lcamtuf.coredump.cx/blog/diodes/?m2

2025-10-29 06:16:28 GMT

Quick question: instead of trying to rewrite all software, have we tried just rewriting the C compiler in Rust?

2025-10-26 13:59:41 GMT

I'm not sure if it's Amazon or if I just don't understand contemporary fashion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/440/823/190/900/918/original/bc18a15e9149be1a.png

2025-10-23 15:15:05 GMT

- reply

Honestly, when I'm helping my kid with math, I'm always far more confused by the three-letter notation. "The angle ABC is the same as MNB and BZY + BCD = 90° - DCE + QAB..." like, just give them real names

2025-10-23 14:46:43 GMT

Well, that's a new one: someone on HN just called me out on breaking my promise not to use "advanced math" because I used basic trigonometry and then asserted that a - b = a + (-b)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/424/020/668/406/832/original/81f7708e21d25e96.png

2025-10-17 16:04:13 GMT

Content farm: "The 8 best AI image generators!"
Search engine: "Yeah, about that... we now prioritize recency"
Content farm: "The 8 best AI image generators in 2025!"
Search engine: "Sorry, your buddies already published that one"
Content farm:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/390/352/571/869/532/original/e76c39453638efbd.png

2025-10-15 15:01:37 GMT

- reply

Geocities integration, duh

2025-10-13 15:08:33 GMT

October is Cybersecurity Awareness Month! Please be aware of cybersecurity. If you encounter cybersecurity, DO NOT APPROACH IT. Back away slowly. Protect children and pets. Make noises to scare it away.

2025-10-11 23:42:43 GMT

Today I needed a bit of code, but instead of asking an LLM I tried writing it myself and wow, this could be a new paradigm

2025-09-17 04:02:37 GMT

I'm still trying to decide on the topic for the next Substack article. A taxonomy of 18th century belt buckles? Construction and everyday uses of Hermitian manifolds? A curious kid's guide to mercury arc rectifiers?

2025-09-07 16:40:53 GMT

The more embedded programming I do, the more amazed I am that anything works at all.
Even in a single-core, single-process bare-metal environment, you obviously get the standard range of reentrancy issues. Hardware interrupts - including nested interrupts - can fire at any time.
There are some big "huh" moments around stuff like DMA. If you request a DMA transfer, it's handled by a separate piece of silicon and your CPU doesn't necessarily know what transpired. The main memory is updated by the DMA controller, but the CPU's cache is not. The CPU might end up with a stale cache even if you haven't touched that memory region before: after all, it does speculative prefetching! Worse, if you did touch the region, the CPU may flush old pending writes *after* the DMA transfer, clobbering your data.
But sometimes, the problems are simpler. I had a program that ran at full clock speed when compiled with -O3, but at something like 1 MHz when not. Yep, "huh".
There was a function that allowed clock speed to be toggled for power save purposes, roughly this:
static void setup_clock(u8 fast) {
CCP = CCP_IOREG_gc; /* unlock */
CLKCTRL.OSCHFCTRLA = fast ? VAL1 : VAL2;
}
This was a two-step task: unlock clock operations by writing to a memory-mapped register called CCP, then manipulate OSCHFCTRLA to set clock speed. Easy enough.
Fine print not included in online examples: the sequence must take at most four CPU cycles. For reasons.
With -O3, the code was simply inlined, the parameter always being a compile-time constant. So, essentially just two insns.
Without -O3? Well, you had a conditional to calculate the value to write to OSCHFCTRLA based on the function parameter. Boom.

2025-09-07 01:36:23 GMT

Getting silly with C, part ~(~1<<1) https://lcamtuf.coredump.cx/blog/c3/?n

2025-09-05 20:05:44 GMT

Can't wait for my $1.79 check from the Anthropic settlement

2025-09-05 14:03:00 GMT

I've been writing articles about mathematics and I've come to realize they're a love letter to *not* teaching things the way they're taught in school.
A formula? I wanted to know the how and why! What did we try first, how did we come up with that? The teachers rarely knew.
( If you're curious, I have a sampling here: https://lcamtuf.substack.com/p/algorithms-and-math-trivia )

2025-09-05 02:48:00 GMT

I see that a pretty but characteristically uninformative article about the Fourier transform is near the top of HN.
If you're interested in how DFT/DCT works, you might find my old write-up a better pick: https://lcamtuf.substack.com/p/not-so-fast-mr-fourier

2025-08-30 14:37:37 GMT

My position on the "doomsday" risk of superhuman AGI is that if IQ offered you a decisive advantage, the world would be run by nerds.
I think it's essentially a geek power fantasy. The returns on puzzle-solving skills rapidly diminish past some modest threshold.

2025-08-28 05:37:09 GMT

I'm working on a universal bucket list for corporations:
1) Declare that you're a different kind of a company
2) Design and announce your own typeface
3) One year of free credit monitoring

2025-08-10 15:42:15 GMT

I'm sorry folks, the spec made it clear
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/229/049/860/435/original/0e85592ee8c6dfed.png

2025-08-10 03:03:50 GMT

telnet uses port 23 to indicate that it's an improvement over ssh, which uses port 22

2025-08-08 14:53:41 GMT

I think the concern about LLMs making up citations is unfounded. If you find a non-existent citation, you can just ask an LLM to quickly generate that missing article

2025-08-02 16:07:54 GMT

If you're feeling overwhelmed, remember that
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/960/030/490/338/698/original/4b9f72d13531993b.png

2025-07-21 15:29:46 GMT

Life before smartphones
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/891/933/821/122/058/original/f48da92358edd2b3.png

2025-07-18 00:52:59 GMT

We used to be more civilized. Presented without further comment: a combination toilet paper holder / bathroom radio receiver, 1960s
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/871/499/309/802/012/original/37efeac2a6f5d5af.webp

2025-07-17 15:36:53 GMT

Daniel writes about his AI slop problem on H1: https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/
I like bug bounties and I put a fair amount of effort into bootstrapping the one at Google back in the day, but I think the problem runs deeper than AI.
First, most people who make a living doing bug bounties don't go after $10,000+ bugs. Very few people can crank out top-notch find month after month. A much better strategy on these platforms is to go after low-hanging fruit and rake in $500 to $1,000 bugs every day.
Companies respond accordingly! Because most of the traffic are lower-importance vulnerabilities from less skilled researchers, you don't want to throw your best analysts at this. It's increasingly common to outsource triage and bug-filing for bug bounty programs.
And especially if the person doing the triage isn't highly paid and familiar with the systems in question, there is a strong tendency to err on the side of caution. If you incorrectly close something serious as a non-issue, you risk the researcher making a stink. Conversely, if the triager files a non-issue with the product team, they'll probably fix it anyway, and you just waste some small amount of corporate time.
But the result is that in most programs, there's no penalty for slop - not just AI, but human too. And researchers exploit this with spray-and-pray tactics, essentially.
I think the core issue here are platforms that make it easy to browse for programs. They have plenty of advantages, but it's also a bit of a race to the bottom in terms of the quality bar.

2025-07-14 05:53:32 GMT

Please be assured that our servers are bolted down with military-grade security screws

2025-07-11 22:18:58 GMT

*** Online shopping in 2010 ***
Me: I'd like to buy underpants.
Underpants Emporium: Certainly! Your underpants should arrive on Monday.
Me: Sweet.
*** Online shopping in 2025 ***
Me: I'd like to buy underpants.
MyFriendo.biz: Yay! Your package is on the way!
Me: wait, who are you?
MyFriendo.biz: we're the store's shipping partner! We're here to keep you in the loop!
SMS: Your package is on the way! Reply STOP to stop.
Me: yeah, I...
UPS MyChoice: Your package is on the way!
Underpants Emporium: Be sure to review your purchase!
UPS MyChoice: Your package is out for delivery.
SMS: Your package is out for delivery.
MyFriendo.biz: Your package it out for delivery!
Logistics Conglomerated: you don't know us, but we couldn't help and notice that your package is out for delivery.
Underpants Emporium: did you know that customers who bought underpants also bought the following

2025-07-08 17:27:33 GMT

I think there's room for a website that subjectively reviews popular computer algorithms. I don't care about big-O and other nonsense like that. Did you like the product? Were the assembly instructions easy to follow? Did you get help from your CS (computer science) representative?

2025-07-03 20:42:00 GMT

Woodworkers are the most welcoming community I know of. You're talking to a master craftsman but they're still excited to see your garden planter.
On the flip side, the worst are probably electronics & math folks on Stack Exchange & Reddit: "get better before you talk to us".
Working theory: toxicity grows in proportion to the distance to wood

2025-07-03 18:09:37 GMT

A slightly unhinged calculator fact: in the golden era of electronic calculators, some Japanese shopkeepers were reluctant to trust the newfangled tool, so Sharp made a line of combination calculator / abacus devices.
Here's a photo, next to some other stuff I own.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/790/639/508/269/728/original/a65590fc923f53cd.jpg

2025-06-27 19:41:22 GMT

I don't know where you folks get your non-orientable manifolds, but the experience of ordering from Cliff Stoll at kleinbottle.com is second to none
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/757/026/962/998/956/original/46aa69c98aa661c5.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/757/027/446/186/638/original/5da4b7829110ab17.jpeg

2025-06-18 04:56:21 GMT

How to tell that you're valued as a customer in 2025: if you need to wait 45 minutes to be connected to a representative, you know they're not using an LLM

2025-06-15 14:57:25 GMT

Tech headlines: Apple engineers develop a revolutionary life-saving technology
Real life:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/687/962/820/968/561/original/803ddafbacea6f61.png

2025-06-09 16:31:23 GMT

The article is about something else, but I belatedly realized that all I wanted to do is write an article about infinity.
Maybe I still should, but I don't know if the remaining five subscribers can handle it
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/654/356/615/863/352/original/030148828a356686.png

2025-05-31 13:36:02 GMT

Did you know?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/602/708/832/813/064/original/6b7acdeddeab3837.png

2025-05-21 19:01:12 GMT

Engineers are supremely rational and value precision. That's why we use a unit called "decibels".
Well, it's not really a unit. It's a difference in magnitude for some other unit. We typically don't specify that other unit, but you can probably guess. We named decibels after Alexander Bell, but we misspelled that a bit.
Using decibels is just more intuitive than writing ×10 or ×1,000. That's why we define a decibel as an increase of ~1.2589. No, I mean, that's for power! If you're doing voltages, obviously use ~1.1220.
As for "0 dB", it probably refers to the other thing we talked about earlier in the text. But it could be one volt. Or a milliwatt, if you're doing radio stuff. Or maybe a threshold of human hearing. Or a really loud sound... I don't know, who's writing the spec?

2025-05-17 03:47:35 GMT

I'm old enough to remember when our #1 concern about the veracity of online information was that anyone could edit Wikipedia

2025-05-10 21:08:11 GMT

Sierpiński triangle? In my bitwise AND?
https://lcamtuf.substack.com/p/sierpinski-triangle-in-my-bitwise

2025-05-06 22:45:37 GMT

We're now offering a practical, self-directed course on cryptographic attacks. To enroll, simply start your own TLS implementation and upload it to Github

2025-04-29 17:07:51 GMT

Quick Q: if you're on a date in the SF Bay Area, what's the optimal number of leetcode questions to ask

2025-04-23 02:08:29 GMT

How do we generate clocks in digital circuits? From relaxation oscillators, to crystals, to phase-locked loops: https://lcamtuf.substack.com/p/clocks-in-digital-circuits

2025-03-28 04:01:48 GMT

My 101 of analog electronics, in the recommended order of reading:
What is electricity - https://lcamtuf.substack.com/p/but-good-sir-what-is-electricity
The physics of semiconductors - https://lcamtuf.substack.com/p/how-do-transistors-work-anyway
Core concepts in electronics - https://lcamtuf.substack.com/p/primer-core-concepts-in-electronic
Core concepts 2: complex impedance - https://lcamtuf.substack.com/p/impedance-part-2-why-do-lcr-meters
Signal amplification, from transistors to op-amps - https://lcamtuf.substack.com/p/the-basics-of-signal-amplification
RC circuits and analog signal filtering - https://lcamtuf.substack.com/p/impedance-part-2-why-do-lcr-meters
Signal filtering 2: Sallen-Key - https://lcamtuf.substack.com/p/analog-filters-part-2-let-it-ring
Signal reflections - https://lcamtuf.substack.com/p/signal-reflections-in-electronic
The skinny on radio theory - https://lcamtuf.substack.com/p/radios-how-do-they-work

2025-03-23 18:40:07 GMT

Here's the thing. When a browser, an app, or a website encourages you to turn on an awesome feature, it's almost always because a lawyer who understands the feature said "whoa, we're gonna be in real trouble if we don't have consent".
In other words,
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/213/204/023/129/116/original/76e8193b92fc3951.png

2025-03-22 22:21:27 GMT

It bugs me that many things in electronics have a really simple and elegant mathematical basis, but they’re given as axioms.
One of the examples is the idea that reactance and resistance are “orthogonal” - that is, we calculate their combined effect with a formula like |Z| = sqrt(R² + X²). And that’s all cool and dandy, but… why?
“Because the waveforms are shifted by 90°” - OK… but why does this produce this effect?
So, I recently reworked this article to provide a simple, visual proof: https://lcamtuf.substack.com/p/impedance-part-2-why-do-lcr-meters

2025-03-13 20:25:22 GMT

This is an actual air humidifier you can buy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/156/995/758/886/551/original/69f9c15dc2468f73.png

2025-03-12 14:35:48 GMT

Yes, as a consumer, I wake up every day wishing that my electric toothbrush had more features
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/149/958/352/264/361/original/6be5e2ec1a5a6bf6.png

2025-03-09 15:53:28 GMT

I know this flies in the face of all the conventional infosec knowledge, but the Communist Party of China is probably not interested in backdooring the Bluetooth chip in your smart litterbox

2025-03-04 18:36:09 GMT

Me: no, that's wrong.
Chatbot: I apologize, you're right to call me out on that! Here's another way to answer the question incorrectly

2025-03-04 00:33:32 GMT

I must note that there is a certain irony in choosing a Mercedes
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/101/348/122/491/474/original/47cbc79fca1a8fd8.png

2025-03-02 17:10:23 GMT

In the early 2000s, Microsoft was dealing with a PR crisis: information security. This wasn't about nerds on Slashdot. You had regular mainstream stories on CNN about Windows worms!
Consumers were fed up. They couldn't quite ditch Windows, but they could trade Microsoft Internet Explorer for a browser called Mozilla / Firefox. They did, en masse. Firefox peaked at a 30%. Microsoft's browser market share is in the gutter to this day.
But then, Chrome happened. Chrome was good, fast, easy to use, and had a solid security story. Firefox still had one ace up their sleeve: they could convincingly say that they put your privacy first.
Except, there wasn't a massive, public uproar about Google's privacy practices.
You could try to stir the pot, or you could give people another reason to stick with you. Firefox did neither, and its user base to a small core of fans who see Google as an abstract yet existential threat. From ~30% to <3%.
Now, Google bankrolled Mozilla for years - first as a defense against Microsoft, and later just to have a token competitor so that antitrust regulators stay put.
If you're getting hundreds of millions for just existing, you turn from a hip OSS project to an ossified bureaucracy. So now, Mozilla has a problem: how do you support your current lifestyle if the funding dries up?
Well, you can monetize with ad tech. Google and Microsoft are getting away with it? But oops, your user base consists entirely of privacy nerds who are going to flip out about that.

2025-02-28 18:02:52 GMT

I've been working in cybersecurity for over 25 years. Here are my key insights.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/082/823/981/453/443/original/5fdaf85c267ab415.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/082/824/433/127/130/original/2d0a92c27955977f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/082/824/995/408/847/original/9393ada9578366f2.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/082/825/428/137/423/original/7287de2aa935b406.png

2025-02-28 01:23:01 GMT

I've been asked why I don't write about infosec more often. Most simply, I learned that such content has a very short expiration date: 0-day in X, vendor Y popped, govt of Z trying to ban something.
Seminal results are rare. Most of it is just daily news and idle punditry. Don't get me wrong: the coverage is useful. In the moment, it gets a lot of clicks. But when I looked back at a decade of my infosec blogging, I thought to myself "wow... almost all of this is worthless today".
You know... woodworking tips will be relevant in a decade. Sandbox bypasses, not so.

2025-02-28 00:55:28 GMT

Look, "never" is relative
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/078/785/559/795/025/original/82086c3d42ce2d23.png

2025-02-25 21:34:45 GMT

We found out that machines performed 7% better if we trapped them in an endless loop of profound existential anguish
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/066/669/633/440/136/original/91fb723767407ea2.png

2025-02-16 03:41:45 GMT

- reply

Another possibility: an artist, fed up with Hitler's lingering influence, travels back in time and fakes a rejection letter from the Academy of Fine Arts

2025-02-16 00:00:15 GMT

POV: You just returned from a mission to travel back in time, assassinate Franz Ferdinand, and save your beloved Serbia. You crack open a history book

2025-02-14 14:39:11 GMT

Every time you deploy an "application firewall" to production, an angel loses its wings
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/002/751/841/486/261/original/20d45ee4d235b5b5.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/002/752/190/889/703/original/636e0fb37f34e533.png

2025-02-14 07:16:36 GMT

- reply

of course, this variant is fine
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/001/011/912/464/083/original/e959d2abde656363.png

2025-02-14 07:15:34 GMT

- reply

minimal repro
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/001/007/744/930/229/original/371815b950681384.png

2025-02-14 05:26:01 GMT

Oooof, Substack deployed some IPS to production and now I can't edit my old article about an LD_PRELOAD worm

2025-02-13 23:07:38 GMT

- reply

my dude... with respect... do something better with your time today.

2025-02-13 22:49:58 GMT

- reply

A source of what? You asked me to give an example, I linked you to another answer in which I gave an example of what I think illustrates the issue.

2025-02-13 22:41:34 GMT

- reply

https://infosec.exchange/@lcamtuf/113997989328216990
Mind you, it's a fairly whimsical example, but the same mechanics play out in a bunch of other areas.

2025-02-13 17:24:47 GMT

I think that Wikipedia is one of the best things that happened on the internet, but it isn't above criticism. Even if it's coming from your political enemies.
There are three issues at play. First, the Wikimedia Foundation. Their finances and activities are *really* hard to defend. They have too much money and they're spending it on sketchy stuff. The best argument for donating to the Foundation is that the excesses are OK if it keeps the server bills paid. But man...
The second issue is the Wikipedia editing culture. The editing standards work in >99% of all cases, but on some hot-button issues, the encyclopedia *does* have an editorial stance and weighs the sources to get the desired outcome. It's OK, but they need to own it. An editorial stance is not a crime.
The third issue is that in some niche areas, you have lone editors pushing weird agendas, from crackpot theories about UFOs, to personal attacks on a specific minor celebrity, to Marxist apologetics. It sucks. The community could be doing better, but a big part of the problem is just that there aren't enough people watching and pushing back.

2025-02-13 14:40:47 GMT

I get better customer support from the Chinese vendor where I order $1 PCBs than any US company where I spend thousands of bucks.
This is not a "we should be like China" post, but the US culture of "CS should cost as little as possible" is so weird.
Yeah, customers are wrong a lot, even if they're tech-savvy. I called my ISP once when the problem was on my side. But we won't remember that. We'll remember that one time when we really needed to get through to a human because the company messed up - and couldn't.
And that person isn't just going to grumble and move on. They will tell their friends, post online, and so forth. The damage is substantial and hard to measure.

2025-02-13 06:09:08 GMT

The thing about social media is that it's easy to get a lot of followers if you post enough memes, but the engagement is stretched so thin that it no longer means anything.
Here's my Twitter example: 37k followers → 2.5k "views" → 26 clicks (0.07%).
You get more out of mailing a couple of friends.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/995/083/670/453/310/original/bd393d5e0becfda7.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/995/084/030/563/958/original/bc1897da96ecb66b.png

2025-02-12 23:39:25 GMT

Your privacy is very important to us. This is why we're sharing your data with our 278 advertising partners, and our partners' 4,728 partners, and their partners' 87,392 partners, UNDER THE FOLLOWING TERMS

2025-02-12 21:43:15 GMT

My middle kid installed an automatic radio tuner in our car so that he doesn't need to use hands (?)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/993/095/024/503/708/original/34a5a748b3c7121d.jpeg

2025-02-12 01:59:04 GMT

Sir, I'm afraid your house is not wired for the latest Nvidia card

2025-02-07 18:31:28 GMT

The new Amish of the late 21st century: isolated, rural communities of software engineers writing their own code and crafting emails by hand, getting around in non-self-driving carriages

2025-02-06 19:49:03 GMT

I keep coming across all these "pseudocode" examples on Wikipedia and in academic papers, and what I don't understand is why the authors can't just learn a real programming language
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/958/671/600/699/602/original/38d28d36c6634062.png

2025-02-05 03:20:03 GMT

- reply

May I interest you in embedded systems
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/949/120/953/300/664/original/81dfe459b2fde3ca.png

2025-01-29 00:05:41 GMT

I designed this open-source handheld Sokoban game back in 2023, but the original OLED display module is no longer available.
In a bid to revive the project, I did a major redesign for a new display module. You can now build your own - enjoy!
https://lcamtuf.coredump.cx/sir-box-a-lot/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/908/720/508/220/352/original/ca27010c84e5d92f.jpeg

2025-01-25 20:52:15 GMT

LLMs have their uses
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/890/973/039/742/639/original/14b3d79063043fb7.png

2025-01-25 05:47:43 GMT

C IS LEGAL AGAIN
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/887/416/259/016/167/original/4ae52ca2fc101ee3.png

2025-01-24 22:52:14 GMT

Mr. President, we must not allow... an LLM gap!

2025-01-23 22:34:51 GMT

UI is hell, or why you can't design a four-function calculator: https://lcamtuf.substack.com/p/ui-is-hell-four-function-calculators

2025-01-22 23:46:14 GMT

- reply

Of course, I'm getting all my news on LinkedIn, so I'm immune to such shenanigans
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/874/670/130/381/594/original/2a53001415cefebb.png

2025-01-22 23:20:19 GMT

The ouroboros economy: turning HN stories into YouTube spam using NotebookLM
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/874/568/316/314/622/original/a7e1ac2314432d02.png

2025-01-22 16:36:05 GMT

Episode 8478 of how the internet works
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/872/978/228/411/988/original/8a65f6577536ca01.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/872/978/611/706/613/original/9644e9400c263160.jpg

2025-01-19 15:29:11 GMT

When people talk about wanting to go back to the old internet, this is what they mean.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/855/728/286/963/266/original/9f0dee82d98c1bc0.png

2025-01-17 10:14:34 GMT

Investigating an "evil" RJ45 dongle: https://lcamtuf.substack.com/p/investigating-an-evil-rj45-dongle