Jan Schaumann

Vell, I'm just zis guy, you know?

Public Key

npub1kvy8enal7npw9ct28tc53d4r5fl7q7a3ua3gku22z8jlyec37f3snmedh2

NIP-05 Address

[email protected]

Profile Code

nprofile1qqstxzrue7llfshzu94r4u2gk636yllq0wc7wc5tw99pre0jvuglyccpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43q0mg6mf

Publishing to

relay.ditto.pub

Author Public Key

npub1kvy8enal7npw9ct28tc53d4r5fl7q7a3ua3gku22z8jlyec37f3snmedh2

Show more details

Last Notes

2026-06-09 13:02:43 GMT

So people are totally now using AI models for regular stuff that you can do via shell scripts and cron, because why do something for free when you can burn tokens and at the same time actively forget how to use the normal tools at your disposal?
🤦 🙏 🤦

2026-05-21 02:44:54 GMT

Now what the fresh fuck is this, then?
Not today, Satan.
https://media.mstdn.social/media_attachments/files/116/610/266/172/810/693/original/d079b19672b93cdf.png

2026-05-08 22:49:26 GMT

Congrats! Your new job is: arguing with a bot. Multiple bots. And people outsourcing their brain to bots. But mostly bots.
Sometimes you have to social engineer the bots to do your bidding. Sometimes you have to pit the bots against each other. But make no mistake, it's arguing with the bots.
That, and email. And meetings.
How beauteous mankind is! O brave new world,
That has such people in't.

2026-05-08 20:27:41 GMT

Btw, there's _no_ way we're done here with #DirtyFrag and #CopyFail. Everybody is aiming their LLMs at this attack path through the page cache now, and there's bound to be other ways.
Be ready to rinse and repeat a few more times before the dust settles, so I guess keep an even closer eye on linux kernel commits for a while.
(And no, I don't know how this will be sustainable.)

2026-05-08 18:45:08 GMT

#DirtyFrag status/advisories:
AlmaLinux:
https://almalinux.org/blog/2026-05-07-dirty-frag/
Debian:
https://security-tracker.debian.org/tracker/CVE-2026-43500
https://security-tracker.debian.org/tracker/CVE-2026-43284
Gentoo:
https://bugs.gentoo.org/974307
RedHat:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-43284
https://access.redhat.com/security/cve/cve-2026-43284
nothing yet on CVE-2026-43500
Rocky:
https://kb.ciq.com/article/rocky-linux/rl-dirty-frag-mitigation
SUSE / OpenSUSE:
https://www.suse.com/security/cve/CVE-2026-43500.html
https://www.suse.com/security/cve/CVE-2026-43284.html
https://www.suse.com/c/addressing-copy-fail2-aka-dirtyfrag-in-suse-virtualization/
Ubuntu:
https://ubuntu.com/security/CVE-2026-43284
https://ubuntu.com/security/CVE-2026-43500
https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available
AWS:
https://aws.amazon.com/security/security-bulletins/rss/2026-027-aws/
https://explore.alas.aws.amazon.com/CVE-2026-43284.html

2026-05-07 20:07:16 GMT

Oh FFS.
#DirtyFrag
https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md
"Because the embargo has now been broken, no patches or CVEs exist for these vulnerabilities."
https://www.openwall.com/lists/oss-security/2026/05/07/8
Well, just put that CopyFail incident work on rinse and repeat, I suppose...

2026-05-02 13:43:24 GMT

Le sigh. Every time we go around and have to do this again and manually figure out wtf each of the ten thousand linux distributions provides their security updates and current status.
Spending my Saturday morning searching for CVE-2026-31431 and "copyfail" patch status is just 👍.
Anyway, here's what I have so far:

2026-04-19 19:02:56 GMT

Current #infosec status.
https://media.mstdn.social/media_attachments/files/116/432/916/727/127/658/original/2b8b268a4b3c60a7.png

2026-03-29 23:29:33 GMT

Die englische Sprache kennt ja “Verschlimmbessern” nicht, weshalb sie stattdessen “vibe coding” sagt.

2026-03-25 13:54:40 GMT

Fallout from the trivy compromise, part N of many:
LiteLLM includes a backdoor and a malicious .pth file that "automatically executes a credential-stealing script every time the Python interpreter starts — no import litellm required"
I.e., "pip install litellm" -> pwned
https://thehackernews.com/2026/03/teampcp-backdoors-litellm-versions.html
https://github.com/BerriAI/litellm/issues/24512
https://github.com/BerriAI/litellm/issues/24518

2026-03-18 17:19:48 GMT

Starting to think the real risk is not AI replacing junior staff, but senior staff quitting because they just can’t take this AI bullshit any longer and just opt for early retirement.

2026-03-04 23:40:05 GMT

What idiot called it “agentic AI” when “Claude Computing” is right there?
(Bonus joke: There is no Claude, only other peoples’ content.)

2026-03-02 19:41:27 GMT

The only thing my brain gives me when I hear Google & Cloudflare talking about Merkle Tree Certificates:
#pqc
https://media.mstdn.social/media_attachments/files/116/161/276/648/995/190/original/2c35a3f7eb1d7293.jpg

2026-03-01 02:12:00 GMT

Another odd trend I'm observing: students don't understand how to work with plain text any longer.
The concept of wrapping text to fit an 80 char terminal gives them trouble. Many resort to random websites where they paste their text into and that will insert line breaks in the middle of the word at exactly 80 chars.
Using a text editor to, uhm, edit text is, at this point, completely foreign to them.
Weird.

2026-02-27 22:37:07 GMT

For anybody wondering why I prefer #NetBSD over #Linux, compare the code for a small tool like whois(1):
NetBSD:
https://cvsweb.netbsd.org/bsdweb.cgi/src/usr.bin/whois/whois.c?annotate=HEAD
372 lines, easy to read
Linux:
https://github.com/rfc1036/whois/blob/next/whois.c
1617 lines in the main program; unchecked malloc(3), misc buffer overflow opportunities, magic numbers, "/* This function has multiple memory leaks.*/", mixed spaces and tabs, another 2K of glue code, ...
KISS, man, KISS.

2026-02-25 02:28:40 GMT

Tonight seems like a good time to remind folks that the next #nokings protest is planned for March 28th:
https://www.nokings.org/
Mark your calendars, I'll see you there! ✌️
#sotu #fucktrump

2026-02-19 22:59:08 GMT

- reply

Let's start at the #DNS. Obviously, the root is fully dual-stack, but what about the TLDs?
Overall, that's not terrible: only 18 of the 1,436 TLDs have only IPv4-only NS records in the root zone, although 240 TLDs have at least one IPv4-only NS.
But for the top 1M _second-level_ domains, this already drops down and only around 72% of them have at least one IPv6-enabled NS.
#ipv6

2026-02-19 22:58:07 GMT

#IPv6 adoption is still terrible.
Akamai, Cloudflare, and Google all report roughly 45% of traffic to their services using IPv6 in the US...
https://www.akamai.com/security-research/ipv6-adoption-visualization
...but that's (a) not all that great, and (b) only HTTP traffic to major services.
Just what % of sites actually _offers_ IPv6? I took a look...

2026-02-12 16:05:25 GMT

Being forced onto Outlook Office365 with the threat of having to use Outlook or webmail. I don't know how anybody can suffer their email with these interfaces.
So very thankful for the folks who created and documented mutt_oauth2:
https://gitlab.com/muttmua/mutt/-/raw/master/contrib/mutt_oauth2.py.README
Got everything to work using the README and this HOWTO:
https://staff.washington.edu/shrike/unix/configuring-mutt-neomutt-for-imap-access-to-o365-exchange/
And thanks to a kind admin who added a new client-id for mutt, I don't even have to pull the Thunderbird ID to fake that.

2026-02-11 18:58:59 GMT

Claiming use of drones by drug cartels forces you to close airports seems like a convenient way to reinforce an argument that the US is "at war" with drug cartels, just in case anybody continues to object to the murder of people on boats in the Carribean and Pacific.
Of which there were two more in the last week, but apparently not only does nobody object to them any more, nobody really notices. It's just what we do now.

2026-02-04 19:09:45 GMT

I can't believe I've waited this long to create this stupid shell function:
```
rfc() {
local rfc="rfc${1##rfc}";
curl -s "https://www.rfc-editor.org/rfc/${rfc}.txt" | ${PAGER:-more}
}
```

2026-02-03 16:33:45 GMT

If you'd like to have a nice 🤦-y day like me, go ahead, search your internal code repository for the following:
curl -k
wget --no-check-certificate
verify=false
InsecureSkipVerify: true
ssl_verify_mode: 0
TrustSelfSignedStrategy
rejectUnauthorized: false
strict-ssl = false
http.sslVerify = false
--no-verify-ssl
--insecure*
verify_hostname: 0
It'll be great.

2026-02-03 03:43:44 GMT

Srsly, what idiot called it "CAPTCHA" instead of "Mein Voight-Kampff".

2026-01-24 14:26:58 GMT

This semester, I'm teaching my class on System Administration / Internet Operations once again.
The syllabus and all course materials are available here:
https://stevens.netmeister.org/615/
All videos for the lectures and exercises are public and available for free on YouTube:
https://www.youtube.com/c/cs615asa/videos
If you want to follow along, I'll be posting lecture videos and related links in this thread throughout the semester.
#sysadmin #devops #sre

2026-01-11 21:32:23 GMT

Lol, Linkedin didn't like me posting photos from today's anti-trump, anti-ICE protests. 'Cause, you know, gotta keep it professional when the goons shoot citizens and snatch your neighbors from the streets. Good job, Linkedin. May I recommend selling Hollerith punch cards next?
(Yes, yes, I'm aware that of course MS sells all sorts of services to ICE. They all do. 🤮)
https://media.mstdn.social/media_attachments/files/115/878/578/349/156/719/original/049b3d0c0d5c7659.png
https://media.mstdn.social/media_attachments/files/115/878/597/908/421/885/original/a913b051679ca719.png

2026-01-11 19:07:23 GMT

Everybody walking past Trump Tower be like…
#fuckICE #iceoutforgood #fucktrump
https://media.mstdn.social/media_attachments/files/115/878/031/379/071/743/original/71247ab8feb95f77.jpeg

2026-01-05 16:39:57 GMT

Completely different topic, so ripping this quote out of the context from the article I just boosted:
"I wonder how much Venezuelan sensitive information was in fact stored on Google/Microsoft services and accessed by the US military to prepare their recent strike."
This is indeed a pretty interesting question to ponder. And if you're, say, Greenland, maybe consider your use of US cloud services...

2025-11-19 03:02:26 GMT

Cloudflare outage root cause: not checking the return value of a function that may fail. In C, that would be calling something on NULL and segfaulting; in Rust it's calling a function on an Err val and panic.
thread fl2_worker_thread panicked: called Result::unwrap() on an Err value
So, yeah, kids, do always check your return values before you use them.
https://blog.cloudflare.com/18-november-2025-outage/
https://media.mstdn.social/media_attachments/files/115/574/133/050/455/869/original/8410ef474b944652.webp

2025-10-18 17:02:17 GMT

- reply

#nokings #fucktrump #fuckICE #nyc
https://media.mstdn.social/media_attachments/files/115/396/236/868/070/799/original/939e354e7f3372f9.jpeg
https://media.mstdn.social/media_attachments/files/115/396/242/038/779/890/original/6a94264ae20a3af8.jpeg
https://media.mstdn.social/media_attachments/files/115/396/242/891/959/280/original/6e97274669c469e9.jpeg

2025-10-18 16:51:23 GMT

Just about the only time I enjoy the crowd in Times Square. #nokings #nyc
https://media.mstdn.social/media_attachments/files/115/396/199/353/551/094/original/7e985c1f1fa03cd3.mp4

2025-10-18 16:48:43 GMT

#nokings #nyc
https://media.mstdn.social/media_attachments/files/115/396/187/178/160/744/original/2ddc44f437da75e9.jpeg
https://media.mstdn.social/media_attachments/files/115/396/187/351/374/811/original/d201446daa93993e.jpeg
https://media.mstdn.social/media_attachments/files/115/396/188/554/639/927/original/d5d35418e5d8a915.jpeg
https://media.mstdn.social/media_attachments/files/115/396/189/874/859/131/original/f346e83db97b8378.jpeg

2025-09-15 13:53:50 GMT

With a few months having gone by since I last checked, I figured I'd do an update on who's currently using post-quantum cryptography on the web. In brief, about 39% of the top 100K domains now offer X25519MLKEM768 (up from about 28% in March). This is primarily the addition of Amazon Cloudfront (the only service to also offer SecP256r1MLKEM768) and Fastly, since Akamai is still opt-in. But we also note Facebook having started to support #PQC.
https://www.netmeister.org/blog/pqc-use-2025-09.html
https://media.mstdn.social/media_attachments/files/115/208/638/200/725/353/original/828f2ead6d48ddee.png

2025-08-27 19:44:21 GMT

https://xkcd.com/2347/ recursion
https://media.mstdn.social/media_attachments/files/115/102/434/901/125/227/original/a0f2758bd2946b67.png

2025-08-07 16:05:05 GMT

Quantum Key Distribution is the cryptocurrency of post-quantum cryptography.
Conceptually interesting, sure, but not practically useful, doesn't actually solve the problem its advertised for, yet snake-oil salesmen peddle it left and right while business fools fall for the high buzz word density of the pitch.
#pqc #qkd

2025-08-07 00:55:37 GMT

If you've seen James Kettle's talk at #BlackHat on HTTP/1.x desync vectors, I also wrote a very short advisory for the Akamai specific request smuggling vulnerability (CVE-2025-32094) noted in there:
https://www.akamai.com/blog/security/cve-2025-32094-http-request-smuggling

2025-08-01 02:33:06 GMT

Pareto's AI Result: You get a response that's 80% correct, 20% of the time, and 20% correct 80% of the time, but no obvious indication which one of those you got this time.

2025-07-24 15:19:46 GMT

Es ist nicht deine Schuld, dass die Welt ist, wie sie ist
Es wär nur deine Schuld, wenn sie so bleibt
https://www.bademeister.com/songs/deine-schuld

2025-07-21 20:33:25 GMT

Uhoh, Let's Encrypt API outage, it looks like.
https://letsencrypt.status.io/

2025-07-05 17:48:41 GMT

Using #AI in college to do your coding for you is like paying somebody else to go the gym for you. The point is not that the weights get lifted, it’s that you build (cognitive) muscles doing the work.

2025-06-29 16:08:13 GMT

*nickt* Jaja, "Mist AI" ist halt auch was ich immer denke.
https://media.mstdn.social/media_attachments/files/114/767/512/784/372/031/original/210f7af5612a4770.png

2025-06-26 22:33:50 GMT

Ugh, here we go. People in the U.S. will get sicker more often, overall health and average life expectancy (US currently ranks 48th or so) will further decline. But because that impact will individually be subtle and compound only over years, the idiot population won’t make the connection.
Next on the chopping block: MMR vaccines. So yeah, young kids and infants are actually going to die. USA, USA.
https://www.nytimes.com/2025/06/26/health/rfk-jr-vaccines-acip-cdc.html

2025-06-26 14:31:36 GMT

"Agentic Misalignment" seems a weird term to use when you mean "Skynet".
#AI #LLM 'models consistently chose harm over failure'
https://www.anthropic.com/research/agentic-misalignment

2025-05-29 02:56:00 GMT

New blog post! Bootstrapping HTTP/1.1, HTTP/2, and HTTP/3 -- redirects, HSTS, Alt-Svc, ALPN, HTTPS DNS records, oh my.
https://www.netmeister.org/blog/http-123.html

2025-05-27 13:50:44 GMT

So you thought ls(1) had a lot of command-line switches at 36 (NetBSD) / 59 (GNU)? Or maybe gpg(1), with around 375 options or so?
Well, here's the list of Chromium command-line switches -- all 1513 of them:
https://peter.sh/experiments/chromium-command-line-switches/

2025-05-21 01:38:26 GMT

Y'all ever see those "utm_" parameters in your web logs and on social media URLs and wonder wtf "utm" stands for?
It stands for "Urchin Tracking Module" and comes from a web stats analysis product made by "Urchin Software Corp.", which Google bought around 20 years ago and then turned into Google Analytics.
Naming things is not only hard, it also is forever.
https://media.mstdn.social/media_attachments/files/114/543/259/585/032/706/original/dde7685a236e718f.png

2025-05-16 14:35:48 GMT

You've probably seen the local root privilege escalation vulnerability in GNU screen(1):
https://www.openwall.com/lists/oss-security/2025/05/12/1
The note there suggests that #NetBSD ships with a vulnerable version of screen(1). This is incorrect: NetBSD includes screen(1) in #pkgsrc as a _possible add-on package_ you can choose to install. It does _not_ include screen(1) in the base system.

2025-05-15 20:56:03 GMT

The "Trump’s sanctions on ICC prosecutor have halted tribunal’s work"[1] story is a timely reminder of what I just tried to instill in my students in my class on System Administration with respect to third party services...
[1] https://apnews.com/article/icc-trump-sanctions-karim-khan-court-a4b4c02751ab84c09718b1b95cbd5db3
https://media.mstdn.social/media_attachments/files/114/513/834/008/847/087/original/7bef8e152d3bd92e.png

2025-05-13 18:04:45 GMT

Pffft *spits coffee all over keyboard*
So apparently on #Linux, usernames starting with "0x" are interpreted as hex numbers under certain circumstances. 🤪 That seems like asking for trouble...
https://media.mstdn.social/media_attachments/files/114/501/839/068/572/779/original/2e088f061f9c19f0.png

2025-05-11 15:12:03 GMT

Students not merely cheating with, but utterly relying on AI in "a society that treats schooling as [nothing more than] a means to a high-paying job" is deeply concerning as AI may actually make you dumber:
"research shows that when students off-load cognitive duties onto chatbots, their capacity for memory, problem-solving, and creativity could suffer. Multiple studies published within the past year have linked AI usage with a deterioration in critical-thinking skills"
https://www.msn.com/en-us/news/technology/everyone-is-cheating-their-way-through-college/ar-AA1EjCRk

2025-05-09 17:58:32 GMT

When Jira over-eagerly tries to replace character strings with emojis, but your input contains e.g., ECC curve names...
https://media.mstdn.social/media_attachments/files/114/479/163/256/467/277/original/51ad4939019e8a89.png

2025-05-09 13:37:20 GMT

German President Steinmeier's speech commemorating the 80th anniversary of the end of World War II:
https://www.bundespraesident.de/SharedDocs/Reden/EN/Frank-Walter-Steinmeier/Reden/2025/250508-End-WWII.html
You want to read the whole thing, but the part below and the emphasis on the importance of learning from the past instead of describing it as a "cult of guilt" were powerful and eloquent. No words were minced, and we need more of that.
https://media.mstdn.social/media_attachments/files/114/478/133/068/595/224/original/9a9e2867b4d9b8bc.png

2025-04-24 21:28:53 GMT

25 years ago today I registered my domain:
$ whois netmeister.org | grep Creation
Creation Date: 2000-04-24T02:15:22Z
One of my best decisions tech-wise was to run my own stack on my own domain (HTTP, SMTP, DNS, and whatever else). It forces me to keep up to date with developing standards and protocols, lets me troubleshoot and debug on a level otherwise impossible and is well worth the occasional "ugh, wtf now?" headaches you inevitably run into.
(And of course it runs #NetBSD. :-)

2025-04-12 14:43:09 GMT

CA/B Forum Ballot SC-081v3:
"Eventual reduction of maximum validity period from 398 days to 47 days [...] starting in March 2026 and concluding in March 2029"
I'm counting 25 "yes" votes and 6 "abstains", zero "no" votes:
https://groups.google.com/a/groups.cabforum.org/g/servercert-wg/c/bvWh5RN6tYI
https://github.com/cabforum/servercert/pull/553
The voting period ended yesterday. I'd say habemus papam, I mean: 47 day max certs are coming!

2025-04-09 21:11:38 GMT

Oh, ok, Yahoo. That's interesting. I have another idea: fuck you.
https://media.mstdn.social/media_attachments/files/114/310/053/819/942/831/original/4d2e842f7b7805a6.png

2025-04-09 13:50:40 GMT

OpenSSH 10.0 just landed, now completely removing DSA signature support (you've been warned, repeatedly :-) and finite-field diffie-hellman key exchange. It also enables mlkem768x25519-sha256 as the default kex! (#pqc)
The new version string ("OpenSSH_10.0") is also likely to confuse a bunch of stupid scanners that assume anything starting with "OpenSSH_1" is a 1.x version.
https://www.openssh.com/txt/release-10.0

2025-04-08 16:29:18 GMT

Suppose you held a large amount of stock. Market's high. You sell.
You then announce totally bananas tariffs. Markets plunge. You buy.
You then announce "deals" and lift tariffs. Markets ralley. Profit.
Would be a sweet deal if you happened to be in a position to do that, or knew somebody who could, wouldn't it?

2025-03-31 17:21:45 GMT

- reply

@nprofile…5k2y Hey Brian, just wanted to say how much I appreciate your speaking out against the active, ongoing destruction of democracy in the US. For every boneheaded “I came for cybersecurity, you should be apolitical” reply know there are dozens if not hundreds who hear and value your voice and courage.

2025-03-31 13:57:34 GMT

This Venn diagram showing which PQ algorithms are permitted by which government regulatory body from Mike Ounsworth's presentation at the Real World Post-Quantum Cryptography Workshop last week.
(Mike gave a version of that talk earlier this year at the PKIC conf: https://pkic.org/events/2025/pqc-conference-austin-us/WED_BREAKOUT_1200_Mike-Ounsworth_Architecting-PKI-Hierarchies-for-Graceful-PQ-Migration.pdf)
#pqc
https://media.mstdn.social/media_attachments/files/114/257/379/964/453/966/original/119aa2ef78507450.png

2025-03-29 18:09:17 GMT

- reply

Details about CVE-2025-31160 (memory corruption in #atop) are now available here: https://github.com/Atoptool/atop/issues/334
In a nutshell: atop at startup connects to local (non-privileged) TCP port 59123 where it expects certain data; if a regular user listens on that port, it can feed data to the next invocation of atop that can corrupt it.
The fix (https://github.com/Atoptool/atop/commit/542b7f7ac52926ca272129dba81d7db80279bb98) is primarily "don't do that" with some attempt at better parsing of the untrusted data (by adding return code checking of `sscanf`).

2025-03-27 10:16:18 GMT

"Nope: Strengthening Domain Authentication with Succinct Proofs"
https://nope-tools.org/nope.pdf
Basically:
domain owner #DNSSEC signs their name, then encodes a proof of that DNSSEC chain into a new domain name, stashes that in a SAN in the cert and wants the client to verify the proof against... the root ZSK? Which it fetches via DoH from Google DNS, but... doesn't verify?
Not sure I get it.
#realworldcrypto #dns

2025-03-26 20:25:20 GMT

More details on the `atop` thing: https://rachelbythebay.com/w/2025/03/26/atop/
Looks to me less severe than speculated (remote exploit via a kernel module in the net filter) but overall not particularly great (corruption from one user to another could lead to local privilege escalation).

2025-03-20 18:30:22 GMT

Remember `.su`, the ccTLD for the Soviet Union? Created in 1990, just 15 months before the USSR was dissolved and in ICANN limbo since, broadly used primarily for various sorts of cybercrime.
Now ICANN will finally move to retire the #TLD from the #DNS, targeting removal by 2030:
https://domainnamewire.com/2025/03/11/icann-moves-to-retire-soviet-era-su-country-domain-name/
Interestingly, ICANN moving forward with this could imply that they _will_ follow through on the removal of the `.io` #ccTLD should the return of the territory to Mauritius complete...

2025-03-12 02:48:34 GMT

This is obviously about more than just tariffs: Republicans willingly cede power by declaring "the rest of the year one long day, nullifying a law that allows [Congress to] put an end to a disaster declared by the president."
I'm so very tired of drawing those parallels, but if a leader declaring an emergency and convincing congress to give up power and consolidate it in him doesn't remind you of the Enabling Act of 1933, then you need to revisit your German history.
https://www.nytimes.com/2025/03/11/us/politics/trump-tariffs-house-gop-vote.html

2025-03-11 14:09:59 GMT

NIST selects HQC (Hamming Quasi-Cyclic -- https://pqc-hqc.org/) for standardization as the second #PQC key-encapsulation mechanism after ML-KEM.
But no rush, "the final version will be published in approximately two years".
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/w-6RREtb7-c/m/vRjBJE3dAAAJ
https://nvlpubs.nist.gov/nistpubs/ir/2025/NIST.IR.8545.pdf

2025-03-11 03:05:51 GMT

If you haven't followed the Mahmoud Khalil story, you should.
"The nearly 13 million green card holders in the United States — not to mention foreign students and professors — have been put on notice that they need to watch what they say. [...] Nor can citizens rest easy; a government this willing to disregard the First Amendment is a danger to us all."
https://www.nytimes.com/2025/03/10/opinion/mahmoud-khalil-free-speech.html?unlocked_article_code=1.3E4.lFik.M0JJqcxbLOxG&smid=url-share
https://media.mstdn.social/media_attachments/files/114/141/581/339/222/436/original/f9ccbffd82e5f246.png

2025-03-08 18:58:36 GMT

The search on https://www.nih.gov/ will not show any results if you search for these (standalone) words:
- diversity
- equity
- inclusion
- DEI
- DEIA
- gender
- transgender
- nonbinary
- non-binary
- racism
Instead, it redirects you back to the home page.
But because there's also always incompetence in addition to malice, just putting the term in quotes or adding another word _does_ give you results. (Although perhaps that's resistance by those forced to implement the censorship?)
https://media.mstdn.social/media_attachments/files/114/128/325/100/411/627/original/b7ef41b6aabd2db5.mp4

2025-03-04 16:46:37 GMT

"Putin Agrees to Negotiate with Musk over Ownership of Trump"
https://www.borowitzreport.com/p/putin-agrees-to-negotiate-with-musk

2025-03-04 03:39:15 GMT

Tonight might be a particularly good time for Americans to donate to the #Ukraine - I just did and hope you will, too.
https://u24.gov.ua/ makes it easy and lets you choose where you want your money to go to.
#SlavaUkraini & #FuckTrump
https://media.mstdn.social/media_attachments/files/114/102/074/311/334/525/original/5a3fa6d1f66f7d8d.png

2025-03-02 02:01:41 GMT

While y'all are having fun with nih.gov's name servers, quick reminder that here's a quick little tool to run a query against multiple public resolvers to see what they see:
https://github.com/jschauma/puddy
(I also have a web interface for puddy, but don't want to mastodos my server. It's linked from GitHub, if you insist. :-)
cc @nprofile…ucuv
https://media.mstdn.social/media_attachments/files/114/090/365/808/272/530/original/29889d0f3fc3750c.png

2025-02-27 14:25:32 GMT

- reply

@nprofile…j5lu Chrome and Firefox both implement X25519MLKEM768; see e.g., https://www.netmeister.org/blog/pqc-2025-02.html for more details about the current status.

2025-02-27 13:35:37 GMT

- reply

@nprofile…j5lu You need oqs-provider for #pqc in #OpenSSL : https://github.com/open-quantum-safe/oqs-provider

2025-02-27 03:01:48 GMT

Looks like Google has enabled X25519MLKEM768 for Gmail STARTTLS:
```
$ openssl s_client -groups X25519MLKEM768 -starttls smtp -connect gmail-smtp-in.l.google.com.:25
Connecting to 2607:f8b0:4004:c07::1b
CONNECTED(00000005)
[…]
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
[…]
250 SMTPUTF8
```
Neat!
#pqc

2025-02-26 22:35:25 GMT

Wait, what? By using #Firefox, I now grant Mozilla "a nonexclusive, royalty-free, worldwide license to use" any data I "upload or input"? That seems, uhm, rather broad. Wtf.
I want my old Mozilla back.
https://www.mozilla.org/en-US/about/legal/terms/firefox/
https://media.mstdn.social/media_attachments/files/114/072/563/541/661/872/original/093a810db2f2857a.png

2025-02-26 03:53:26 GMT

Mark your calendars, nerds! Nationwide "Stand Up for Science" rallies to protest Trump's attacks on science and common sense are scheduled for March 7th.
Find your local event here:
https://standupforscience2025.org/
#standupforscience #fcktrmp

2025-02-23 16:02:08 GMT

- reply

@nprofile…eyyt 1) Thanks a lot for your always thorough and insightful analysis. I really appreciate your work! (Long overdue.)
Less important, but FYI
2) The link “something like this has already happened” goes to https://berthub.eu/articles/posts/servers-in-the-eu-eigen-sleutels-helpt-het/#wat-als-er-ruzie-is, which 404s.

2025-02-18 21:54:12 GMT

History of #Unix from the Multics perspective, including the fun reference that Unix was "One of whatever Multics was many of" or "Multics without balls.":
https://multicians.org/unix2.html

2025-02-17 19:03:48 GMT

Scenes from the “No Kings On Presidents’ Day” protest in Union Square just now.
Fuck Trump. Fuck Musk. And fuck the entire cowardly Republican Party.
#NotMyPresident #nyc
https://media.mstdn.social/media_attachments/files/114/020/767/482/849/500/original/61575f9558b463a3.jpeg
https://media.mstdn.social/media_attachments/files/114/020/767/421/672/482/original/53767cf124569e08.jpeg
https://media.mstdn.social/media_attachments/files/114/020/767/414/240/941/original/61b1594cca46e2d9.jpeg
https://media.mstdn.social/media_attachments/files/114/020/767/486/132/074/original/caf76912ef9afcff.jpeg

2025-02-11 04:13:45 GMT

Jesus Fucking Christ, so this is a thing now. Not only on the US version, but in international versions as well.
US Google Maps vs DE Google Maps
https://media.mstdn.social/media_attachments/files/113/983/300/157/214/851/original/e3fea55712fea9ff.png
https://media.mstdn.social/media_attachments/files/113/983/302/722/055/612/original/eb6e54a6444e460f.png

2024-12-18 14:59:38 GMT

- reply

Oh, and while I'm complaining: requiring sudo for dmesg is stupid, too. 🙄

2024-12-17 19:47:34 GMT

I swear, every time I use (a, any) Linux, I have to do a double-take and go "what the fresh fuck is this now". Today it's whatever is going on with /etc/motd on Ubuntu.
Making simple things complicated seems to be the trend there.

2024-11-22 19:59:56 GMT

#CISA has been doing a really good job promoting sensical #infosec practices over the last few years.
I'm not looking forward to the change in direction that Jen Easterly's departure and whatever ghastly appointees the new administration comes up with will mean.
https://www.nextgov.com/people/2024/11/cisa-director-jen-easterly-depart-inauguration-day/401036/

2024-06-11 18:39:53 GMT

If you give a typical systems project to a typical...
Software Developer: "This should be rewritten in Rust." (You might get a prototype in 6 months. It won't do what you need it to, but at least it won't have any buffer overflows.)
SRE: "I rewrote half of it in Go. The other half isn't working because that's not how you do this in Go."
SysAdmin: "Oh, I wrote that in Perl and shell years ago. Here, still works." (It does, but for some reason it contains your hardcoded password.)

2024-05-30 21:27:52 GMT

Wikipedia ain't asleep.
https://media.mstdn.social/media_attachments/files/112/532/155/695/545/587/original/7fc8781b5619e1e1.png

2024-05-02 12:02:43 GMT

OpenSSL is the latest major Open Source project moving distribution / development to GitHub:
https://openssl.org/blog/blog/2024/04/30/releases-distribution-changes/
Can't say I'm a fan of centralizing all our development, history, and releases of global, distributed, open source infrastructure pillars under one for-profit US company.

2024-04-05 18:24:28 GMT

Keep an eye on the uBlock logo in the upper right...
https://media.mstdn.social/media_attachments/files/112/220/006/027/844/710/original/eadc38e455f3bbad.mp4

2024-03-29 16:57:42 GMT

Some good sleuthing and interesting chaining here:
CVE-2024-3094: backdoor in upstream xz/liblzma leading to ssh server compromise
inserted m4 code -> configure script -> injected code into xz -> sshd when compiled with liblzma (e.g., used by systemd, what else)
https://www.openwall.com/lists/oss-security/2024/03/29/4

2024-03-05 16:09:16 GMT

Downdetector thinks there's a lot of ops folks having an interesting day on the internet...
Time for another round of "DNS, BGP, or expired certs?"

2024-02-12 16:40:59 GMT

Here's your regular reminder that by picking a cutesy name under some #ccTLD you are necessarily relinquishing full control to the ccTLD owner. @npub1vju…8ulw found out about that when Lybia shut down her vb.ly back in... 2010 or so? Now here is @npub17lg…9uux noting that queer.af was suspended by the Taliban.
Don't register your domains under a repressive regime's #TLD.
https://mstdn.social/@[email protected]/111918426534026789
#DNS #censorship

2023-12-21 02:56:47 GMT

Thinking of starting a new consulting business, called "That's Fucked Up As A Service".
I sit there and you explain your legacy system to me, and all I do is say "That's fucked up." If you agree, you get a discount. If you try to justify the brokenness, you have to pay double.

2023-12-05 14:32:50 GMT

The .ing and .meme #domains have their sunrise registration phase ending in about 90 minutes and enter general availability. Get 'em while they're hot!
https://blog.google/products/registry/google-registry-meme-domain/
https://blog.google/products/registry/introducing-the-ing-top-level-domain/
See more #DNS #TLD stats here:
https://www.netmeister.org/tldstats/
https://media.mstdn.social/media_attachments/files/111/528/290/283/825/543/original/bbb6f45189f4709f.png
https://media.mstdn.social/media_attachments/files/111/528/294/558/892/141/original/605e4c37c40a9160.png

2023-10-26 02:21:49 GMT

Ken Thompson's original Unix backdoor of "Reflections on Trusting Trust" fame was apparently never published. 40 years (!) later, here it is: 99 lines of code plus a 20-line shell script. That's it.
Nicely annotated and explained by Russ Cox:
https://research.swtch.com/nih

2023-10-02 14:36:15 GMT

- reply

@npub1jw5…9fry Yep. And different RIRs may have different requirements around what data is present in what format. So yes, my gripe is not with RDAP the protocol, but with the lack of a forced structure of the data the protocol makes available, I guess.

2023-10-02 14:20:22 GMT

- reply

@npub1jw5…9fry Different RIR's RDAP servers have different information (e.g., for 0.0.0.0, 1.0.0.0/8); the "registrant" role is sometimes present (1.0.0.0/24), sometimes missing (1.0.1.0/24); the vcard information for an entity sometimes points to an individual, sometimes a company, sometimes just an address, sometimes a net handle, etc.

2023-10-01 19:06:52 GMT

I've previously[1] talked about how stupid #WHOIS is, and while #RDAP is an improvement, it's still really just a bunch of information bits based on (regional) convention.
A human can usually quickly identify e.g., the owning legal entity from inspection of of the data, but good luck doing that programmatically. It's infuriating.
[1] https://www.netmeister.org/blog/whois.html

2023-09-21 14:11:31 GMT

Got a mail from somebody letting me know that my #Unix #Programming youtube lectures helped them get a job, so that absolutely made my day. 😃
https://www.youtube.com/c/cs631apue

2023-09-11 16:00:25 GMT

Happy OpenSSL 1.1.1 EOL Day to all who celebrate! 🎉
Congrats on having upgraded everything in time, because you knew exactly what software is used everywhere in your network and you have full control over all components and depdencies!
Good thing, too - would be pretty uncomfortable otherwise, running unsupported software that won't get security updates going forward.