Marsh Ray

Mostly computer and technical stuff. Radical listener. Tries to be a good person.
#Rust #UA

Github: https://github.com/marshray
Bluesky: @marshray.bsky.social
Discord: marshray
Email: marshray & live ! c0m
Twitch: https://www.twitch.tv/marsh_ray
Type: Static, strict

Last Notes

2026-05-01 20:03:09 UTC

Free as in

2026-05-01 19:24:20 UTC

There are approximately 488 Linux kernel CVEs per month* and not a lot of reason to think that CVE-2026-31431("copy .fail") is particularly special.
- It's an LPE (local privilege escalation). Yes, we should take it seriously and never give up the dream. No, you should not rely on non-virtualized containers to provide a true multi-tenant security boundary.
- Every potential attacker in the world has been able to observe the vulnerability in source code form since mid-2017 (9 years ago).
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=72548b093ee38a6d4f2a19e6ef1948ae05c181f7
- The vendor was notified of the vulnerability 2026-03-23 (39 days ago), apparently with enough detail to put together a patch in ~3 days.
- Every potential attacker in the world was informed of the specific vulnerability 30 days ago (2026-03-31 at the latest) when the patch was committed with the header "Reported-by: Taeyang Lee <0wn@ theori. io>" Theori .io advertises both offensive and defensive security information services on their site.
https://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git/commit/?id=a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
The researchers:
- Notified the kernel security team
- Observed the patch committed
- Waited another 34 days
- Published a detailed writeup
Professionally done, IMO.
The researchers followed the process outlined on the affected vendor's website. Specifically:
"the kernel security team strongly recommends that as a reporter of a potential security issue you DO NOT contact the “linux-distros” mailing list UNTIL...[list that includes some absurdly vague conditions]"
https://docs.kernel.org/process/security-bugs.html
To do much more than follow the vendor's preferred disclosure process often amounts to demanding that *your* bug be given special attention and treatment. Which is a thing researchers sometimes do. Naturally it's hard to be objective about one's own finding.
Assessing and prioritizing bug reports is generally the job of the *vendor's* security team, *not* the researchers. There are exceptions. But to force special handling for your bug is simply to blindly take resources away from all the reports that will lead to the 487 other CVEs that month. And some of those might not be LPEs. They could be wormable remote network holes or virtual machine breakout bugs.
In this case, the kernel security team appears to have decided that the appropriate response was to let downstream read about it when the patch was committed to source control like everybody else. A CVE was publicly announced 11 days later, for a total of 30 days after being notified.
There are far worse systems.
Regardless, that process is theirs to manage. It's between the Linux kernel team and whoever they have made promises to.
I don't know about you, but I get my Linux for free. Nobody promised me anything.
* Data from stack .watch/product/linux/linux-kernel/, 14 month average

2026-03-06 15:13:56 UTC

- reply

tay are you ok?

2025-12-23 06:09:59 UTC

- reply

Perhaps it’d be easier to make a map of where the people who are in each location today are the original inhabitants.

2025-11-28 00:28:56 UTC

- reply

Imagine a major cloud provider relied on lava lamps for entropy, but the villain just unplugs them and lets them cool down.

2025-07-30 06:52:46 UTC

- reply

Automatically, every time I exit the browser. So typically a few times a week.

2025-07-25 21:24:46 UTC

- reply

Weird, most mathematical notation I’ve seen prefers to begin numbering indices starting with 1.

2025-07-10 10:32:37 UTC

- reply

I have done Rust for many years and I agree completely. It can feel like being stuck indoors, building a tall ship in a bottle, looking out the window at your friends playing with their model boats on the lake.

2025-02-02 04:52:24 UTC

- reply

I wish I had the strength in my pinkys for emacs

2025-01-29 16:17:17 UTC

Don’t be surprised by reports of highly capable #ai models trained or running on 10x or lower powered hardware. No one really knows where the bottom is, but there’s likely a lot of room there.
What we do know is many of the greatest minds in the world are powered by a cup of coffee and a bagel or a banana, and only a fraction of that energy ends up powering the actual text generation.

2024-11-13 19:31:33 UTC

- reply

I personally find it helpful to treat them as two different networks for mostly different kinds of content.
I don’t have Bsky on my phone anymore.

2024-11-12 23:41:34 UTC

- reply

Also relevant:
How to Eat Your Entropy and Have it Too - Optimal Recovery Strategies for Compromised RNGs
Dodis; Shamir; Stephens-Davidowitz; Wichs
https://eprint.iacr.org/2014/167
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/472/625/691/990/178/original/a78e3a851e7d7798.png

2024-11-12 23:31:11 UTC

- reply

Good catch!Neils Ferguson is a designer of both.
I believe he had a proof involving these requirements, it may have been in that paper.

2024-10-12 02:12:21 UTC

- reply

This argument has probably been used against general literacy since the beginning of history.

2024-09-30 16:28:43 UTC

- reply

I‘m struggling to name more than 2 or 3 anti-maga conservatives at this point.
Liz Cheney? Adam Kinzinger?

2024-09-28 20:00:39 UTC

- reply

Perhaps we should dig 99 deep hardened concrete vaults containing absolutely nothing for every one containing nuclear waste.