Marsh Ray

Mostly computer and technical stuff. Radical listener. Tries to be a good person.
#Rust #UA

Github: https://github.com/marshray
Bluesky: @marshray.bsky.social
Discord: marshray
Email: marshray & live ! c0m
Twitch: https://www.twitch.tv/marsh_ray
Type: Static, strict

Public Key

npub1aq665y7hv4ntmghu5pgnled3g6xmzc2mtrcx6n4nfy5h8h0nkpwqx5xjyr

NIP-05 Address

marshray_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqswsdd2z0tk2e4a5t72q5flukc5drd3v9d43urdf6e5j2tnmhemqhqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds7tfldn

Publishing to

nostr.mom

relay.damus.io

nos.lol

Author Public Key

npub1aq665y7hv4ntmghu5pgnled3g6xmzc2mtrcx6n4nfy5h8h0nkpwqx5xjyr

Show more details

Last Notes

2026-08-17 03:35:59 UTC

- reply

I feel validated, lol
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/108/752/349/110/242/original/f674f3f8d39b8bdc.png

2026-08-09 23:30:23 UTC

- reply

I feel "whitening" under-sells what needs to be done to the raw entropy-bearing data before outputting to the client.
A good CSRNG requires multiple pools, each effectively a CSPRNG.

2026-08-07 08:53:10 UTC

- reply

Eventually I did finish this one and it was quite good. Thank you for the recommendation.

2026-07-14 03:31:47 UTC

- reply

What if the evil AI sees the reflection of the screen in your glasses tho

2026-07-11 00:47:01 UTC

- reply

Huh. I thought the helicopter sound was made by John Fogerty’s guitar.

2026-07-06 09:01:37 UTC

- reply

I do find it really interesting that this idea of a uniquely capable yet maliciously compliant non-human entity is one of our ancient and universal cross cultural archetypes.

2026-06-24 23:49:35 UTC

- reply

Just curious, what would you have preferred to have read ?

2026-06-24 23:47:29 UTC

- reply

Good stuff

2026-06-24 17:37:53 UTC

Pls boost for sample size thx

2026-06-20 18:48:06 UTC

- reply

Well, sure, but you knew that as soon as you saw the page count.
Neil Stephenson's books are for readers who enjoy reading Neil Stephenson's writing. It's certainly not for everyone and it's not even what I choose most of the time. But I have never regretted that time.

2026-06-19 06:31:35 UTC

*Cryptonomicon*
Neil Stephenson (1999)
If you want a dramatic tour of 1940-1999 cryptography, internet, WWII, Philippine history, and pre-BTC crypto-libertarianism, this is amazing. Few unapologetically-technical books of this type hold up this well 27 years later.
How had I not read this before?

2026-05-21 20:06:57 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/614/366/200/600/451/original/0eea82d82d588d3e.png

2026-05-01 20:03:09 UTC

Free as in

2026-05-01 19:24:20 UTC

There are approximately 488 Linux kernel CVEs per month* and not a lot of reason to think that CVE-2026-31431("copy .fail") is particularly special.
- It's an LPE (local privilege escalation). Yes, we should take it seriously and never give up the dream. No, you should not rely on non-virtualized containers to provide a true multi-tenant security boundary.
- Every potential attacker in the world has been able to observe the vulnerability in source code form since mid-2017 (9 years ago).
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=72548b093ee38a6d4f2a19e6ef1948ae05c181f7
- The vendor was notified of the vulnerability 2026-03-23 (39 days ago), apparently with enough detail to put together a patch in ~3 days.
- Every potential attacker in the world was informed of the specific vulnerability 30 days ago (2026-03-31 at the latest) when the patch was committed with the header "Reported-by: Taeyang Lee <0wn@ theori. io>" Theori .io advertises both offensive and defensive security information services on their site.
https://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git/commit/?id=a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
The researchers:
- Notified the kernel security team
- Observed the patch committed
- Waited another 34 days
- Published a detailed writeup
Professionally done, IMO.
The researchers followed the process outlined on the affected vendor's website. Specifically:
"the kernel security team strongly recommends that as a reporter of a potential security issue you DO NOT contact the “linux-distros” mailing list UNTIL...[list that includes some absurdly vague conditions]"
https://docs.kernel.org/process/security-bugs.html
To do much more than follow the vendor's preferred disclosure process often amounts to demanding that *your* bug be given special attention and treatment. Which is a thing researchers sometimes do. Naturally it's hard to be objective about one's own finding.
Assessing and prioritizing bug reports is generally the job of the *vendor's* security team, *not* the researchers. There are exceptions. But to force special handling for your bug is simply to blindly take resources away from all the reports that will lead to the 487 other CVEs that month. And some of those might not be LPEs. They could be wormable remote network holes or virtual machine breakout bugs.
In this case, the kernel security team appears to have decided that the appropriate response was to let downstream read about it when the patch was committed to source control like everybody else. A CVE was publicly announced 11 days later, for a total of 30 days after being notified.
There are far worse systems.
Regardless, that process is theirs to manage. It's between the Linux kernel team and whoever they have made promises to.
I don't know about you, but I get my Linux for free. Nobody promised me anything.
* Data from stack .watch/product/linux/linux-kernel/, 14 month average

2026-03-06 15:13:56 UTC

- reply

tay are you ok?

2025-12-23 06:09:59 UTC

- reply

Perhaps it’d be easier to make a map of where the people who are in each location today are the original inhabitants.

2025-11-28 00:28:56 UTC

- reply

Imagine a major cloud provider relied on lava lamps for entropy, but the villain just unplugs them and lets them cool down.

2025-07-30 06:52:46 UTC

- reply

Automatically, every time I exit the browser. So typically a few times a week.

2025-07-25 21:24:46 UTC

- reply

Weird, most mathematical notation I’ve seen prefers to begin numbering indices starting with 1.

2025-07-10 10:32:37 UTC

- reply

I have done Rust for many years and I agree completely. It can feel like being stuck indoors, building a tall ship in a bottle, looking out the window at your friends playing with their model boats on the lake.

2025-02-02 04:52:24 UTC

- reply

I wish I had the strength in my pinkys for emacs

2025-01-29 16:17:17 UTC

Don’t be surprised by reports of highly capable #ai models trained or running on 10x or lower powered hardware. No one really knows where the bottom is, but there’s likely a lot of room there.
What we do know is many of the greatest minds in the world are powered by a cup of coffee and a bagel or a banana, and only a fraction of that energy ends up powering the actual text generation.

2024-11-13 19:31:33 UTC

- reply

I personally find it helpful to treat them as two different networks for mostly different kinds of content.
I don’t have Bsky on my phone anymore.

2024-11-12 23:41:34 UTC

- reply

Also relevant:
How to Eat Your Entropy and Have it Too - Optimal Recovery Strategies for Compromised RNGs
Dodis; Shamir; Stephens-Davidowitz; Wichs
https://eprint.iacr.org/2014/167
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/472/625/691/990/178/original/a78e3a851e7d7798.png

2024-11-12 23:31:11 UTC

- reply

Good catch!Neils Ferguson is a designer of both.
I believe he had a proof involving these requirements, it may have been in that paper.

2024-10-12 02:12:21 UTC

- reply

This argument has probably been used against general literacy since the beginning of history.

2024-09-30 16:28:43 UTC

- reply

I‘m struggling to name more than 2 or 3 anti-maga conservatives at this point.
Liz Cheney? Adam Kinzinger?

2024-09-28 20:00:39 UTC

- reply

Perhaps we should dig 99 deep hardened concrete vaults containing absolutely nothing for every one containing nuclear waste.

2024-09-28 19:34:07 UTC

- reply

Yeah, I typically listen to books on Audible.
Some were recorded for cassette tape distribution. Some narrations even sound sped up. Audible started in the 1990’s, when bandwidth costs motivated high MP3 compression ratios.

2024-09-28 18:48:50 UTC

- reply

10 minutes in and this is the same formulaic ‘character introduction by graphic torture scene’ as in ‘Consider Phlebas’.
Also, the audio quality is terrible.

2024-09-27 17:21:27 UTC

- reply

Thank you. I have tried to get into Banks in the past, but perhaps I will give this one a shot.

2024-09-27 06:51:43 UTC

- reply

How does it work out in the book?