2026-05-01T19:28:33Z https://yabu.me Marsh Ray https://yabu.me/npub1aq665y7hv4ntmghu5pgnled3g6xmzc2mtrcx6n4nfy5h8h0nkpwqx5xjyr https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/545/146/816/261/022/original/e6c404adf9827341.jpg https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/545/146/816/261/022/original/e6c404adf9827341.jpg https://yabu.me/nevent1qqsfkmsth6klq2dlet0pucw9w8hmqw2n4snmt8zjdwzyshhm76g33jgzyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9c2gj2h9 Free as in 2026-05-01T20:03:09Z https://yabu.me/nevent1qqspr7650k9v5nr7d6ea5hqrpt6q5cnjd8zuukqywykc0gczmywyhmgzyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9caen7e4 There are approximately 488 Linux kernel CVEs per month* and not a lot of reason to think that CVE-2026-31431(&#34;copy .fail&#34;) is particularly special.<br/><br/>- It&#39;s an LPE (local privilege escalation). Yes, we should take it seriously and never give up the dream. No, you should not rely on non-virtualized containers to provide a true multi-tenant security boundary.<br/><br/>- Every potential attacker in the world has been able to observe the vulnerability in source code form since mid-2017 (9 years ago).<br/><a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=72548b093ee38a6d4f2a19e6ef1948ae05c181f7">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=72548b093ee38a6d4f2a19e6ef1948ae05c181f7</a><br/><br/>- The vendor was notified of the vulnerability 2026-03-23 (39 days ago), apparently with enough detail to put together a patch in ~3 days.<br/><br/>- Every potential attacker in the world was informed of the specific vulnerability 30 days ago (2026-03-31 at the latest) when the patch was committed with the header &#34;Reported-by: Taeyang Lee &lt;0wn@ theori. io&gt;&#34; Theori .io advertises both offensive and defensive security information services on their site.<br/><a href="https://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git/commit/?id=a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5">https://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git/commit/?id=a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5</a><br/><br/>The researchers:<br/><br/>- Notified the kernel security team<br/>- Observed the patch committed<br/>- Waited another 34 days<br/>- Published a detailed writeup<br/><br/>Professionally done, IMO.<br/><br/>The researchers followed the process outlined on the affected vendor&#39;s website. Specifically:<br/>&#34;the kernel security team strongly recommends that as a reporter of a potential security issue you DO NOT contact the “linux-distros” mailing list UNTIL...[list that includes some absurdly vague conditions]&#34;<br/><a href="https://docs.kernel.org/process/security-bugs.html">https://docs.kernel.org/process/security-bugs.html</a><br/><br/>To do much more than follow the vendor&#39;s preferred disclosure process often amounts to demanding that *your* bug be given special attention and treatment. Which is a thing researchers sometimes do. Naturally it&#39;s hard to be objective about one&#39;s own finding.<br/><br/>Assessing and prioritizing bug reports is generally the job of the *vendor&#39;s* security team, *not* the researchers. There are exceptions. But to force special handling for your bug is simply to blindly take resources away from all the reports that will lead to the 487 other CVEs that month. And some of those might not be LPEs. They could be wormable remote network holes or virtual machine breakout bugs.<br/><br/>In this case, the kernel security team appears to have decided that the appropriate response was to let downstream read about it when the patch was committed to source control like everybody else. A CVE was publicly announced 11 days later, for a total of 30 days after being notified.<br/><br/>There are far worse systems.<br/><br/>Regardless, that process is theirs to manage. It&#39;s between the Linux kernel team and whoever they have made promises to.<br/><br/>I don&#39;t know about you, but I get my Linux for free. Nobody promised me anything.<br/><br/>* Data from stack .watch/product/linux/linux-kernel/, 14 month average 2026-05-01T19:24:20Z https://yabu.me/nevent1qqsxr94ah374l8n0t5yrrtxjuedm9g88aun2fjt0t5nce9mv2r0046czyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9cg6wwmc In reply to <a href='/nevent1qqs2u7kn89r5nrwdyyamyz20m4lky3as93ztdm3gzm5x9kpw2sxuh9gz0atlk'>nevent1q…atlk</a><br/>_________________________<br/><br/>tay are you ok? 2026-03-06T15:13:56Z https://yabu.me/nevent1qqs89qmvl20s9nd2qqcfeww62ske6k7dqyeyenll7txr83axxdtgutszyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9cxqq30s In reply to <a href='/nevent1qqs969e3la4fqyws69v8y24musvy4cc7zun5hnh26saq34nfy0k80fc5wfc4u'>nevent1q…fc4u</a><br/>_________________________<br/><br/>Perhaps it’d be easier to make a map of where the people who are in each location today are the original inhabitants. 2025-12-23T06:09:59Z https://yabu.me/nevent1qqs94f7mfc6gqd724lmf34jf4m92m7wmq0rm9jm6zc7gjme4s0hwshszyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9cp69yqj In reply to <a href='/nevent1qqswe2pgaal2tnlxk8y0k2qvfezndvryqgnym0x9s6fksln70k2cwtcj75ppd'>nevent1q…5ppd</a><br/>_________________________<br/><br/>Imagine a major cloud provider relied on lava lamps for entropy, but the villain just unplugs them and lets them cool down. 2025-11-28T00:28:56Z https://yabu.me/nevent1qqs0upxw0486mr8mj26tr4nv5jex62vnkxmw0xrx5mq0ynd43pkmpqczyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9c33vtnt In reply to <a href='/nevent1qqswp3l8yknrrspdrgrstemjtrznsufq5hstcgvaef4gd9fm3z53p3cp8fy99'>nevent1q…fy99</a><br/>_________________________<br/><br/>Automatically, every time I exit the browser. So typically a few times a week. 2025-07-30T06:52:46Z https://yabu.me/nevent1qqs26spquc8xdhkxrzts25pfkyf78uj8f4teursn5jmhyw6hhacth5czyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9cpdemme In reply to <a href='/nevent1qqsdj08rp9z8asgdt040y6t06geyxcemrl89r8lucw3ywdj6kh2ptdc5nc3nt'>nevent1q…c3nt</a><br/>_________________________<br/><br/>Weird, most mathematical notation I’ve seen prefers to begin numbering indices starting with 1. 2025-07-25T21:24:46Z https://yabu.me/nevent1qqsfkxljs5d30dudu04j5cuveprma6y4zctvqzaz9kjax6w2k794mxszyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9cz7nk0l In reply to <a href='/nevent1qqs8yfg2lmnsj3qhk3j2lxj407v6kux7kxwuekytpa2nhn32ppzu9ccjxncun'>nevent1q…ncun</a><br/>_________________________<br/><br/>I have done Rust for many years and I agree completely. It can feel like being stuck indoors, building a tall ship in a bottle, looking out the window at your friends playing with their model boats on the lake. 2025-07-10T10:32:37Z https://yabu.me/nevent1qqsvaqreaqy2vlhhhqcjyg3qwr5tqd44e0c26s4fkw6pmwrhgfkl54qzyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9c6pdhm9 In reply to <a href='/nevent1qqsguhsczmapwv5cxuxm8lrd4tpcq3uaz9vnsg7l7h5vxqec0e5xsuqwfe8sg'>nevent1q…e8sg</a><br/>_________________________<br/><br/>I wish I had the strength in my pinkys for emacs 2025-02-02T04:52:24Z https://yabu.me/nevent1qqspagsxza2csd5fqcq0f7qe5gs2vks89zqhku6zcgsxzcnaaqynplczyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9clna2c6 Don’t be surprised by reports of highly capable #ai models trained or running on 10x or lower powered hardware. No one really knows where the bottom is, but there’s likely a lot of room there.<br/><br/>What we do know is many of the greatest minds in the world are powered by a cup of coffee and a bagel or a banana, and only a fraction of that energy ends up powering the actual text generation. 2025-01-29T16:17:17Z https://yabu.me/nevent1qqsguxnaj3he9xry4vcvdldkvmjt94nfdantryn6n9aw7lu7w859zkgzyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9c60s0ph In reply to <a href='/nevent1qqsdxm87ga9jnrc8t9wtx02qv06lyx9umndnvzk5tmnse70fes9fkdqt96gfw'>nevent1q…6gfw</a><br/>_________________________<br/><br/>I personally find it helpful to treat them as two different networks for mostly different kinds of content.<br/><br/>I don’t have Bsky on my phone anymore. 2024-11-13T19:31:33Z https://yabu.me/nevent1qqsg4998uc2rhs774uvypyxa98xssr98kr02fm5k3hk3z2lzpr0c0dczyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9cs99qx3 In reply to <a href='/nevent1qqsf2creqx4v056yrfzjr86y5z3qf4l3fetga87jjwqztalxdwchm0shy5ekg'>nevent1q…5ekg</a><br/>_________________________<br/><br/>Also relevant:<br/><br/>How to Eat Your Entropy and Have it Too - Optimal Recovery Strategies for Compromised RNGs<br/>Dodis; Shamir; Stephens-Davidowitz; Wichs<br/><a href="https://eprint.iacr.org/2014/167">https://eprint.iacr.org/2014/167</a><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/472/625/691/990/178/original/a78e3a851e7d7798.png"> <br/> 2024-11-12T23:41:34Z https://yabu.me/nevent1qqsf2creqx4v056yrfzjr86y5z3qf4l3fetga87jjwqztalxdwchm0szyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9cd9l0ud In reply to <a href='/nevent1qqszy6acn8vyf86c8mdq4vauv345x3r6tm7nrxjxmklzdhn54acj55qtvmd4w'>nevent1q…md4w</a><br/>_________________________<br/><br/>Good catch!Neils Ferguson is a designer of both.<br/><br/>I believe he had a proof involving these requirements, it may have been in that paper. 2024-11-12T23:31:11Z https://yabu.me/nevent1qqsv52numqda9dfc3ygsefmm3e8pn7w73pvav25qw9jm7v4eaeynhtgzyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9cseqqe2 In reply to <a href='/nevent1qqsyys4ffljd627n9lgq2t7gqeaywp45p4xjvvrav95y0y20nf33jygrj9pcs'>nevent1q…9pcs</a><br/>_________________________<br/><br/>This argument has probably been used against general literacy since the beginning of history. 2024-10-12T02:12:21Z https://yabu.me/nevent1qqsds0tth46jctfl7qj8jcv22c560cgm6rluzhf457xkshufvuyhntqzyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9ctc7ks6 In reply to <a href='/nevent1qqsqr605dm7l7p8q9cyypk083r63ve5gmq4yfy6f2v36vx9ckw4znjsm76hhz'>nevent1q…6hhz</a><br/>_________________________<br/><br/>I‘m struggling to name more than 2 or 3 anti-maga conservatives at this point.<br/>Liz Cheney? Adam Kinzinger? 2024-09-30T16:28:43Z https://yabu.me/nevent1qqswv889n6vkhxkzv5rfmz2dhjvwm7ftsj84un280j6jxq8l5u5hsxgzyr5rt2sn6ajkd0dzljs9z0l9k9rgmvtptdv0qm2wkdyjju7a7wc9ct8gz9g In reply to <a href='/nevent1qqsdlv63v3w7wude0d3syhcyp66vpscs6x3q62l8aa8dav339mvmj5sy7vu0w'>nevent1q…vu0w</a><br/>_________________________<br/><br/>Perhaps we should dig 99 deep hardened concrete vaults containing absolutely nothing for every one containing nuclear waste. 2024-09-28T20:00:39Z