lcamtuf :verified: :verified: :verified:

To Be Filled By O.E.M.

Homepage: https://lcamtuf.coredump.cx
Blog: https://blog.coredump.cx/archive
Book: https://lcamtuf.coredump.cx/electronics/

Public Key

npub1ysw7nqfvcf6l7w6n828j8xnsjsxz2lcxmk3fu536ucm2z963mv3qhduzpe

NIP-05 Address

lcamtuf_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqszg80fsykvya0l8dfn4rernfcfgrp90urdmg572gawvd4pzagakgsprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt99xsvs

Publishing to

relay.momostr.pink

Author Public Key

npub1ysw7nqfvcf6l7w6n828j8xnsjsxz2lcxmk3fu536ucm2z963mv3qhduzpe

Show more details

Last Notes

2026-07-11 15:15:35 UTC

I don't find it surprising that people send LLM-generated docs, publish LLM-generated blog posts, etc. Writing is a chore and there's this big button labeled "get it done".
But almost no one is forthcoming about it: maybe 1% of AI-generated text I see credits the tool? People deny it even when caught red-handed.
I suspect one reason is that they still want the credit for pressing the button. But another factor may be that they realize there's no moat. If person A can prompt for blog posts, so can person B and C and D... so you don't want others to get the same idea.

2026-06-20 16:57:35 UTC

NOT COOL, MUSEUM. Not cool.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/783/488/672/977/322/original/acaad2e8220ba718.png

2026-05-04 16:14:48 UTC

The coreutils Rust rewrite story is pretty funny.
Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.
But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:
https://seclists.org/oss-sec/2026/q2/332
PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

2026-05-03 15:11:11 UTC

Do you own books about electronics, but could never make it all click? Do you know what a resistor does, but still get stumped designing your own circuits?
If yes, I wrote "The Secret Life of Circuits" with you in mind. All chapters are available now: https://lcamtuf.coredump.cx/blog/secret/

2026-05-01 04:46:33 UTC

Are you tired of memorizing IP addresses? Well, you no longer have to!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/497/500/685/787/398/original/34eadf97481f0592.png

2026-04-30 01:55:16 UTC

When you search for the title of my upcoming book on Twitter, you mostly get... LLMs doing weird things
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/491/164/945/566/423/original/c31ef91b0ee1a1ae.png

2026-04-28 20:08:30 UTC

Two words: systemd-openclawd

2026-04-24 13:54:27 UTC

I'm sorry folks, but I checked with ICANN and we're renaming "infosec" to "Mythos hot takes"

2026-04-18 14:06:10 UTC

With "The Secret Life of Circuits", I aim for the middle ground between simplistic introductory books and academic textbooks such as "The Art of Electronics". In a nutshell, you don't need to take calculus to understand what this book is about, but it also doesn't insult you with plumbing analogies.
There's plenty of beautiful, hobbyist-friendly paperbacks that teach about Ohm's law and explain how to use a breadboard. Not as many help you grasp op-amps or transistors. Heck, even capacitors sometimes remain shrouded in mystery.
Anyway, if you've ever read a book about electronics and then felt completely helpless when trying to design your own circuits, SLC might be just what you need.
Linkety-link: https://lcamtuf.coredump.cx/electronics/

2026-04-17 13:06:28 UTC

- reply

I imagine it should be available on amazon.co.uk soon, but if you want the early access copy, I'm afraid it is what it is :-(

2026-04-16 22:26:21 UTC

The cat's out of the bag! My latest book, "The Secret Life of Circuits", is available in early access:
https://lcamtuf.coredump.cx/blog/secret/
It's the reference I wish I had when I was starting out. Electrons to embedded systems, 290+ color illustrations and 420+ pages of well-explained theory.

2026-04-16 14:21:31 UTC

I wonder if Mythos is good at writing thought pieces about Mythos, because if yes, it stands to jeopardize thousands of livelihoods

2026-04-15 14:39:20 UTC

Interesting. It would appear that something has changed on Hackernews around April 8. Up until that point, the daily line-up was pretty much dominated by stories written by AI or about AI. After that, it pretty much stopped.
(I've been tracking it for a while for fun.)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/409/234/549/922/361/original/5ad5f2e86b201bb5.jpg

2026-04-12 15:35:35 UTC

At this point, LLM-written think pieces make up about half of all long-form writing in my social media feed.
When I push back, I get two reactions. Authors say that it just helps them express themselves. AI promoters say "get used to it".
I don't think we should: it boils down to asymmetry. Our time here is limited. Social interaction on the internet breaks down if it takes ~0 effort to publish, but readers are still expected to use their own eyeballs and brains to engage.
So, I feel that we have three choices:
1) Refuse to engage with LLM writing *no matter if the article makes a good point or not*.
2) Embrace it and have my agent argue with your agent forever, for internet points.
3) Call it quits and move to an off-the-grid cabin in the woods.

2026-03-25 15:46:31 UTC

Look, the 1950s just hit different
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/290/585/242/339/979/original/4255dbb3525916a5.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/290/586/479/428/016/original/2ca109f16ef7ec2f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/290/587/927/893/784/original/14e05a4454bbe1d8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/290/597/329/358/783/original/f599574e0936ec26.png

2026-03-21 00:13:23 UTC

Do not forget to patch your systems!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/264/271/707/753/032/original/d77640bb2383bb66.png

2026-03-19 01:23:58 UTC

Conway's Game of Life, in real life: http://lcamtuf.coredump.cx/blog/conway

2026-03-17 05:32:20 UTC

I'm dying. With this translate tool, I'm finally able to effectuate all my ideation synergies
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/242/876/217/392/254/original/c7ce8bf210daed79.png

2026-03-10 14:34:59 UTC

hmm, I installed some updates and now this is happening
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/205/374/486/366/265/original/c30ae994dbbaa21b.png

2026-03-06 04:11:38 UTC

If you ask AI to rewrite the entirety of an open-source program, do you still need to abide by the original license? In philosophy, this problem is known as the Slop of Theseus

2026-03-02 17:13:11 UTC

Look, if you're not using an LLM as a creative partner, you're gonna be left behind. It's just very inefficient to keep having original thoughts

2026-03-01 16:22:18 UTC

Thank you, internet! I know I speak for all of us when I say that what we needed at this hour was another 1,000 think pieces about AI

2026-03-01 01:02:21 UTC

I'm proud to announce a breakthrough in ML image generation. We use reverse diffusion to turn good images into uniform noise

2026-02-28 17:15:00 UTC

"I ran out of API credits" gofundme campaigns are now a thing, because of course they are
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/149/376/411/615/338/original/82ce70c94ea7a0a8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/149/445/975/134/751/original/eb446fd10d6a8abc.png

2026-02-28 02:33:51 UTC

Approximation game: https://lcamtuf.coredump.cx/blog/approx/

2026-02-25 01:29:27 UTC

OK, it was time to add this page: https://lcamtuf.coredump.cx/webring.shtml

2026-02-24 17:46:07 UTC

OK, I'm speechless: https://lyra.horse/x86css/

2026-02-17 04:11:36 UTC

So, you might have heard about > or ≥. But are you ready for...
≩ U+2269 GREATER-THAN BUT NOT EQUAL TO
⋛ U+22DB GREATER-THAN EQUAL TO OR LESS-THAN (just remember that ⋛ is not equal to ⋚)
⪌ U+2A8C GREATER-THAN ABOVE DOUBLE-LINE EQUAL ABOVE LESS-THAN (compare to ⪋, ⪒, and ⪑)
And of course, let's not forget the classic ⪔ U+2A94 GREATER-THAN ABOVE SLANTED EQUAL ABOVE LESS-THAN ABOVE SLANTED EQUAL (don't mix that one up with ⪓)

2026-02-16 20:59:59 UTC

Did you know that Unicode has a symbol for "really equals, but this time I mean it"? It could come in handy for JavaScript
U+003D = EQUALS SIGN
U+2261 ≡ IDENTICAL TO
U+2263 ≣ STRICTLY EQUIVALENT TO

2026-02-14 17:57:28 UTC

Math trivia: the "B." in Benoit B. Mandelbrot stands for Benoit B. Mandelbrot

2026-02-08 04:31:11 UTC

I just upgraded to a new laptop and to the designer who dreamt up rounded corners for the LCD panel: hilarious, real hilarious
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/033/130/847/124/388/original/c56b1ed202687134.jpg

2026-02-03 20:14:04 UTC

I'm speechless, that's not even enough for node.js
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/008/526/686/106/339/original/b81c3e79afa1f2c3.png

2026-01-12 22:00:53 UTC

Fun computer fact: in binary data streams, zeros don't convey information and are included solely for padding purposes. They can be removed to make files smaller, then inserted back if a particular program requires padding for compatibility.

2026-01-11 16:56:02 UTC

- reply

They don't exist to meet demand; they exist to game the engagement systems we put in place. I think that's true for a lot of other AI content on the internet too.
3/3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/511/856/719/176/original/64d031e36112a0f7.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/512/850/277/313/original/229ebbce9cf85526.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/513/563/296/541/original/4e6a4ff6d8e5ec29.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/515/117/922/011/original/5991587758d2c1dc.png

2026-01-11 16:54:49 UTC

- reply

...the usual argument for AI-generated articles is that they're just good enough for most people, so there's no point in getting your panties in a twist.
But you can't argue that these schematics are useful. No one can build these circuits. They make no sense!
2/3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/509/337/171/507/original/6955495940923318.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/509/525/961/048/original/169cd7011e8af678.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/510/016/571/760/original/0329bebf43142d53.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/510/313/749/776/original/89b6f62411cc0a27.png

2026-01-11 16:54:17 UTC

So there is this Facebook page with 1M subscribers, and an associated network of content creators with tens of thousands of followers, that's essentially dedicated to posting nonsensical, AI-generated circuit "schematics".
And it's interesting because... 1/3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/506/020/052/828/original/7962b678c8849f6a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/506/346/701/832/original/6622eb70a18c231d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/506/997/830/416/original/28cd3c3aefac4604.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/877/507/616/632/074/original/e9fcf6987203f69b.png

2026-01-04 16:52:45 UTC

The plot of new Stack Exchange questions asked per month is pretty spectacular.
And while I don't doubt that LLMs player a role on the tail end (2023 onward), it was cooked long before.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/837/849/403/545/519/original/81aabde0f8b5efe1.png

2026-01-04 05:26:35 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/835/167/805/948/354/original/7c3c9ca81d4bcbf3.jpg

2026-01-03 22:19:06 UTC

OK, not bad, not bad
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/833/486/967/730/939/original/1d060c5a508117c4.png

2026-01-03 16:44:55 UTC

Remember to unplug your computer before midnight
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/832/172/008/442/645/original/ddbff256241fb64e.png

2025-12-19 02:50:01 UTC

Time to cash in on RAM shortages! No lowballs, I know what I've got
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/743/954/642/776/178/original/5fd54496e8980090.png

2025-12-10 20:51:06 UTC

If you're planning to visit Europe, be sure to bring the right adapter with you
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/697/242/497/549/506/original/6a64979e43499207.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/697/243/793/234/254/original/603e7b2e9b8d62a6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/697/244/369/663/654/original/e874d9ae551728a0.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/697/245/543/887/592/original/07f974fbecf74203.png

2025-12-08 01:21:10 UTC

Hmm, the visitors to my website seem to be really interested in React, I wonder if I should install it

2025-11-14 19:43:21 UTC

Not bad: https://clocks.brianmoore.com/

2025-11-13 23:14:01 UTC

When it comes to writing, LLMs have won - https://lcamtuf.coredump.cx/blog/llm-win/

2025-11-12 22:12:02 UTC

Oh, you use transistors? How quaint!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/539/018/033/099/830/original/82f4b61f68722d1a.jpg

2025-11-11 00:54:24 UTC

My favorite fact about recycling is that 100% recycled plastic is often worthless, so instead, you add 5% of recycled material to a vat and make 10,000 shampoo bottles out of that, and then you take 500 of these bottles and label them "100% recycled".
Which is not wrong and yet terribly wrong at the same time

2025-11-02 19:42:10 UTC

Things you can do with diodes: https://lcamtuf.coredump.cx/blog/diodes/?m2

2025-10-29 06:16:28 UTC

Quick question: instead of trying to rewrite all software, have we tried just rewriting the C compiler in Rust?

2025-10-26 13:59:41 UTC

I'm not sure if it's Amazon or if I just don't understand contemporary fashion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/440/823/190/900/918/original/bc18a15e9149be1a.png

2025-10-23 15:15:05 UTC

- reply

Honestly, when I'm helping my kid with math, I'm always far more confused by the three-letter notation. "The angle ABC is the same as MNB and BZY + BCD = 90° - DCE + QAB..." like, just give them real names

2025-10-23 14:46:43 UTC

Well, that's a new one: someone on HN just called me out on breaking my promise not to use "advanced math" because I used basic trigonometry and then asserted that a - b = a + (-b)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/424/020/668/406/832/original/81f7708e21d25e96.png

2025-10-17 16:04:13 UTC

Content farm: "The 8 best AI image generators!"
Search engine: "Yeah, about that... we now prioritize recency"
Content farm: "The 8 best AI image generators in 2025!"
Search engine: "Sorry, your buddies already published that one"
Content farm:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/390/352/571/869/532/original/e76c39453638efbd.png

2025-10-15 15:01:37 UTC

- reply

Geocities integration, duh

2025-10-13 15:08:33 UTC

October is Cybersecurity Awareness Month! Please be aware of cybersecurity. If you encounter cybersecurity, DO NOT APPROACH IT. Back away slowly. Protect children and pets. Make noises to scare it away.

2025-10-11 23:42:43 UTC

Today I needed a bit of code, but instead of asking an LLM I tried writing it myself and wow, this could be a new paradigm

2025-09-17 04:02:37 UTC

I'm still trying to decide on the topic for the next Substack article. A taxonomy of 18th century belt buckles? Construction and everyday uses of Hermitian manifolds? A curious kid's guide to mercury arc rectifiers?

2025-09-07 16:40:53 UTC

The more embedded programming I do, the more amazed I am that anything works at all.
Even in a single-core, single-process bare-metal environment, you obviously get the standard range of reentrancy issues. Hardware interrupts - including nested interrupts - can fire at any time.
There are some big "huh" moments around stuff like DMA. If you request a DMA transfer, it's handled by a separate piece of silicon and your CPU doesn't necessarily know what transpired. The main memory is updated by the DMA controller, but the CPU's cache is not. The CPU might end up with a stale cache even if you haven't touched that memory region before: after all, it does speculative prefetching! Worse, if you did touch the region, the CPU may flush old pending writes *after* the DMA transfer, clobbering your data.
But sometimes, the problems are simpler. I had a program that ran at full clock speed when compiled with -O3, but at something like 1 MHz when not. Yep, "huh".
There was a function that allowed clock speed to be toggled for power save purposes, roughly this:
static void setup_clock(u8 fast) {
CCP = CCP_IOREG_gc; /* unlock */
CLKCTRL.OSCHFCTRLA = fast ? VAL1 : VAL2;
}
This was a two-step task: unlock clock operations by writing to a memory-mapped register called CCP, then manipulate OSCHFCTRLA to set clock speed. Easy enough.
Fine print not included in online examples: the sequence must take at most four CPU cycles. For reasons.
With -O3, the code was simply inlined, the parameter always being a compile-time constant. So, essentially just two insns.
Without -O3? Well, you had a conditional to calculate the value to write to OSCHFCTRLA based on the function parameter. Boom.

2025-09-07 01:36:23 UTC

Getting silly with C, part ~(~1<<1) https://lcamtuf.coredump.cx/blog/c3/?n

2025-09-05 20:05:44 UTC

Can't wait for my $1.79 check from the Anthropic settlement

2025-09-05 14:03:00 UTC

I've been writing articles about mathematics and I've come to realize they're a love letter to *not* teaching things the way they're taught in school.
A formula? I wanted to know the how and why! What did we try first, how did we come up with that? The teachers rarely knew.
( If you're curious, I have a sampling here: https://lcamtuf.substack.com/p/algorithms-and-math-trivia )

2025-09-05 02:48:00 UTC

I see that a pretty but characteristically uninformative article about the Fourier transform is near the top of HN.
If you're interested in how DFT/DCT works, you might find my old write-up a better pick: https://lcamtuf.substack.com/p/not-so-fast-mr-fourier

2025-08-30 14:37:37 UTC

My position on the "doomsday" risk of superhuman AGI is that if IQ offered you a decisive advantage, the world would be run by nerds.
I think it's essentially a geek power fantasy. The returns on puzzle-solving skills rapidly diminish past some modest threshold.

2025-08-28 05:37:09 UTC

I'm working on a universal bucket list for corporations:
1) Declare that you're a different kind of a company
2) Design and announce your own typeface
3) One year of free credit monitoring

2025-08-10 15:42:15 UTC

I'm sorry folks, the spec made it clear
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/005/229/049/860/435/original/0e85592ee8c6dfed.png

2025-08-10 03:03:50 UTC

telnet uses port 23 to indicate that it's an improvement over ssh, which uses port 22

2025-08-08 14:53:41 UTC

I think the concern about LLMs making up citations is unfounded. If you find a non-existent citation, you can just ask an LLM to quickly generate that missing article

2025-08-02 16:07:54 UTC

If you're feeling overwhelmed, remember that
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/960/030/490/338/698/original/4b9f72d13531993b.png

2025-07-21 15:29:46 UTC

Life before smartphones
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/891/933/821/122/058/original/f48da92358edd2b3.png

2025-07-18 00:52:59 UTC

We used to be more civilized. Presented without further comment: a combination toilet paper holder / bathroom radio receiver, 1960s
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/871/499/309/802/012/original/37efeac2a6f5d5af.webp

2025-07-17 15:36:53 UTC

Daniel writes about his AI slop problem on H1: https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/
I like bug bounties and I put a fair amount of effort into bootstrapping the one at Google back in the day, but I think the problem runs deeper than AI.
First, most people who make a living doing bug bounties don't go after $10,000+ bugs. Very few people can crank out top-notch find month after month. A much better strategy on these platforms is to go after low-hanging fruit and rake in $500 to $1,000 bugs every day.
Companies respond accordingly! Because most of the traffic are lower-importance vulnerabilities from less skilled researchers, you don't want to throw your best analysts at this. It's increasingly common to outsource triage and bug-filing for bug bounty programs.
And especially if the person doing the triage isn't highly paid and familiar with the systems in question, there is a strong tendency to err on the side of caution. If you incorrectly close something serious as a non-issue, you risk the researcher making a stink. Conversely, if the triager files a non-issue with the product team, they'll probably fix it anyway, and you just waste some small amount of corporate time.
But the result is that in most programs, there's no penalty for slop - not just AI, but human too. And researchers exploit this with spray-and-pray tactics, essentially.
I think the core issue here are platforms that make it easy to browse for programs. They have plenty of advantages, but it's also a bit of a race to the bottom in terms of the quality bar.

2025-07-14 05:53:32 UTC

Please be assured that our servers are bolted down with military-grade security screws

2025-07-11 22:18:58 UTC

*** Online shopping in 2010 ***
Me: I'd like to buy underpants.
Underpants Emporium: Certainly! Your underpants should arrive on Monday.
Me: Sweet.
*** Online shopping in 2025 ***
Me: I'd like to buy underpants.
MyFriendo.biz: Yay! Your package is on the way!
Me: wait, who are you?
MyFriendo.biz: we're the store's shipping partner! We're here to keep you in the loop!
SMS: Your package is on the way! Reply STOP to stop.
Me: yeah, I...
UPS MyChoice: Your package is on the way!
Underpants Emporium: Be sure to review your purchase!
UPS MyChoice: Your package is out for delivery.
SMS: Your package is out for delivery.
MyFriendo.biz: Your package it out for delivery!
Logistics Conglomerated: you don't know us, but we couldn't help and notice that your package is out for delivery.
Underpants Emporium: did you know that customers who bought underpants also bought the following

2025-07-08 17:27:33 UTC

I think there's room for a website that subjectively reviews popular computer algorithms. I don't care about big-O and other nonsense like that. Did you like the product? Were the assembly instructions easy to follow? Did you get help from your CS (computer science) representative?

2025-07-03 20:42:00 UTC

Woodworkers are the most welcoming community I know of. You're talking to a master craftsman but they're still excited to see your garden planter.
On the flip side, the worst are probably electronics & math folks on Stack Exchange & Reddit: "get better before you talk to us".
Working theory: toxicity grows in proportion to the distance to wood

2025-07-03 18:09:37 UTC

A slightly unhinged calculator fact: in the golden era of electronic calculators, some Japanese shopkeepers were reluctant to trust the newfangled tool, so Sharp made a line of combination calculator / abacus devices.
Here's a photo, next to some other stuff I own.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/790/639/508/269/728/original/a65590fc923f53cd.jpg

2025-06-27 19:41:22 UTC

I don't know where you folks get your non-orientable manifolds, but the experience of ordering from Cliff Stoll at kleinbottle.com is second to none
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/757/026/962/998/956/original/46aa69c98aa661c5.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/757/027/446/186/638/original/5da4b7829110ab17.jpeg

2025-06-18 04:56:21 UTC

How to tell that you're valued as a customer in 2025: if you need to wait 45 minutes to be connected to a representative, you know they're not using an LLM

2025-06-15 14:57:25 UTC

Tech headlines: Apple engineers develop a revolutionary life-saving technology
Real life:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/687/962/820/968/561/original/803ddafbacea6f61.png

2025-06-09 16:31:23 UTC

The article is about something else, but I belatedly realized that all I wanted to do is write an article about infinity.
Maybe I still should, but I don't know if the remaining five subscribers can handle it
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/654/356/615/863/352/original/030148828a356686.png

2025-05-31 13:36:02 UTC

Did you know?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/602/708/832/813/064/original/6b7acdeddeab3837.png

2025-05-21 19:01:12 UTC

Engineers are supremely rational and value precision. That's why we use a unit called "decibels".
Well, it's not really a unit. It's a difference in magnitude for some other unit. We typically don't specify that other unit, but you can probably guess. We named decibels after Alexander Bell, but we misspelled that a bit.
Using decibels is just more intuitive than writing ×10 or ×1,000. That's why we define a decibel as an increase of ~1.2589. No, I mean, that's for power! If you're doing voltages, obviously use ~1.1220.
As for "0 dB", it probably refers to the other thing we talked about earlier in the text. But it could be one volt. Or a milliwatt, if you're doing radio stuff. Or maybe a threshold of human hearing. Or a really loud sound... I don't know, who's writing the spec?

2025-05-17 03:47:35 UTC

I'm old enough to remember when our #1 concern about the veracity of online information was that anyone could edit Wikipedia

2025-05-10 21:08:11 UTC

Sierpiński triangle? In my bitwise AND?
https://lcamtuf.substack.com/p/sierpinski-triangle-in-my-bitwise

2025-05-06 22:45:37 UTC

We're now offering a practical, self-directed course on cryptographic attacks. To enroll, simply start your own TLS implementation and upload it to Github

2025-04-29 17:07:51 UTC

Quick Q: if you're on a date in the SF Bay Area, what's the optimal number of leetcode questions to ask

2025-04-23 02:08:29 UTC

How do we generate clocks in digital circuits? From relaxation oscillators, to crystals, to phase-locked loops: https://lcamtuf.substack.com/p/clocks-in-digital-circuits

2025-03-28 04:01:48 UTC

My 101 of analog electronics, in the recommended order of reading:
What is electricity - https://lcamtuf.substack.com/p/but-good-sir-what-is-electricity
The physics of semiconductors - https://lcamtuf.substack.com/p/how-do-transistors-work-anyway
Core concepts in electronics - https://lcamtuf.substack.com/p/primer-core-concepts-in-electronic
Core concepts 2: complex impedance - https://lcamtuf.substack.com/p/impedance-part-2-why-do-lcr-meters
Signal amplification, from transistors to op-amps - https://lcamtuf.substack.com/p/the-basics-of-signal-amplification
RC circuits and analog signal filtering - https://lcamtuf.substack.com/p/impedance-part-2-why-do-lcr-meters
Signal filtering 2: Sallen-Key - https://lcamtuf.substack.com/p/analog-filters-part-2-let-it-ring
Signal reflections - https://lcamtuf.substack.com/p/signal-reflections-in-electronic
The skinny on radio theory - https://lcamtuf.substack.com/p/radios-how-do-they-work

2025-03-23 18:40:07 UTC

Here's the thing. When a browser, an app, or a website encourages you to turn on an awesome feature, it's almost always because a lawyer who understands the feature said "whoa, we're gonna be in real trouble if we don't have consent".
In other words,
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/213/204/023/129/116/original/76e8193b92fc3951.png

2025-03-22 22:21:27 UTC

It bugs me that many things in electronics have a really simple and elegant mathematical basis, but they’re given as axioms.
One of the examples is the idea that reactance and resistance are “orthogonal” - that is, we calculate their combined effect with a formula like |Z| = sqrt(R² + X²). And that’s all cool and dandy, but… why?
“Because the waveforms are shifted by 90°” - OK… but why does this produce this effect?
So, I recently reworked this article to provide a simple, visual proof: https://lcamtuf.substack.com/p/impedance-part-2-why-do-lcr-meters

2025-03-13 20:25:22 UTC

This is an actual air humidifier you can buy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/156/995/758/886/551/original/69f9c15dc2468f73.png

2025-03-12 14:35:48 UTC

Yes, as a consumer, I wake up every day wishing that my electric toothbrush had more features
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/149/958/352/264/361/original/6be5e2ec1a5a6bf6.png

2025-03-09 15:53:28 UTC

I know this flies in the face of all the conventional infosec knowledge, but the Communist Party of China is probably not interested in backdooring the Bluetooth chip in your smart litterbox

2025-03-04 18:36:09 UTC

Me: no, that's wrong.
Chatbot: I apologize, you're right to call me out on that! Here's another way to answer the question incorrectly

2025-03-04 00:33:32 UTC

I must note that there is a certain irony in choosing a Mercedes
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/101/348/122/491/474/original/47cbc79fca1a8fd8.png

2025-03-02 17:10:23 UTC

In the early 2000s, Microsoft was dealing with a PR crisis: information security. This wasn't about nerds on Slashdot. You had regular mainstream stories on CNN about Windows worms!
Consumers were fed up. They couldn't quite ditch Windows, but they could trade Microsoft Internet Explorer for a browser called Mozilla / Firefox. They did, en masse. Firefox peaked at a 30%. Microsoft's browser market share is in the gutter to this day.
But then, Chrome happened. Chrome was good, fast, easy to use, and had a solid security story. Firefox still had one ace up their sleeve: they could convincingly say that they put your privacy first.
Except, there wasn't a massive, public uproar about Google's privacy practices.
You could try to stir the pot, or you could give people another reason to stick with you. Firefox did neither, and its user base to a small core of fans who see Google as an abstract yet existential threat. From ~30% to <3%.
Now, Google bankrolled Mozilla for years - first as a defense against Microsoft, and later just to have a token competitor so that antitrust regulators stay put.
If you're getting hundreds of millions for just existing, you turn from a hip OSS project to an ossified bureaucracy. So now, Mozilla has a problem: how do you support your current lifestyle if the funding dries up?
Well, you can monetize with ad tech. Google and Microsoft are getting away with it? But oops, your user base consists entirely of privacy nerds who are going to flip out about that.

2025-02-28 18:02:52 UTC

I've been working in cybersecurity for over 25 years. Here are my key insights.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/082/823/981/453/443/original/5fdaf85c267ab415.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/082/824/433/127/130/original/2d0a92c27955977f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/082/824/995/408/847/original/9393ada9578366f2.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/082/825/428/137/423/original/7287de2aa935b406.png

2025-02-28 01:23:01 UTC

I've been asked why I don't write about infosec more often. Most simply, I learned that such content has a very short expiration date: 0-day in X, vendor Y popped, govt of Z trying to ban something.
Seminal results are rare. Most of it is just daily news and idle punditry. Don't get me wrong: the coverage is useful. In the moment, it gets a lot of clicks. But when I looked back at a decade of my infosec blogging, I thought to myself "wow... almost all of this is worthless today".
You know... woodworking tips will be relevant in a decade. Sandbox bypasses, not so.

2025-02-28 00:55:28 UTC

Look, "never" is relative
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/078/785/559/795/025/original/82086c3d42ce2d23.png

2025-02-25 21:34:45 UTC

We found out that machines performed 7% better if we trapped them in an endless loop of profound existential anguish
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/066/669/633/440/136/original/91fb723767407ea2.png