Nostr notes by Jan Schaumann

Starting to think the real risk is not AI replacing junior staff, ...

2026-03-18T17:19:48Z

Starting to think the real risk is not AI replacing junior staff, but senior staff quitting because they just can’t take this AI bullshit any longer and just opt for early retirement.

What idiot called it “agentic AI” when “Claude Computing” ...

2026-03-04T23:40:05Z

What idiot called it “agentic AI” when “Claude Computing” is right there?

(Bonus joke: There is no Claude, only other peoples’ content.)

"Never have, never will." Promise, shmomise. This is some ...

2026-02-27T15:27:59Z

"Never have, never will." Promise, shmomise.

This is some bullshit, Mozilla.

https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e#diff-a24e74e4595fa85440a2f4e7e5dcfe68aba6e1e593aef05a2d35581a91423847

And the explanation is bullshit, too, and sounds rather annoyed at having to explain to us silly users that *of course* you have to "share some data with our partners".

https://blog.mozilla.org/en/firefox/update-on-terms-of-use/

Tonight seems like a good time to remind folks that the next ...

2026-02-25T02:28:40Z

Tonight seems like a good time to remind folks that the next #nokings protest is planned for March 28th:

https://www.nokings.org/

Mark your calendars, I'll see you there! ✌️

#sotu #fucktrump

I still don't understand where people think Senior Engineers ...

2026-02-22T22:12:13Z

I still don't understand where people think Senior Engineers come from if they replace Junior Engineers with AI.

How do they think the next iteration of GIGO regurgitated code will be validated and debugged if nobody understands how the black box works?

Not wanting to understand but just wanting the quick answer is a clear trend and implicit outcome of frequent AI use.

To me, that's the real supply chain risk.

If you'd like to have a nice 🤦-y day like me, go ahead, ...

2026-02-03T16:33:45Z

If you'd like to have a nice 🤦-y day like me, go ahead, search your internal code repository for the following:

curl -k
wget --no-check-certificate
verify=false
InsecureSkipVerify: true
ssl_verify_mode: 0
TrustSelfSignedStrategy
rejectUnauthorized: false
strict-ssl = false
http.sslVerify = false
--no-verify-ssl
--insecure*
verify_hostname: 0

It'll be great.

Billionaires, man. Greedy motherfuckers. Brin is worth $266B. A ...

2026-02-01T17:41:37Z

Billionaires, man. Greedy motherfuckers.

Brin is worth $266B. A one-time 5% billionaire tax (with the money going to healthcare!) would mean he's left with... $242B. Which that year's rate of growth would trivially earn him back. But he just can't.

You can do a 99% one-time billionaire tax and he'd be left with *2.6 billion dollars.

https://www.nytimes.com/2026/01/28/us/politics/california-billionaires-sergey-brin-campaign.html

CA has maybe 200 billionaires in a population of ~40 million. Talk about the richest 0.0005%. Greedy motherfuckers.

NoFX pops out of retirement to say #fuckICE 🤘: ...

2026-01-29T12:51:21Z

NoFX pops out of retirement to say #fuckICE 🤘:

https://www.youtube.com/watch?v=sU6s6VEJxrU

And this is why he's The Boss. "Here in our home they ...

2026-01-29T01:54:22Z

And this is why he's The Boss.

"Here in our home they killed and roamed
In the winter of ’26
We’ll take our stand for this land
And the stranger in our midst
We’ll remember the names of those who died
On the streets of Minneapolis"

https://www.youtube.com/watch?v=wWKSoxG1K7w

OpenSSL Security Advisory ...

2026-01-27T18:27:05Z

OpenSSL Security Advisory

https://openssl-library.org/news/secadv/20260127.txt

One high, one medium, and 9 low severity issues.

The high severity is a stack buffer overflow in CMS AuthEnvelopedData parsing (CVE-2025-15467): attacker provides an oversized IV, leading to buffer overflow prior to authentication, possibly leading to remote code execution if you're parsing untrusted CMS or PKCS#7 content with AEAD (e.g., AES-GCM).

Here #curl is again showing the way in Open Source, this time ...

2026-01-23T17:27:47Z

Here #curl is again showing the way in Open Source, this time with vulnerability management. Per their well-known/security.txt:

With TikTok now going to be owned by Larry Ellison and Emerati ...

2026-01-23T16:22:40Z

With TikTok now going to be owned by Larry Ellison and Emerati MGX/G42, the concerns about it being used as a government propaganda machine really are totally put to rest. Phew!

(My hope remains that this move will ruin the product and the kids will move on.)

Everybody walking past Trump Tower be like… #fuckICE ...

2026-01-11T19:07:23Z

Everybody walking past Trump Tower be like…

#fuckICE #iceoutforgood #fucktrump

Quotable as ever, here's @npub1fdr…lvhs on code as ...

2026-01-06T16:23:34Z

Quotable as ever, here's Cory Doctorow (npub1fdr…lvhs) on code as liability and that having AI produce more code faster is simply tech debt at scale:

https://pluralistic.net/2026/01/06/1000x-liability/#graceful-failure-modes

"The longer a computer system has been running, the more tech debt it represents. The more important the system is, the harder it is to bring down and completely redo."

"Writing code that works, without consideration of how it will fail, is a recipe for catastrophe. It is a way to create tech debt at scale."

Completely different topic, so ripping this quote out of the ...

2026-01-05T16:39:57Z

Completely different topic, so ripping this quote out of the context from the article I just boosted:

"I wonder how much Venezuelan sensitive information was in fact stored on Google/Microsoft services and accessed by the US military to prepare their recent strike."

This is indeed a pretty interesting question to ponder. And if you're, say, Greenland, maybe consider your use of US cloud services...

He was covered in cables, from head to his foot, patched 'em ...

2025-12-24T17:27:08Z

In reply to nevent1q…ysnq
_________________________

He was covered in cables, from head to his foot,
patched 'em in switchports, he doubled throughput!
He opened his laptop, his terminal: no hype.
No Electron, no XCode, only in 'vi' did he type.

His code -- so readable! His Makefiles how clean!
His scripts were well structured, his includes pristine!
His CFLAGS? Warn 'all', warn 'extra', be extra pedantic
Turn warnings to errors, it's almost romantic!

The zombie processes with their parent now killed were reaped by ...

2025-12-24T17:26:05Z

In reply to nevent1q…ckuf
_________________________

The zombie processes with their parent now killed
were reaped by init(8), as Ken Thompson willed;
So out of the process table they flew,
freeing up cycles and memory space, too.

And then, in a twinkling, the tcpdumps showed,
with buffer caches flushed, connections now flowed!
As I mirrored the ports and tailed the log file,
I heard St. Root run down the hot aisle.

With a little old hacker, so focused, resolute, I knew in a ...

2025-12-24T17:24:58Z

In reply to nevent1q…d35l
_________________________

With a little old hacker, so focused, resolute,
I knew in a moment it must be St. Root.
More rapidly typed spells I've never seen
And he whistled, and shouted, and cursed at the screen:

"Ugh, DOCKER! Now, TRACEROUTE! Now, KTRACE and TRUSS!
On, PYTHON! On PERL! No RUBY or RUST!
Process loops fork! I'll have to killall(1)!
Now bash - away! bash away! Warn users with wall(1)!"

When out of the machine room there arose such a clatter, I sprang ...

2025-12-24T17:23:36Z

In reply to nevent1q…0g25
_________________________

When out of the machine room there arose such a clatter,
I sprang from my bean bag to see what was the matter.
Away to the laptop I flew like a flash,
logged into the jumpbox, starting my bash,

The lights on the servers blinking all red
Gave the lustre of multiple threads all locked dead
When, what to my wondering eyes should appear,
But a banged up crash cart, with eight cans of beer

'Twas the night of the moratorium, and all through the cloud ...

2025-12-24T17:22:19Z

'Twas the night of the moratorium, and all through the cloud
not a pager was beeping: no deploys were allowed.
The packages frozen on the servers with care,
In hopes that an outage would strike nowhere;

The developers still pondering code to embed,
While visions of monads danced in their heads.
The VM put to sleep, and I in this app,
Had just settled down for a long masto thread,

If you just updated React / NextJS for #react2shell , you now get ...

2025-12-11T21:29:25Z

In reply to nevent1q…jexn
_________________________

If you just updated React / NextJS for #react2shell , you now get to update again. Two additional vulnerabilities identified in follow-up work were just published: CVE-2025-55183 (DoS), CVE-2025-55184 (Source Code Exposure)

https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

https://nextjs.org/blog/security-update-2025-12-11

Here's another funny generational divide: students no longer ...

2025-12-05T21:47:36Z

Here's another funny generational divide: students no longer understand public_html directories and /~user/ URLs because apparently nowadays shared fileserver access is no longer a thing.

Smh, fist, yells at cloud.

Yesterday, after various bogus AI slopped "PoC"s, ...

2025-12-05T15:16:18Z

In reply to nevent1q…ud4q
_________________________

Yesterday, after various bogus AI slopped "PoC"s, eventually a functional PoC for the React RCE emerged:
https://github.com/msanft/CVE-2025-55182

We now have a PoC from the reporter of the vulnerability as well:
https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc

#react2shell

"We did a number of refactors [...] This also fixes a ...

2025-12-03T15:55:53Z

"We did a number of refactors [...] This also fixes a critical security vulnerability." 👀

CVE-2025-55182, an RCE in React Server Components just landed:

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Enjoy your patching, and make sure to check your bundled frameworks and dependencies.

Here's the commit:
https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700

Nostr event nevent1qqsgj8c46pw4rcnk4980utr072dj3qec4xy5ckjxzhva2gcu4x42e7qzyqtt8fueq38zgz4fh8yf5lgk3vxj09uakcczrmhpz47d00qvd285w6mrdps

2025-11-29T17:00:49Z

What comes first?

Trump literally demolishing the White House may just be too much ...

2025-10-22T01:59:50Z

Trump literally demolishing the White House may just be too much symbolism for me.

Over the last few months, I've repeatedly had people tell me ...

2025-09-26T01:55:28Z

Over the last few months, I've repeatedly had people tell me about how "well, the Military will refuse an illegal order", to which I can only gesticulate in a bewildered manner in the direction of at least 17 dead from the Venezuelan boats they happily blew up, why not.

And the third one barely made any headlines. Jfc.

Re-posting due to current events. The secret language of coders, ...

2025-09-08T17:35:03Z

Re-posting due to current events.

The secret language of coders, part N of many. Today: "npm"

https://xkcd.com/2347/ recursion ...

2025-08-27T19:44:21Z

https://xkcd.com/2347/ recursion

The problem with dogfooding is if it tastes like dogfood, I ...

2025-07-31T15:45:28Z

The problem with dogfooding is if it tastes like dogfood, I don't wanna eat it.

Ugh, here we go. People in the U.S. will get sicker more often, ...

2025-06-26T22:33:50Z

Ugh, here we go. People in the U.S. will get sicker more often, overall health and average life expectancy (US currently ranks 48th or so) will further decline. But because that impact will individually be subtle and compound only over years, the idiot population won’t make the connection.

Next on the chopping block: MMR vaccines. So yeah, young kids and infants are actually going to die. USA, USA.

https://www.nytimes.com/2025/06/26/health/rfk-jr-vaccines-acip-cdc.html

At Akamai, we're launching a blog post series on various ...

2025-06-18T16:13:22Z

At Akamai, we're launching a blog post series on various topics relating to post-quantum cryptography. The first post is by rsalz (npub18zc…4p69), discussing some related IETF initiatives, including the two #TLS drafts he co-authored:

https://www.akamai.com/blog/trends/building-quantum-safe-internet-ietf-plan-tls

#pqc

New blog post! Bootstrapping HTTP/1.1, HTTP/2, and HTTP/3 -- ...

2025-05-29T02:56:00Z

New blog post! Bootstrapping HTTP/1.1, HTTP/2, and HTTP/3 -- redirects, HSTS, Alt-Svc, ALPN, HTTPS DNS records, oh my.

https://www.netmeister.org/blog/http-123.html

CVE-2025-4575: Low severity OpenSSL (3.5 only) vulnerability in ...

2025-05-22T15:28:55Z

CVE-2025-4575: Low severity OpenSSL (3.5 only) vulnerability in openssl x509 (marking certs as trusted when asked to reject them): https://openssl-library.org/news/secadv/20250522.txt

Unlikely to have a big impact, but it's funny since this is a case of the tool doing the literal opposite of what it's asked to do. :-)

Pffft spits coffee all over keyboard So apparently on #Linux, ...

2025-05-13T18:04:45Z

Pffft *spits coffee all over keyboard*

So apparently on #Linux, usernames starting with "0x" are interpreted as hex numbers under certain circumstances. 🤪 That seems like asking for trouble...

I know "X will ruin learning" has been said for every new ...

2025-05-11T15:21:10Z

In reply to nevent1q…mkam
_________________________

I know "X will ruin learning" has been said for every new technology from Wikipedia back to books, but over the last 20 years of teaching, I've definitely observed a regression in students' independent learning ability, while simultaneously seeing an increased aversion to seek help. Students believe answers must be found online via Stackoverflow, Google, and now AI, but also think they are expected to provide complete answers, when often I'm looking much more for _how_ they got their answer.

Students not merely cheating with, but utterly relying on AI in ...

2025-05-11T15:12:03Z

Students not merely cheating with, but utterly relying on AI in "a society that treats schooling as [nothing more than] a means to a high-paying job" is deeply concerning as AI may actually make you dumber:

"research shows that when students off-load cognitive duties onto chatbots, their capacity for memory, problem-solving, and creativity could suffer. Multiple studies published within the past year have linked AI usage with a deterioration in critical-thinking skills"

https://www.msn.com/en-us/news/technology/everyone-is-cheating-their-way-through-college/ar-AA1EjCRk

German President Steinmeier's speech commemorating the 80th ...

2025-05-09T13:37:20Z

German President Steinmeier's speech commemorating the 80th anniversary of the end of World War II:

https://www.bundespraesident.de/SharedDocs/Reden/EN/Frank-Walter-Steinmeier/Reden/2025/250508-End-WWII.html

You want to read the whole thing, but the part below and the emphasis on the importance of learning from the past instead of describing it as a "cult of guilt" were powerful and eloquent. No words were minced, and we need more of that.

I'm both so very thankful that ...

2025-04-28T15:11:29Z

I'm both so very thankful that https://github.com/lwthiker/curl-impersonate exists and simultaneously hate that I need it.

The web should be the web should be the web no matter what client you use to access it.

Oh, ok, Yahoo. That's interesting. I have another idea: fuck ...

2025-04-09T21:11:38Z

Oh, ok, Yahoo. That's interesting. I have another idea: fuck you.

Hey Brian, just wanted to say how much I appreciate your speaking ...

2025-03-31T17:21:45Z

In reply to nevent1q…7kvh
_________________________

Hey Brian, just wanted to say how much I appreciate your speaking out against the active, ongoing destruction of democracy in the US. For every boneheaded “I came for cybersecurity, you should be apolitical” reply know there are dozens if not hundreds who hear and value your voice and courage.

So I'm curious about something. Boost for reach? You are a ...

2025-03-19T18:23:36Z

So I'm curious about something. Boost for reach?

You are a dual US / Other citizen with international travel booked in the near future.

You are ___ sure you will be able to re-enter the US without any problems:

The secret language of coders, part N of many. Today: security ...

2025-03-18T01:20:10Z

In reply to nevent1q…kdz4
_________________________

The secret language of coders, part N of many. Today: security vendor vulnerability announcement phrases.

An interesting recap of how the #Plan9 OS developed at Bell Labs, ...

2025-03-16T16:43:09Z

An interesting recap of how the #Plan9 OS developed at Bell Labs, with many familiar names, including, of course, Ken Thompson, Dennis Ritchie, Rob Pike, and many others, making appearances.

"What I Saw at the Evolution of Plan 9" by Geoff Collyer

https://adi.onl/oral.pdf

#unix

NIST selects HQC (Hamming Quasi-Cyclic -- https://pqc-hqc.org/) ...

2025-03-11T14:09:59Z

NIST selects HQC (Hamming Quasi-Cyclic -- https://pqc-hqc.org/) for standardization as the second #PQC key-encapsulation mechanism after ML-KEM.

But no rush, "the final version will be published in approximately two years".

https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/w-6RREtb7-c/m/vRjBJE3dAAAJ

https://nvlpubs.nist.gov/nistpubs/ir/2025/NIST.IR.8545.pdf

If you haven't followed the Mahmoud Khalil story, you should. ...

2025-03-11T03:05:51Z

If you haven't followed the Mahmoud Khalil story, you should.

"The nearly 13 million green card holders in the United States — not to mention foreign students and professors — have been put on notice that they need to watch what they say. [...] Nor can citizens rest easy; a government this willing to disregard the First Amendment is a danger to us all."

https://www.nytimes.com/2025/03/10/opinion/mahmoud-khalil-free-speech.html?unlocked_article_code=1.3E4.lFik.M0JJqcxbLOxG&smid=url-share

The search on https://www.nih.gov/ will not show any results if ...

2025-03-08T18:58:36Z

The search on https://www.nih.gov/ will not show any results if you search for these (standalone) words:

- diversity
- equity
- inclusion
- DEI
- DEIA
- gender
- transgender
- nonbinary
- non-binary
- racism

Instead, it redirects you back to the home page.

But because there's also always incompetence in addition to malice, just putting the term in quotes or adding another word _does_ give you results. (Although perhaps that's resistance by those forced to implement the censorship?)

Tonight might be a particularly good time for Americans to donate ...

2025-03-04T03:39:15Z

Tonight might be a particularly good time for Americans to donate to the #Ukraine - I just did and hope you will, too.

https://u24.gov.ua/ makes it easy and lets you choose where you want your money to go to.

#SlavaUkraini & #FuckTrump

While y'all are having fun with nih.gov's name servers, ...

2025-03-02T02:01:41Z

While y'all are having fun with nih.gov's name servers, quick reminder that here's a quick little tool to run a query against multiple public resolvers to see what they see:

https://github.com/jschauma/puddy

(I also have a web interface for puddy, but don't want to mastodos my server. It's linked from GitHub, if you insist. :-)

cc Michał "rysiek" Woźniak · 🇺🇦 (npub1afm…5gp4)

Today in "#systemd ruins everything", Jan learns that ...

2025-02-27T16:25:50Z

In reply to nevent1q…z7ra
_________________________

Today in "#systemd ruins everything", Jan learns that systemd-resolve...

- runs a proxy DNS server on 127.0.0.53 (which is in /etc/resolv.conf)
- uses it's own /run/systemd/resolve/resolv.conf
- will read and cache /etc/hosts regardless of what /etc/nsswitch.conf says (`ReadEtcHosts` defaults to `yes` in /etc/systemd/resolved.conf)

Applications that follow traditional libc resolver logic now will continue to get /etc/hosts results even if /etc/nsswitch.conf excludes 'files'.

🤦‍♂️

Wait, what? By using #Firefox, I now grant Mozilla "a ...

2025-02-26T22:35:25Z

Wait, what? By using #Firefox, I now grant Mozilla "a nonexclusive, royalty-free, worldwide license to use" any data I "upload or input"? That seems, uhm, rather broad. Wtf.

I want my old Mozilla back.

https://www.mozilla.org/en-US/about/legal/terms/firefox/

Mark your calendars, nerds! Nationwide "Stand Up for ...

2025-02-26T03:53:26Z

Mark your calendars, nerds! Nationwide "Stand Up for Science" rallies to protest Trump's attacks on science and common sense are scheduled for March 7th.

Find your local event here:

https://standupforscience2025.org/

#standupforscience #fcktrmp

1) Thanks a lot for your always thorough and insightful analysis. ...

2025-02-23T16:02:08Z

In reply to nevent1q…qlnf
_________________________

1) Thanks a lot for your always thorough and insightful analysis. I really appreciate your work! (Long overdue.)

Less important, but FYI
2) The link “something like this has already happened” goes to https://berthub.eu/articles/posts/servers-in-the-eu-eigen-sleutels-helpt-het/#wat-als-er-ruzie-is, which 404s.

I know it's one part "let's get folks riled up" ...

2025-02-20T01:41:32Z

I know it's one part "let's get folks riled up" but it's also two parts "haha, only serious", and I'm not going to link to it, but when Trump tells the world he sees himself as King, not President, people need to fucking believe it.

Every single representative or senator needs to take this seriously and distance themselves explicitly. Anything less needs to be reported as betraying Democracy itself.

Scenes from the “No Kings On Presidents’ Day” protest in ...

2025-02-17T19:03:48Z

Scenes from the “No Kings On Presidents’ Day” protest in Union Square just now.

Fuck Trump. Fuck Musk. And fuck the entire cowardly Republican Party.

#NotMyPresident #nyc

FYI: I have made public new #NetBSD AMIs for #AWS #ec2. These are ...

2025-02-16T20:58:56Z

FYI: I have made public new #NetBSD AMIs for #AWS #ec2. These are evbarm and amd64 images for NetBSD/10.1 and now have their boot messages sent to the serial console (although it takes EC2 about 5-8 minutes from instance creation until `aws ec2 get-console-output` shows the messages).

These AMIs should be public and ready for you to launch in us-east-1a:

https://stevens.netmeister.org/615/netbsd-amis.html

TIL: On Ubuntu, AppArmor restricts tcpdump from reading files ...

2025-02-13T16:17:31Z

In reply to nevent1q…n34r
_________________________

TIL: On Ubuntu, AppArmor restricts tcpdump from reading files that don't end in ".pcap". 🤦‍♂️

$ ls -l /tmp/out
-rw------- 1 tcpdump tcpdump 13651 Feb 13 15:49 /tmp/out
$ sudo tcpdump -n -r /tmp/out
tcpdump: /tmp/out: Permission denied
$ sudo mv /tmp/out /tmp/out.pcap
$ sudo tcpdump -n -r /tmp/out.pcap
reading from file /tmp/out.pcap, link-type EN10MB (Ethernet), snapshot length 262144
[...]

Why are people trying so hard to make "file extensions" happen?

Not that it surprises me, but the "National Cybersecurity ...

2025-02-04T15:36:36Z

Not that it surprises me, but the "National Cybersecurity Strategy" has disappeared:
https://www.whitehouse.gov/oncd/national-cybersecurity-strategy/

So yeah.

Archive link:
https://web.archive.org/web/20250117195921/https://www.whitehouse.gov/oncd/national-cybersecurity-strategy/

#infosec

System Administration Week 1, #Unix History Exhibiting one of the ...

2025-01-26T16:10:43Z

In reply to nevent1q…4whq
_________________________

System Administration

Week 1, #Unix History

Exhibiting one of the cardinal virtues of System Administrators — laziness — we're reusing a video from my #programming class to give a whirlwind history tour: Bell Labs, Berkeley & the Unix Wars, USL v. BSDi, the birth of #NetBSD & #FreeBSD, the development of GNU & its adoption of #Linux, all leading to Unix on your fridge, car, and mobile phone.

https://youtu.be/3H7SQWTR6Dw

Last semester's #apue thread:
https://mstdn.social/@jschauma/113087999769442250

#sysadmin #sre #devops

System Administration Week 1, Core Principles In this video, we ...

2025-01-25T19:47:36Z

In reply to nevent1q…v6c0
_________________________

System Administration

Week 1, Core Principles

In this video, we present a few core principles that will guide us throughout the semester, including our three pillars: Scalability, Security, and Simplicity. We'll also get to know a few basic "laws", well known by any System Administrator. If you're wondering what all this has to do with Legos, please tune in...

https://youtu.be/bfqP6PlS6Og

#SysAdmin #sre #devops

System Administration Week 1, The Job of a System Administrator ...

2025-01-24T17:51:13Z

In reply to nevent1q…n03r
_________________________

System Administration

Week 1, The Job of a System Administrator

In this video, we try to show what things SysAdmins may encounter in their day to day routine, ranging from power tools to actual and symbolic duct tape and WD40. With this, we try to sort out just how the job may be defined. It's not that easy, as it turns out...

https://youtu.be/osIO9CbqHQo

#SysAdmin #sre #devops

System Administration Week 1, Introduction We cover all the meta ...

2025-01-23T16:34:13Z

In reply to nevent1q…6trx
_________________________

System Administration

Week 1, Introduction

We cover all the meta info for the course, how System Administration fits into a Computer Science curriculum, our syllabus, systems used, grading policy etc. (There will be Venn diagrams...)

https://youtu.be/QJL5cNv9dJs

#sysadmin #sre #devops

This week, I'm again starting my #SysAdmin class where we ...

2025-01-22T17:24:55Z

This week, I'm again starting my #SysAdmin class where we focus on a lot of practical aspects commonly missing in Computer Science curricula. I'm running the same class as an internal study group at work as "Internet Operations".

The syllabus and all course info is available here:

https://stevens.netmeister.org/615/

All video lectures are public and available for free on YouTube:

https://www.youtube.com/@cs615asa/videos

Follow along! I'll be posting weekly links in this thread throughout the semester.

#sre #devops

Nostr event nevent1qqsweg6px5hws6za74mvear799kqr3vgn9sawmdv8qe932ufkru74sszyqtt8fueq38zgz4fh8yf5lgk3vxj09uakcczrmhpz47d00qvd285whahsl5

2025-01-16T20:53:49Z

You know, I’d pay extra to get a product *without* AI.

Just spent 45 minutes groveling through 2,300 lines of bash ...

2025-01-15T23:19:26Z

In reply to nevent1q…r3x3
_________________________

Just spent 45 minutes groveling through 2,300 lines of bash completion gunk because apparently nowadays bash[1] will only tab-complete files based on filename "extension"[2] as if this was fucking MS-DOS.

Grrr.

[1] Well, _this_ bash on _this_ particular Linux version.
[2] E.g., "sh x<tab>" will only complete "x*.sh".

#LinuxGrievances

6 new CVEs in "rsync". "In the most severe CVE, an ...

2025-01-14T18:26:09Z

6 new CVEs in "rsync".

"In the most severe CVE, an attacker only requires anonymous read access to a rsync server, such as a public mirror, to execute arbitrary code on the machine the server is running on."

That would be CVE-2024-12084 (9.8) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, a heap-based buffer overflow in rsyncd.

https://www.openwall.com/lists/oss-security/2025/01/14/3

I forgot where I read it it, but calling a company's ...

2025-01-13T19:33:48Z

I forgot where I read it it, but calling a company's "Data Privacy Policy" its "Data Exploitation Policy" exactly describes its purpose spot-on.

For years, I've seen this weird sort of referrer spamming in ...

2025-01-03T21:50:19Z

For years, I've seen this weird sort of referrer spamming in my http logs whereby the referrer is set to

`https://<some spam domain><my domain>/<valid path>`

I.e., a spam domain prefix-glued (without a separator of any kind) onto an otherwise valid URL on my site (see screenshot below).

Anybody have an idea what's up with those? It's not useful spamdexing because the resulting domain domain is invalid. What's the objective?

A Visit from St. Root - a #SysAdmin poem 'Twas the night of ...

2024-12-24T02:17:22Z

A Visit from St. Root - a #SysAdmin poem

'Twas the night of the moratorium, and all through the cloud
not a pager was beeping: no deploys were allowed.
The packages frozen on the servers with care,
In hopes that an outage would strike nowhere;

Today's #linux grievance: apparently #fedora comes up with a ...

2024-12-19T15:08:32Z

In reply to nevent1q…rkj4
_________________________

Today's #linux grievance: apparently #fedora comes up with a default firewall that blocks anything besides SSH and something called "cockpit" (apparently a remote admin web interface running on port 9090 using a self-signed certificate, so, uhm, yeah 🤦‍♂️).

Oh, and while I'm complaining: requiring sudo for dmesg is ...

2024-12-18T14:59:38Z

In reply to nevent1q…cct0
_________________________

Oh, and while I'm complaining: requiring sudo for dmesg is stupid, too. 🙄

I swear, every time I use (a, any) Linux, I have to do a ...

2024-12-17T19:47:34Z

I swear, every time I use (a, any) Linux, I have to do a double-take and go "what the fresh fuck is this now". Today it's whatever is going on with /etc/motd on Ubuntu.

Making simple things complicated seems to be the trend there.

Most of “The Mythical Man Month”, “Worse is better” and ...

2024-12-16T02:30:33Z

In reply to nevent1q…qs45
_________________________

Most of “The Mythical Man Month”, “Worse is better” and the Unix philosophy. Optimize for readability & human debugging (don’t be clever), use boring tech.

Many of those are common/obvious. Perhaps less so:

Keep your commit history and tracking systems. E.g., #NetBSD’s CVS, mailing list index, and gnats go back to 1993 (which let me fix a bug the other day that I had filed myself 20 years ago). People come and go, so don’t assume context.

Scott Aaronson's take (i.e., somebody who, unlike me, knows ...

2024-12-11T14:44:58Z

In reply to nevent1q…rugz
_________________________

Scott Aaronson's take (i.e., somebody who, unlike me, knows what he's talking about):

https://scottaaronson.blog/?p=8525

So I do think this is very, very cool. But it's in line with ...

2024-12-11T02:51:15Z

In reply to nevent1q…y8qt
_________________________

So I do think this is very, very cool.

But it's in line with what we've been predicting for quantum computing: we'll see progress made in jumps, but we're still a fair bit away from any practical quantum computer able to do anything useful that a classical computer can't do (much less break RSA).

So no need to panic, but certainly good reason to be excited. And to keep calm and carry on with your post-quantum cryptography efforts, cause it looks like we _will_ get there in a few years' time.

You get better coverage in something like New Scientist, which ...

2024-12-11T02:50:04Z

In reply to nevent1q…cjxc
_________________________

You get better coverage in something like New Scientist, which summarizes the importance of their progress:

By exponentially reducing the error rate as new qubits are added, you reach a threshold where larger quantum computers finally actually _get better_, "which hasn’t been a trend so far."

https://www.newscientist.com/article/2459318-is-googles-new-willow-quantum-computer-really-such-a-big-deal/

But reporting on quantum computing is difficult, and the concept ...

2024-12-11T02:48:50Z

In reply to nevent1q…r55e
_________________________

But reporting on quantum computing is difficult, and the concept of superpositions is hard to put into easy to understand language, and so you get misleading suggestions such as the assertion that a qubit is both 0 and 1 at the same time.

This is where I reference Zach Weinersmith (npub1rkp…dy04) 's "The Talk": https://www.smbc-comics.com/comic/the-talk-3

You also get weird conclusions like PCMag's "Google makes a quantum leap that suggests we may live in a multiverse." (Not gonna link, you can find it.)

The RCS benchmark, as Google notes in their blog post (but what ...

2024-12-11T02:47:43Z

In reply to nevent1q…u5g0
_________________________

The RCS benchmark, as Google notes in their blog post (but what is not as widely reported), "measures performance against classical computers but has no known real-world applications".

Why it's useful is explained in a somewhat approachable manner in the paper "Sampling random quantum circuits: a pedestrian's guide" from 2020:

https://arxiv.org/abs/2007.07872

What Google did was demonstrate exponential error correction, ...

2024-12-11T02:46:39Z

In reply to nevent1q…jfzp
_________________________

What Google did was demonstrate exponential error correction, which is critical due to qubit fragility, requiring multiple physical qubits to be combined into one logical qubit to avoid a collapse into a classical state.

But the calculations they performed are not generic, general purpose calculations. Instead, they ran a specific type of computation, the random circuit sampling (RCS) benchmark:

https://research.google/blog/validating-random-circuit-sampling-as-a-benchmark-for-measuring-quantum-progress/

This is a pretty cool step forward in quantum computing. But the ...

2024-12-11T02:45:12Z

In reply to nevent1q…60sa
_________________________

This is a pretty cool step forward in quantum computing. But the reporting I've seen, or perhaps: the takeaways people assume after skimming the headlines are often wildly off the mark.

Part of the problem is in the phrasing, saying Google's chip can solve a problem in 5 minutes that a classical computer can't solve in "a quadrillion times the age of the universe".

This is misleading.

Google announced a new #quantum chip, "Willow": ...

2024-12-11T02:44:32Z

Google announced a new #quantum chip, "Willow":
https://blog.google/technology/research/google-willow-quantum-chip/

This chip demonstrates exponential error correction:
https://research.google/blog/making-quantum-error-correction-work/

Their research in Nature:
https://www.nature.com/articles/s41586-024-08449-y

"Multinational corporations are destroying Earth for profit. ...

2024-12-10T22:21:19Z

"Multinational corporations are destroying Earth for profit. If we want real change, we have to be willing to threaten those profits"

https://www.irishtimes.com/life-style/people/2024/11/23/sally-rooney-when-are-we-going-to-have-the-courage-to-stop-the-climate-crisis/

I really don't think Trump's talk of ending birthright ...

2024-12-09T02:17:18Z

I really don't think Trump's talk of ending birthright citizenship is getting enough attention, being too easily dismissed as unlikely to execute.

It is literally the equivalent of the Reichsbürgergesetz under the Nuremberg Laws.

Why, you ask? Is it because we've filled up all existing ...

2024-12-05T01:52:08Z

In reply to nevent1q…dhzp
_________________________

Why, you ask?

Is it because we've filled up all existing #TLDs and ran out of space?

Or is it because consumers, widely recognized for understanding so well the intricacies of the internet, are clearly asking for more TLDs?

Or could it be because ICANN will charge applicants $227,000, and if they get even half the number of applications they did in 2012 (1,930) that adds up to a cool $220M?

Remember that glorious period back in 2012, when #ICANN started ...

2024-12-05T01:50:07Z

Remember that glorious period back in 2012, when #ICANN started accepting applications for new generic top-level domains (#gTLDs), eventually adding over 1,200 new TLDs, including such goldmines as .extraspace and .vermögensberatung?

Well, clearly that wasn't enough, because we're now finding ourselves on the cusp of another round.

https://newgtldprogram.icann.org/en

#CISA has been doing a really good job promoting sensical ...

2024-11-22T19:59:56Z

#CISA has been doing a really good job promoting sensical #infosec practices over the last few years.

I'm not looking forward to the change in direction that Jen Easterly's departure and whatever ghastly appointees the new administration comes up with will mean.

https://www.nextgov.com/people/2024/11/cisa-director-jen-easterly-depart-inauguration-day/401036/

Jokes aside, I expect (a) CISA to rescind its previous (and ...

2024-11-15T01:41:26Z

In reply to nevent1q…3j55
_________________________

Jokes aside, I expect
(a) CISA to rescind its previous (and actually really good) guidelines, because business
(b) a requirement for services to provide "lawful access" to encrypted messages
(c) a mandate that everybody switch to quantum computers by end of 2025
(d) a new Cryptocurrency Czar under CISA/DOGE

It'll be yuge.

Ancient Rules of Open Source #17 If you wait long enough, the ...

2024-11-09T16:43:19Z

Ancient Rules of Open Source #17

If you wait long enough, the person who reported the bug will eventually fix it themselves.

Although sometimes that can be 20 years:
https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=27309

Nostr event nevent1qqsgs9ysjuemwkccmfgujhw4dwr64k6el3ev4wr87wcg2fknrfppjxczyqtt8fueq38zgz4fh8yf5lgk3vxj09uakcczrmhpz47d00qvd285wyjyw53

2024-11-08T15:10:08Z

I'm so exhausted from the next four+ years.

"This time, that choice came with full knowledge of who Trump ...

2024-11-06T16:33:48Z

"This time, that choice came with full knowledge of who Trump is, how he behaves in office and what he’ll do to stay there. [...] The grotesque rally at Madison Square Garden, that carnival of insults against everyone that the speakers do not want in their America, was not an anomaly but a summation. It was Trumpism’s closing argument, and it landed."

https://www.nytimes.com/2024/11/06/opinion/trump-wins-harris-loses.html

You all know how `popen(3)` shells out and thus has been the ...

2024-10-29T02:35:27Z

You all know how `popen(3)` shells out and thus has been the cause of countless command injections, but did you also know that #NetBSD has `popenve(3)`, which uses `execve(2)` instead?

https://man.netbsd.org/popenve.3

Seriously, other #Unix versions should pick that up.

One of the more infuriating aspects of the tech industry's ...

2024-10-18T22:36:53Z

One of the more infuriating aspects of the tech industry's appalling "sorry, can't cut down on emissions, we need #AI to solve #ClimateChange" stance is that this is simply not an unsolved problem. We *know* what the solution is. We *know* how to implement it. We just *choose not to do it* -- precisely for the same reasons tech leaders don't want to cut down on their energy use: short term profit at all cost.

https://mastodon.online/@parismarx/113328904040155003

While I expect Harris to win the popular vote (albeit perhaps by ...

2024-10-16T16:36:54Z

In reply to nevent1q…zr2x
_________________________

While I expect Harris to win the popular vote (albeit perhaps by less of a margin than Clinton), the electoral vote is a toss-up. If we're lucky and she wins, it'll be by a slim margin. And then the attempts to overturn that result will kick into high gear.

I expect several local election boards and some state governors to refuse to certify the vote. Challenges will go to courts stacked by Trump loyalists. Democrats need to be ready, but I fear we'll see a lot of "Who could've foreseen _this_?"

I sure hope that Democrats are lawyering up and preparing for ...

2024-10-16T16:35:31Z

I sure hope that Democrats are lawyering up and preparing for what's coming after November 5th.

Unfathomably, this election is still close. There will be no landslide. Somehow the result hinges on a small number of as-of-yet "undecided" voters trying to make up their mind between a dastardly, incompetent, racist grifter dictator-wannabe and a well-qualified candidate who respects democracy -- who happens to be a woman (Gasp! Inconceivable!).

👍 Waiting for an automated job still feels like waiting for a ...

2024-09-26T22:54:24Z

In reply to nevent1q…j50f
_________________________

👍

Waiting for an automated job still feels like waiting for a cron job to click a link, though, unless the attacker can trigger/inject the job.

¯\_(ツ)_/¯

And I still think that “wait for a user to print something to ...

2024-09-26T22:37:05Z

In reply to nevent1q…8rau
_________________________

And I still think that “wait for a user to print something to the malicious printer” counts as “user interaction”, which many scores don’t seem to reflect.

https://mstdn.social/@jschauma/113205895293128908

Might be worth calling out that this #cups #rce is dependent on ...

2024-09-26T21:07:56Z

In reply to nevent1q…r2m8
_________________________

Might be worth calling out that this #cups #rce is dependent on the user sending a print job to the injected/manipulated printer.

In my book, that counts as "user interaction", and would yield a CVSS score of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L => 8.8

Looks like that end-of-the-world-all-your-linux-are-belong-to-us ...

2024-09-26T20:26:23Z

Looks like that end-of-the-world-all-your-linux-are-belong-to-us hyped #RCE vulnerability leaked early and it's #CUPS:

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

So… you know… maybe don't run a printer server on your prod systems. But every #sysadmin already knew that printers are the enemy.

I just imported Open Quantum Safe's liboqs and oqs-provider ...

2024-09-13T19:00:50Z

I just imported Open Quantum Safe's liboqs and oqs-provider into #NetBSD #pkgsrc (see Pkgsrc Changes (npub10hm…5sde) :-). With that, you can now do post-quantum crypto using Kyber (now ML-KEM):

#pqc #oqs

Advanced #Programming in the #UNIX Environment Week 2, basic I/O ...

2024-09-13T14:44:57Z

In reply to nevent1q…skw7
_________________________

Advanced #Programming in the #UNIX Environment

Week 2, basic I/O with file descriptors: open(2) and close(2)

We see what happens when we try to create a file, "create" an existing file, open an existing file, truncate a file, and look at the various other flags we can pass. We also note the perhaps surprising number of ways in which open(2) can fail and take a look at openat(2) and TOCTOU defenses.

https://youtu.be/QnL4eYpb5Iw

#apue