miduil

yes, and as long people don't start exploiting that.

Same experience, GitLabs CI/CD language is to me so much better - it has really strong abstractions and you can model a lot of developer experience into it. Especially when it comes to security practices of GitLab CI, but also custom runners, web terminals, ... there is just so much that is shining much more than any other Git forge with built-in CI/CD.

Yeah, I mean thinking about it - you could also just use HN to host that image. I believe gdrive et al would just do the job.

> The 10GB limit per project sounds small on paper but I’ve never come close to hitting it

The docker images don't have limits, there is a limit per layer. IIRC I've distributed a 100GB image through their free tier (just had to make sure to keep the layer size small enough).

Update: Sources

https://docs.gitlab.com/user/storage_usage_quotas/ https://gitlab.com/gitlab-org/container-registry/-/issues/10...

Yes, plenty - sometimes data centers are built together with apartment or office complexes for this particular purpose. Unfortunately that already pinpoints the core limitation, due to the low-temperature of the data centers. The higher the temperature difference is, the more affective heating becomes - with air cooled systems it requires preparation to ensure that can be used for heating.

Also data centers need physical space, and often - you need heating where there is not a lot of space (cities), and for "district heating" you need higher temperatures usually.

yes sorry, just updated my comment shortly before you replied.

This is CVE-2025-36911, the other ones were CVE-2025-20700, CVE-2025-20701, CVE-2025-20702. Coincidentally a similar set of headphones affected.

This one also has a pairing vulnerability, but I assume fast pair is on the BLE level:

> To start the Fast Pair procedure, a Seeker (a phone) sends a message to the Provider (an accessory) indicating that it wants to pair. > [...] allowing unauthorised devices to start the pairing process [...]

It's a pity that this is only awarded with $15k, this is a really bad vulnerability - which clearly required thoughtful investigation, publishing, reporting, ... and would have a much bigger audience in the exploit market.

Previous discussion on ?a similar? vulnerability. That means there is yet another critical vulnerability from the same vendors, given the reporting date around ~August I hope this was addressed by Sony and Jabra around the same time.

https://news.ycombinator.com/item?id=46453204

   > Bluetooth Headphone Jacking: A Key to Your Phone [video]
   > 551 points
   > 223 comments
   > 21 days ago

I wonder if some people could find more affected versions or whether there is some tool to detect more models, as I would doubt this is being nearly complete given how many vendors rely on this supplier.

Thanks, really had to listen to the song.

https://www.youtube.com/watch?v=DWRJC8ap9B4

Nice, you can already see some solar flares in Austria again.

https://www.foto-webcam.eu/webcam/kleinfleisskees/

https://www.foto-webcam.eu/

Key aspects from the talk iirc (I was in the audience :)):

* Real time embedded CPUs are usually without an MMU -> kernels such as FreeRTOS lack secure memory due to the lack of MMUs in those CPUs

* A kernel targeting embedded CPUs with MMUs that supports secure memory management

* Secure memory communication a there called server/client method to communicate leveraging Rust borrow checker build time for later having "user-land processes" to communicate via pages.

These things combined allow a very small kernel, with user-space implementation of usually kernel-level functionality, such as the system clock timer (presented in the talk).

All of this is meant to provide a complete trustworthy processing chain, from CPU dies that can be inspected through infrared microscopy through the CPU epoxy package/cover to the entire build/software tool chain.

The Xous OS project both takes care of the Kernel, but also the CPU/RISC-V runtime with an MMU, something that is usually quite difficult to obtain - but due to synergy effects with another chip consumer/organization they managed getting their custom processor manufactured.

what's still missing is encrypted stealth radio communication. something that uses a wide range of frequencies, low power with big timing windows to be indistinguishable from other things happening on air. It should look like noise and regular signals (like non-decryptable LTE packages combined with noise that could also as well just come from a power-supply)

My first "contributions" were 2004, I was 10 years old and supposed to write a text about Mozart. Somehow I noticed the edit button and started vandalizing the page, as I didn't understood what Wikipedia was meant to be. Some patient wikipedian kept reverting and reporting my IP addresses during that day. It's both incredible to see how old and young Wikipedia is, if we'd say there was a "World Wide Web Heritage" project, Wikipedia and the contributors are truly the first thing that comes to mind.

Wonderful website!

> Spain will need to make some very hard choices

Thankfully there is now more focus and financing available to elevate the network quality - right? Portugal has added 1% onto the electricity price for that purpose alone: https://www.energy-storage.news/portugal-to-invest-e400-mill...

I've followed "expert testimonials" in the Austrian news over the past years, and even there the importance of grid safety is a common theme - there seems to be some gap, even in the networks that on the surface level appear to be tolerant.

> I know that the typical grid operator is extremely careful and pro-active on this subject

That's really good to hear, unfortunately standardization is extremely slow moving and even though a potentially "safe grid" may be much more at risk during "hybrid-war times" (or other civil unrest, as seen in Berlin this year).

https://positive.security/blog/blinkencity-38c3

> I have no idea then why you're trying to throw shade on something good that was accomplished by bending the truth

I'm not trying to "throw shade on something good" - in contrary, even with a "once in a decade event", the benefit of renewables speaks mountains (not even to speak of the severe damage fossil energy causes that's currently unaccounted in the price of expelling greenhouse gasses).

If renewable energy increases the chances of such events happening, only with accurate numbers you can do the appropriate risk management and operate an efficient, yet stable, grid.

My original comment is flagged now so well, didn't mean to fuel some awful views trying to pretend renewable energy is bad - something I strongly disagree.

I did not mean to suggest that the outage in Spain and Portugal were caused by wind power or just renewables.

It's more related to me in terms of when you look at the economical impact of energy, what sizes are in play. Just reading 4.6B Euro is a bit vague to understand to me, at least without having that put into perspective.

Another topic that has been surfacing every now and then is Electricity theft, partially for in-door cannabis plantation in occupied apartments. Which Endesa is valued 2B Euro per year.

https://www.endesa.com/en/press/press-room/news/energy-secto...

Generally renewables do pose new challenges onto the grid, unfortunately conservatives/fascists are using that for FUD - making a technical conversation harder on that topic.

https://www.brattle.com/wp-content/uploads/2025/11/2025-Iber...

Even in the hypothetical scenario that renewable energy being more expensive than fossil energy (in production), the climate catastrophe and the impact of that on the economy is undeniable magnitudes bigger than any investment we could currently do to shift quicker stronger to renewable resources.

Well, the cause is known - it's many causes that have accumulated. Of course, maybe more research will bring some more definitive conclusions - but overall the core mechanisms seem to be well understood, at least to the extend on what will be needed to avoid similar scenarios in the future.

I don't understand why your reply is so aggressive though.

What is upsetting you by others talking about the blackout?

Especially understanding the economic impacts better, seems to be a reasonable thing to do?

Overall, there seems to have been very little effect on the economical growth of both countries - even though it has been a regular business day.

Some slide-deck that covers the situation well: https://www.brattle.com/wp-content/uploads/2025/11/2025-Iber...

Yes, however the safety-profile is quite the opposite to 222nm.

https://www.larsonelectronics.com/news/1763

https://uvmedico.com/far-uvc-light

Seems `session/:id/shell` was also `session/:id/bash` and originally `session/:id/command` in some commits.

Maybe I'm using GitHub code search wrongly, but it appears this was just never part of even a pull request - the practice of just having someone pushing to `dev` (default branch) which then will be tagged should perhaps also be revisited.

(Several more commits under `wip: bash` and `feat: bash commands`)

https://github.com/anomalyco/opencode/commit/7505fa61b9caa17...

https://github.com/anomalyco/opencode/commit/93b71477e665600...

In case the authors sees that, your default shell is configured via [0]:

   users.users.yourUser.shell = pkgs.fish;

[0]: https://search.nixos.org/options?channel=unstable&show=users...

Right, that's what is next :(

As a close follower of Boston Dynamics since my high-school years, I feel like in hindsight that was a good call, they've managed to progress everything else seemingly very well - which now gives them a head-start for an industry that surpasses any amount of money Boston Dynamics could ever get by many times. The data and capabilities around data would unlikely have brought similar scale of innovation, as other companies could now come up with.

Now instead, they're ahead of end2end integration of their section of robotics - especially with actual business customers that gave them a great head-start in figuring out how to integrate them as a product.

ChatGPT xD

Reading through this makes me realize that I wonder what will come after "energy wars"? Like if around ~2040-2050 almost 100% of electricity demand is hopefully renewable, that means a completely new area of power.

Till then, fossil energy has been the strongest dominator on which establishment is holding power - once that's becoming the past - what will happen on the world table?

Of course, mining etc. is part of the answer; but I feel like there is much more flexibility around working around refined material availability, than it is with access to energy to start with. Also, contrary to Energy, almost anything that's mined will stay in recyclable economy - so the dominance/control one country can exercise is limited.

Does the URL end in "women-in-the-world.html"?

> If you are forced to use encryption to report security problems, please reconsider this policy as it feels counterproductive (UK government, this means you…)

LOL

Uh totally, I can't believe how much support Gadgetbridge has - wow thanks for the reminder. I'd love to use that on Linux eventually.

the session (or pairing key) means you can both connect to the headphone or impersonate it.

It can toggle the hands-free mode and listen to whatever is being talked, you'd notice that it has switched to the mode though - but if you're headphones are powered on and you're not listening to in they can be used for eavesdropping.

During the talk they both demonstrate listening to the microphone and also receiving a WhatsApp 2FA call.

Glad this submission is finally receiving upvotes.

This was just shown at the 39C3 in Hamburg, few days back.

Common (unpached) Bluetooth headsets using Airoha's SoCs can be completely taken over by any unauthenticated bystander with a Linux laptop. (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702)

This includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, ...

> Examples of affected vendors and devices are Sony (e.g., WH1000-XM5, WH1000-XM6, WF-1000XM5), Marshall (e.g. Major V, Minor IV), Beyerdynamic (e.g. AMIRON 300), or Jabra (e.g. Elite 8 Active).

Most vendors gave the security researchers either silent treatment or were slow, even after Airoha published fixes. Jabra was one of the positive outlier, Sony unfortunately negatively.

What is exciting, even though the flaws are awful, that it is unlikely for current generation of those Airoha bluetooth headsets to change away from Aiorha's Bluetooth LE "RACE" protocol. This means there is great opportunity for Linux users to control their Bluetooth headsets, which for example is quite nice in an office setting to toggle "hearthrough" when toggling volume "mute" on your machine.

RACE Reverse Engineered - CLI Tool: https://github.com/auracast-research/race-toolkit

I feel like this should receive state-level attention, the remote audio surveillance of any headset can be a major threat. I wonder what the policies in countries official buildings are when it comes to Bluetooth audio devices, considering that Jabra is a major brand for conference speakers, I'd assume some actual espionage threats.

This was just shown at the 39C3. Common (unpached) Bluetooth headsets using Airoha's SoCs can be completely taken over by any unauthenticated bystander with a Linux laptop. (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702)

This includes firmware dumps, user preferences, Bluetooth Classic session keys, current playing track, ...

> Examples of affected vendors and devices are Sony (e.g., WH1000-XM5, WH1000-XM6, WF-1000XM5), Marshall (e.g. Major V, Minor IV), Beyerdynamic (e.g. AMIRON 300), or Jabra (e.g. Elite 8 Active).

It was presented here https://fahrplan.events.ccc.de/congress/2025/fahrplan/event/...

You can watch the pre-recorded talk here:

https://streaming.media.ccc.de/39c3/relive/887fe87e-6ef2-5d9...

There is also a good write-up [0] by Julia Evans. We ran into this with DICOM storescp, which is a chatty protocol and TCP_NODELAY=1 makes the throughput significantly better. Since DICOM is often used in a LAN, that default just makes it unnecessarily worse.

[0]: https://jvns.ca/blog/2015/11/21/why-you-should-understand-a-...

[1]: https://news.ycombinator.com/item?id=10607422