notherhack

Long ago at a startup, In-System Design, I was on a team that made one of the first USB-to-ATA mass storage adapter chips. Small company, having fun, one of us put in an easter egg so that when the drive was plugged in and before the OS enumerated it the drive activity light would blink our team cheer, "ISD rocks!", in morse. He even added a test to make sure it worked in verilog simulation.

The chip was fairly successful and years later someone out in the world noticed the funny blinking on their retail USB drive that used it and they figured it out. They wrote a letter to the editor of Byte or Dr. Dobbs or something, wondering what the message "Sis you rock!" meant. Twisted sister fan, maybe?

We saw the letter in the magazine and were chuffed that our easter egg had hatched but... It turns out the designer had typoed the table of ASCII-to-morse values and dot/dash timing he used to build the messaging circuit, so it really was saying "Sis you rock!". And because he also wrote the test it didn't catch the error. Doh!

OSO? Maybe it was a Spanish flashlight warning of a bear nearby? ;)

People correlate to usage of services, not buildings. An empty apartment building is no more likely to catch fire than an empty house. Taxing land and taxing people, via local sales and/or income taxes, makes more sense to me.

V guvax gur vqRn jnf gb fcyvg guR uvtu seRdhrapl "r" gb gjb qvssReRag flzobyf r naq R ng yRffRe serdhrapvRf. Fvzcyl ercynpvat nyy r'f jvgu R qbrfa'g qb gung.

Firefox 140 ESR was released this month. I expect Debian will publish an update to it soon.

On my system I see that libxslt is a dependency for glib, gtk+, samba, systemd, pam, and a bunch of others. That's pretty foundational. What could possibly go wrong?

A government stake gives confidence in the company’s survival that a one-time cash dump for the CHIPS act couldn’t.

It’s not a lot different than what car and financial companies got in 2009. They were about to go under because no one thought they’d be around long enough to get out from under and deliver goods or pay their debts. The government stake enabled them to keep operating and eventually recover and then the government returned the stake to the market (or will soon w/ Fannie & Freddie).

Any cost-plus defense or aerospace contract.

Nit: Marvel makes comics. Marvell Technologies (two l's) makes chips with ARM CPUs in them, mostly for datacenter gear.

See also https://news.ycombinator.com/item?id=44924254

"The Debian development team put it like this: So, given the wafer thin vectors of attack here, the extreme age of the images in question, and the fact that even at the time that they were fresh, they were images that shouldn't be used in production anyhow (Debian's "development" repositories), we've opted to leave them in place.

Binarly kind of agrees ... "

Harness, or train? When a junior uses AI the junior learns. When a senior uses an AI the AI learns. Maybe the AI owners are harnessing experienced devs to train their replacements.

"The Gobi Wall was not just a barrier—it was a dynamic mechanism for governing movement, trade, and territorial control in a challenging environment."

I feel like acme.sh is the kind of client she's ranting about. 8000 lines of shell code in acme.sh and more in dozens of user-contributed hook scripts, and over 1000 open issues on github?

Personally I like https://github.com/dehydrated-io/dehydrated. Same concept as acme.sh but only 2500 lines of shell and 54 open issues. You do have to roll your own hook script though.

Curiously, first commits for both acme.sh and dehydrated were in December 2015. Maybe they both took a security class at uni that fall.

See https://news.ycombinator.com/item?id=43556521

wherein a hosting company sees AI bot scans that appear to be coming from millions of unique addresses, thousands of ASNs, many residential and often with a single connection from an IP. The AI bots are proxying through either hacked IoT devices or apps that pay people pennies to let their phone be used as a proxy.

Likely your proof of work will be distributed to the proxies. It'll just make millions of webcams and phones run a little hotter without slowing down the AI bots at all.

The Borg site says Windows support is "experimental, no binaries yet". Is that still true?

Restic 0.17.1 was released last month. The home page says "During initial development (versions prior to 1.0.0), maintainers and developers will do their utmost to keep backwards compatibility and stability, although there might be breaking changes without increasing the major version."

So worth a peek but still under construction.

Page 3 says FreeBSD is 2X faster (200% bogo ops) than Linux on the semaphore benchmark, 3X on function calls, 7X on poll, and 15X (!) on context switching. Of course it shines with lots of cores.

It's strange that Linux comes up 3-5X faster on socket activity, given that networking is supposed to be BSD's strength.

Maybe FreeBSD just does things a different way that sidesteps the benchmark tests for those OS-related ops, so those results aren't really valid? Or does anyone see these differences in the real world, and if so why is BSD faster?

"Improved" fire suppression systems contain hydrofluorocarbon gases which when burned decompose into HF gas. What could possibly go wrong?

Do NOT stay in the server room (or armored personnel carrier) when the fire suppression system goes off. https://academic.oup.com/milmed/article/177/1/108/4345530

Imazing Profile Editor works well to generate VPN profiles, and a lot of other profiles I don't use. Runs on Mac or Windows and it's free. No personal stake, just a satisfied user. https://imazing.com/profile-editor

Netgate is providing a pfsense patch that disables ETM MACs but leaves chacha20 enabled. The vuln announcement is arguably vague because of the way is uses "and" and "or" but from the vuln scanner source chacha20 is clearly not okay even without ETM.

    https://forum.netgate.com/topic/184941/terrapin-ssh-attack

Shame they won't let me post a reply to let them know.

The US army had portable reactors 60 years ago. They were deployed in Greenland, Alaska, Antarctica. https://web.archive.org/web/20220404082426/https://www.usace...

At least some of them were produced at the Idaho Nuclear Engineering Laboratory, and one of them suffered an accident there due to operator error. That site was later renamed to Idaho National Laboratory when being "nuclear" became bad, and they're making these "new" ones, too.