a fun lunchtime reading
(gift article via a post I found on Reddit)
Remote
Ben
@jianmin@defcon.social
mastodon 4.7.3Be anti-fascist.
he/him.
My views are not anyone else's. Retweets are not endorsements, etc
"This land was yours and mine until they bled it dry. History won't be kind to those who turn the other away." 🎶
Posts now auto-delete after 2 weeks unless I bookmark them.
Banner alt text: three kittens in hoodies with dark sunglasses with metallic frames and circular lenses. A digital American flag is in the background, suggesting these are elite american hackers. Paws are on keyboard
113 Followers
355 Following
10 Posts
Joined November 18, 2022
this is a great thread but also claude found rce in freebsd this week and then another claude operationalized it with two different exploit chains.
both things can be and are true and maybe we're just all cooked.
https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-4747
Last year I looked at buying a maxed out framework build and it was around $2k for what I wanted.
Now I'm looking at the same build and it's $3k.
And yet, after pivoting to the cloud in the late 2010s, I feel like it is a strategic investment to buy local compute while I still can.
AI is killing the market already, but if TSMC fabs go offline, the crunch is going to get way worse.
Replying to
@nullagent@partyon.xyz
Who is encouraging activists to use meshtastic or any lorawan devices? Probably they are the ones most at fault here.
I think the security docs from meshtastic are fairly transparent about what they offer and don't offer.
Correct me if I'm wrong, but your tool primarily abuses the Trust On First Use model for establishing trust. Also without digging into code, I suspect you can combine this with the limited space for nodes in the nodedb to easily spoof arbitrary users that aren't saved/favorited.
It's not as much of a bug as it is an artifact of how the designers decided to handle the limited bandwidth in terms of which features to prioritize. They don't claim to provide security or privacy and seem to prioritize lower bandwidth and operability.
Replying to
*disclaimer: Opus 4.6 drafted the one liner.
It is consistent with my own reading of the writeup and behaves as expected when patching. It doesn't come with any guarantees that you are fully patched against this bug, but it does seem to mitigate the obvious public path to exploitation.
Another day, another Linux LPE and container escape: https://github.com/V4bel/dirtyfrag
Remembering my 2019 refurbished Dell Latitude 7300 after it gave up the ghost last night and won't come back online despite my best efforts to revive it.
Got me through the COVID era, grad school, and many projects since then.
The Framework 13 I just ordered has big shoes to fill.
I'm thread-blogging on main. a story about searching for meaning in life. feel free to ignore.
I grew up in a flavor of charismatic christianity where there was incredibly strong pressure to perform spiritually by "speaking in tongues," conjuring feelings during church services, or hearing a deity speak directly to me through "journaling."
In high school I came across some of those journals. in entry after entry where I dutifully wrote conversations the child version of me thought he was having with God. there was a repeating pattern that resembles a horoscope; they were vague and fluffy and generally meaningless. As I reread them, I realized it for what it was and felt anger and shame.
1/