New vulnerability report from Talos:

WolfSSL wolfSSL X.509 registeredID name constraints enforcement improper input validation vulnerability

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2410

CVE-2026-5263,CVE-2026-5263,CVE-2026-5263

New vulnerability report from Talos:

WolfSSL wolfSSL X.509 iPAddress name constraints enforcement improper input validation vulnerability

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2409

CVE-2026-7532,CVE-2026-7532,CVE-2026-7532

I love everything about the way it was written, but it got under my skin more than watching Obsession: https://weli.dev/blog/half-baked-product/

@zhuowei https://gracecondition.github.io/posts/dirtyslide/ "virtual machine only" lpe

@drwhax Endless fun!

@drwhax coming out with this line after your guests finished their first cup of tea: priceless!

"this property was involved in the Novichok event that took place in 2018"

https://www.rightmove.co.uk/properties/90003912#/?channel=RES_BUY

Anything can be real. Every imaginable thing is happening somewhere along the dimensional axis. These things happen a billion times over with exactly the same outcome and no one learns anything. Whatever a person can think, imagine, wish for, or believe has already come to pass. Dreams come true all the time, just not for the dreamers.

#HitchhikersGuide #DouglasAdams #quotes #quote #bot

Amstrad PPC640 [1987]
CPU: NEC V30 8 Mhz CPU
MEM: 640k RAM ('all you'll ever need')
STORAGE: Dual 720kb DD Floppy Drives

This weeks ritual: copying huge PDB's across machines, otherwise I'll *definitely* hit a bug when executing the binary.

#MurphysLaw

It's been a long time I've seen a good old #deface:

https://www.thyssenkrupp.hu/hu/

(Someone is having fun with JS dependencies?)

@seindal @matdevdug Some doctors in Hungary can do something similar now that authentic notes are stored and shared online, but the expectation is that you go and see the doctor.

The most fun part is since most working adults are generally healthy and this level of healthcare is heavily understaffed many of us never visit their designated doctor (use private healthcare instead) and after a while end up living in far away cities. So in the end we'd travel several hours to see a doctor who is busy with patients actually in need to say that "I have fever" and get a piece of paper.

I started using #Zed for some C/C++ work and I gotta say this is probably the best IDE experience I had with these languages:

- Minimal UI, but important stuff works
- Compilation databases are ingested automagically
- Remote, cross-platform editing (this is **huge**, I still have to figure out remote build/debug though)

As a bonus they even got to disable the Most Annoying Feature(tm) of the editor recently:

https://github.com/zed-industries/zed/issues/59427

@matdevdug I think it's a quite common thing across EU and I hate it.

I’m a little shocked that #germany is requiring workers to get a doctor’s note for any sick leave. It’s such an insanely high barrier for people. I’m sad to see such an important member of the EU go in such an anti-worker direction.

I can say as an American who has had jobs with that requirement, the result is “people come into work sick all the time”. Truly the sickest I’ve been in my life have been places that mandate that, to the extent that one of the two that did ended up rolling it back when an intern threw up in a trashcan in front of our largest customer.

A politician investigating Pegasus spyware… had their phone hacked with Pegasus multiple times. The compromises came days ahead of key meetings of the spyware inquiry:

https://www.wired.com/story/eu-politicians-investigated-pegasus-spyware-then-it-ended-up-on-one-of-their-phones/

Apply all regulations to the last letter.

And after yesterday's post, here's one on the state of things in agentic identity: https://www.codon.org.uk/~mjg59/blog/p/securing-agentic-identity/

So. For the past few days I've been deep in a fun and very rewarding, but also extremely scary debugging saga. To cut a long git-bisecting story short:

Since Linux 6.9 (May 2024), the tool that locks the laptop's drive on suspend had been silently failing.

Like many of my friends, I use full-disk encryption (LUKS) to protect my data if my laptop is lost, seized or stolen. Highly recommended to everyone; in combination with tested and automated backups, it contributes greatly to peace of mind. (Under Windows, the canonical software to do that is VeraCrypt.)

Except that, for more than two years, the encryption key remained resident in memory across suspend, leaving it there for the taking by anyone who seized the still-powered laptop. (It still worked on a full shutdown, but a full shutdown is rare these days.)

There is something uniquely unsettling about trusting a security mechanism for years and learning it was never doing the thing. "A technical argument by a trusted author, which is hard to check and looks similar to arguments known to be correct, is hardly ever checked in detail." The same, it seems, is true for computer code.

The culprit was a sensible and useful refactoring, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a28d893eb3270cf62c10dd8777af0d8452cdc072. But it had an unexpected long-range interaction with the encryption code. The fix is exactly one line long: https://lore.kernel.org/all/ajKwRtP8izwRsMmv@quasitopos/ And no, without formal proofs I cannot say whether my patch is correct and free of its own long-range interactions... At the very least, we now have an automated test to detect future regressions (https://github.com/NixOS/nixpkgs/pull/532499) and a patch to emit a warning instead of failing silently (https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/936).

This is so cool: 4 alternatieve Fields Medals for

Excellence in mathematics research by somebody who is currently over the age of 40.

Excellence in mathematics research with approaches that are not mathematically rigorous (construed broadly).

Excellence in leadership in the mathematics community (construed broadly).

Excellence in exposition of mathematics to a popular audience.

https://esander1789.github.io/afm/