dunder_cat

The rss button doesn't work, kicks back a 404 when you are redirected to https://pwn.watch/feed.xml :-(.

In fact, it seems to be the case for the "json" and "llms.txt" buttons, too.

I hope it does get fixed, but Apple actually has a bad track-record with another deprecated API, AppleAL (OpenAL). They broke it in a very interesting way in Tahoe where mono-channel audio on Aarch64 (not through Rosetta) did not play and it was broken through all the betas. I believe it actually may still be broken today. The workarounds were either mono-to-faux-stereo channel duplication or switch to openal-soft.

OpenGL is an even bigger deal so I don't see a world where it doesn't get fixed, but I also thought exactly the same way with the previous issue. It seems that Apple does not have any older video games in their testing apparatus.

Some references on the issue:

1. https://github.com/luanti-org/luanti/issues/16499

2. https://support.sega.com/hc/en-us/articles/39540396560145-Ma...

I think at work I am just barely in the category of I've removed more code than I have added. Over many, many bugs and long meetings I've sort of arrived at the conclusion that in most cases, the best code (excluding comments) is the code that doesn't have to exist [0]. It occurred to me at work today while refactoring some change that even in this LLM-driven world, I can still optimize for that for some additional challenge and satisfaction.

The root of this challenge comes from more text aka more code ~= more tokens, so these firms have little incentive to optimize for that mindset. Sure, they might have more optimized individual responses - but the end result is still giving people what they want: more features, more documentation, nice, long, verbose and well-formatted Jira comments, of sometimes questionable but sometimes undeniably impressive quality. The band marches on, and when your codebase outgrows the constraints of the tried-and-true tools, you can just invent your own. With documentation and an MCP or two, or ten -- to also pull into your context window.

[0] I work on an operating system, so a suggested retort is to say this is me pushing responsibility and logic to the people higher up on the stack ;-)

With AMD, most GPUs including the integrated ones will just default to the `amdgpu` module which is maintained by AMD themselves. You pretty much have the best possible experience on Linux right now.

I can't speak from personal experience since my only laptop is an Intel Framework 13 with no dGPU, but there'll be two other main cases both involving Nvidia that tend to bite people.

1. "Gaming" laptops usually with integrated Intel GPU + Nvidia discrete GPU. Not sure what advancements have been made in power management, there. I know there's some incantations one can put in .desktop files to prefer the discrete GPU for like, games, but not much more I can speak to.

2. General fun involving the fact that Nvidia's "gold-standard" drivers are not mainlined in the kernel, but maybe the fact that they are "open source"* means at some point there'll be parity with them. I think that is the goal of Red Hat's Nova driver in development.

* these days, the GPUs got complicated enough they have management processors on them that can actually run most of the complicated algorithms via a firmware blob. So the current open-source drivers basically bridge the gap between the kernel's various subsystems and that little processor to work the magic.

On another note, Intel Xe/i915 have been pretty good, I've used both for integrated GPUs and an Arc Alchemist-generation discrete card of theirs. The framework 13 12th gen intel GPU struggled at the start with a lot of hangs but within a few months of launch, some smart cookies at Intel managed to fix various bugs and it was smooth sailing from there, with the exception of thermals just being in a rough spot on that generation.

Eventually it will, but it is console exclusive for some indeterminate amount of time. Google seems to indicate that this was 19 months for GTA5. Not entirely sure why, the tinfoil hat theory seems to be it's to encourage people to buy it a second time to play multiplayer with their PC friends. Alternatively, it could just be it's easier to get some fixed targets out the door than worry about broad optimizations.

A bit disappointing either way though as someone whose only console is a Nintendo Switch 2.

This feels like a nitpick but it's important to mention anyway

> Mullvad Browser uses them [ the DoH servers ] by default when you're not on Mullvad VPN, preventing your ISP from seeing the domains you visit.

This is a half-truth until Encrypted Client Hello (ECH) is in-use for most of your traffic. Sure, you won't have clear-text DNS floating out there in the series of tubes. However, without ECH the hostname you're connecting to is exposed in the SNI field during TLS handshakes.

I imagine most sites we are browsing will eventually be able to leverage ECH, so this should become less of an issue over time, but in the event you frequent any self-hosted operations (e.g. no Cloudflare or similar), encrypted client hello could still reveal identifying information since it requires still exposing an "outer SNI" that a valid certificate needs to be presented for. You only get to easily hide in with the masses when you use a big infrastructure provider as a consequence, since the common outer SNI of cloudflare-ech.com doesn't really reveal anything different than an IP <-> ASN database would. But if the outer SNI is "dunder-cat-enterprises.com", then all I've protected you from is your ISP snooping on the subdomain or pinpointing exactly which one of my domains you might be talking to.

Yes, but the article (not to call you out - I just think it's a very important point!) points out that this type of throttling would not be effective:

> Suddenly, the crawlers were coming from millions of random residential or mobile IPs, all pretending to be random modern browsers. An IP like that would make 4-5 requests and then never show up in the logs again. There was no point in banning them, because by the time you figured out that they were bots, they were already done with you. You just needlessly ballooned your firewall ruleset by adding IPs that would never be back.

Without something like cookies (which are almost certainly tossed after the IP is rotated) or some other persistent identifier, you are stuck have to apply mitigations that scale with the load you're encountering, which means longer challenges for everyone or degraded functionality, like removing some of the fancier cgit features.

I testified against the equivalent of this bill in my state. One of the things I mentioned is because of a non-trivial monetary fine per infraction [1], as someone who would potentially need to implement this, I would have no idea how to reliably differentiate a computer that was simply out-of-date/implementation has bugs from willful non-compliance vs Open Source [2].

It just felt like the bill had the goals it had when it was created, and the broader cloud of "gee, if people implement this a certain way, it could have unintended consequences" was completely ignored. But don't worry, one of the co-sponsors proclaimed. near the end of the hearing, that they had a Masters Degree in Computer Science and worked on operating systems in their career, so they made sure to let us know that we were over-reacting.

The other thing that really pissed me off was it was rumored my states bill was going to get an open source exemption. However, they waited until the end of the hearing to introduce all of the amendments, including the Open Source exemption. The proposed amendments were not publicly visible on the bill page or the page about the committee meeting for that day. This ended up being an excellent strategy to sway other committee members [3], since they could just hand wave the bulk of us as "concerns resolved". It was quite illuminating to also see media lobbyists come in and verbatim just state "hey did you get our proposed amendments?" and then without much reading of them at all, they were ratified during that session. Lesson learned: the moment there was a rumor of amendment, I should have made a considerable effort to get my hands on that text ahead of time since for the implementation concerns I raised, I was still unhappy. I'm not quite sure though how much of a difference it would have made though, since at least 30 other people fell into the same trap.

Anyhow, hopefully my long-winded Sunday morning post was useful to someone in the future either when dealing with compliance, a version of the bill in their own states, or the federal government's attempts to do a similar thing. I confess that I have been lazy and not remotely done any due diligence on that federal bill (https://www.congress.gov/bill/119th-congress/house-bill/8250... / HR-8250: Parent's Decide Act). I encourage others to be better than me and contact their representatives, assuming it isn't already on the fast track to becoming law.

[1] at least, for smaller businesses -- big tech won't care! I think it was something like $6,000/pop, which is chump change for big tech and will be negotiated during settlement talks.

[2] Okay, you can check the user agents. But who wants to need to maintain or pull in a list of enforceable user agents! What happens if someone is spoofing the UA and suddenly they end up in my list of "must check" UAs (or inversely, !(not must check)). How long does one reasonably wait for the API call to time out? What about running the app on Wine? And most importantly, what if someone that doesn't care about Linux ("okay claude make my website legal no mistakes") is in charge of implementing this logic, or the library that people will end up using for compliance.

[3] Assuming they cared. The vote was largely amongst partisan lines, some people had clearly looked checked out the whole time, despite the abnormally high numbers of their constituents being there that day.

I'm in that camp of has a dating app installed but have no partner so the is-my-partner-cheating admittedly doesn't resonate with me. I've had to do some of this fingerprinting myself before for non-data-selling reasons so a lot of the system-level statistics didn't quite impress me [1], but that one was a gut-punch when I saw it pop up. It makes me wonder what apps out there have leveraged that as a signal for ads or other behavior modifications to exploit my search for a partner -- without at least having to spend a few pennies querying a data broker!

It makes sense that there's some discovery mechanism - since Google loves to use it to prefer Chrome, GMail, etc when you're in one of their apps. I wish that there were more restrictions though where you only get implicit permission to query from apps that have the same developer ID. Maybe a mutual allowlist that has to be formed, or some sort of privileged intent where you at least have to tell Apple what's going on and that gives them some contractual right to sanction you if you're using it for nefarious purposes instead.

[1] excluding the clipboard copy count, that was novel!

I like to always tell interns/new hires that I measure their productivity in the amount of questions they're asking (whether its to me, seeing them roam into people's cubes or in company chat systems). AI has changed that calculus a bit since they can use the magic talking box to query the codebase with varying degrees of accuracy or as a search engine for someone's random internal wiki article/ticket from years ago.

Nevertheless though, we're blessed with a codebase that is several orders of magnitude larger than what the human brain can fully internalize so if you're trying to do anything remotely interesting, you're going to have questions.

After CVE-2023-7028 (account takeover via password reset, IIRC you just had to add a semi-colon between the correct email and the attacker email and it'd email both) was exploited against my cluster, the boasting about fully-automated changes and reviews scares me. I hope I'm far from the only one that hasn't forgotten issues like this.

I'm aware that the defective code was not written by AI but nonetheless, GitLab is what stands between many small organizations and their most precious resources. I was fortunate that 2FA stopped the damage, but what's going to happen the next time? What if my organization is permanently damaged because we taught the machines to go fast and break things, too [1]?

[1] VPN is an option but we're a non-profit with a number of non-technical users, so admittedly we're caught in a balance between making it harder to do things. As much as WireGuard is awesome, there's still a barrier.

Also, meant to share some interesting readings. In the Kubernetes world, my RSS feed lit up with their blog post about user namespaces being generally available in k8s 1.36.

They actually provided some example CVEs that wouldn't have been possible if in addition to containers, they were also using user namespaces https://github.com/kubernetes/enhancements/tree/217d790720c5.... The first example talks about "CVE-2019-5736: Host runc binary can be overwritten from container. Completely mitigated with userns." So it seems like getting root in a regular container gives you more of an attack surface, but if user namespaces are deployed, then it's even harder to do anything useful with it. I am looking forward to the aforementioned writeups since user namespace escapes usually mean another kernel bug.

Your understanding is fine. In many environments, you can still do a lot of damage just by popping a shell and being able to access the database/sensitive environment variables/sensitive code. Getting to root would just be the icing on the cake.

That being said, it's pretty common for non-containerized processes to drop permissions to a low-privileged service account (like nginx running as `nobody`), so it definitely thwarts defense-in-depth in those setups.

In containerized environments, my understanding is their use of namespaces means you still need something more clever than just "patch out the authentication logic in su via the page cache" to escalate permissions in the system to break out of the container. That doesn't mean it's impossible in these exploits (the original copyfail writeup alluded to a second writeup coming to this effect - distinct from dirtyfrag though), but it does mean you're not going to be able to just spam the PoCs floating around.

Doesn't have to even be that advanced, people get conditioned to stuff like reCAPTCHA and friends & Cloudflare's interstitial landing page (when "I'm under attack" mode is on) and they won't bat an eye. That's how we get people piping `curl | bash` into their terminal to "solve" fake challenges.

As a side note though, I recently have tried to turn CSP on a website I run and the amount of garbage I see in the reports is astonishing. There's some noise from things like OpenDNS intercepting YouTube or Social embeds for people using the work-friendly or family-friendly options, but the sheer amount of things attempting to phone home to random URLs and random extension scripts injecting ads into the site would astonish you. My mental model of "toolbar hell" from the Windows XP days being gone has completely shattered.

Is the QR code check mandatory and if not, is it the default?

The bulletpoint as-is just says:

> AI-resistant challenge: As we identify potentially fraudulent behavior from agents, we enable application providers to deter and mitigate malicious requests by requesting humans to be in the loop using the new QR code-based challenge. This AI-resistant mitigation challenge to prove human presence is designed to make automated fraud economically unviable.

Followed by

> Existing reCAPTCHA customers are automatically Fraud Defense customers, with no migration required, no action needed, and no change to pricing. Your existing site keys and integrations remain exactly as they are today.

It is probably me being a literal reader but "we enable application providers to deter and mitigate malicious requests by requesting humans to be in the loop" feels like it can be read as "Good news: by using reCAPTCHA, we're now interfering with agents that can solve the regular challenges" or "there's now a flag the application developer can set". This is the difference between me swapping off reCAPTCHA ASAP or just editing my configuration. I have to imagine someone somewhere anticipated the kind of reactions a number of us are collectively feeling (I too don't want to use my phone to browse the web more than I already do) and it feels irresponsible to publish a feature announcement without covering basic information like this for site administrators. Maybe they thought the second line about existing reCAPTCHA customers being moved over clears this up, but "Your existing ... integrations remain exactly as they are today" feels like again, literally, you won't have this new attestation requirement being presented to your users... but then why am I Fraud Defense customer!

A more direct source (possibly the original source?) I know of is a YouTube video entitled "LISA11 - Fork Yeah! The Rise and Development of illumos" which detailed how the Solaris operating system got freed from Oracle after the Sun acquisition.

The whole hour talk is worth a watch, even when passively doing other stuff. It is a neat history of Solaris and its toolchain mixed with the inter-organizational politics.

YouTube link: https://www.youtube.com/watch?v=-zRN7XLCRhc

Direct link to lawnmower quotes (~38.5 minute mark): https://youtu.be/-zRN7XLCRhc&t=2307

Instagram needs to do this for Reels, too. I got quite addicted to these short-form videos during the pandemic and after I finished college things went immediately downhill once a lot of my mental activity could be somewhat "deferred". I could make up for the productivity hit by crunching but my life would be better without them. I remove things from my phone or put services into Pi-Hole but eventually I capitulate. Something about having the option to remove the most addicting parts of a service but not cutting yourself off completely has more success.

Edit: also to be somewhat objective, Instagram also offers a time limit. However, I've found that just by exiting the app (or it getting killed in the background), it basically clears the lockout so you don't even have to make the effort to click the "ignore" button.

Chiming in as well to say to the author when the victory lap here is over: please consider adding the RSS feed! I want to see whatever you do next, regardless of how long it takes.

> Edit: This is going to have huge ramifications for the tech security industry as these systems will be able to break security systems as easily it solved the proof. The sooner the good guys, if there are any left, understand this the better it will be for everybody.

What can the good guys do? Fire up Claude to improve their systems? Unless you have it working fully autonomously to counter-act abuse, I don't see how you can beat the "bad guys". There may be some industries where this is a solved problem (e.g. you can do all the validation server-sided, religiously follow best practices to prevent and mitigate abuse), but a lot of stuff like multiplayer video games will be doomed unless they move to a "you must use a locked down system we control" model. I honestly don't consider it liberating as someone that has various hobby projects, that now in addition to plain old DDoS I'll also have people spin up layer 7 attacks with just their credit card. It almost makes me want to give up instead of pushing forward in a world where the worst of the worst has access to the best of the best.

I am curious, have you attempted to do this to any binary packed with commercial obfuscation/"virtualization" schemes (e.g. Orean's Themida/Code Virtualizer and VMProtect)?

Seems to be down for me. https://web.archive.org/web/20260220192124/https://vmfunc.re...

Ah good to know. My pi-hole actually was blocking the blog itself since the ublock site list made its way into one of the blocklists I use. But I've been just avoiding links as much as possible because I didn't want to contribute.

https://news.ycombinator.com/item?id=46624740 has the earliest writeup that I know of. It was running it via a script and intentionally using cache busting techniques to try to increase load on the hosted wordpress infrastructure.

One thing that is amusing about the prevalence of advanced anti-cheat in Windows gaming is it's actually causing said API/ABIs to undergo ossification. A good data point is the invention of Syscall User Dispatch^1 on Linux which would allow a program to basically install a syscall handler when they originate from various regions of memory. I do not know how usable this is in practice, admittedly -- but I think the fact it was contributed at all speaks to the growing need.

^1 https://docs.kernel.org/admin-guide/syscall-user-dispatch.ht...

This exists although not in the traditional BOINC space, it's Archiveteam^1. I run two of their warrior^2 instances in my home k3s instance via the docker images. One of them is set to the "Team's choice" where it spends most of its time downloading Telegram chats. However, when they need the firepower for sites with imminent risk of closure, it will switch itself to those. The other one is set to their URL shortener project, "Terror of Tiny Town"^3.

Their big requirement is you need to not be doing any DNS filtering or blocking of access to what it wants, so I've got the pod DNS pointed to the unfiltered quad9 endpoint and rules in my router to allow the machine it's running on to bypass my PiHole enforcement+outside DNS blocks.

^1 https://wiki.archiveteam.org/

^2 https://wiki.archiveteam.org/index.php/ArchiveTeam_Warrior

^3 https://wiki.archiveteam.org/index.php/URLTeam

There's nothing new or original in a lot of things that get posted here. Reading about someone starting a journey provides an interesting catalyst for discussion. What they did right, what they did wrong, other things to try, or even just providing a push to someone else to also try.

I'll take my turn on the soapbox to say I hope people keep posting about their adventures and misadventures in trying something new. I'd much rather be reading that than seeing yet another post on LLM-based agentic startups or pelicans riding bicycles.

Related discussion (the actual project is mentioned in the issue): "Detour: Dynamic linking on Linux without Libc" https://news.ycombinator.com/item?id=45740241

In theory, IPv6 Privacy Extensions (https://datatracker.ietf.org/doc/html/rfc4941) could mitigate this. In practice, I imagine when you bind to `[::]:port`, that also means that the randomized addresses would work for new inbound connections, too. Not sure how long they typically last, but you'd be fighting against the clock at least before a new randomized address.

That being said, on a slightly less common note: it is quite possible to have each individual service running on a /128. E.g. on IPv6 k8s clusters, each pod can have a publicly addressable /128, so activities like NTP would require the container to have an NTP client in it to expose in that way. That'd mitigate a good chunk of information exposure -- that being said, I agree with the larger point about security via obscurity being insufficient.

I'm glad I stumbled across this: life circumstances have allowed me go abroad for a trip the past two years. One thing I had forgotten about since the last trip were some of my group being unable to get one of the cheap prepaid data eSIMs because their phone was still locked to the carrier. I've been tempted to replace my aging iPhone SE 2022 (^1) with a trade-in deal and get a new phone, but it never occurred to me that would mean being forced to use AT&T's $10/day (capped at $100 in one billing cycle) "International Day Pass" during future trips until it had been paid off for long enough.

(^1) I wish I wasn't so tempted after ~4 years, but the battery health has dropped to 75% and the performance has suffered dramatically. A new battery is on the table I suppose, but I am split between just putting that money towards a new phone.