kyleomalley

Amatuer radio is interesting. It does remind me of the earlier wild west days of the internet. There are no bots, nothing commercial, and you can just “rag chew” with real people or do contesting where you try to reach further distances or make contacts in certain areas. Most of it is only as hard as you want to be but it’s such a vast and complex environment (licensed and unlicensed stuff). All of it is fun. Far enough away from computers that it’s all mostly (and technically always should be) a real person at the other end talking — but that will change soon enough I’m sure.

I probably use Reddit 1/10 as much as I used to as well. Kind of sad seeing Reddit going down the enshitification path that seems like most software and apps tend to do.

Question: what about the other trusted roots? Has anyone tested them?

I’ve tested most of them (from historical archives) and have automated testing any new CA certificates that show up in CT.

I’m calling the check “luggage code entropy” (1 byte).

It was a mistake to trust so many root CAs and misapply the same level of trust where clearly it is impossible to independently verify and most of the accountability is smoke and mirrors. We need to be asking “why” here, the stated reason needs to be much more than “because webtrust audit” and “we recorded the entire operational process for key material handling on YouTube with this open source implementation of key ceremony tooling and have underwritten the strength of the private key with a few $mm dollars, to be paid out to the rest of the roots for the shared reputational damage to the entire ecosystem should we fuck up (intentional or otherwise).

A quick aggregated look at common cloud status information, along with popular AI models, DNS and public CA infrastructure status.

I expect if enough of these stop working, the site will too.

Strange seeing how people have such a hard time seeing others using AI and seem to want to complain about it instead of just, well, asking AI why something was likely done a way. It works both ways my dudes, experts don’t need to explain every last detail, prompt a bot with the context until you understand.

From my prospective, the outputs of a bot aren’t the interesting bits, it’s the input prompt that should warrant more attention.

It might be kind of overlooked when people read about the big scary results from mythos; the real breakthrough was probably just as much the application of the (very decent) model through a well engineered wrapper (harness). Other models including codex or glm result in significant findings as well.

Harness example: https://github.com/evilsocket/audit

If you haven't been following MeshCore, it seems to be really hitting strides with adoption and growth. There are scaling issues [1] and overall the protocol has its limitations[2] , but its really interesting to play with and cheap, which is helping fuel adoption. Since devices are cheap and software is too, so given enough time, it is likely these issues can be sorted out (and it may not even look or smell like what we're working with now, as long as people can upgrade firmwares and software)

On the west coast of the US, there is a consortium of independent networks that are likely to merge (to some degree, TBD). https://www.wcmesh.com/

I'm in SoCal right now and while this network is impressive, the Cascade network is really really awesome (I was able to use it first hand last week!). https://cascadiamesh.org/

One of the challenges that remains unsolved is how local networks are forming around non-default-for-the-region settings and making those well know or obvious to new users.

Take away from the map from analyzer.letsmesh.com for today is that ohio is extremely overrepresented, why? This weekend is Hamvention!

Interesting links:

  - https://analyzer.wcmesh.com/#/map (Local SoCal mesh
  - https://www.localmesh.nl/en/ (Netherlands based network)
  - [1] https://bostonme.sh/docs/MeshCore/meshcore-collisions/
  - [2] https://nodakmesh.org/blog/2026-03-06-repeater-firmware-v1140

I regularly use about half a dozen programs that interface with radio equipment. Most of it works but getting it all working together is extremely complex.

Since primarily interested in FT8 and MeshCore here in the local SoCal MC region (wcmesh.com) I put together a Pure-Golang implementation to combine both modes into the same GUI client. The FT8 modem might be the only functional Golang decoder right now, unsure, but it’s entirely open source and here:

https://github.com/kyleomalley/nocordhf

The workflow releases cross compiled for MacOS (notarized), Windows, Linux and uses Fyne for the UI.

In the future, I plan to add other more interesting modes like JS8Call and VeraHF modes, FT4 etc.

It’s unclear, my next step is taking the few days worth of recordings along with the ground truth that you can get from ‘jt9’ and giving Claude the task. I’ve been running decode shootouts on 128c aarch64 and made some progress but I needed to finish the UI.

Im going to take all of the data and use it for a corpus for training and see if I can get a small model built that can run easily on mac arm64

I wanted something better than WSTJ-X and Gridtrackr with the endless knobs and complications and developed this along with my favorite french intern (Claude).

The /lib/ golang FT8 library is not yet complete and struggles with around 15% of the decodes that WSTJX will get at very low signal to noise ratios (-18 to -25). But otherwise matches at around 85%.

If you have an newer ICOM or Yaesu radio and use MacOS, you can simply just run the program, configure your callsign and LOTW logins and you are off. Every logged QSO goes into a standard ADIF file that gets signed/uploaded automatically and DXCC grid tracking can be enabled on the map overlay.

The waterfall scope overlay is my favorite feature though as you can live watch decodes and quickly cross reference what you see, get magnified view of a decode and do QRZ lookups etc directly on the waterfall.

I wanted to play around with Claude cli for a bit this morning and spent about 2 hours setting up hosting and making this (obviously) satire security company website.

You have a choice here on your platforms, this isn't even remotely an honest comparison, is it?

Even just a few seconds running normal pressure bidet is extremely effective. Let it run for 10 seconds, use hot water, use a rotating sprayer (or just wiggle around a bit) and there is absolutely nothing left. Don't forget your skin doesn't want poo on it and gravity is also actively working against anything sticking.

Is it time to revive fuckedcompany.com yet?

1. This will be the decade of compact hospital-grade health and bio-Informatics devices being brought into the home and personal life. Think Startrek tricorder capability but in a (likely) larger package.

2. Deep fakes will precipitate the need for digitally signed media. This likely means further reliance on root-of-trust systems like x509 certificates or some new international body designed to issue a new form of lightweight signing mechanism that works at low resolutions/low bandwidth.

3. Continued climate change will result in at-least one major U.S. city losing population due to feasibility/costs of providing either clean water or breathable air.<br><br> 4. China and Russia will split their version of the internet entirely apart from the traditional internet and will sell products and services to other countries to do the same (I.e. Iran).

5. The era of horizontal drilling and fracking for ultra-cheap gas and oil will slowly wind down and energy costs will increase to 2000’s era costs.

6. Most ominously: this might be the first decade where we see large scale orchestrated micro-drone attacks (death by a thousand paper cuts) and autonomous vehicles being used for delivery of some kind of malicious purpose (I.e. explosive delivery).

7. Massive inflation globally during 2010/early 2020’s will result in stagflation in the U.S. and other countries.

The “real economy” runs on a fiat (inflating) currency system that is effectively not zero sum. The stock market is a closed system that currencies feed into - at the end of the day it’s still a measure of a fixed amount of value and thus zero sum.

I’ve had no trouble finding fishing and hunting partners in SV. I’ve never personally felt anyone hugely opposed to hunting either, unless it some how conflicted with how they feed themselves. I do find it interesting thatduck hunting during season can be done just a maybe a mile from the Yahoo/Google Cloud buildings in north Sunnyvale. I have frequently seen full camo duck hunters carrying shotguns from the water treatment center walking out to the duck blinds.

As far as sports, your average engineer isn’t typically consumed by them, but half the engineers I’ve worked with from the bay seem to be fans of whichever team is doing great at the moment (warriors or giants or often the sharks).

I’ve also done more sport fishing and crabbing here than anywhere else I’ve lived.

I think the huge numbers of foreign residents have a large impact on the overall culture compared to say rural Texas, but it doesn’t seem too far off imho.

One other point is just how many super packed country concerts there are at shoreline.

Tl;dr San Jose/SV is just as country music/sports obsessed /game and fish oriented as the rest of the country (if you don’t surround yourself with non-North American engineers for eg).

Edit: on mobile, autocorrect at word.

ESNI doesn't solve for a future where ipv6 takes over and suddenly every site has a huge block of dedicated IPv6s for just that site/fqdn.

ESNI as it has been developed to essentially require two other components to work properly:

1) a large scale cdn 2) a trusted dns infrastructure (i.e. DNS-over-HTTPs or DNS-over-TLS).

So people are absolutely right that in distant future when IPv4 fronted sites go extinct, it may be possible that site hostnames can be correlated to a set of IPv6 address(s). ESNI doesn't and can't solve for that. I imagine that as the internet continues to become more and more centralized, a few large CDNs will host most (or very close to all) internet traffic through a few sets stabilized anycast addresses (thus obfuscating any individual hostname among many hundreds or thousands of other sites as they would all correlate to the same ip blocks).

That being said, I still don't understand why it's so important to have the SNI on the "outside" of the tunnel. Seems like we should have another layer before the symmetric key exchange where the sni is exchanged on its own.