ls65536

Another place to search for private key candidates would be the outputs of various common PRNGs when they have been seeded with a timestamp (for all timestamps in, say, the past 20 years).

These would look like nice random values (unlike the ones that were recently compromised), but they would be trivial to generate by anyone who knows the initial inputs (PRNG algorithm, seed, maybe starting byte position, etc.).

It shifts the problem elsewhere, though as you suggest it's sometimes still the same people having to deal with it! For example, anyone relying on celestial navigation who had until now been satisfied with up to 1 second of time error is going to need to start keeping track of UT1-UTC before it starts exceeding those old bounds. This will be possibly within a few years, whenever the next leap second would have been inserted/removed.

I've set up all NFS mounts within my home LAN over WireGuard partly for this exact reason. The impacts to bandwidth and latency are negligible, and even the increase in CPU usage remains relatively low (at least on non-ancient hardware). This reduces some of my worries about silent data corruption (at least from this potential source).

That format looks like it would allow for up to 10k per day. Unless one of those X's is a check digit?

> just have a single timezone

We already have UTC, which is almost always used as the legal basis for all local timezone definitions. In many industries (such as in many aviation and maritime operations), UTC is used almost exclusively to synchronize things worldwide and to avoid any local timezone confusion that might cause problems.

So using UTC works great in situations where participants span multiple timezones. But I think the intuition of maintaining a local clock for local things, with solar noon kept somewhere approximately around clock noon, is still useful, since many day-to-day scheduling concerns remain entirely within one's local timezone. The key is that participants must be aware of their local timezone's offset from UTC. Not having to change their clocks twice a year would hopefully also make this easier.

In this case, the analysis focuses on Canada, which does have a few population centres around the same latitude as London.

Looks like they're making progress toward getting things restarted: "Update #2: The GOES-19 Safehold has been resolved and engineers are working to prepare for restart of the onboard instruments. More information on the recovery timeline will be provided when known." [0]

[0] https://www.ospo.noaa.gov/data/messages/2026/07/MSG_20260716...

Very unfortunate timing given the ongoing wildfires and associated smoke spreading across eastern North America in recent days.

There's an agreement to do something about leap seconds before 2035, either by allowing DUT1 to exceed its currently specified bounds (this is most likely) or by agreeing to simply not insert/delete leap seconds going forward (this is less likely). For certain bounds on DUT1 and at some timescale, these would be practically the same in terms of their effects on civilization, computing, etc. In any case, a decision will almost certainly be made much sooner than 2035, perhaps even before the next leap second insertion/deletion would need to take place under the present rules.

Fortunately, in the past couple months, the likelihood of actually needing a negative leap second in the next few years has been trending down. This is based on measurements and predictions done by the IERS, the data for which they publish weekly in their Bulletin A [0]. I've been tracking this data for a while, and their DUT1 predictions have been trending more negative over the past few months, suggesting that the anticipated negative leap second is likely to be delayed, or it may very well not happen at all.

[0] https://datacenter.iers.org/data/latestVersion/bulletinA.txt

I have a machine that's on a Debian installation that I've been steadily upgrading, one Debian stable release at a time, since I originally installed it about a decade ago now. At one point I even copied the entire installation to another disk (just a "dd" from its original SATA SSD to a new NVMe one, plus some partition and filesystem resizing), and I've upgraded the CPU/motherboard/RAM at another time, and it just keeps going reliably. It's fun knowing that the origin of that Debian installation predates every hardware component it's presently running on (with the exception of only the case and power supply).

They bought P.A. Semi, but it was for their design capability; they never had fabs anyway, and Apple still depends on TSMC and others for manufacturing chips. Apple building fabs to ensure a guaranteed supply of memory (or logic) chips would be an unprecedented level of vertical integration, even for them.

I made something similar a long time ago partly as a challenge to see what could be done with just 2 KB RAM [0]. It was possible to implement some very basic context switching between two "processes", pipes (okay, I only had a single pipe, and it only worked between certain commands), and some other things like a few built-in games (pong, snake, and a breakout-style game, naturally). I didn't go as far as adding any filesystem functionality though, and ultimately yours does feel more Unix-like overall, but it was a fun little project where you learned to always consider every single byte as precious.

[0] https://github.com/ls4096/avrsysh

~450 square feet, with how many feet in the third dimension? You probably had an order of magnitude more volume than 330 cubic feet there.

This is really fun!

A possible bug though: I managed to finish Inverness to Gibraltar, and the top three spots on the leaderboard somehow had negative time durations!

My intuition would be that constant usage (not exceeding maximum rated capacity/thermals/etc.) should generally result in less wear compared to the more frequent thermal cycling that you might expect from intermittent use, but maybe there's something else going on here too. I suppose this would depend on what exactly the cause of the failure is.

Either way, these are obviously being intentionally sold to be used for non-gaming-type workloads, so it wouldn't be a good argument to state that they're just being (ab)used beyond what they were inteded for...unless somehow they really are being pushed beyond design limits, but given the cost of these things I can't imagine anyone doing this willingly with a whole fleet of them.

But if everyone follows this advice, then everything just gets overwhelmed by "hustlers" (and their "shameless spam"), and collectively we're now all worse off because of it. It just turns into yet another tragedy of the commons situation.

I say this as someone who received a lot of great feedback and had some interesting interactions after posting about a project of mine using "Show HN" a few years ago. I didn't need to spam anything to get the attention, but I admit maybe I just got very lucky, or maybe there were just fewer posts to "compete" with at the time (this was before the recent write-everything-with-AI-and-launch-it-out-there craze).

Finally, I'm not making any moral judgments here, and if someone feels they need to do this to get the attention they want, then who am I to tell you otherwise? But we should be aware of what we give up when we tend to behave this way, even if it's the inevitable outcome we get stuck with.

The total size isn't what matters in this case but rather the total number of files/directories that need to be traversed (and their file sizes summed).

> I've seen claims of providers putting IPv6 behind NAT, so don't think full IPv6 acceptance will solve this problem.

I get annoyed even when what's offered is a single /64 prefix (rather than something like a /56 or even /60), but putting IPv6 behind NAT is just ridiculous.

If that's really the case, I wish they would just come out and say it and spare the rest of us the burden of trying to debate such a decision on its technical merits. (Of course, I am aware that they owe me nothing here.)

Assuming this theory is true then, what other GPLv3-licensed "core" software in the distro could be next on their list?

Maybe the thought is that there will be more pressure now on getting all the tests to pass given the larger install base? It isn't a great way to push out software, but it's certainly a way to provide motivation. I'm personally more interested in whether the ultimate decision will be to leave these as the default coreutils implementation in the next Ubuntu LTS release version (26.04) or if they will switch back (and for what reason).

I can certainly understand it for something like sudo or for other tools where the attack surface is larger and certain security-critical interactions are happening, but in this case it really seems like a questionable tradeoff, where the benefits in this specific case are abstract (theoretically no more possibility of any memory-safety bugs) but the costs are very concrete (incompatibility issues; and possibly other, new, non-memory-safety bugs being introduced with new code).

EDIT: Just to be clear, I'm otherwise perfectly happy that these experiments are being done, and we should all be better off for it and learn something as a result. Obviously somebody has assessed that this tradeoff has at least a decent probability of being a net positive here in some timeframe, and if others are unhappy about it then I suppose they're welcome to install another implementation of coreutils, or use a different distro, or write their own, or whatever.

I'm not going to speculate about what might be ahead in regards to Oracle's forecasting of data center demand, but regarding the idea of efficiency gains leading to lower demand, don't you think something like Jevons paradox might apply here?

The industry definitely seems to be going in this hybrid PQC-classical direction for the most part. At least until we know there's a real quantum computer somewhere that renders the likes of RSA, ECC, and DH no longer useful, it seems this conservative approach of using two different types of locks in parallel might be the safest bet for now.

However, what's notable is that the published CNSA 2.0 algorithms in this context are exclusively of the post-quantum variety, and even though there is no explicit disallowing of the use of hybrid constructions, NSA publicly deems them as unnecessary (from their FAQ [0]):

> NSA has confidence in CNSA 2.0 algorithms and will not require NSS developers to use hybrid certified products for security purposes.

[0] https://www.nsa.gov/Press-Room/News-Highlights/Article/Artic...

> until there is actually a quantum computer that can break it

There isn't one yet (at least that the general public knows about), but that doesn't mean we don't need to do anything about it right now. See this problem, for example, which would potentially affect today's encrypted data if it were harvested and saved to storage for the long term: https://en.wikipedia.org/wiki/Harvest_now,_decrypt_later

There's also a lunar occultation of Mars (which is near opposition itself, making it relatively bright) happening in a few days, and then again in February, which should be visible from parts of the northern hemisphere: https://in-the-sky.org/news.php?id=20250114_16_100

> If you do consider paying for either Wubuntu or LinuxFX, it's worth keeping in mind that in the past, the developer's activation system and registration database have both been investigated and found to be horribly insecure. However, from the database, it looks like some 20,000 people did pay.

Even if one wanted to use it for anything serious without paying or otherwise providing any personal information in the process, this is a huge turnoff.

It looks like there's also a "fix" for that nested virtualization bug causing host reboots on Ryzen 7000/8000 CPUs [0]. It's nice to see that the cause appears to be known and that it's being addressed (even if the kernel here is technically not at fault).

Apparently this problem is caused by a CPU erratum with some (many?) BIOSes still reporting the broken functionality (VMLOAD/VMSAVE) as being available with these CPUs, at least according to some discussion about it on the LKML [1].

[0] https://www.phoronix.com/news/Linux-Clear-VMLOAD-VMSAVE-Zen4

[1] https://lkml.org/lkml/2024/11/5/1006