Jan Schaumann

Vell, I'm just zis guy, you know?

Website / Blog: https://www.netmeister.org

Public Key

npub1z6e60xgyfcjq42deezd8695tp5ne08dkxqs7acg40ntmcrr23arsjwehl4

NIP-05 Address

Profile Code

nprofile1qqspdva8nyzyufq24xuu3xnaz69s6fuhnkmrqg0wuy2he4aup34g73cprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyxhwumn8ghj7mn0wvhxcmmvk5q8s7

Publishing to

relay.momostr.pink

nos.lol

nostr.mom

Author Public Key

npub1z6e60xgyfcjq42deezd8695tp5ne08dkxqs7acg40ntmcrr23arsjwehl4

Show more details

Last Notes

2026-10-27 15:32:57 UTC

Oh FFS. If you just patched /etc/ssl/cert.pem on all your macOS endpoints, rejoice: the just landed Apple OS update to 26.7.2 / 27.2 will revert that for you and put the emSign and AAA roots back.
:facepalm: #emudhra

2026-10-22 14:58:22 UTC

It's only Thursday, so this week stll has a few punches to pack.
Apparently Trend Micro accidentally dropped 0-days into the public kernel list, including RCEs and LPEs, so yeah, cybersecurity awareness month is really nailing it this year.
https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities

2026-10-20 16:16:52 UTC

Certificate trust bundles contain several hundred trusted certs that all can sign any cert for any name they want.
Your system contains at least four different of these bundles used by different libraries and languages, while other frameworks hardcode their own.
Outside of the browsers, absolutely nobody checks CRLs, OCSP (stapled or not), or CT logs.
Selectively distrusting intermediates (as Go did) doesn't scale and is not practical for most deployments.
So yeah, happy Tuesday.
#emudhra

2026-10-17 21:19:03 UTC

This is the first year that a lot of students rely on errno being set instead of a library function's return value:
errno = 0;
func()
if (errno) {
error handling here
}
instead of
if ((n = func()) < 0) {
error handling here
}
What's up with that? Is AI somehow defaulting to errno checking instead of return values? Where is this trend coming from?

2026-10-14 14:35:13 UTC

When I read that Anthropic source repository post with the "every bottleneck we remove immediately leads to a further increase in the amount of code we produce" quote, I just think back to Ken Thompson's famous quote:
"One of my most productive days was throwing away 1,000 lines of code."
"More code" is not a metric of success.

2026-09-19 15:57:23 UTC

"How To Write With An LLM"
https://sockpuppet.org/blog/2026/09/17/how-to-write-with-an-llm/
A problem I see is that of course this way of writing is still work and takes time, care, and attention -- exactly what most people using an LLM here are seeking to avoid.
Those who _do_ put in this effort could likely do the same editing job without the LLM. You need to already be a strong writer to be able to follow his two rules.
As elsewhere, LLMs make it hard for you to get better at something you're not already good at.

2026-09-19 01:18:43 UTC

Quick reminder: Models Don't Go Rogue
https://mail.cyberneticforests.com/models-dont-go-rogue/
(Now AI companies and their cultists on the other hand...)

2026-09-18 00:42:56 UTC

I wasn't even going to post it here, because it's just a rant that felt good to jot down, but since it's now been on the hackernews front page and shared elsewhere, it looks like it touched a nerve:
(Read the comments at your own risk. There's brain worms there, too.)
https://www.netmeister.org/blog/everybodys-lost-their-minds.html

2026-09-17 21:01:55 UTC

Tee hee, HN stumbled upon my AI rant blog post and boy is that a different discussion from Lobsters. ✌️
https://media.mstdn.social/media_attachments/files/117/288/391/947/554/456/original/e34d80ad777b8f47.mp4

2026-09-12 15:21:25 UTC

Dear journalists: it's not "AI escaped", it's "AI companies failed to restrict the programs". Programs that did exactly what they were instructed to do. By those companies.
Place the blame where it belongs.

2026-09-10 15:45:26 UTC

- reply

Advanced Programming in the #UNIX Environment
The objective of this class is to learn and understand the interfaces, libraries and concepts we cover as well as to actually write code. This requires struggling with code, to work your way through your problems rather than copy together AI generated snippets and pasting errors into a prompt.
Below are my updated slides on the use of AI in this class, and this is our policy:
https://stevens.netmeister.org/631/use-of-ai.html
https://media.mstdn.social/media_attachments/files/117/247/495/619/473/519/original/265bb99445821ed4.png
https://media.mstdn.social/media_attachments/files/117/247/498/315/307/719/original/e442fcf6cb036715.png
https://media.mstdn.social/media_attachments/files/117/247/500/145/645/885/original/7b57023007a7ea39.png
https://media.mstdn.social/media_attachments/files/117/247/503/073/337/532/original/c530162cb246b9ac.png

2026-09-08 22:39:06 UTC

- reply

Advanced Programming in the #UNIX Environment
Week 01, Segment 01: Introduction
In this video lecture, we provide an introduction, discuss the purpose of the class, the syllabus, student expectations, as well as available resources.
Note: The videos in this series were mostly created in 2020. A few things have changed since then. Specifically, consult the course website for updates regarding the assignments.
https://youtu.be/BsB9Cg6yJc4

2026-09-08 13:11:10 UTC

Feels like a Monday when you open the inbox and see "Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more".
https://www.openwall.com/lists/oss-security/2026/09/08/1
Various exploits/PoCs here:
https://github.com/NebuSec/CyberMeowfia/tree/main/security-research
While I don't know how widespread the use of RDS is, it's the "and 20 more" that kills me. Pretty much assuming shell access == root access at this point.

2026-09-02 19:44:37 UTC

Hey kids! It's the start of the Fall semester, and I'm again teaching "Advanced Programming in the UNIX Environment".
The syllabus and all course materials including all code examples are available here:
https://stevens.netmeister.org/631/
As usual, we'll be using #NetBSD as our main platform. All video lectures are public and available for free on YouTube:
https://www.youtube.com/playlist?list=PL0qfF8MrJ-jxMfirAdxDs9zIiBg2Wug0z
I'll be posting individual lecture videos and related links in this thread throughout the semester.
#programming #unix #apue

2026-08-14 20:16:33 UTC

Incident: actively exploited CVE
Service team: Not to worry. The EoL'd version we run is *much* older than that, so we're not affected. 🤡
Infosec: 🤦‍♂️
(This happens far too often.)

2026-08-10 15:43:18 UTC

You're right - AI _is_ useful. Your use of it provides an important signal to me:
1) For writing: "I didn't care to put the effort in to write this myself."
2) For coding: "I don't care if I understand the solution."
3) For vuln impact analysis: "I don't understand the code base nor the attack vector."
Or shorter: "I do not care about the details."
This, of course, on top of the other ethical problems with AI. It's a strong signal, and I see it everywhere.

2026-08-09 19:04:55 UTC

‘“The world looks different now than when we co-founded the climate pledge,” said Margaret Callahan, an Amazon spokeswoman.’
Yeah, no kidding. IT’S ON FUCKING FIRE because of soulless sacks of shit and the corporate bullshitters like you.
Climate pledge my ass.
https://www.nytimes.com/2026/08/08/climate/amazon-data-center-texas-pollution.html

2026-08-08 13:46:33 UTC

Couldn't find the first occurrence to repost, but yes, AI companies trying to one-up each other by touting their incompetence to airgap their systems and chest-thumping their wantonly committing cybercrimes with no consequences is a vibe.
https://media.mstdn.social/media_attachments/files/117/060/188/649/366/331/original/cdc34e89162c7dd4.png

2026-07-21 01:21:33 UTC

RE: https://mastodon.social/@nixCraft/116953574480188144
Lol, nice. I've said it before: linux kernel CVEs are no longer meaningful. You can't assess 432 new CVEs. You basically have to sit and wait to see which ones get a logo and a website or which ones become KEVs to prioritize.
#note1pjg…u8k5

2026-07-18 13:57:50 UTC

Brooks's Law of Software Engineering:
Adding manpower to a late software project makes it later.
Jan's Corollary:
Adding AI to any software project prevents its completion.

2026-07-13 20:17:03 UTC

Really looking forward to the first large-scale OpenAI / Anthropic API outage, where 85% of the industry will be flopping around trying to remember how to hello-world on their own while execs google "how to write an email".

2026-06-28 20:01:01 UTC

I keep seeing this purported screenshot of that Yahoo job posting for a “Claude Code Expert” make the rounds, and I’m sorry to disappoint you, but unless anybody can produce the actual (archived) link, I’m gonna assume it’s fake rage bait.
Very successful rage bait, sure, but y’all should know better than to fall for it.

2026-06-24 11:58:36 UTC

Slides from my #Troopers26 talk "Get in Loser, We're Upgrading the Internet -- Lessons from Deploying Post-Quantum Cryptography across Akamai's global Content Delivery Network"
https://www.netmeister.org/misc/troopers26.pdf

2026-06-15 21:39:37 UTC

Watching Anthropic try to add "guardrails" to models to basically do "sploits for the good guys, but not for bad guys" seems like somewhere somebody needs to learn the lessons from the first round of the cryptowars.
You can't add or restrict capabilities in software based on who runs it.

2026-06-15 13:47:36 UTC

I miss Web 1.0. You click a link, you get to the website, you read the content. What a concept.

2026-06-14 12:43:57 UTC

June 12th: “Your Frontier Provider Is Quietly Limiting Your Capability & Research” https://starseer.ai/blog/your-frontier-provider-is-quietly-limiting-your-capability-research
June 13th: “Irony: The US Government Issues an Export Control Directive for Fable 5 and Mythos 5” https://berryvilleiml.com/2026/06/13/irony-the-us-government-issues-an-export-control-directive-for-fable-5-and-mythos-5/
Turns out, it’s not such a great idea for the entire industry to joyfully jump into a deep dependency on pre-IPO hype machines.

2026-06-09 16:53:30 UTC

New OpenSSL advisory:
https://openssl-library.org/news/secadv/20260609.txt
1 high, 5 medium, 12 low severity
The high (CVE-2026-45447) was explicitly noted as discovered with help from Claude.
What's more interesting is again the confirmation that vulnerabilities are increasingly identified independently by multiple people:
CVE-2026-34182 (independently found by 4 different people), CVE-2026-35188 (2), CVE-2026-9076 (2), CVE-2026-34181 (2), CVE-2026-42766 (4).

2026-06-09 13:02:43 UTC

So people are totally now using AI models for regular stuff that you can do via shell scripts and cron, because why do something for free when you can burn tokens and at the same time actively forget how to use the normal tools at your disposal?
🤦 🙏 🤦

2026-05-29 18:03:00 UTC

A spreadsheet is not a database.
Thanks for coming to my TED talk.

2026-05-21 14:25:21 UTC

Saw this fly by somewhere and I lol'd:
CVE = Curriculum Vitae Enhancer

2026-05-21 02:44:54 UTC

Now what the fresh fuck is this, then?
Not today, Satan.
https://media.mstdn.social/media_attachments/files/116/610/266/172/810/693/original/d079b19672b93cdf.png

2026-05-19 23:59:46 UTC

Remember to update your libc for the new AI errno(2) values that just dropped:
https://www.netmeister.org/blog/ai-errno.html
https://media.mstdn.social/media_attachments/files/116/603/953/211/638/410/original/2fc8f146cd86ed56.png

2026-05-15 18:14:31 UTC

Ok, so this "v12 security team" is just dropping 0-days for kicks, huh?
"QEMUtiny", qemu escape via CXL:
https://github.com/v12-security/pocs/tree/main/qemu
(I'm tired, boss.)

2026-05-08 18:45:08 UTC

#DirtyFrag status/advisories:
AlmaLinux:
https://almalinux.org/blog/2026-05-07-dirty-frag/
Debian:
https://security-tracker.debian.org/tracker/CVE-2026-43500
https://security-tracker.debian.org/tracker/CVE-2026-43284
Gentoo:
https://bugs.gentoo.org/974307
RedHat:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-43284
https://access.redhat.com/security/cve/cve-2026-43284
nothing yet on CVE-2026-43500
Rocky:
https://kb.ciq.com/article/rocky-linux/rl-dirty-frag-mitigation
SUSE / OpenSUSE:
https://www.suse.com/security/cve/CVE-2026-43500.html
https://www.suse.com/security/cve/CVE-2026-43284.html
https://www.suse.com/c/addressing-copy-fail2-aka-dirtyfrag-in-suse-virtualization/
Ubuntu:
https://ubuntu.com/security/CVE-2026-43284
https://ubuntu.com/security/CVE-2026-43500
https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available
AWS:
https://aws.amazon.com/security/security-bulletins/rss/2026-027-aws/
https://explore.alas.aws.amazon.com/CVE-2026-43284.html

2026-05-07 20:07:16 UTC

Oh FFS.
#DirtyFrag
https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md
"Because the embargo has now been broken, no patches or CVEs exist for these vulnerabilities."
https://www.openwall.com/lists/oss-security/2026/05/07/8
Well, just put that CopyFail incident work on rinse and repeat, I suppose...

2026-05-04 20:48:31 UTC

Hah, just occurred to me that there's probably a number of folks who don't quite realize that the #copyfail PoC _actually modified_ the su(1) binary. That is, if you ran it _once_ to check, and then you applied mitigations, you still have a compromised /bin/su*.
Wonder how many systems end up left with that... 🤪
*Edit: Yes, until reboot.

2026-05-04 16:59:20 UTC

- reply

Should have called this thread “The Claude Delusion”, huh?

2026-04-13 14:38:58 UTC

*slow clap* to everybody out there doing Anthropic's Marketing Team's job for them. 🍿

2026-04-11 16:12:42 UTC

"#Mythos discovers 27-year-old bug" is intentionally conflating length of existence of a bug with difficulty of finding it. There is no such correlation.
If software projects and companies performed regular, ongoing, in-depth code audits over and over and missed it, sure, then age would be meaningful, but that is simply not what organizations do.
But sure, it makes for great headlines.

2026-03-18 17:19:48 UTC

Starting to think the real risk is not AI replacing junior staff, but senior staff quitting because they just can’t take this AI bullshit any longer and just opt for early retirement.

2026-03-04 23:40:05 UTC

What idiot called it “agentic AI” when “Claude Computing” is right there?
(Bonus joke: There is no Claude, only other peoples’ content.)

2026-02-27 15:27:59 UTC

"Never have, never will." Promise, shmomise.
This is some bullshit, Mozilla.
https://github.com/mozilla/bedrock/commit/d459addab846d8144b61939b7f4310eb80c5470e#diff-a24e74e4595fa85440a2f4e7e5dcfe68aba6e1e593aef05a2d35581a91423847
And the explanation is bullshit, too, and sounds rather annoyed at having to explain to us silly users that *of course* you have to "share some data with our partners".
https://blog.mozilla.org/en/firefox/update-on-terms-of-use/
https://media.mstdn.social/media_attachments/files/116/143/284/786/316/090/original/5919273be9cfaca9.png

2026-02-25 02:28:40 UTC

Tonight seems like a good time to remind folks that the next #nokings protest is planned for March 28th:
https://www.nokings.org/
Mark your calendars, I'll see you there! ✌️
#sotu #fucktrump

2026-02-22 22:12:13 UTC

I still don't understand where people think Senior Engineers come from if they replace Junior Engineers with AI.
How do they think the next iteration of GIGO regurgitated code will be validated and debugged if nobody understands how the black box works?
Not wanting to understand but just wanting the quick answer is a clear trend and implicit outcome of frequent AI use.
To me, that's the real supply chain risk.

2026-02-03 16:33:45 UTC

If you'd like to have a nice 🤦-y day like me, go ahead, search your internal code repository for the following:
curl -k
wget --no-check-certificate
verify=false
InsecureSkipVerify: true
ssl_verify_mode: 0
TrustSelfSignedStrategy
rejectUnauthorized: false
strict-ssl = false
http.sslVerify = false
--no-verify-ssl
--insecure*
verify_hostname: 0
It'll be great.

2026-02-01 17:41:37 UTC

Billionaires, man. Greedy motherfuckers.
Brin is worth $266B. A one-time 5% billionaire tax (with the money going to healthcare!) would mean he's left with... $242B. Which that year's rate of growth would trivially earn him back. But he just can't.
You can do a 99% one-time billionaire tax and he'd be left with *2.6 billion dollars.
https://www.nytimes.com/2026/01/28/us/politics/california-billionaires-sergey-brin-campaign.html
CA has maybe 200 billionaires in a population of ~40 million. Talk about the richest 0.0005%. Greedy motherfuckers.

2026-01-29 12:51:21 UTC

NoFX pops out of retirement to say #fuckICE 🤘:
https://www.youtube.com/watch?v=sU6s6VEJxrU

2026-01-29 01:54:22 UTC

And this is why he's The Boss.
"Here in our home they killed and roamed
In the winter of ’26
We’ll take our stand for this land
And the stranger in our midst
We’ll remember the names of those who died
On the streets of Minneapolis"
https://www.youtube.com/watch?v=wWKSoxG1K7w

2026-01-27 18:27:05 UTC

OpenSSL Security Advisory
https://openssl-library.org/news/secadv/20260127.txt
One high, one medium, and 9 low severity issues.
The high severity is a stack buffer overflow in CMS AuthEnvelopedData parsing (CVE-2025-15467): attacker provides an oversized IV, leading to buffer overflow prior to authentication, possibly leading to remote code execution if you're parsing untrusted CMS or PKCS#7 content with AEAD (e.g., AES-GCM).

2026-01-23 17:27:47 UTC

Here #curl is again showing the way in Open Source, this time with vulnerability management. Per their well-known/security.txt:
https://media.mstdn.social/media_attachments/files/115/945/581/457/119/897/original/7a353e1277dcc360.png

2026-01-23 16:22:40 UTC

With TikTok now going to be owned by Larry Ellison and Emerati MGX/G42, the concerns about it being used as a government propaganda machine really are totally put to rest. Phew!
(My hope remains that this move will ruin the product and the kids will move on.)

2026-01-11 19:07:23 UTC

Everybody walking past Trump Tower be like…
#fuckICE #iceoutforgood #fucktrump
https://media.mstdn.social/media_attachments/files/115/878/031/379/071/743/original/71247ab8feb95f77.jpeg

2026-01-06 16:23:34 UTC

Quotable as ever, here's @npub1fdr…lvhs on code as liability and that having AI produce more code faster is simply tech debt at scale:
https://pluralistic.net/2026/01/06/1000x-liability/#graceful-failure-modes
"The longer a computer system has been running, the more tech debt it represents. The more important the system is, the harder it is to bring down and completely redo."
"Writing code that works, without consideration of how it will fail, is a recipe for catastrophe. It is a way to create tech debt at scale."

2026-01-05 16:39:57 UTC

Completely different topic, so ripping this quote out of the context from the article I just boosted:
"I wonder how much Venezuelan sensitive information was in fact stored on Google/Microsoft services and accessed by the US military to prepare their recent strike."
This is indeed a pretty interesting question to ponder. And if you're, say, Greenland, maybe consider your use of US cloud services...

2025-12-24 17:27:08 UTC

- reply

He was covered in cables, from head to his foot,
patched 'em in switchports, he doubled throughput!
He opened his laptop, his terminal: no hype.
No Electron, no XCode, only in 'vi' did he type.
His code -- so readable! His Makefiles how clean!
His scripts were well structured, his includes pristine!
His CFLAGS? Warn 'all', warn 'extra', be extra pedantic
Turn warnings to errors, it's almost romantic!

2025-12-24 17:26:05 UTC

- reply

The zombie processes with their parent now killed
were reaped by init(8), as Ken Thompson willed;
So out of the process table they flew,
freeing up cycles and memory space, too.
And then, in a twinkling, the tcpdumps showed,
with buffer caches flushed, connections now flowed!
As I mirrored the ports and tailed the log file,
I heard St. Root run down the hot aisle.

2025-12-24 17:24:58 UTC

- reply

With a little old hacker, so focused, resolute,
I knew in a moment it must be St. Root.
More rapidly typed spells I've never seen
And he whistled, and shouted, and cursed at the screen:
"Ugh, DOCKER! Now, TRACEROUTE! Now, KTRACE and TRUSS!
On, PYTHON! On PERL! No RUBY or RUST!
Process loops fork! I'll have to killall(1)!
Now bash - away! bash away! Warn users with wall(1)!"

2025-12-24 17:23:36 UTC

- reply

When out of the machine room there arose such a clatter,
I sprang from my bean bag to see what was the matter.
Away to the laptop I flew like a flash,
logged into the jumpbox, starting my bash,
The lights on the servers blinking all red
Gave the lustre of multiple threads all locked dead
When, what to my wondering eyes should appear,
But a banged up crash cart, with eight cans of beer

2025-12-24 17:22:19 UTC

'Twas the night of the moratorium, and all through the cloud
not a pager was beeping: no deploys were allowed.
The packages frozen on the servers with care,
In hopes that an outage would strike nowhere;
The developers still pondering code to embed,
While visions of monads danced in their heads.
The VM put to sleep, and I in this app,
Had just settled down for a long masto thread,

2025-12-11 21:29:25 UTC

- reply

If you just updated React / NextJS for #react2shell , you now get to update again. Two additional vulnerabilities identified in follow-up work were just published: CVE-2025-55183 (DoS), CVE-2025-55184 (Source Code Exposure)
https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
https://nextjs.org/blog/security-update-2025-12-11

2025-12-05 21:47:36 UTC

Here's another funny generational divide: students no longer understand public_html directories and /~user/ URLs because apparently nowadays shared fileserver access is no longer a thing.
Smh, fist, yells at cloud.

2025-02-26 22:35:25 UTC

Wait, what? By using #Firefox, I now grant Mozilla "a nonexclusive, royalty-free, worldwide license to use" any data I "upload or input"? That seems, uhm, rather broad. Wtf.
I want my old Mozilla back.
https://www.mozilla.org/en-US/about/legal/terms/firefox/
https://media.mstdn.social/media_attachments/files/114/072/563/541/661/872/original/093a810db2f2857a.png