Remote profile

apparently it's a -thing- for a rich asshole to go find a university and hire an entire graduating class, paying basically peanuts.

RE: https://infosec.exchange/@munin/117475529156732569

I have now learned about the specific hiring practices of the company in question and am now absolutely sure that this statement is correct.

Microsoft, innovative tech leader that they is, has taken a cue from early 2010s hotel room media rental paradigms and has decided to make playing your games a per-minute charge.

You know. On top of "buying" .....I guess the option -to- play it?

https://arstechnica.com/gaming/2026/10/xbox-wants-you-to-pay-24-to-40-cents-per-hour-to-stream-games-you-already-bought/

RE: https://mastodon.social/@mcc/117481463040319587

the nonconsensual a/b testing norms of megacorps have real usability consequences for people.

RE: https://infosec.exchange/@munin/117481460676947894

hey babe are you an Apache Traffic Server vulnerability 'cuz you're a perfect 10

ooh and here's Apache Traffic Server with a hat trick

https://www.cve.org/CVERecord?id=CVE-2026-111815
https://www.cve.org/CVERecord?id=CVE-2026-111814
https://www.cve.org/CVERecord?id=CVE-2026-111812

RE: https://climatejustice.social/@ketan/117480486889964027

yes, this is the purpose of LLMs.

see @rain 's thread starting at https://hachyderm.io/@rain/117446083340236126 for specific attributions of this happening recently, via anthropic.

3 billion devices run Java, and that's a threat.

https://www.cve.org/CVERecord?id=CVE-2026-91403

I am gratified that someone I respect had a conversation with me earlier about coming to a significant appreciation of my insistence on defense in depth.

the so-called 'dark ages' weren't a period when nothing happened, but instead a period from which few writings survived due to the lack of preservation, destruction, or simple lack of literacy to record what did happen.

oh I think I have a migraine now.

that's unfortunate.

like, what is this

the way in which browsers have decided they're their own thing and don't have to cooperate with the rest of the system for services has some systemic effects.

https://emudhra.we-have-a-problem.com/#macos-curl

I fucking hate corporate communications, especially when they deflect any responsibility for their fuckup and insist that nothing happened and that the real offender is the person who found out that they fucked up.

https://emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca

RE: https://live.acarsdrama.com/@acarsdrama/117480815873794949

hey it's been thirty years so there's really no fucking excuse for people smoking or vaping on aircraft, what the fuck.

the lack of a simple, easily deployed services stack here means that anyone trying to implement this has to fight with half a dozen different tools (lol LDAP and its friends) and maintain, effectively, an ops department to manage it - something that's not very feasable for small orgs.

so yeah I really think that we need some tooling to allow for streamlined NIST 800-207 section 4.4 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf - "Zero Trust with collaboration across enterprise boundaries" - access limitations with semi-automated self-service provisioning of access credentials.

if we're going to be seeing the aipocalypse and finding every service continually getting pwned over and over again, then building tooling to mitigate the blast radius of any particular service being pwned by an attacker is only sensible.

oh hey another cvss 10

https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html

anyway, I think that "intro to programming" courses should go back to BASIC specifically so that people can learn why the unbounded fuck we don't do that shit.

the phpocalypse isn't really hitting me all that hard tbh.

I suppose it's in part because I've accepted, long ago, that Everything Is Always Broken; part of it's that I've long since moved away from php blog sites and when I bother publishing anything it's a static page; part of it's that I'm just fucking tired; and part of it's that .....

idk how to put this even slightly diplomatically

the number of times I've been told over the years that adding new shit takes priority over making sure existing shit works correctly, exacerbated by the past couple years of llm fuckery endorsing that tendency, means that I actively want the software industry to die.

remember that summer when we had shellshock, rowhammer, and all their friends show up? and the entire cloud industry had to take a 30% perf haircut in order to do mitigations?

turning on a little mood music this morning

https://www.youtube.com/watch?v=G8hKxUxYDkQ

just -say- that an llm did it.

tho personally I'd crack a handful of hosts and use those to propagate a patchbot.

you know, the old discourse about whether it's ethical to break in to shit and patch it is suddenly potentially interesting if you make an "ai" do it to liability-wash yourself.

I can't believe I have to fucking say this but:

DO NOT FUCKING VIBECODE YOUR OWN CRYPTO

look at me, the 1337-ass h4xx0r,
of experienced years I've a score:
I've factored your keys
and can do as I please
as the values are one, two, and FOUR

Four is the number of tequilas that everyone in ops gets tonight.

Welcome to the biannual "someone is tampering with the voting machines" panic.

https://www.actionnews5.com/2026/10/17/voting-machine-issues-reported-madison-county/

(I assume @mattblaze is already on the case)