Mathieu Kerjouan

Posted on Aug 16

WeeklyReview#202633

#weekly #review #link #followup

Few years ago, I was collecting all the interesting links, publications, books, articles or videos found each weeks. Those posts were never published... And it's a shame. Let fix that by creating my Weekly Review on dev.to. Here the first issue!

The last 4 or 3 weeks were kinda exhausting to me due to the French weather but also because of travelling (not really vacation). This is the reason why the amount of posts decreased. In fact, the motivation is still not there, but it gave me a moment to breath and took a moment to see "new things".

Tcl/Tk seems to be a great language. Being part of all my systems for many years, it never attracted me for some reasons. After watching a talk on SQLite talking about it, especially on the fact it was created to be a "LISP-like language with C syntax". It triggers my curiosity and started to read the documentation. A comparison between LISP and Tcl is available on their wiki. Many great features are present in Tcl:

VFS (virtual file system) support gives the possibility to mount file systems or file directly from the language itself. It can be used with ZIP files for example. This feature is missing on Erlang/OTP and can offer great advantages for dynamic update or portability (especially with escript).
Tk seems easier to use than wxWidget on Erlang/OTP and more portable. It looks like no one created a tcllib or libtk interface to Erlang. This kind of feature could help to also increase portability.
A bit like Erlang, Tcl supports small isolated stackful processes (called coroutines). It also uses a share-nothing design for its thread implementation. It was a surprise to read that. Even more, Tcl is event-driven and using a message system to pass the data!

Why this language, like Erlang, is in the shadow since the 90s? Why is nobody speaking more about that?! If you want to know more about that, and can't wait to read my future publication, I invite your to check Develop Cross-Platform CLI and GUI Tools With Tcl/Tk. Powerful, Event-Driven, Open-Source And Future-Proof Toolkit… From the Past?!.

Regarding my projects, including my application, it was in stand-by as well during the past weeks. It is planned to be restarted during the next coming days, with more publication on mobile application design and private API reverse engineering. Another big part of my time was also dedicated to update and do a big cleanup of my resume, a good way to have a "quick" view of my long journey in IT.

Coding

▶️ Fil-C: Garbage In, Memory Safety Out! - Filip Pizlo | SSW 2026: a talk about Fil-c (a way to protect memory in C) with the creator of the project. Really interesting project using many unheard Clang features, can be a good alternative to "modern" programming language like Rust, Go or Zig.

🏗️ Assembly Hall of Shame: A project checking ASM instruction performance by Christopher Domas.

📝 Elixir's GenStage Demand (a Visual Explainer): an article explaining how Elixir GenStage is working with beautiful animation.

🏗️ clpz-sudoku-9x9.pl: AI Escargot solver in Prolog (eyeProlog), solving the problem in 0.88 seconds instead of 7.27 seconds. From @josderoo on X/Twitter.

📝 Master C and C++ with our new Testing Handbook chapter: a summary post regarding their Security Checklist for C/C++ Programs, containing a long list of things to verify before shipping something in C or C++, like Bugs, Linux Userland common issues, Linux Kernel-land common issues, Windows Userland issues, Windows Kernel-land and finally on sandboxing.

Database

▶️ Reliability Lessons From SQLite - Richard Hipp | SSW 2026: an awesome talk from one of the SQLite creator, about SQLite history, testing and reliability. A must watch.

📝 Modeling State Transitions in Postgres: nice article about state transition in PostgreSQL. Few years ago, one of my project needed something similar (it's ended by implementing a FSM-like system in postgres).

📝 plx : Write PostgreSQL functions in the language you already know.: an interesting way to interact with PostgreSQL database by creating SQL function using another language; the plx project source code can be found on Github.

System

📝 Apple Container Internal: a publication about an Apple container feature I was unaware of, using a QEMU-KVM-like interface. A lot of code samples and details about this feature.

📝 Tachyum Open Sources its Prodigy ISA and Platform to Make AI Available to Everybody in the World: Tachyum announced officialy they will release their Prodigy platform in full open-source (CC BY 4.0). They already have a Github profile containing many open-source projects, including their SIMD IEEE-754 fused multiply-add unit and Tachyum TDIMM Design Specification (available as PDF). The idea behind Tachyium Prodigy is to integrate in one processor, General Purpose Computing, Artificial Intelligence, Physical AI and many other features. Based on their website: "Prodigy has up to 21x higher performance and up to 10x better performance per watt than its competition". Curious to see if it's true.

🏗️ BORE (Burst-Oriented Response Enhancer) CPU Scheduler: A Linux scheduler designed to deal with high load without disturbing user input. The news come from Slackware-Based Zenwalk Linux Aims For "True Low Latency Desktop Experience".

🎥 Lefinnois on Twitch Live: Denis Bodor aka lefinnois started to do some live streaming session on FreeBSD kernel development (in French). Still great to see some BSD content in French!

Network

📝 Off-Grid Communications, Part 1: Break Free from the Grid with Meshtastic: another off-grid network project called Meshstatic. This network can be used for backup when the main network is down (can be helpful for hiking, camping and so on). It uses ESP32 boards with LoRa modules. Can be interesting to deploy locally to test it, the bandwidth is not really great (max 20 kbps) but it can be another way to communicate.

📝 isTRAIN: Detecting if a Train is Blocking a Local Crossing By Listening to Railroad Frequencies: a quick review of an open-source application used to detect when a train is blocked (decoding data from 457.9375 and 452.9375 MHz). Interesting, a domain I did not really know.

📝 War Driving for DECT Devices with a HackRF and Android Device: a wardriving session review (on youtube) about DECT devices (a wireless standard using frequencies from 450 MHz up to 5,875 MHz) with the help of the DeDECTive open-source software.

📝 Mobile Network Hacking:What is a Mobile Network and How Does it Work?: quick publication on mobile network. This more like a small summary than a complete cheatsheet, mobile network is really complex, and doing a post on that seems impossible, but it's a good start for someone interested in this topic.

📝 Off-Grid Communications, Part 6: Internet-over-LoRa with deadmesh: a tutorial to use deadmesh, a text-first internet bridge for mesh network. It uses LoRa and Meshstatic to communicate.

🏛️ IEEE 802.11bb: every year I check if new improvements are made with the LiFi technology. Unfortunately, it's pretty rare to have good news. Using the light to transport locally the information seems (to me) way better than using radio signals. I hope one day we will be able to have that everywhere, with open-source compatible hardware.

Security/BlueTeam

📝 Linux Security in 2026: Hardening, Monitoring, and Defense Strategies: some good practices everybody should apply.

📝 The Detection & Response Chronicles: Covert Operations Through QEMU: I love QEMU, and it's always a pleasure to read how to use it in some context. Here, Qemu is used as tunneling system, especially to cover up long-living attacks using custom network arguments.

📝 Most Common Linux Security Mistakes I Keep Seeing (And How to Avoid Them): another publication about good practices.

📝 Artificial Intelligence in Cybersecurity, Part 14: Turning OSquery into an AI-Powered Forensics Engine: a way to use OSQuery with LLMs.

Security/RedTeam

📝 SDR (Signals Intelligence) for Hackers: Building Your Own Bluetooth and Wi-Fi Jammer: this article present a way to generate noise in 2.4Ghz communication range (and then generate DoS) with the help of the ESP32-BlueJammer tool.

📝 Pentesting: Taking Over A Corporate Mail – Mailcow: Interesting publication about a pentest review involving mails and credential recovery. Using tcpdump to watch the active connection and stole the credentials (from an active server). Classic.

📝 Compromising Telecom Systems: Deploying and Detecting the BPFDoor Backdoor: An APT review involving BPFDoor (a malware/backdoor) waiting for a magic packet to be active.

📝 Social Engineering: Attacking Networks with a BadUSB-ETH, Part 1: a covert-network attack using BadUSB-ETH and doing some DHCP poisoning.

📝 Open Source Intelligence (OSINT): Extracting Information from TikTok: a small OSINT publication about collecting data from TikTok.

🏗️ Spaghettifying DRAM (skitter-creek-bath-salts): Exploit attacking the memory controller by rewiring the DRAM and breaking the memory protection. By doing that, even protected memory region can be exposed and can expose everything in the end. This can be exploited via C code (with the help of paging, cache, threading and TLBs). See also the announcement on X/Twitter. Announced during the Black Hat 2026 by Christopher Domas.

📝 Rocket.Chat Cross-Site Scripting leading to Remote Code Execution CVE-2020-15926: an example of XSS exploitation vulnerability with remote code execution.

🌐 pwn.college: another platform to learn hacking from the basics to the expert level based on challenge (as usual). It looks great.

📝 CVE-2026-46331: Linux Kernel pedit COW LPE Exploit Explained: most of the recent Linux distribution impacted. The security is from May 2026, but the exploits are interesting to study, especially pedit-cow-exploit.

📝 Social Engineering: Building Your Own BadUSB: a small tutorial to configure/create/use BadUSB for social engineering and local attack purpose.

📝 SDR (Signals Intelligence) for Hackers: Building Your Own Fake GPS Satellite: a post about GPS spoofing, quickly describing how GPS works and how to manipulate the protocols with the GPS-SDR-SIM project.

🏗️ LEAKSFORUMS: a github project listing forum leaks.

Security/Cryptography

📝 Factoring "short-sleeve" RSA keys with polynomials: an attack on RSA keys using biased data and weak keys based on a CompleteFTP vulnerability.

📝 2026.08.14: NSA and IETF, part 9: An update: this is a very long story you can find on cryp.to's blog. It started in October 2025 with the first post called 2025.10.04: NSA and IETF: Can an attacker simply purchase standardization of weakened cryptography?. The problem described by those publications are the current structure and organization around IEFT, and the high risk of being manipulated by some agency (NSA). This is a long series of article and will probably require a summary someday:

📑 UFOs: A Very Efficient Multivariate Public Key Signature Scheme: UFOs (Unbalanced Frobenius Oil and Vinegar with Schedule): only read the abstract and the conclusion. Always interesting to read about alternative public-key signature scheme.

📑 Verbeth: Secure Messaging with Metadata Minimization over Public Blockchain Logs: transforming a blockchain (ledger/smart-contract) into private communication channels with end-to-end encryption. Need to dig a bit more about this one.

Security/Patches

🔄 rsync 3.5.0: 33 security issues patched for rsync, including 16 high level CVEs. Quite an important update to do.

🔄 Erlang/OTP 29.0.5: multiple bug fixes (epmd, ssh).

🔄 Erlang/OTP 28.5.0.5: multiple bug fixes (epmd, ssh).

🔄 Erlang/OTP 27.3.4.16: multiple bug fixes (epmd, ssh).

🔄 OpenBSD 7.9 Errata 008: fixes an heap or stack corruption in npppd.

🔄 OpenBSD 7.9 Errata 009: fixes iked remote crashes during authentication.

🔄 OpenSSH 10.5 released: many bugs and security fixes. Improvement on FIDO support during key generation and authentication.

Embedded

📝 ESP32 Thing Plus (USB-C) Hookup Guide: Quick guide to start using ESP32 board from SparkFun.

📝 f4pga: an open-source FPGA toolchain compatible with some Xilinx, Lattice and QuickLock board. Previously called Symbiflow, it was originally created to become the GCC of FPGA. The source code is available on Github.

📝 z486: A 486-Class Pipelined FPGA CPU with Integrated Floating-Point: In this post, @nand2mario is explaining how to create a 486-like CPU called z486 using FPGA and SystemVerilog. He also previously worked on z386 implementation. Those projects are great to study for someone interested to use FPGA and learn more about CPU design/architecture. All the series are absolute bangers and must be read, what I did, but it will require another reading due to the amount of knowledge shared. Here the latest posts from the series:

🏗️ schoolMIPS project: a MISP CPU core for FPGA board using Verilog. The same project exists for RISC-V called schoolRISCV.

▶️ How does a USB keyboard work?: Ben Eater channel is a great place to learn things about electronics. That's a great introduction to the USB 2.0 protocol and its complexity, by using something simple: "a keyboard". Anyway, I wanted to work with USB recently (for a small electronic project) and it seems to be a good place to start. In summary, the computer is asking for data by sending a SYNC IN packet, the keyboard answer with the data, and the computer acknowledge with an ACK packet. Each packet is made of type containing a Packet ID (PID), the data, and a checksum (CRC-16). If nothing changed on the keyboard side when the computer asks for more data, the keyboard can return a NAK packet. An USB transaction is made of (1) a SYNC packet (2) a data packet encoded on 8192bits (3) an ACK packet. A computer poll every 16ms (low-speed) and 1ms (full-speed) to see if some data are available. It seems only 6 keys can be pressed at the same time on an USB keyboard (interesting). RFWirelessWorld is offering a CRC-16/USB calculator.

▶️ How does USB device discovery work?: another video from Ben Eater channel talking about the USB discovery protocol, starting with the question "why only 6 keys strokes can be used at the same time?". When the keyboard is plugged, the computer is starting a SETUP transaction by sending a SETUP packet. I think a longer publication will be required here to explain all of that. Note: the oscilloscope (a Keysight DSOX4024A) used here is insanely cool, like its price (~$8000).

Misc

📝 The PC OS That Would Have Blown Your Mind Back In 1984: discover os8088 operating system in this article from HackaDay.

🌐 CVE Numbering Authority for the BEAM ecosystem: Good to know Erlang ecosystem got a way to announce security issues.

📑 The second law of infodynamics and its implications for the simulated universe hypothesis: an hypothesis made in 2022/2023 about a second law of infodynamics, saying the universe is being compressed or "the second law of infodynamics states that the information entropy of systems containing information states must remain constant or decrease over time, reaching a certain minimum value at equilibrium". Only for general knowledge, I don't think I will use this kind of theory in my work.

Cover Image by Nikolett Emmert on Unsplash

DEV Community