Another week of doing Erlang/Elixir code on expki project. Again, that's mostly a sandbox to remove my 2 years rust doing only Erlang code and infrastructure stuff. Things are moving though, and I have a way to deal with the public_key module from Elixir. It's not perfect yet and can be optimized, but it should do the job. I think you will read that in a post very soon.
My way to extract macros and records from Erlang source code has been moved to its own module called preprocessing. It is currently being tested, but it should work correctly. Many things remain to be added though, like the support for dynamic macros and perhaps other attributes from Erlang.
Dev.to is buggy. One big article I started to write few days ago was practically destroyed because of cache issue on the browser. When editing the file from the dashboard, an old version was displayed instead of the latest one. Don't save. Don't publish. Close the window, logout from your dev.to account and reconnect.
publish is now able to fetch all the posts from dev.to using the API and curl. I did not have a lot of time working on it this week though. It would be really nice to migrate few my articles very soon on my own domain.
mac_randomizer was a pet project I got year ago, simply an idea at first. I wanted to do a bit of C this week and started to play with that. Not a really serious project though.
Coding
📖 Course book: Open Source Introductory Systems Programming Textbook for the University of Illinois
🌐 zero-js: compiling code in HTML/CSS directly, without javascript.
📝 Optimizing a Lock-Free Ring Buffer
📝 Simplify Function Generation in Elixir with Macros: a quick reminder to generate function in Elixir with macros. A good way to do meta-programming.
📝 Elixir Anonymous functions: official documentation about anonymous/lambda functions in Elixir.
📝 Elixir Quote and unquote: official documentation about metaprogramming elixir with quote and unquote.
🏗️ pulso: A headless, open-source observability backend: unified logs, metrics, and traces access, built-in alerting, and a native Model Context Protocol (MCP) interface, built on Elixir/OTP with a Rust hot path for columnar data.
🏗️ erlang_pay: A pure-Erlang payment gateway library for Alipay (App pay), WeChat Pay v3 (JSAPI/Native) and Stripe (PaymentIntent).
📝 How Copy-on-Write Works with Memory-Mapped Files
📝 Disable debuginfo to improve Rust compile times
📝 Reverse Engineering Novalogic's Comanche Terrain Maps: not an expert in game programming, but reverse engineering is an amazing field. This article explains how to reverse the maps from an old game, it's in C, and it's a great one! I liked this quote:
Programmers in the early 90s didn't reinvent everything. They used the formats and tools the artists already had, like PCX files straight out of a paint program, and saved their cleverness for the parts that really needed it: the renderer.
📝 What TLA+ can and can't check: TLA+ fascinated me few years ago, and I started to learn it by myself. Unfortunately, I was not really good with it. Languages formal verifications/specifications can be challenging to learn, even more if you don't have any a real usage for them. It's good to read a post on this language, even more to clarify what TLA+ can do or not.
📝 Compiler Options Hardening Guide for C and C++: an extremely useful guide and reference to correctly set C compiler flags for hardened applications.
Database
🏗️ Dasha: PostgreSQL performance dashboard for analyzing database cluster health, identifying problems, and providing optimization recommendations.
System
🏗️ MiniOS: A full-featured desktop environment with a wide range of applications. Professional tools for creativity and development.
🏗️ Vinix: Vinix is an effort to write a modern, fast, and useful operating system in the V programming language.
📝 HardenedBSD August / September 2026 Status Report: mostly small modification and bug/security fixes.
📝 OpenBSD-current has moved to version 8.0: openbsd 8.0 will be ready soon.
📝 vmm(4)/vmd(8) gain support for multi-processor VMs: OpenBSD vmm/vmd can now have more than one CPU configured, that's a very good news!
📝 SmartOS: The illumos Way of Thinking About Servers: sunos, illumos and smartos... A good way to introduce them via this article.
🏗️ How To Secure A Linux Server: An evolving how-to guide for securing a Linux server that, hopefully, also teaches you a little about security and why it matters.
📝 Powerboard Tyche unveiled at Pianeta Amiga: Never got an Amiga, never installed AmigaOS, but since I learnt DragonFlyBSD kernel was a mix between FreeBSD and AmigaOS, I always wanted to test it. Another crazy thing is... the community is active! The passion for Amiga seems eternal. Crazy.
Security
📝 Auditing in the age of (good enough) AI
🏗️ apk-reverse: a skill to reverse APK.
📝 Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure: a must read to apply modern protection on CI/CD.
Organizations should mandate a minimum release-age cooldown of seven days before any newly published public package version becomes installable [...] Establishing a strict seven-day buffer provides the open-source ecosystem time to detect and pull poisoned releases before they reach internal builds. [...] All external packages and container images should, wherever possible, route through a centralized internal proxy that caches, inspects, and gates each component.
📝 The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches: the number of supply chain attacks is growing, and this is another article to remind us to always verify the security of our CI/CD.
📝 Cops Can Bypass iPhone’s Automatic Reboot to Get Into Locked Phones, Leaked Video Claims
Security/Cryptography
📑 A Survey of Pseudorandom Codes:
📑 Fully Anonymous Perfect Secret-Sharing
🏗️ Jolt: Just One Lookup Table. Jolt is a zkVM (zero-knowledge virtual machine) for RISC-V, built to be the simplest, fastest, and most extensible general-purpose of its kind. A book is available.
📑 Formally Modeling the Terrapin Attack on SSH
📑 DASH: Distributed Asynchronous Schnorr with High Throughput
📑 Lightweight Cryptography for Secure UAV Data Integrity Using Ascon-XOF128 and SHAKE128
📑 Forging 1024-bit RSA signatures in nearly SNFS time
Security/RedTeam
📝 Offensive Security: Pentesting Office Phones with SIPVicious: a post showing a quick demo of sipvicious against VoIP local server.
Embedded
🏗️ Sail architecture definition language: Sail is a language for defining the instruction-set architecture (ISA) semantics of processors: the architectural specification of the behaviour of machine instructions. Sail is an engineer-friendly language, much like earlier vendor pseudocode, but more precisely defined and with tooling to support a wide range of use-cases.
📝 You Can Make A Microprocessor That’s All Your Own
📝 Reverse Engineering the iPod Classic's Undocumented Mikey Chip
Updates/Upgrades
🔄 Hackney 4.8.4: many updates here, from the 4.8.1 to 4.8.4, fixing many bugs. If you are using a previous version, you should probably update it.
🔄 OpenBSD 7.9 Errata: a huge amount of patch (9) to fix security issues on the whole system. ldapd, nsd (8 CVEs), unbound (35 CVEs), iked and many other issues found on the kernel.
Misc
📝 How to Optimize a CUDA Matmul Kernel for cuBLAS-like Performance: a Worklog
📝 Making Deep Learning Go Brrrr From First Principles
📝 Someone ‘Torturing’ LLMs in a Robot Prison Has Triggered the Dumbest Debate in AI Yet: Yeah. Crazy right? LLMs are not conscious. Adding a "feature" to feel pain/pleasure in a program does not make it conscious, it adds just another variable in the state, or another way to interpret inputs. This can be called - at best - "LLM moding".
AIs are not conscious. They do not feel, experience, or suffer. They do not have innate preferences or underlying motivations. They are sequence completion engines, internally hollow, designed to follow instructions, and accomplish goals set by humans. Unfortunately, there’s a growing chorus of people who argue that AIs could now be, or may soon become, conscious. They argue that AIs may deserve rights and protections similar to those that we provide other conscious beings […] If this is how AI is developed, it will have a disastrous impact on the wellbeing of humanity.
Leaks of the week
📝 Alaxione: more than 8.5 millions patients impacted, data from 2010 to 2026. +5 millions phone numbers leaked, +1.4 millions e-mail, +300k social security number.
📝 KEL/Orisha: 1.3 million people impacted including +600k e-mail, +600+ phone number, +140k IBAN.
📝 PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies: Glow labs identified more than 13k screenshots from 300 organizations (including big companies). Impacted more than 900 repositories and 100k employees. It seems it was mostly skill issue there, and the "AI" were not hardened. Interesting leaks though, because if screenshots can leak, probably other data can be leak as well.
📝 FFRandonnée: 1.43 millions impacted people, more than 1 million e-mail and 663k phone numbers, with physical address location.
📝 Cookson-CLAL: complete credit card information have been leaked. No more information about the number of people impacted though.
📝 VosFactures: data leaks on one of the companies in charge of the digital invoices in France. No more information right now, but they have a database with more than 500k companies. Less than 1 month after the official launching of the digital invoices for the companies, one of the "big player" seems to have been impacted by a huge data leaks.
Cover Image by Konstantin Dyadyun on Unsplash
Top comments (0)