This week was mostly dedicated to clean up and fix my CI/CD local infrastructure. The first version of this one was undocumented and using Tor as relay to hide my private IP address. Unfortunately, most of the tor exit nodes were blocked by Google, and following the recent news regarding the 333 rogue exit nodes, forwarding this traffic through my own servers is probably a better idea. Both configuration have been configured - even if it's not yet finished but it works.
In the end, it was great to do some old-school sysadmin/netadmin tasks on OpenBSD. This system is still my favorite after all these years. Yes, it is not fast as a Linux-like distribution, it does not have all fancy hardware support from other operating system, but damn... In few hours, one is able to deploy a crazy stable and secure infrastructure.
On my Dart/Flutter application side, the database management was - and still is - a problem. sqflite and other interface to it are unpleasant to use. One of my target is to use ribs_sqlite over sqlite or sqflite, but designing it this way requires to change some of my first design.
Another thing, the front-end part was my main target because it was my weak point. By doing that, a big part of my time was dedicated to learn more about UI/UX and mobile design. A post is planned to be released - one day - on that.
Coding
🏗️ nanofil: A C compiler written in Prolog that emits x86-64 assembly in the Fil-C ABI. Its object files link with clang-built Fil-C code, and they keep Fil-C's guarantees
🌐 Learn Erlang Step-By-Step: a new initiative to learn Erlang based on a real-world project! I like the concept and how it has been done.
📝 A faster way to compute signed 64-bit floor division by constants: a way to optimize floor division when the divisor is known during compile time.
📝 Writing a Linux Debugger Part 1: Setup: a serie of article on developing its own linux debugger in C++.
System
🏗️ Beszel: a lightweight server monitoring platform that includes Docker statistics, historical data, and alert functions.
Database
🏗️ pgCluu: a Perl program used to perform a full audit of a PostgreSQL Cluster and System performance.
🌐 SafeGrd: SafeGrd backs up your databases, files and mail, encrypts and locks each copy, and restores it on a schedule to prove it works. An agent with your production keys can drop the database, but not the backups.
🏗️ pgrecon: an open-source Oracle to PostgreSQL migration assessment and schema conversion tool. It inventories an Oracle database from an offline dump and runs a deterministic rule engine over it.
🏗️ PostgreSQL Anonymizer: an extension to mask or replace personally identifiable information (PII) or commercially sensitive data from a Postgres database.
🏗️ sqlean: There are a lot of SQLite extensions out there, but they are incomplete, inconsistent and scattered across the internet. Sqlean brings them together, neatly packaged into domain modules, documented, tested, and built for Linux, Windows and macOS.
Security
🌐 Tailworm, we have zero-trust in our infrastructure: a report audit of the tailscale project, containing a lot of security issues.
🐦 Keystone: Statement Regarding the Security Incident on Our Official Website and Customer Guidance
📑 Don’t Look Up: There Are Sensitive Internal Links in the Clear on
GEO Satellites
📝 Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines
🌐 tpbreak: TP-Link firmware decryption at scale — 52,609 images. The verification public key is also the decryption key: the AES key/IV fall out of the RSA-PSS salt. No private key required.
🌐 SMS of Death: an unchecked cast on an array can cause a denial of service for a long period of time on Android. It can lead to SQLite database corruption and also impact the phone to boot. It can brick the phone. If I understand correctly, it will not be fixed... Crazy.
📝 Alpine Linux GitLab security incident: attempted exploitation of CVE-2026-97229: a gitlab upgrade where the main fix was not applied because of Ruby. It confirms me Alpine Linux team is great, instead of ignoring this attack, they are redeploying/rebuilding everything. Great project.
📝 SPECTER: Leaking Data from Air-Gapped Computers by Toggling USB Power States
📝 Thermal Noise Communication: Sending Data Without a Carrier Signal, with an RTL-SDR as the Receiver
📝 Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
📝 When intermediate CAs fail, language stacks discover they own the blast radius
📑 Bypassing Secure Boot using Fault Injection
Security/cryptography
📝 The case of the 9 bit AES key: encrypt your document yourself... PDF encryption from open-source world is just broken. The keys/seeds are not coming from cryptographic random sources, then, it is easy to break.
📝 QSYRUPWD, Part 2: Correcting the Rijndael Key Builder
📝 Lean for Cryptanalysts: A Practical Introduction to Formal Proofs: a lot of people are talking about the lean language, it is on my long list of thing to learn. When someone is writing a post about Lean and cryptanalysis, for sure it will be a banger. So, this is a great example of lean usage, and it motives me even more to learn/use it.
Security/RedTeam
🌐 Exploit for php2shell-audit: a "working" (yet non-tested on my side) exploit against php2-shell.
🌐 Exploit for CVE-2026-111497 (brotli): a "working" (yet non-tested on my side) exploit on nodejs brotli vulnerability.
📝 Bluetooth Low Energy Security Testing, Consolidated: Introducing Caeruleus: Bluetooth fascinate me since High School, at this time, I unsuccessfully tried to create an audio/video streaming application on Nokia SymbianOS in C++. It was fun, and bluetooth is a really interesting piece of technology. Having a list of tools to identify and attack this protocol is always useful, especially if you are developing Bluetooth application.
Embedded
📝 Digikey Reference Design Library
Update/Upgrade
🔄 LibreSSL 4.4.0: including eMudhra security fix.
🔄 Sel4 17.0.0: many bug and security fixes. Documentation was also improved. Few platforms have been removed (Arndale, Odroid-X, HiKey, Inforce IFC6410, exynos5). The full changelog is available on Github.
🔄 Elixir 1.20.5: Security and bugs fixes release, including 2 CVEs.
🔄 Flutter 3.47.9: bugs fixes release.
Theory
📑 Evidence for the representation of non-hierarchical structures in language
Leaks of the Week
🐦 Sony: more than 2.5 millions customers leaked, including sensitive information like mails and phone number.
📝 Solnet: Switzerland network provider impacted by a data leak impacting more than 5000 customers.
📝 Rassemblement National: more than 432000 subscribers data leaked from this French political party.
🐦 iCloudITS: Saudi IT Provider leaked more than 15GB of data from their database.
📝 Bangkok Post: more than 820000 members impacted by a data leak
📝 Grand Orient de France: 6.72GB of data leaked from one of the main French freemasonry.
🐦 French Unknown IT Company: if true, an IT company was impacted by a huge data leaks, including their private keys API for Stripe and Vercel.
Misc
📝 Anthropic announces bankruptcy by...?
📝 Who’s Aligned to Whom? How AI Agents Shape Experts’ Research Judgment Calls: The conclusion contains all you need to know.
experts may defer underdetermined decisions to an AI agent, and that this deferral can be hard to identify, even for the experts themselves [...] Judgment also depends on skill, and people who stop making these decisions may lose the ability to make them [...] institutions will need an explicit strategy for developing human skills as models become more capable [...] Institutions may want to protect these skills and human oversight even with extremely capable AI, for safety, resilience, or their own sake.
📝 Claude Code burns ~15–20% of your tokens on a 3-word status line. Here's how to turn it off
📝 Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning: What a great leader and innovator... Calling his engineers and technicians loser is really an incredible act. So, time to move to another solution. By the way, tutanota is perhaps not a good alternative.
Cover Image by Nikolett Emmert on Unsplash
Top comments (0)