The past weeks were hard... And it's probably not over yet. Between the number of crazy vulnerabilities discovered recently and the economic crash, it is becoming increasingly complex to follow everything. The latest Musl/OpenSSH security issue was one of the most scary one discovered recently. During the last 10 years, any users can connect to any sshd server with a password greater than 256 characters. It works perfectly if the targeted user on the server does not have any password set and the field is set to *. Yeah. That's the name of the vulnerability: *sshole.
Coding
📝 How to Prepare a Flutter App for Google Play Closed Testing: a checklist to publish a flutter app to google play.
📝 Benchmark: Which Dart loop is the fastest?: a microbenchmark on loop performance in Dart. Conclusion: in most case ,the compiler is smart enough to optimize loops, even when using forEach().
📝 What Every C Programmer Should Know About Undefined Behavior #1/3
📝 Unicode, Tolkien, and Privacy
🏗️ Bondy-connect: first 1.0.0 and 1.0.1 release of bondy-connect.
🏗️ Pattern-Oriented-Software-Design: a Prolog term matching program.
📖 Prolog for Pattern-Oriented Software Diagnostics
📖 Practical Guide to Bare Metal C++
🏗️ Kaisel: Routes as values. A Dart 3-native router for Flutter — no string paths, no codegen.
System
🏗️ AlpineBSD: operating system based on the NetBSD kernel with a userspace inspired by Alpine Linux and the objective of making it possible to use as little AI-generated software as possible. There is no LLM output included in the base system or main package repository (AlpineBSD AI policy).
📝 Linux First Patch: A checklist to create your first Linux patch.
📑 safeL4: Rethinking Safe-Language-Based Single Address Space Microkernels
🏗️ kmorph: transforms a running multikernel Linux machine from one kernel into another without a reboot. A second kernel, the successor, is armed beside the kernel running the machine, the predecessor, and takes it over.
📖 UNIX PROGRAMMER’S MANUAL Third Edition
Database
🏗️ HypoPG: hypothetical -- or virtual -- index is an index that doesn't really exist, and thus doesn't cost CPU, disk or any resource to create. They're useful to know if specific indexes can increase performance for problematic queries.
📝 Designing a reliable unplanned failover
Network
📝 Setting up a new zone in BIND with DNSSEC
Embedded
📖 Embedded Systems - Shape The World: That's just great! One of the best series of books about embedded systems design and programming is now available online for free! Valvano's books were the best - and probably still are - more than 10 years ago. You can add The Art of Electronics, and you don't need anything more... By the way, the 2nd edition of the X chapters is out, the new edition is containing more than 900 pages (the previous one around 400). Received it last week, but I don't think I will have a lot of time to read it, sadly.
Security
📝 Trezor says a tampered wallet came from the reseller tied to the Ledger thefts. How do you check yours?: don't. trust. startups. They don't respect elementary security rules, that's why their products are usually cheap. If the manufacturing chain has been compromised, all their products are just garbage. Like few crypto-bros are saying, if you want a wallet/ledger, use a very old air-gapped laptop.
🏗️ POWBlock: high-performance, zero-dependency, system/stack-agnostic Proof of Work microservice that turns any proxy or server into a defense gate against AI scrapers, bots, and DDoS attacks.
📝 DOPPLERGEIST: a Python tool for acoustic geolocation research. It analyzes aircraft Doppler patterns in audio recordings and compares them against historical ADS-B flight trajectories to estimate possible recording locations.
📝 Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities: a way to be informed of the new security vulnerabilities using the Zero Wire project.
🏗️ Noriben: a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware.
📝 Detection Engineering: Implementing Detection-as-Code in an Existing Environment: Part 2 – Execution
Security/cryptography
📑 HKDF-Based Encryption Method with Very Long Keys for QKD and RKD
📝 The cryptography behind electronic voting (and why paper ballots are still essential): not the first time a publication is trying to explain the risk of using cryptography (and technology) to replace paper ballot in real world voting. IIRC, Schneier explains that in one of his book. In this post, we have a deeper idea why it's not a good idea to use electronic vote.
Security/RedTeam
📝 Exploit Development: Getting Started: nice introduction to writing exploit
Misc
▶️ Learning from AI Teachers: AI/LLM is the future. Just watch that and you will be convinced.
🏗️ DiscImageStudio: a cool project to burn disk image... as physical image on the disk.
📝 The entire quant theory on one sheet
▶️ Nassim Taleb Calls Stocks a 'Trap,' Sees 'Naive' AI Investors: Taleb intervention at the Greenwich Economic Forum regarding the naive investors thinking the first companies will succeed in the AI world. Technology is unpredictable by nature.
📝 You can't design software you don't work on
Update/Upgrade
🔄 QSB-121: Arbitrary read/write via grant copy (XSA-523)
🔄 Alpine Linux 3.24.4: including OpenSSH Security patch linked to Security advisory: openssh-server password authentication bypass.
Leaks of the week
🌐 Groupe MPA and Auto Planning: 19 millions of license plate just leaked.
Mathematics
📝 What are vectors?: a modern introduction to vectors.
Quotes
The delusion that technology and finance have given us god-like powers that moot the pendulum of history will be revealed as delusion in a most painful manner. A social-economic system in which what's moral is what's legal, and what's legal is for sale generates its own demise, as The Big Con doesn't work on the forces of history.
The Pendulum Of History by David Hackett Fischer
Top comments (0)