mkj

AWS customers have to pay for outbound traffic. Is there a way to get them to send you (or cloudflare) huge volumes of traffic?

With Rust there are ways to do that on embedded (no heap). A wrapper StaticCell holds the allocation, then when you are ready you intialise it with the inner value. From then on work with a mut reference to the inner value. Being a bit verbose is the main downside AFAIK.

https://github.com/embassy-rs/static-cell

Yeah, like Strega Nona the kids book where a magic pasta pot floods a town with pasta.

I agree generally, but is carbon-captured natural gas generation actually a thing? The only carbon capture I've heard of is at the gas production site removing CO2 from the reservoir gas and pumping it back underground - that's not after combustion. (And the pumping it back underground hasn't been particularly successful, eg https://www.boilingcold.com.au/regulator-limits-chevrons-tro... )

What kinds of side channels are you thinking of? Given the key exchanges have a straightforward sha256/sha512 combiner, it would be surprising that a flaw in one of the schemes would give a real vulnerability?

I could see it being more of a problem for signing.

https://greatscottgadgets.com/cynthion/ is another in-production user of it, a USB protocol analyzer and tool.

Hm, I guess that's one point. 15 years worth of accumulated revoked certs is a pretty big list though, not sure how much they win there.

Idle thought - wonder if there are perfect hash-like constructions they could use for revoked certificate lists.

What purpose does the expiry date have? There might be something I've missed, but I really can't see one apart from needless complication, which is what makes it a mistake. (There are other problems in the UEFI/firmware ecosystem yes, but that doesn't excuse expiry dates)

Set your clock to December, reboot, and see what happens.

It's not just Linux - certificates to sign Windows are also affected in 2026.

https://support.microsoft.com/en-us/topic/windows-secure-boo...

https://techcommunity.microsoft.com/blog/windows-itpro-blog/...

Really it seems like having any expiry date for these certificates is a mistake. The one thing it might protect against is a compromised signing key, but if you have to wait 15 years for a compromised key to stop being valid, it's not very useful!

Don't worry, the replacement MS certs expire in 2038 (a couple of months after the 32-bit unix time rollover).

Is that legal?

Who are cloud innovation's IP address range customers?

It didn't include the terrible battery pack design of the vacuum cleaners either. They could have added a few resistors (already supported by the battery management chip they're using), but instead they didn't so the battery packs just fail. https://old.reddit.com/r/18650masterrace/comments/tifbgr/dys... and the eevblog original linked there.

The linked URL doesn't really explain, what does "stable" mean here?

Are more northern countries able to take over some of the production? I'd guess maybe as water declines in southern countries, the temperature rises so more northern latitudes might grow the same crops.

Of course it's going to take time for different agriculture regions to get set up.

Image a layer, sand it off, image another layer, sand it off, repeat until you have them all?

I'll say it again - environment variables or pam_env aren't expert features - they're primitive. They were a contributing factor in the first privilege escalation.

Ok yeah, I had actually misread what the vars were.

But it's the same kind of problem as general environment vars - rather than just a name, maybe it needs metadata of where it came from.

To be clear, I'm talking about the unprivileged to allow_active CVE-2025-6018, not the allow_active to root.

Another case of environment variables causing LPE. Wonder if we'll ever end up with something more robust for passing details between processes than parsing ambient settings from strings.

Plausible they're anonymously proxying the captcha to google?

Intel's wifi cards and drivers are their saving grace for laptops. Atheros/qualcomm drivers are pitful in comparison on Linux.

Nabrawind have something like that. It's still a column at the top for blade clearance, but the rest is a grid structure so it doesn't need huge external cranes.

https://www.nabrawind.com/our-solutions/nabralift/

I thought his biggest claim to fame was writing Linux ethernet drivers (?) in the early 2000s?

Are they doing anything to fix it or just raising awareness?

Here's an example of measuring packages that report warnings for software that has suspicious conversions. Compile with `-Wconversion` with both 32-bit and 64-bit time_t, and see what the difference is. https://github.com/mkj/yocto-y2038

That is using yocto, but you could probably do something similar with other less-embedded distros too, if you can rebuild the world.

FWIW I didn't find much interesting with that apart from busybox dhcpd.

LTO gets a lot of the way there, but it won't for example help with eliminating unused enums (and associated codepaths). That happens at per-crate MIR optimisation iirc, which is prior to llvm optimisation of LTO.

A random 16 star github repo using unsafe doesn't really tell anyone much.

Wasabi doesn't seem to be a public company, so are they profitable?

The Linux kernel integer hash uses something similar, so not totally forgotten.

   \* These are the negative, (1 - phi) = phi\*2 = (3 - sqrt(5))/2,
   \* which is very slightly easier to multiply by and makes no
   \* difference to the hash distribution.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

Would that help with UDP, or only TCP?

There's no reason a USB PSU couldn't have such a low quiescent current that you wouldn't notice it when there's no usb plug. No idea if they've done that there though.