q3k

Also didn't have much luck on Alpine 3.20.10 with OpenSSH_9.7p1 which I've freshly installed from an official ISO.

Last two entries in /etc/shadow:

    test:*:20762:0:99999:7:::
    q3k:$6$snip.GgDQNTrqqX.A0:20762:0:99999:7:::

Private keys can be trivially recovered from the public keys because they're tiny. I found D=156, flüpke found D=4.

Yes, that's the entire private key.

D=4. That's the entire private key for one of the certs.

D=156 in my case. Yeah, that's the entire private key.

Yeah okay this is funny. Nice little CTF challenge :).

Two vibecoders are walking down a forest path.

One of them spots a Zig codebase and challenges the other: “I'll give you $100 to convert this codebase to Rust!”. They accept and after spending $1000 worth of tokens on a thousand commits the codebase is now in Rust.

On the way back, the second vibecoder spots the same codebase again, and challenges back: “I'll give you $100 to convert this codebase to Zig!”. Another gajillion tokens later, the codebase is now in Zig.

Walking a little more, one vibecoder (in a moment of unusual clarity) asks the other: “It feels like we just did this for nothing”. “No”, the other responds, ”we just increased our company productivity by two thousand commits per day!”.

(this is one of those things that's really magical with OSPv3 - it just runs on IPv6 LL addresses, no need to set anything up other than set the link to be within some area and it just works! well, as much as they do with OSPF anyway.)

(Keep in mind that the setup described here has work for years now.)

Skill issue.

What? Absolutely not! At least not in the countries in which I went to school.

"LLMize the succeses, humanize the failures." is the PR strategy at play here. Anything goes well it's because AI did it, anything goes bad it's because a human didn't catch it.

It's free_my_ipod and devos50 is not capitalized like (it makes no sense if you knew that it's a derivative of a last name).

You might say all these things but I can't see anything but disrespect if you can't even be bothered to spell the name of the involved project/people correctly.

Your work wouldn't exist in this shape without those who came in before you, and all you're doing is discouraging them (at least me) from ever publishing any code or research again.

wInd3x can decrypt it.

> and the boot ROM cannot be read from the running device

Yes it can, you just need to turn on the right clock gate.

I'm so tired of AI slop. We've been reverse engineering these SoCs slowly and carefully for years, but this is what ends up getting published and shared.

It's so sometimes just performative. I remember when Tailscale had a similar performative approach with 'just use a JSON file on disk'. Then etcd. Then SQLite. Like sure, you can keep picking the absolite mininum technology for your needs and then change it every couple of years... Or you could just immediately go with a solid Postgres (or Postgres-like setup, eg. yugabyte) and save yourself a bunch of faffing about with weird solutions and migrating between them. But I guess that doesn't drive engagement on your blog.

To be clear, I am also not an expert - I can pick out things that are wrong because I generally know a thing or two about semiconductor fabrication, but I'm not willing to sign-off on correctness of the whole thing, especially wrt. to modern processes. I personally wouldn't publish anything about this matter without getting it checked by someone else, because I know where the limits of my knowledge are.

The goal of my comment was to bring that to your attention - that you need someone to actually review your content before you continue teaching people the wrong thing. When you're educating people, you're in a position of power that comes with the responsibility of making sure what you write is as correct and clear as possible. You have a duty of care.

With all due respect, I would recommend you run any educational resources and infographics you create past an actual subject matter expert (not an LLM!) before release. Otherwise you're just spreading shiny misinformation.

All subtly wrong. And no, not in the 'simplified' sense.

https://blog.dragonsector.pl/2017/10/?m=1