Claudio Álvarez retweeted
USB-C has 24 pins, and at least 12 different ways to take them over.
DisplayPort, Thunderbolt, an HDMI mode nobody built, a VR standard that died in 2 years, and hidden ones from Apple and Nintendo.
Here's which pins each one takes.
Claudio Álvarez retweeted
A 9.8 Linux kernel bug.
Remote. No login. Root.
It lives in the TCP handshake.
Before any app even sees the connection.
CVE-2026-98432.
Sitting in the kernel since version 4.4.
That's 2016.
The trigger is an IPv4 option from 1981.
Record Route.
A feature nobody uses.
Marcus Hutchins says someone is scanning the whole internet for it.
More than 2 million reachable endpoints.
Not confirmed vulnerable.
But he says ordinary scanners don't speak MPTCP.
These ones do.
Someone built the scanner on purpose.
The reassuring take was that you need MPTCP enabled.
Debian enables it by default.
Go 1.24 opens MPTCP sockets by default.
Including Caddy.
Nobody turned it on.
It was already on.
The fix is net.mptcp.enabled=0.
It doesn't close sockets that are already open.
So you apply the mitigation.
You feel safe.
The server is still exploitable.
Until someone restarts the app.
Red Hat shipped the fix November 1.
Debian shipped it.
Amazon Linux shipped it.
Ubuntu's fixes are in a repository called proposed.
Testing.
Nineteen days after the CVE.
Ubuntu 16.04, 18.04 and 20.04 have no fix coming.
Write-ups say an AI-assisted exploit got root in under an hour.
So the attackers have the exploit.
The scanners.
And the target list.
Defenders have a pocket called proposed.
‼️ Attackers are scanning the whole internet for Linux servers exposed to a critical 9.8 kernel flaw, Marcus Hutchins says.
They found 2.1M servers that accept it.
Ubuntu still has no patch.
The bug, CVE-2026-98432, is a race condition in the code that handles incoming IPv4 TCP connections. It can let a remote attacker run commands as root during the handshake.
When people ask how SQLite creator D. Richard Hipp and his team maintain a C database running on billions of devices, the answer is in the testing.
In 2023, SQLite’s engine had about 156,000 lines of C.
Its test suite contained over 92 million lines of code and scripts.
That’s roughly 590 lines of tests for every line of production code.
Before releases, SQLite deliberately simulates power loss, disk I/O errors, and malloc() failures. A separate harness achieves 100% branch coverage of the core in its tested configuration.
They don’t build reliable software by assuming everything will work.
They build it by systematically testing what happens when things go wrong.
Claudio Álvarez retweeted
The bug is like a joke.
On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Beware juicejacking is a thing that exists...
Holy sh*t. Claude Code just found a hidden chip inside my Chinese power bank from Guangzhou. Every time I charged my iPhone, it quietly copied the whole phone…
It also read our saved Wi-Fi password off my iPhone, got onto our home network and sent everything to a server.
I bought it for $19 at an airport kiosk there 3 weeks ago. No brand, 30,000 mAh on the label, and it felt heavy.
The first time I plugged in, the screen asked "Trust This Computer?". I tapped Trust without thinking and went on with my day. That one tap gave it access to everything.
This morning I finally set up Claude Code to warn me when any device starts reading my files. An hour later, 10 seconds into charging, the screen filled with yellow warnings, then red ones: data was moving when it should only be charging.
I asked Claude Code what was going on. My phone saw the power bank as a small computer with 64 GB of storage and its own internet connection.
A USB cable has wires for power and wires for data, and a normal charger only uses the power ones. This one used both, and it had already copied all of this:
→ /device → IMEI and serial number
→ /contacts → 1,206 numbers
→ /apps → every app I have, including my 2 bank apps
→ /photos → 3,912 pictures, my passport among them
→ /wifi → our network name and its key
→ /wife's iPhone → her photos too, she charged from it twice and tapped Trust too
Each time we plugged in, it used that key to get online and send out the new files:
sends to → 47.***.***.12
uploads → 19 in 3 weeks
last one → last night at 2:14, while we slept
I pulled the cable right away. Then Claude Code blocked that address on our router and walked me through changing the Wi-Fi password and the logins for my bank apps.
I had it opened at a repair shop, and what was inside is in the first comment. A 30-second check for your own is in the second one. Save this and test every power bank in your house today.
Readers added context they thought people might want to know
Obvious fake. The front camera and the dynamic island are misaligned. No such iPhone exists.
instagram.com/p/DcTNn9IyvFv/…
Claudio Álvarez retweeted
The amount of Microsoft energy that went into trying out this theory—a database running locally as a file system—would be hard to calculate across Windows, Office, email.
It is one of those ideas that seems interesting on paper. In practice it is never good enough for everything you want to do and the constraints do not help you to think of better or more clever ways to get things done. The constraints just got in the way of getting anything done.
There's significant utility in having a local database available for use in the platform, but that too carries with it challenges in backup/restore/upgrade/security/privacy/etc.
In hardcoresoftware.substack.co… I think I wrote about this adventure in four times (working on strategy for Bill, Outlook, SharePoint, Longhorn.) I don't know if there is another example of a technology aspiration that endured so long and lacked a solution that worked. And also caused so much division and consternation inside Microsoft.
Perhaps more than anything it is the lesson of a big company thinking it can invent the future in isolation—all sorts of isolation or tunnel vision. Big companies, it turns out have a surplus of two things:
1. Hubris. There was no shortage of people starting at the top who become "obsessed" with delivering on an idea and believed the success Microsoft had recently achieved was a license to know how to build it.
2. Doubt. There was also no shortage of people who thought from the first days that the idea made no sense and believed the defined solution in no way benefitted the products that are being made, loved by customers, and pay the bills.
This 1-2 punch is fascinating because it sets up a divisive dynamic where you are either an "innovator" who is "on board" with the future OR you are a "obstacle" who does not see the value in "big bold bets" on the future of the company. Along comes a book like "Innovator's Dilemma" [1998] and suddenly resisting the next big corporate strategy makes one throw out common sense engineering because you don't want to get disrupted. It is the other side of the disruption coin no one talks about—sometimes the new thing does not in fact work very well nor will it in any finite time. The lesson applies to the product and technology leadership of a company.
Part of what happens in a big company as well is the ability for the company to speak broadly and enroll their ecosystem in their own excitement for the future. Microsoft described WinFS as early as 1992 and over the course of more than a decade it polluted our ability to talk about new products. The email product (Exchange, today the mail for 365) was famously the most important product to be launched and for the first decade of its life was always about to become strategic even while it was in fact the most strategic product the company made. The strategy nearly wrecked Outlook the face of the email strategy. It did in fact derail an entire generation of Windows. There was fallout across a range of products never released. All the while Microsoft was talking about the grand future of this product while customers were investing and buying into products built an entirely different way. A dynamic few are willing to speak about is another 1-2 punch:
• Customers and the press talk all about waiting and seeing if the current product will adopt the all important strategy. The first signs of this are the sales force freaking out and escalating their concerns.
• Customers actually ignore the strategy because "product market fit" dynamics take over and they can't buy and adopt the actual product soon enough. The first signs of this are visible to those in the real world who never get asked about the strategy because customer have a million feature requests.
This is the second way the whole dynamic divides the company. The "obstacle" people start to look like they are focused on the past to the "innovators" who are clearly focused on the "future."
You can find many examples of this near computing technology and broadly in other industries:
• Intel Itanium (which Dave below knows well) was a chipset architecture that just never panned out. Itanium occupied Intel for more than two decades.
• Copeland OS pursued by Apple muddled their decaying ecosystem and divided the company, cancelling it set the stage for Jobs return with NeXT becoming the future OS.
• IBM "Stretch AND "Future Systems." IBM was such a defining company it had two generations of this dynamic in an effort to reinvent (or invent!) mainframes. Stretch was much like Microsoft Longhorn in that there were portions that went on to greatness in the 1960s. FS just got cancelled.
• IBM also had the Micro Channel Architecture (MCA) which divided the hardware side of PCs at just the wrong moment. It just went away. Also IBM had OS/2 which I think still runs some bank ATMs :-) [There's a theme that maybe IBM invented this whole level of hubris which would follow from second-system-syndrome in "Mythical Man Month"]
• Hydrogen Fuel cars have been surpassed by improved gas and now EV yet you can still see them being pushed in Japan though at last Detroit moved on. This one has been going on since I was a kid.
• GE Predix was a broad SAP-like industrial information technology bet that was the technical undoing of GE IMO, though the 2008 financial crisis really did the work. Predix was Immelt's bet (his book details this) while cleaning up was left to a successor as often happens.
There's a difference between a failed product and a failed all-consuming strategy. All companies have failed products essentially all the time. Technology companies seem unique at hubris required to broadly pursue—in public—a direction that doesn't work. They do so under the guise of preventing the decline of the company that makes it all the more painful.
Likewise there is a difference between a successful product line that can't escape its own success gravity and failed attempts to reinvent it. The most common thread is the inability of a successful company to find a new strategy for an existing product. We are living in this moment now with AI as we see Intel which could not transform its chip architecture into something different while at the same time Nvidia's long term architectural bet ended up as the foundation of the the AI era. Had we found ourselves in some other chip architecture from a third company it might very well be that we'd be talking about Nvidia's GPU bet as a strategy initiative they just would not give up on.
One of the things that happens over time is this corporate hubris can get rewritten into "we had the right idea but were just early." The problem with this is it separates the broad concept at 30,000 feet from the actual technology and implementation. I've watched this happen with everything from Clippy to TabletPC to Windows Phone. There's a huge difference between a concept and an implementation that makes the claims of being right. I love Clippy but there was no path where it went from what we did in 1995 to today's AI agents, any more than the clipboard Captain Kirk used was a product precursor to an iPad.
And of course as always with product development, no matter what happens...someone always said it would. Which makes me sharing all the times I thought WInFS would fail all the less satisfying for me.
Here are the places in Hardcore Software where WInFS was part of key decision making and controversy.
024. Discovering “Cornell is WIRED!” [1994] hardcoresoftware.learningbys…
053. Strategy Tax: Outlook Storage, First Attempt hardcoresoftware.learningbys…
065. SharePoint: Office Builds Our Own Server hardcoresoftware.learningbys…
069. Mega-Scale, Mega-Complexity hardcoresoftware.learningbys…
074. Outlook Pride, Finally hardcoresoftware.learningbys…
085. The Memo (Part 1) hardcoresoftware.learningbys…
091. Cleaning Up Longhorn and Vista [2006] hardcoresoftware.learningbys…
Microsoft chased using a DB as a filesystem for about 20 years.
It likely all started with OFS around the Cairo timeframe.
OFS was conceived as an installable filesystem that would:
- Store OLE objects (not just raw files) with rich, application-accessible metadata.
- Support multiple data streams per object, long filenames, ACLs, quotas, and journaling.
- Index both content and metadata so items could be searched and queried across applications (not just by name or path).
- Optimize for large numbers of small files.
The broader Cairo vision included “Smart Folders,” representing non-file objects (printers, devices, etc.) in the same hierarchy, and fulfilling Bill Gates’s “information at your fingertips” idea. Public demos appeared around the 1993 PDC.
Then of course there was Storage+ and RFS and WinFS. Even ReFS uses a B-tree database internally.
Claudio Álvarez retweeted
James Watt achieved ~2% thermal efficiency in 1769.
Where are we now?
Gasoline car engine: 20-40%
Diesel engine: 40-45%
Gas turbine (aircraft): ~45-50%
Combined cycle gas plant: ~60-63%
Fuel cell (hydrogen): up to 60-70%
Steam turbine (nuclear): ~33%
The theoretical max (Carnot efficiency) for a heat engine is set by temperature difference, not materials.
For a typical power plant: ~65%.
We're getting close. The physics limits are in sight.
Claudio Álvarez retweeted
Ever wondered why the Mac's ⌘ key looks like that? 🤔⌨️
👀 Early Mac menus showed a tiny 🍎 logo next to every shortcut
😤 Steve Jobs saw it and said "There are too many Apples on the screen!"
⏳ The team had only a few days to replace it
📖 Designer Susan Kare flipped through a book of international symbols
🇸🇪 She found ⌘, a sign used in Sweden to mark a place worth visiting
🎨 She drew it as a tiny 16×16 pixel icon
💻 And it's been on Mac keyboards ever since ✨
Did you know this? 👇
Claudio Álvarez retweeted
The boom in Linux CVEs lately should get you thinking.
Surely, given a finite codebase, there are also a finite number of bugs / unintended behavior, thus, a finite amount of vulnerabilities. Theoretically, a “solvable” problem. Right?
Well…not at all actually.
It gets a bit philosophical, but there’s the concept of “weird machines”.
A weird machine is an accidental computer located inside of another computer program. Quite a few exploits (e.g. anything ROP) falls into this category, where the attacker’s instruction set consists of fragments of the original software.
Finite code can *easily* have infinite Unintended Behavior (not undefined behavior btw…that’s a very different thing). Weird machines don’t even have to be Turing complete to be, really, really powerful!
Even if you have a million superhuman AI coders and fuzzers thrown at the Linux kernel, you quickly hit halting-problem-esque uncomputable states. The concept of patching every possible bug until none remain isn’t possible, because we can’t often correctly define what a “bug” even is.
Now, can you make a kernel that truly has zero weird machines relative to a formal specification? ….yes, but it wouldn’t look like Linux. It’d look more like sel4, VxWorks, or (shudder) INTEGRITY-178.
The second question is always: How do you deal with the glare!? Don't you have to keep the blinds down all day? And the answer is no, thanks to 3M and SCIENCE! Incredible technology. 3m.com/3M/en_US/home-window-…
A picture of @DHH's desk goes viral every few months, and he says the number one comment he always gets is that it can't be a real office because it’s too clean.
His response:
"If I have shit all over my desk, I'm not creating work, because my mind will just go to the shit."
“It's a bit like that Marie Kondo thing where you go through simplifying your home and throwing out all this stuff. It actually creates free mental space.”
“I need this pure cocoon.”
“It's actually a form of procrastination, and I need to run out of obvious things to procrastinate on before I'll start the real work.”








































