father, husband, american abroad. i build companies and software and stuff. optimist 🇺🇸🇹🇭
bkk
Joined December 2011
- Tweets34.8K
- Following773
- Followers3.9K
- Likes198K
matthew retweeted
‼️ Claude Code's "Don't Ask Again" option can save passwords and API keys in plaintext.
Apiiro found 2,539 exposed secrets across 1,994 public GitHub repos, including database credentials, SSH logins, and cloud keys.
Deleting files doesn't erase Git history.
Read: thehackernews.com/2026/11/cl…
matthew retweeted
Use languages with:
1. Strong static typing
2. ADT (= struct and enums)
3. Null safety + Result type
4. Preferably affine (linear is even better) typing
5. Strong linter to enforce best practices
And delete every tests except algorithmic logic, boundary IO, and integration flows
matthew retweeted
TIL about this bootstrapping scene for the first time. It's wild.
They are building a tower of languages, starting with a 256-byte hand-written binary, for building a complete Linux system.
Love how Guix is attempting to thwart the trusting trust attack:
"The goal is to start from a minimal, easily inspectable binary (which should be readable as source)"
"Guix bootstraps by using MesCC—the small C compiler that comes with Mes—to build TinyCC, which is used to build GCC 2.95.0, which then builds GCC 4.7.4."
matthew retweeted
When researchers analyzed how Pegasus spyware infected iPhones without the user tapping anything, they found something wild. The attackers sent an iMessage with a fake GIF that targeted Apple's image decompression engine. The decompression math was so flexible that the exploit chained arithmetic operations together to construct a literal, functioning software CPU using over 70,000 segment commands that defined logical bit operations (AND, OR, XOR, XNOR, etc.) entirely inside the image parser. This created a small computer architecture with registers, a full 64-bit adder, and a comparator, running raw code before the phone even buzzed with a notification
matthew retweeted
Just reproduced sshole (CVE-2026-123158), beautifully simple bug by @kultekin
Needs password auth on and no PAM, but you can ssh as root into an unpatched Alpine box with any 257+ byte password.
musl crypt() returns "*" for any password over 256 bytes. a locked account's shadow field is also "*". sshd compares them and they match.
fix: openssh 10.6p2
matthew retweeted
A developer built a free Linux driver for USB display adapters and got a legal notice instead.
Mike Lothian was building Vino, a free Linux driver for DisplayLink hardware, using Rust and some AI assistance.
Then Synaptics, the company behind DisplayLink, sent him a cease-and-desist notice alleging patent infringement.
Lothian challenged the claims and shared the legal letters publicly. He’s a hobbyist developer without a lawyer.
The project’s GitHub repository is now no longer publicly available.
Full story: phoronix.com/news/Synaptics-…
matthew retweeted
The bug is like a joke.
On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
matthew retweeted
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
write a replacement for tokio, make no mistakes
this is such a bad take lol
matthew retweeted
If your cocaine dealer shorted you and didn’t supply you with the full amount of product, contact us at 336-373-2222 to file an official complaint.
matthew retweeted
❗️ A Dutch Starlink user says he got a Paramount piracy notice within two days of torrenting a single episode of Dexter: Resurrection.
Starlink forwarded it with a warning that further downloads could get his service suspended or terminated and put him at risk of legal action.
He says 24 years of torrenting had never brought him a single notice before. In the Netherlands, the Supreme Court ruled in 2021 that a major ISP did not have to hand alleged pirates' details to a film distributor. So the user thought he was safe.
Starlink, a US company bound by the DMCA, has said it is obliged to pass such notices on.
matthew retweeted
Heads up @Netlify DNS has been compromised & attackers are actively redirecting dapps to drainer domains.
Readers added context they thought people might want to know
Netlify's Hosted DNS is reported operational with no incidents or compromises. Targeted DNS hijacks affected specific crypto project domains like flap.sh and fluxbeam.xyz, per security alerts, not Netlify infrastructure.
netlifystatus.com
en.bloomingbit.io/feed/news/1233…
x.com/blockaid_/stat…
x.com/STACCoverflow/…
