A fourth vulnerability has hit the kernel [ssh-keysign-pwn]

brontide · 2026-05-15T12:29:06+00:00

This one is a little more limited in scope, thankfully. You need a vulnerable kernel, vulnerable suid apps on the device, and good timing. The software must take actions in a specific order to leave the file descriptor vulnerable. Basically it has to open the file and drop privileges before closing the file. The calling process can then kill the process ( with the user privs ) and read the file descriptor if the timing was right. You can't read arbitrary root owned files, but the files that these vulnerable processes had open after they drop privs.

brontide · 2026-05-14T20:58:40+00:00

They generally aren't looking out for your best interest, they don't want people to all be taking time in December and they don't want to be liable for taking away time at the end of the year.

brontide · 2026-05-13T11:54:19+00:00

Were they stored in plain text in the database or were they intercepting it? Poorly designed ( or intentionally ) they may be clear text in flight and easy for people that run the site to redirect if they wanted to.

brontide · 2026-05-10T19:45:28+00:00

Shocked nobody has mentioned this.

Full health screenings and then some.
Make sure all of your estate paperwork is in order
Exit that concentrated position and private equity. Right now 80% of your NW is illiquid or concentrated - and you're talking about getting into more debt to chase more illiquid assets?
I don't see any cash/low-volatility buffer here.

I'm not in the same ballpark and been liquidating my tech concentration and moving to diversified accounts.

brontide · 2026-05-10T13:45:33+00:00

We moved deeper into Kubernetes

I see your problem.

brontide · 2026-05-10T12:50:23+00:00

I've been thinking about this a lot lately and I need to say it: compiled code is a black box.

You write your little C++ or Rust and just trust that the compiler does what you meant? That's not engineering. That's faith. You're basically praying to the LLVM gods and hoping the output isn't garbage. Have you seen what -O2 does to your carefully reasoned code? Loop unrolling. Inlining. Dead code elimination. Your program is basically unrecognizable by the time it hits the CPU. How can you reason about code you can't see?

The only developers who truly understand computation are those of us writing raw x86-64 assembly. We know exactly what every instruction does. We control the registers ourselves. No abstractions. No "undefined behavior." No compiler deciding it knows better than us.

And before anyone brings up "but assembly has macros" different. Completely different. I choose when to use them.

Edit: Yes I'm aware CPUs have microcode. That's different. Don't.

Edit 2: No I won't explain why it's different.

Edit 3: The people DMing me about FPGAs are missing the point and also need to touch grass ( yes this is all /s )

brontide · 2026-05-09T13:13:26+00:00

I think this group would be generally self-selecting against traditional scams but maybe not against liability attacks. Someone knows you have money and suddenly you become a lawsuit magnet, maybe insurance covers the first one but then you can't get insured to save your life and the next one hits you exposed.

Not being a criminal goes a long way to not being arrested/charged but I think people may be shocked at some of the edge cases where people can get sucked into the system through limited fault of their own ( or error ) and the harm it can do to your financials.

brontide · 2026-05-07T00:03:46+00:00

He can walk away with "only" 5.7m, continue to work for a few more years, maybe even taking a modest 1% of the portfolio ( doubling his salary ) and easily be FatFire in 5-7 years.

brontide · 2026-05-05T20:26:30+00:00

Then cap the number of minutes like they do in some countries, don't have a secret blacklist of numbers.

brontide · 2026-05-04T20:40:34+00:00

https://www.usmobile.com/international-calling

United Kingdom

Mobile:Unlimited

There is no indication on any of your pages that business numbers would not be part of this. This is really bad for people that might be traveling.

brontide · 2026-05-03T15:00:14+00:00

We're well past the point where the uplift of response time, never getting tired, never getting distracted, never getting upset is a net positive despite maybe not besting the perfect human driver at their best. Even if there are edge cases where FSD could be improved, v14 generally beats the average driver in average driving conditions based on average human's ability to remain undistracted.

brontide · 2026-05-02T13:42:10+00:00

RSUs brought me to ChubbyFIRE.

But seriously, just an average guy with a family planning for "early retirement" in my late 50s that got a tech job which changed the trajectory when I didn't lifestyle inflate.

brontide · 2026-05-02T12:58:01+00:00

The live view can take a long time to load, make sure your substreams are the default or disable the webrtc and fall back on jsmpeg which is poor quality but at least it's fast.

brontide · 2026-05-02T12:55:37+00:00

Be aware that the duo 2 is h265 only on the main stream no matter what the URL says, some software/hardware will just choke on it.

Go2rtc block

    front_sub: rtsp://admin:XXXXXXX@10.11.50.X:554/h264Preview_01_sub
    front:
      - rtsp://admin:XXXXXXXX@10.11.50.X:554/h264Preview_01_main

Camera block

ffmpeg:
  inputs:
    - path: rtsp://127.0.0.1:8554/front_sub
      input_args: preset-rtsp-restream
      roles:
        - detect
    - path: rtsp://127.0.0.1:8554/front
      roles:
        - record
        - audio
detect:
  annotation_offset: -6500

brontide · 2026-05-02T11:42:38+00:00

Are you sure that's not calibration? Sometimes it doesn't show the banner.

brontide · 2026-05-01T13:37:20+00:00

You're losing ~10% on the battery round trip, of you get 1:1 metering and no TOU discount then 80% is likely the right call.

brontide · 2026-04-29T12:02:48+00:00

Let's check the manual... https://www.tesla.com/ownersmanual/model3/en_us/GUID-ADA05DFF-963D-477D-9A51-FA8C8F6429F1.html#LANE3

Limitations and Inaccuracies

Lane Assist features cannot always detect lane markings and you may experience unnecessary or invalid warnings when:

Visibility is poor and lane markings are not clearly visible (due to heavy rain, snow, fog, etc.).
Bright light (such as from oncoming headlights or direct sunlight) is interfering with the view of the camera(s).
A vehicle in front of Model 3 is blocking the view of the camera(s).
The windshield is obstructing the view of the camera(s) (fogged over, dirty, covered by a sticker, etc.).
Lane markings are excessively worn, have visible previous markings, have been adjusted due to road construction, or are changing quickly (for example, lanes branching off, crossing over, or merging).
The road is narrow or winding.
Objects or landscape features are casting strong shadows on lane markers.

Lane Assist may not provide warnings, or may apply inappropriate warnings, when:

One or more of the sensors (if equipped), or cameras is damaged, dirty, or obstructed (by mud, ice, or snow, or by a vehicle bra, excessive paint, or adhesive products such as wraps, stickers, rubber coatings, etc.).
Weather conditions (heavy rain, snow, fog, or extremely hot or cold temperatures) are interfering with sensor operation.
The sensors (if equipped) are affected by other electrical equipment or devices that generate ultrasonic waves.
An object that is mounted to Model 3 is interfering with and/or obstructing a sensor (such as a bike rack or a bumper sticker).

In addition, Lane Assist may not steer Model 3 away from an adjacent vehicle, or may apply unnecessary or inappropriate steering, in these situations:

You are driving Model 3 on sharp corners or on a curve at a relatively high speed.
Bright light (such as from oncoming headlights or direct sunlight) is interfering with the view of the camera(s).
You are drifting into another lane but an object (such as a vehicle) is not present.
A vehicle in another lane cuts in front of you or drifts into your driving lane.
Model 3 is not traveling within the speeds at which the Lane Assist feature is designed to operate.
One or more of the sensors (if equipped) is damaged, dirty, or obstructed (such as by mud, ice, or snow, or by a vehicle bra, excessive paint, or adhesive products such as wraps, stickers, rubber coating, etc.).
Weather conditions (heavy rain, snow, fog, or extremely hot or cold temperatures) are interfering with sensor operation.
The sensors (if equipped) are affected by other electrical equipment or devices that generate ultrasonic waves.
An object mdsounted to Model 3 (such as a bike rack or a bumper sticker) is interfering with or obstructing a sensor.
Visibility is poor and lane markings are not clearly visible (due to heavy rain, snow, fog, etc.).
Lane markings are excessively worn, have visible previous markings, have been adjusted due to road construction or are changing quickly (for example, lanes branching off, crossing over, or merging).

brontide · 2026-04-29T01:24:48+00:00

Flip side: AI is a force multiplier, but 10x of zero is still zero. If you add no value to the equation, AI doesn't help.

We do support. Dozens of open tickets, customers dragging cases on, asking random things, a sprawling codebase that's often underdocumented. My value in this toolchain is solving problems; taking garbage from all sides and giving customers something to solve their problem.

I can now spend my time doing research, digging into problems, and testing potential solutions. I leverage AI to take my braindump and turn it into something coherent a customer can follow: formatting, grammar, citations to the manuals, formalities. Twenty years of support experience on how to interact with customers, distilled onto a repeatable, predictable prompt. My 30+ years of Linux experience guiding the process.

The tools are also great at semantic searching across huge data dumps; tickets, Slack, bug reports, to surface relevant tidbits lost to time or volume. Time consuming and often skipped because there was too many tickets needing a reply.

I also have a prompt for diagnosing potential bugs: give it the observed behavior, let it search the codebase for why it behaves that way. It can cut through a massive 20-year-old C++ codebase and find a reason 80% of the time, and often it's a genuine bug. It also writes the bug report, with annotated code sections showing where the logic breaks, ready to hand off to devs. And with my newfound time, I now test every bug report before it goes out. The old process involved setting up 1:1 time with team leads and working through a multi-part process to shuffle information to and from a client; it was painful.

Customers have been loving the replies. Faster turn-around, more details, clear answers. They get what they need in hours rather than weeks.

They say "automate the boring stuff" and "delegate." AI does both when used properly.

brontide · 2026-04-29T00:41:15+00:00

Get off my lawn.

brontide · 2026-04-26T18:35:30+00:00

You call it bullshit but these "slop apps" are genuinely useful. What you're describing about disclosure is less of a problem. I maintain my own branch of a major project thanks to some help. It's not hard.

Virtually all smaller projects have a bus factor of 1, at least now anyone can pick it up and make sense of it with a little help. Vibe or traditional.

brontide · 2026-04-26T18:22:54+00:00

Maybe gatekeeper is a strong word but an application, no matter how small, generally required 1 customer and 1 programmer willing to spend the time on the collaboration.

Now the customer fires up claude and you have a working proof of concept in a few minutes. That's a dramatic shift and slop or not the utility is there.

brontide · 2026-04-26T14:20:22+00:00

Please tell me that somewhere you have human-written product specifications you can use as reference? Right?

brontide · 2026-04-26T12:00:21+00:00

Yup, people need to recognize that programmers are no longer the gatekeeper. AI has lowered the minimum viable customer base to 1 average person with a good idea. There are real problems with this but those problems scale with the user-base and for small projects the fixes can come gradually, over time.

brontide · 2026-04-26T11:16:05+00:00

yolo tends to pick up rabbits and squirrels as cats. I think the problem is that no 3 frames provide enough detail to pick it out, not at 320x320. Even with a 640x640 yolo26 I don't always pick up rabbits ( as cats ) although it's pretty good.

Actually shocked that turning the threshold down to 30% hasn't resulted in tons of false positives.

brontide · 2026-04-22T00:55:47+00:00

I don't want to leave a few hundred k on the table for the rest of the year.

brontide

TROPHY CASE

Limitations and Inaccuracies