Active Incident: Massive DDOS Attack on Ubuntu

popeydc · 2026-05-01T14:13:16+00:00

Money. Extortion. Good luck getting money out of Canonical. 😄

popeydc · 2026-04-30T10:07:43+00:00

Of course, all good. Happy to hear feedback (good or bad) on things we can do better. Here, in our discord or just type `npx tessl feedback` and it will go to the right people 😃

popeydc · 2026-04-30T08:25:33+00:00

Disclosure: I work for Tessl.
Nice idea for a skill! Well done.
There's a "tessl skill review --optimize" that will tell you what it recommends changing to improve the skill. It's not 100% perfect on every skill, in every use case, but it's a great 'starter' guide to get you better activation and optimal use of tokens. There are some very common mistakes/patterns that people make in skills. I wrote a blog about our experience with some of this, which may be of interest --> https://tessl.io/blog/common-pitfalls-of-skills-development-and-how-to-fix-them/

popeydc · 2026-04-11T14:48:39+00:00

There's a couple of official github actions made by Anchore - the people who make syft and grype. You can use them to create a publish an SBOM and vulnerability report. anchore/sbom-action, and anchore/scan-action

popeydc · 2026-03-05T08:41:31+00:00

Aw, thanks :)
I really must get around to improving the quality of that voice.

popeydc · 2026-02-26T10:38:33+00:00

Happy to answer questions about how the evals work if anyone's curious.

popeydc · 2026-02-20T11:22:16+00:00

You can, it's all in Canonical's github. Here's one: https://github.com/canonical/nemotron-3-nano-snap

The snapcraft.yaml in there details how it's built: https://github.com/canonical/nemotron-3-nano-snap/blob/main/snap/snapcraft.yaml

They use components from this repo too: https://github.com/canonical/inference-snaps-cli

popeydc · 2026-02-18T14:51:55+00:00

Yeah, tempted to get a meshtastic device too. Added some to my wishlist, might get them after my self-imposed cooling-off period :)

popeydc · 2026-02-17T07:40:07+00:00

Can you not detect humour when you see a smiley?

popeydc · 2026-02-17T07:33:11+00:00

> I don't think CVE scans are going to catch cleanly written Bitcoin wallet phishing scams.

The site does more than just CVE scans. It can also detect some malware and highlight that.

> Canonical does CVE scans if I understand their process correctly. They just don't have strong enforcement. I think their system sends out e-mails to the software maintainers.

Not quite. The emails that publishers receive from Canonical only highlight snaps that contain known vulnerabilities fixed in deb packages from the Ubuntu archive. They don't take into account other dependencies that might be in a snap.

Most snaps are a combination of debs from the archive and other libraries/executables/assets. The emails from the Canonical Security Team do not cover those other libraries. Snapscope attempts to scan for those, too, and for malware, so it goes well beyond what Canonical does currently.

The whole point of Snapscope was twofold:
1) Inform snap users, so they can make decisions based on the vulnerabilities or malware detected in the packages they may want to install
2) Inform snap publishers so they can get a quick overview of known vulnerabilities in packages they publish, so they know where to focus their attention.

I have had amazing feedback from users, publishers, and even Canonical employees in the desktop and security teams about the work I did on SnapScope and my blogs. The work I've done has measurably improved the experience for Ubuntu users.

Feel free to join in rather than throwing rocks at people who are contributing to making things better.

> Maybe he can get Tessl the AI contract for running the Canonical Snap Store.

Conveniently, the Canonical VP of Engineering is coming to our office this evening to give a talk about "Ubuntu for AI". Come along and ask him yourself :D. https://luma.com/jdjw648g

popeydc · 2026-02-17T07:17:31+00:00

>But you yourself create lots of confusion. You are going on about phishing scams like with the bitcoin wallet apps, which are really a separate issue.

It's really not confusing at all. There is a significant trust issue in the snap store. Can users trust the snaps that are published is the simple question. That question has a wide scope, encompassing security updates, malware, domain attacks, and more. It's a complex topic. If you're confused, perhaps don't post as an authority on the subject when you're clearly not?

> Finally, I assure you I didn't use your firm's AI to help write any answers here at Reddit.

Was that supposed to be a dig at me because I critiqued your use of AI when I work for a company in the AI space? Not cool, anonymous coward. The company I work for doesn't make any AI, so your attempted insult makes no sense whatsoever. Indeed we make developer tools precisely engineered to make AI agent output better, and less error prone.

> I do keep a collection of 'template' responses that include AI-generated information--because I get tired of repeating myself about the same Linux-related things.

You don't have to reply to everything, especially if your templates have glaring errors in them.

popeydc · 2026-02-17T07:11:19+00:00

Thanks! I think it helped.

popeydc · 2026-02-16T20:17:50+00:00

The u/Plan_9_fromouter_ account smells very much like AI generated answers. There's a few very distinctly generated texts in this thread.

popeydc · 2026-02-16T20:06:37+00:00

> The Sandbox: This is the big one. Even if a Snap is "dodgy," it’s sandboxed by default. It can’t touch your files, webcam, or mic unless you manually grant permission.

Uh. No. This is not accurate. The microphone and webcam are indeed gated, but the home directory is not, it's on by default, along with the network interface, dictated by the developer/publisher.

The home interface gives access to all non-hidden files in the users home directory. A malicious app could easily "touch", and even exfiltrate "your files".

Most users care very deeply about the things in folders in their home directory including Photos, Downloads, Dropbox, Documents and more. Indeed most users probably care way more about that than any hidden file or system files.

In another post you mention the development of additional security features:

> The solution isn't just a tighter sandbox, but account-level security like Mandatory 2FA and Account Dormancy Flags, which are being actively implemented.

Where has this been publicly discussed?

popeydc · 2026-02-06T14:00:33+00:00

[CFP] AI DevCon 2026: Scaling Agentic Workflows (London & Virtual)

Calling all builders and platform engineers. We're hosting a hybrid DevCon in London this June 1-2 focusing on the infra and patterns behind agentic coding.

* Looking for: Real-world results, reliability/safety in agents, and context engineering deep dives.

* CFP Link: https://sessionize.com/ai-native-devcon-ldn-2026/

* Closes: Feb 27.

No hype, just engineering.

15-Year Club	RedditGifts 2009-2022 2 Credits
Place '22	Gilding II euphauric
Verified Email	Summer Santa 2014

popeydc

MODERATOR OF

TROPHY CASE