Who's up bunyip'ing their Sun box
#RetroComputing flashback

Wow, I never even glanced at eBay Live before. What a cesspool of slop.

Code-execution flaw in UEFI firmware affects most servers on planet Earth: https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/

This is an interesting bug for a few reasons:
- In part of the code that was heavily fuzzed (but ICMP was skipped)
- In the reference SDK used by huge amounts of downstream firmware
- Exploitable before the PCH check (can attack BitLocker keys in TPM)
- A forever-vulnerability in out-of-support hardware

Great work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!

If this helps anyone, this is part of a CONTRIBUTING.md file that I have on my current major project.

I'm not ready to discuss the project any further at the moment, but this is part of it.

If you use MailMunge, MIMEDefang, or other Perl mail tools, you very likely want to update MIME-Tools to the latest release today, as it includes performance, behavior, and security fixes.

Thanks to Dianne Skoll (@dfs_comedy) for maintaining this highly-useful toolkit for so long.

#Email #spam #InfoSec #Sysadminnery

Great work from @jfslowik on rationally handling the vulnpocalypse.

https://www.dataminr.com/resources/intel-brief/examining-the-vulnpocalypse-and-defensive-responses/

"Programming is rather a test of understanding. In this respect it is like writing; often when we think we understand something and attempt to write about it, our very act of composition reveals our lack of understanding even to ourselves." [..]
"One programs, just as one writes, not because one understands, but in order to come to understand. "
-- Joseph Weizenbaum, Computer Power and Human Reason

highlighted in https://nex-3.com/blog/computer-power-and-human-reason/ by @nex3

via @samir 🙏

Has anyone dug into the strange new #alaska “free WiFi powered by Tmobile” inflight #privacy? You sign in with frequent flyer, but with date of birth and seat rather than atmos # and password and I didn’t see a privacy policy of where that data goes

You can be cybersecurity aware and still get compromised.

Prevention matters, but limiting the damage, stopping attackers from spreading, and recovering quickly matter just as much.

Part 4 wraps up my case for replacing Cybersecurity Awareness Month with Cybersecurity Readiness Month.

https://semgrep.dev/blog/2026/cybersecurity-readiness-after-compromise/

Oh FFS. If you just patched /etc/ssl/cert.pem on all your macOS endpoints, rejoice: the just landed Apple OS update to 26.7.2 / 27.2 will revert that for you and put the emSign and AAA roots back.

:facepalm: #emudhra

Need to know the name, phone number, and email address of someone and only have their address? No problem, if they're a comcast subscriber their website will happily tell you if you just say you forgot your Xfinity ID and enter the address. It just says "This you?" and dumps everything.

I freaking hate companies.

Researchers at TrendAI concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX's Starlink service and that the ads were likely being used to geolocate or otherwise surveil them.

https://www.reuters.com/business/media-telecom/alleged-israeli-spy-company-heavily-targeted-starlink-users-sources-say-2026-10-27/

@tychotithonus

TIL most weeks of my life are Alaskan winters.

The Alaskan urge to fatten up for winter with copious amounts of ice cream ... is real.

@lune @jcoglan

When people say 'this is possible only with LLM-generated programming' what they often actually means is 'this is possible only with massively subsidised automation'. An LLM is probably not the most efficient way of getting to the end point, but when the compute for the LLM is subsidised by a factor of 10-100x, if the other technique requires 20% as much compute it's still vastly more expensive if you can't burn someone else's money on it.

Hey, I know that guy!
@dangillmor

https://archive.org/details/ETREEuro1999_2?start=187.1

I'm not sure claiming "everything is on fire" is the correct takeaway here

There is a pile of flammable materials we've been ignoring for decades. It catches on fire sometimes. It caught on fire a lot this week

And the people who put out the fires, for free, put the fire out again

The current plan is to just keep throwing more oily rags on the pile. We could try to help the volunteers, but that costs more than adding oily rags to the pile

hashcat 8.0.0 has been released!

This is the largest update in the history of hashcat. It brings PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards, along with 146 new hash-modes and 306 bug fixes.

If you are upgrading an existing setup, please read section 5 of the release notes, "Before You Upgrade", first.

Release notes: https://github.com/hashcat/hashcat/blob/v8.0.0/docs/releases_notes_v8.0.0.md

Download: https://hashcat.net/hashcat/

Forum thread: https://hashcat.net/forum/thread-13700.html

Via: https://x.com/hashcat/status/2114448641779769418

#hashcat

Thinking about updating my Microsoft profile pic so I can roll up to Teams meetings looking like this.

I was curious how many Electron apps I had (it turns out: way too many) and whether any auto-updated b/c the emSign/eMudhra thing is a real weakness, especially if you're using DNS not in your control.

All it did was rly make me hate this timeline even more.

Script here — https://ray.so/UWhETDA — and in alt txt with a warning for screen readers.

(I need to tweak the /git/* blocking config a bit hence no gist link for this for now)