Unexpectedly missed including what I thought was the main point in yesterday’s post, so here’s that bit too: https://bjoreman.com/diary/2026/2026-10-27.html

#blog #jolla #habits

Veckans Kodsnack är här: Fredrik och Ingo Junefjord snackar snackar om att hålla sin egen data säker, och om hur i storföretagens grepp man är bekväm med att vara.
https://kodsnack.se/726/
#podcast #did #digitalSovereignty #backups

A shader: https://twigl.app/?ol=true&ss=-P4o_MBliyESGHUkoFf9

Youtube on Jolla is the nicest: the extended text edition. https://bjoreman.com/diary/2026/2026-10-26.html
#blog #jolla #sailfishOS

But it's not "node2shell". It's a normal memory corruption that's blocked by ASLR. It's not easy to exploit. You should fix it, yes. But using the "blah2shell" terminology is misleading.

It's misleading because it tells people that it can be trivially exploited. It cannot, unless you disable ASLR and compile without PIE.

OpenAI and the other ghouls want you to think LLMs finding all kinds of critical bugs that are trivial to exploit. They want you to think there's no other way to find them.

That's just not true.

I looked at the code, and you know the first thing I noticed? A fuzzer. Google fuzzes their code. OpenAI wrote their press release very cleverly so that it could be misinterpreted as them finding the initial bug, as others have reported, but this could have been (and probably was) found by the existing fuzzer.

more or less confirms that the PHP exploit on Wednesday was overblown, and contrary to claims it would be exploited in 15 mins, we haven’t even seen one confirmed exploit yet. even proof of concept exploits are incredibly hard to write and deploy.

AI companies were lying. again

https://blog.luitjes.it/posts/i-want-my-wednesday-back/

Snälla rara, ska man verkligen behöva lyssna till sånt här trams om superintelligens i P1 Morgon på lördagmorgonen?

#nickbostrom

Wait, what was your old approach to model containment?

https://openai.com/index/securing-our-frontier-model-training-environment/

Nature is healing.

@NetNewsWire brings back the status bar (across the bottom of the window) with useful metadata and options/commands. So nice to see the traditional style of Macintosh apps come back.

Apps can be both simple _and_ useful without having to be a whole ass “eXpEriEnCe”. It’s just an RSS reader, not a whole media center.

(And I don’t mean that to sound like its diminishing the value of NetNewsWire).

But yay! Back to useful apps once again!!! Even the grab handle is back!!!

Thank you to everyone who joined us at the Jolla Phone Roadshow community meeting in Stockholm yesterday. We had good conversations, a Sailfish OS 5.3 release hands-on preview with participants, and a teaser of AppSupport improvements. We saw the Jolla Phone in people’s hands and of course enjoyed the company. Thank you for coming, sharing your ideas and giving us feedback. Moments like this are why we build this with you ♥️

#Jolla #SailfishOS #DigitalSovereignty #PrivacyFirst #CommunityPowered #European

So turns out Gram is vulnerable to the eMudhra "lets use 4 as our private key" root cert and I've released 3.4.0 to address this:

https://gram-editor.com/posts/release-3.4.0/

I'd encourage everyone to upgrade as soon as possible. Partly so your editor doesn't download things it shouldn't, but also because there have been a lot of improvements and fixes since 3.3.0 so yeah it's a good upgrade in general I hope.

Thank you to Clint from https://getsol.us for letting me know about the vulnerability, I hadn't realized myself.

Skriva drivare för Linux
Pierre Ossman om hur han blev ansvarig för drivare för SD-kortläsare i Linuxkärnan - med Linus på linjen.

Ett klipp ur Kodsnack 725 - lyssna där poddar finns eller på kodsnack.se!
#linux #kernel #drivers #memoryCard #podcast

There’s absolutely shit tons of exploits for PHP2Shell on GitHub and basically none of them actually work to RCE as nobody can figure out ASLR properly.

Which is good, because patching is going to take a long time.
https://php2shell.censys.com/

RE: https://narrativ.es/@janl/117484474907395355

#FOSDEM will not have a DEIB room 😔 True to #DIY #OpenSource spirit we will fix this ourselves.

Support @Gina @elena @RosannaSibora initial proposal for a DEIB room with the #FOSDEMPledge @janl proposes:

Take a min or 2 to discuss the need for diversity, equity, inclusivism & belonging (DEIB) in your talk or have a talk on this topic in the room you organise.

For me #FLOSS is about people. Let's make sure everyone feels welcome & enable their participation in the FLOSS ecosystem. ✊

Bra genomgång av en del av alla lögner, förvrängningar och falska klipp som sprids på sociala medier om det som händer i Frankrike.
https://www.dn.se/varlden/franska-protesterna-utnyttjas-politiskt-har-ar-falska-bilderna-som-sprids/

RE: https://mastodon.melin.org/@bjoremanmelinahs/117482866748475291

Innehåller också en skrämmande snabbt hoprafsad ”jingel” för jollatapporten. Andra försök välkomnas varmt!

OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.

Coffee cup for the current Open Source workload and situation.

truly a wild time to be alive when the cryptography world is split between those worried about quantum computers and those whose private key is “4”

http://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

#eMudhra

it's Ursula Day! 💓

“You cannot buy the revolution. You cannot make the revolution. You can only be the revolution. It is in your spirit, or it is nowhere.”

“My imagination makes me human and makes me a fool; it gives me all the world and exiles me from it.”

and 50 more quotes.....

🌹 Ursula K. Le Guin, born on this day in 1929.