👀 #i3wm

In case you’re looking for a Nintendo 64 controller which connects via USB-C and feels good to use, I can recommend the 8bitdo 64, e.g. https://www.galaxus.ch/de/s1/product/8bitdo-64-bluetooth-controller-android-pc-switch-switch-2-gaming-controller-66904542

[1/2] After a long debate we finally pulled the trigger.
Earlier this morning I merged support for writing leaf components, i.e., binaries, of #systemd in Rust.

Rust binaries are only marginally larger than C binaries.
We don't use cargo and the binaries behave exactly like C binaries (help, command line arguments etc).

I'm very happy this landed.

https://github.com/systemd/systemd/pull/44324

#php2shell was fixed in #NixOS with https://github.com/NixOS/nixpkgs/pull/576853

Until Hydra has caught up with package builds, you can pin to the commit directly (and compile PHP locally, no big deal): nix flake lock --override-input nixpkgs github:NixOS/nixpkgs/8c259fc0dd1f3ccc1aaf4f9156ab16b7328b5a4f

You can verify the PHP version is 8.4.27 afterwards.

> 2026-10-17 21:48 - Mozilla independently recover the keys without any tips, and send oh_dear.zip as proof using 'EM DV TLS CA - G3B'

oh_dear.zip 😂

FYI, https://github.com/NixOS/nixpkgs/issues/576485 is the #NixOS tracking issue for the CA issue

(Just updated my machines.)

🚨 Six WebPKI Intermediate CAs are compromised.

This is bigger than Heartbleed, but a client-side issue.

Anything that verifies certificates against public roots, like most TLS clients, is/was affected.

Details, live test, patched versions and workarounds at https://emudhra.we-have-a-problem.com

Act now.

I conduct periodic fire tests where I literally just unplug the server and see what I can recover from my onsite and offsite backups.

Literally- I pull the plug. That's not a euphemism, that is literally what I do.

Even if you don't self-host, this sort of backup strategy is what makes sense. Like the photos on your phone? Turn off your phone, put it in a drawer, and get at the photos using a laptop or desktop. If you can't do it, you don't have a backup, and should correct that.

Achievement unlocked: ran an emergency hot fix command on >>100k running VMs

Got it done in under 4 hours with a parallelism level of 1000 concurrent command executions :D

Me, an #Emacs user, explaining why I keep killing your X11 session every time I touch your keyboard

Hey Team, quick one before the weekend:

https://youtu.be/3TNpOD6bov8

New blog post: The forgetful CPU (Linux on M4)

Much clear. Most helpful.

TIL: In the speed-running category Drum%, you complete the game using a drum kit as input device 🤯

https://www.youtube.com/watch?v=93KJcGlBxmE

#speedrun #supermario64

Had a look at NixOS’s largest sources. Unsurprisingly, there are a number of different LLVM versions (same in Debian).

Notable: Ethereum blockchain projects that come with multiple gigabytes (!!) of testdata 🤨

Somewhat ironic: TinyGo needs GBs of microcontroller description files to produce kilobytes of code

New blog post: Debian Code Search: Fast TurboPFor with Go SIMD 🥳

This August, I accomplished what I wanted for many years: I deleted the last cgo dependency in Debian Code Search! This was made possible by Go’s recently introduced SIMD support, because now we can implement the TurboPFor integer compression format as efficiently — more efficiently, in fact, by using the newer AVX512 instruction set! — as the reference implementation.

https://michael.stapelberg.ch/posts/2026-09-06-dcs-fast-turbopfor-go-simd/

#golang #debian #simd

Paper: “Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation”

"""
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. […] On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages.
"""

https://arxiv.org/abs/2607.24888

The more you know, the dumber you think others are

Oh, and just in case you’re wondering "is AVX512 even worth it, I thought Intel CPUs don’t even ship that anymore":

AVX512 provides a massive speed-up for this use-case due to its more powerful instructions. I am running DCS on AMD CPUs, where Zen 4+ ships with AVX512, and I plan to keep on doing so.

I don’t care about Intel CPUs anymore now that they just keep dying — AMD is where my compute will be running on for the next years: https://michael.stapelberg.ch/posts/2025-09-07-bye-intel-hi-amd-9950x3d/

Milestone achieved! For Debian Code Search, I no longer need to use cgo to link in the AVX2-optimized TurboPFor C library that powers our index since 2019: https://michael.stapelberg.ch/posts/2019-09-29-dcs-positional-turbopfor-index/

Instead, thanks to Go 1.27’s SIMD support, I can use AVX2 (and AVX512) natively from Go :)

Turns out that upstream C TurboPFor does not use AVX512 yet, so my Go implementation is now *faster* than C (for our use-case) 😲

So, as of today, Debian Code Search is running with CGO_ENABLED=0 (and GOEXPERIMENT=simd GOAMD64=v3) 🎉

A blog post with more details is in the works, if you’re curious. Let me know if you run into any bugs.

#golang #debian #simd