And if you only accept mail from Google and Microsoft, running your own mail server kinda serves no privacy or autonomy purpose, since Google/Microsoft already see all the mail you send/receive on the other end anyway. 🤡

Huge "I got mine, fuck you" energy.

Huge red flag that someone is probably going to be a person I don't like:

They run their own mail server, and it refuses mail from anyone else who runs their own mail server.

🤦

I would recommend upgrading OpenSSH (or just disabling password auth) if you use any non-mainstream-glibc, non-OpenBSD systems - not only musl.

I don't know any in particular to be vulnerable and multiple things would probably have to come together for that to happen, but the property (a difference in crypt() behavior that Theo has known about for decades) is not unique to musl, and it's plausible that other systems are affected too.

Mail, and running your own mail, is not hard at all when you're doing it on an individual personal mail scale and not sending spam (or any other kind of bulk/automated mailings you want to pretend aren't spam).

I was just noting how much I love it, and that I really need to polish up and publish my mail system.

Test mail from myself is literally 12 (11+envelope) headers.

(Envelope) From, Return-Path, a single Received, Date, From, To, Subject, Message-ID, MIME-Version, Content-Type, Content-Disposition, and User-Agent.

Only the first 3 actually come from the transport, and half of the rest are optional stuff the MUA put there.

And the whole thing was end-to-end encrypted.

I've had an account note on Graham Perrin for a while now, that's apparently migrated with his jumping between instances. In addition to mod abuse shit and hostile AI-pusher engagements, he's also used the R slur.

Some fedi moderation abuse shit I just saw:

Apparently Graham Perrin, big AI pusher and FreeBSD reddit mod who jumps around various fedi accounts that aren't clearly identified as him, organized a false reporting campaign against Tomáš (Unix Surrealism) because he didn't like a post mocking the fascist dotfile cult Omarchy. Tomáš was at least temporarily suspended from infosec.exchange and probably lost all relationships on that instance.

Graham is the kind of person who should not be welcome on fedi.

First of all, slop is slop because of provenance. Provenance is not a function of content. It's a function of how that content came to be. Provenance is what makes "the same sentence" plagiarism or not-plagiarism in different contexts, what makes "the same apple" organic or not-organic in different contexts.

Why is slop still slop, even if the patch is small, you reviewed it, and after reviewing it you think it matches what you would do?

A short 🧵

Speaking of mitigations, I suspect there's an easy binary patching one, locating the OOM handling function and (for x86) replacing the first 2 bytes with 0F 0B.

Polar opposite of the usual vuln announcement of the form:

OMG THE WORLD IS ENDING YOU WILL GET PWNED IF YOU DO NOT DOWNLOAD OUR LATEST VERSION WITH ALL SORTS OF ANTIFEATURES ALONGSIDE THE VULN FIX RIGHT THIS MINUTE THIS IS NOT A DRILL ROFLMAO U NEWBS!!!!!!!!!!!1111

The PHP vuln advisory is a textbook example of how to do it right. Huge props to them!

https://www.php.net/archive/2026.php#2026-10-21-5

Specifically, it details:

- what went wrong

- what is and isn't known about who is affected (e.g. for the OOM one, Apache mod_php definitely is, FPM may be but isn't known)

- what mitigations are available if patching/updating is not possible, and whether they are partial or full

- sufficient information to roll your own further mitigations if needed (e.g. I think you could setup policies to terminate the process on OOM rather than letting it continue to the vulnerable OOM handler)

Everyone else: happy their browser automatically distrusted the bad CAs.

Me: digging into what else Firefox can change through the phone-home backdoor it used to figure out it should distrust the bad CAs and how tf you're supposed to block that.

Anyone remember vrms? It was/is(?) a silly program to audit your installed deb packages to see if you have anything non-free installed.

I think we need a "vantifa". It would audit your installed packages for things with known far-right ties and display the receipts. And being how much stuff now is not installed software but saas/webapps, I think it'd be useful to have it also audit your browser history and report the same for sites you visit frequently.

It also reminds me of learning offhand (no particular traumatic experience, thankfully) as a child of how the law basically treats all animals, pets included, as cattle, and always has, and being horrified at the mindset of adults who would build such a system.

Our servers or devices are not living beings, but the "cattle not pets" ideology still has us treating people's precious data the same way these monsters have always treated "lesser beings".

I think it's that it's a call to adopt the mindset of the worst people throughout history, the ones who have deemed themselves above other life forms (including humans) on such a level that they are something aggregate to be managed for profit on a ridiculous scale beyond that which any one being should control, not something to care for. Something that it's even *shameful* to care for.

Was just reminded of how much I *viscerally* hate the "cattle not pets" ideology. I want to say more on this but I don't even know where to begin.

With the locale overhaul project drawing to a conclusion in the next couple weeks, I'll be back to not having any funded projects on #musl.

I would really like to get some funding for C23 support (this is a mix of merging/revising existing patches and writing some new code) and POSIX 2024 support (some new code, lots of review of new specification text and bringing existing code for newly-standardized stuff up into conformance) as the next big project(s).

Any good leads on making this happen would be most welcome!