mastodon - Link to source

Just to be clear, I am currently dumping elliptic curve keys from the tls certificate transparency logs, and will then be running an optimized mass-cracker tool that I'll use to check a few trillion weak private keys against the entire set simultaneously using sparse bloom filters.

The scanner (which is being heavily cribbed from my mass cryptocurrency key cracker "brainflayer") should be able to scan hundreds of thousands if not millions of keys per curve per second per core.

I am not aware of anyone else having previously done this, so hold on to your butts.

mastodon - Link to source
10-alarm fire for #gitlab installs: docs.gitlab.com/releases/patch…

GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 | GitLab Docs

Learn more about GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).
Félix Veillette-Potvin (GitLab Docs)
#gitlab
mastodon - Link to source
I used to write short stories. I asked ChatGPT to review them, and apparently my characters avoid painful self-knowledge with deadpan jokes. I now can't escape the suspicion that auto-correct-on-steroids understands my writing better than I do.
in reply to MFennVT
mastodon - Link to source

Stuck_Here

@MFennVT
Yep. It understands nothing. It's a language calculator making a predictive answer based on reams of stolen data. But, it probably did give a right answer that any book club veteran could have given.

Fesser should rethink their own coping mechanisms used in relationships.

@MFennVT
mastodon - Link to source
More a snitch than a fess. I work in admin for a national courier firm. When you get those "how did the driver do?" feedback emails you are enabling their maximum profit business model by completing them. There are no area managers because you are doing the job for them for free.
mastodon - Link to source

GitLab treu una actualització de seguretat que corregeix una execucció remota de codi sense autenticació per un desbordament d'enter al motor de regex Onigmo. Afecta tots els self-managed des de la 7.0 (2014).

QUIN DIA AMICS…

thehackernews.com/2026/10/crit…

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.
The Hacker News
mastodon - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.

Apple appears to have rolled the eMudra distrust into their native root program, but **not** into `/etc/ssl/cert.pem`, meaning that macOS supplied tools like `curl` and the system Python are still affected by the compromised intermediates.

setting `CURL_SSL_BACKEND=secure-transport` redirects the system curl to the platform verifier, but it's not great that every macOS host is trivially MITM-able by default at the moment.

gotosocial - Link to source
the PHP security bug patch is a nightmare, our server is patched but this thing looks more like a desperate attempt to patch hundreds of different leaks than a straightforward single bugfix, I do not trust that this is over…
mastodon - Link to source
I've made 15 albums, which you might think would have taught me something about promoting music. Unfortunately most of what I've learned is how to make another album. Anyway, lots of electronic/indie/gothy stuff here. limneticvillains.bandcamp.com

Limnetic Villains

Press contact: limneticv@gmail.com
Limnetic Villains
in reply to Limnetic Villains
mastodon - Link to source

william ⁂ maggos

in a better world, creators wouldn't be doing promotion. but also nobody would be paid to do it.

we'd instead have a great mostly frictionless system where great stuff would be shared via the word of mouth (boosts) of their fans. And for music...an internet radio DJ ecosystem of curators paid to crate dig and be honest about what they find.

mastodon - Link to source

I know people have a whole set of feelings around this and so do I, but “we made a dot-release so users running unsupported configurations or forks don’t get hung out to dry” is not something you will get anywhere else from anyone else.

Love and respect to the whole team this week.

Frederik Braun �

2026-10-21 08:03:10

mastodon - Link to source

this is one of the reasons we also made a dot-release. To protect users in unsupported configurations and convey the urgency

in reply to mhoye but seasonally spooky
glitchsoc - Link to source

ǝʌɐp

I run forks usually and this hadn't even crossed my mind. Checked on my zen and ironfox installs this morning and it seems like the revocations worked. Really just very thankful for everyone working to get this patched up.
mastodon - Link to source
Wenn der Nachrichtensprecher im Dudelfunk plötzlich statt Kriegsmeldungen etwas von PHP-Sicherheitslücken faselt ist das schon irgendwie befremdlich. Nun denn: Webserver, lokale Entwicklungsumgebungen und eine Radioplattform nach besten Wissen abgedichtet, die Hetzner-Nextcloud läuft inzwischen auch wieder. Dann kann ich ja erst mal beruhigt ins Bett gehen. Allen Admins eine pannenfreie Nachtschicht! 👍 ☕
glitchsoc - Link to source
With all the zero day issues with PHP currently going on, I have a legit question, as someone who is in no way a security or programming expert. If you execute code via the web, which I assume is what a remote code execution vulnerability basically is, how would you know if your code executed? Would you literally see a shell in your web browser instead of like an error page. Or would you have to log on to an SSH server of the target you are attacking after you submit a malformed HTTP request or something like that? I'm more a networking nerd, programming stuff overloads my brain, but whenever I hear of issues like this, especially severe ones that are so severe, I've already had 2 of my server providers inform me about them, I just wonder how that all works. I don't run PHP on any of my resources, but I just wonder how a component of a server that's meant to serve content and files, can turn into a way for you to access the whole system. A separate service does that, so I just wonder.
mastodon - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.

Walkin'

#MastoArt #FediArt #FresnoNightcrawler #Cryptids #illustration

#illustration #mastoart #fediart #fresnonightcrawler #cryptids
mastodon - Link to source

Please stop anthropomorphizing AI company executives.

They're not sentient and they can't actually think. They just predict the next token using statistical patterns scraped from LinkedIn, X and the Financial Times. The apparent "understanding" is simply a parlor trick: They produce text strings that *sound* plausible, but they don't actually have any understanding of the world.

I'll grant that they became a lot more technically impressive when Reinforcement Learning from Investor Sentiment pipelines were introduced, but fundamentally they're still just stochastic bullshit generators. Running them in a loop and giving them access to the internet will end up being the most expensive mistake in the history of technology.

This entry was edited (today, 9:28 PM)
mastodon - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.

Prorrogamos a chamada para palestras do GNOME Latam 2026 até 31 de outubro!

Ainda não enviou sua proposta?

Esta é sua chance de fazer parte do evento realizado junto com a CCOSS, que une a comunidade @gnome na América Latina.

Compartilhe sua experiência como palestrante!

Inscreva-se aqui: events.gnome.org/e/latam2026

#GNOME #Latam #SoftwareLivre

GNOME Latam 2026

GNOME Latam & CCOSS 2026 12 al 14 de noviembre | Universidad Anáhuac Mayab (Mérida, Yucatán, México) & Track en línea.
GNOME Events (Indico)
#gnome #latam #SoftwareLivre @GNOME
mastodon - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.

¡Extendimos el llamado a charlas de GNOME Latam 2026 hasta el 31 de octubre!

¿Aún no envías tu propuesta?

Esta es tu oportunidad de ser parte del evento impulsado junto a CCOSS que une a la comunidad de @gnome en América Latina.

¡Comparte tu experiencia como ponente!

Postúlate aquí: events.gnome.org/e/latam2026

#GNOME #Latam #SoftwareLibre

GNOME Latam 2026

GNOME Latam & CCOSS 2026 12 al 14 de noviembre | Universidad Anáhuac Mayab (Mérida, Yucatán, México) & Track en línea.
GNOME Events (Indico)
#gnome #softwarelibre #latam @GNOME
ActivityPub - Link to source

¿Cuál es tu tipo?

Este curso me ha tocado en suerte (y lo está siendo) dar la pseudo asignatura de «Atención educativa» una asignatura con nota, pero sin contenido curricular, que tiene que aprobarse pero que no cuenta para la media y que está ahí porque algo hay que hacer con el alumnado que no cursa Religión. La idea de quitar esa hora y que las criaturas salgan una hora antes los viernes, por ejemplo, no se baraja.

Al tratarse de una asignatura de una hora, se utiliza para rellenar huecos en horarios, así que la plantilla que se encarga de ella tiene profesores de todas las especialidades. Te puedes imaginar la angustia de algunos profesores al abordar una materia sin libro de texto (aunque hay algunos, por lo que se ve hay demanda), sin un contenido marcado, en la que supuestamente hay que tratar temas interdisciplinares relacionados con los valores, la educación cívica y blabliblú. Palidecen. No obstante, a mí me encanta la idea: todo son posibilidades. Así que este año, que la tengo en 3º de ESO, he decidido abordarla tratando diversos temas a través de recursos que pueden leerse/verse en un ratito para que el grueso de la clase consista en los chavales y chavalas hablando del tema que toque. Estoy tirando mucho de poemas y, sobre todo, de canciones. Y se lo están pasando muy bien. Y yo con ellos.

Hoy, por ejemplo, tocaba el tema de la superficialidad y el «culto al cuerpo». Normalmente primero pongo el recurso (hoy tocaba la canción «Guapos y guapas» de El Kanka) y luego charlamos. Pero en esta ocasión le di la vuelta un poco a la dinámica. Antes de proponer el tema, ni qué íbamos a escuchar, sin darles contexto escribí en la pizarra la pregunta «¿Cuál es tu tipo?» y les invité a ir hablando.

Lo primero que encontré fue desconcierto. Las chicas se desconcertaban porque no confiaban en estar entendiendo la pregunta. Algunos chicos porque no sabían si era adecuado decir lo que iban a decir.

La cosa es que yo preparé la clase así con la expectativa de señalar la importancia que damos al físico cuando pensamos en escoger a un compañero/a de vida (por el tiempo que sea) cuando la parte no física (personalidad, hábitos, virtudes y defectos) es fundamental. Pues me han reventado la clase para bien.

En el primer grupo, más masculinizado, bastantes chicos han dicho lo que seguramente esperas: que si culonas, que si pechos grandes, blabla. Pero también han mencionado que fuesen buenas comunicándose, que les dijesen claramente las cosas, que no fumasen... Y las chicas, aunque también han mencionado rasgos físicos, han tirado mucho a cuestiones menos estéticas. Ojo: no supero lo importantísima que es la altura para todos ellos. Parece que si la chica no es más baja que el chico o el chico más alto que la chica, como quieras, la pareja no es posible. Finalmente, puedo decir que el balance de requisitos físicos – requisitos no físicos fue como de un tercio a dos tercios.

En el segundo grupo, con muchas más chicas que chicos, la parte de características o requisitos relacionados con los hábitos, la personalidad, el trato y los valores era abrumadoramente mayor que los requisitos físicos. Creo que llené una mitad de la pizarra con requisitos no físicos y que requisitos relacionados con el físico o la apariencia había como cinco o seis. También me llamó la atención que los chicos en este grupo, al no tener demasiado apoyo de iguales con una expresión más tradicional de la masculinidad fueron muchísimo más moderados en su expresión.

Salieron reflexiones muy interesantes de ellos. Un alumno me decía que un requisito es que la chica esté en un buen momento emocionalmente: «Si tienes problemas de salud mental y demás, no estás en un buen momento para una relación.» En ambos grupos hablaron de que es mucho más fácil encontrar a alguien guapo que a una buena persona. Muchas de ellas afirmaban que esas características a las que dan importancia se encuentran más fácilmente en sus amigas que en los chicos. La mayoría de ellos y ellas (salvo, casualmente, los que expresaban una masculinidad más tradicional y dos chicas que también me recuerdan mucho a las adolescentas de mi época) decían que esos requisitos no son opcionales y que si hay que estar si pareja pues se está: no se rebaja en estándar.

No sé. Llevo poco de curso, pocas clases de esta asignatura, pero me alucina el software que traen puesto las nuevas generaciones. Yo con su edad, (14-15 años, ojo) no estaba ni cerca de tener las cosas tan claras. De hecho, algunas de las cosas que ellos y, sobre todo, ellas asumen con toda naturalidad a mí me llevó bastantes años aprenderlas.

Me da la sensación de que estas clases me van a dar para mucha reflexión así que: seguiremos informando.

Este post ha sido creado sin la intervención de Large Language Models/Inteligencia Artificial Generativa. Si quieres dejarme un comentario puedes hacerlo a través de mi correo electrónico o de mi cuenta de Mastodon

mastodon - Link to source
Target has an open roll for a Senior Accessibility Consultant. This position is hybrid in MN. If you are interested in working with a fabulous group of humans, please apply.
target.wd5.myworkdayjobs.com/t…

Senior Accessibility Consultant

The pay range is $88,000.00 - $158,000.00 Pay is based on several factors which vary based on position. These include labor markets and in some instances may include education, work experience and certifications.
target.wd5.myworkdayjobs.com
glitchsoc - Link to source

I got this from X. Sorry to read this, I remember Dan Davis on ESPN radio back in the day. This is from X.
Adam Schefter, Retweet, ESPN PR, ESPN remembers Dan Davis, an ESPN Radio founding member, who passed away Wednesday

Starting Jan. '92, Davis served as a host & update reporter

Upon retiring in '11, colleagues paid tribute to 'The Duke' celebrating his unmistakable voice & contributions: bit.ly/4jyXJLE, One

mastodon - Link to source
Here's a mystery behavior on VoiceOver on macOS! VO+Space stopped working on anything identified as buttons, pop-up buttons, checkboxes, etc. VO+Space does work normally on anything that does not indicate button, checkbox, or other control. I tried rebootting, resetting all VoiceOver settings from VoiceOver utilities. Could anyone suggest a fix or offer a theory about what might be causing this? I would also appreciate boost. #accessibility #MacOS #VoiceOver @FreakyFwoof @vick21 @ZBennoui
#Accessibility #MACOS #voiceover @victor tsaran @Andre Louis @Zach Bennoui

reshared this

mastodon - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.
iOS 27.2 reveals Apple’s Messages app could soon get highly requested change 9to5mac.com/2026/10/21/ios-27-…

iOS 27.2 reveals Apple’s Messages app could soon get highly requested change

iOS 27.2 hints at a forthcoming Messages app change: the ability to exclude muted conversations from the unread badge count.
Ryan Christoffel (9to5Mac)
mastodon - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.

This is going to be such a beautiful thing.

9to5Mac

2026-10-21 20:55:08

mastodon - Link to source

iOS 27.2 reveals Apple’s Messages app could soon get highly requested change 9to5mac.com/2026/10/21/ios-27-…

iOS 27.2 reveals Apple’s Messages app could soon get highly requested change

iOS 27.2 hints at a forthcoming Messages app change: the ability to exclude muted conversations from the unread badge count.
Ryan Christoffel (9to5Mac)
mastodon - Link to source
Good day folks. Needless to say, I think the majjority monitoring this feed are well aware that the house is very much five alarm on fire here for a lot of us folks today. I just wanted to pop in here and mention that we have had to have a forced upgrade to patch several very severe vulnerabilities that mark as at least 92% of the worst possible outcome. There was no time for a schedule. No time to warn. So since I really don't like that outcome, but felt backed into a corner while doing it, I am asking the community to please offer feedback if any, remember what they say though, if nothing nice to say, say nothing. But if you have something constructive, I am welcome and open to hearing it. This may have resulted in some serious interface changes that I have not even had time to fully review myself. I believe they are rolling Mastodon 5.0 features, but I have no idea if that is rolling into the Glitch fork we are running. Well, I am getting on top of all this, and I do apologize for riding behind the wave on this one. We'll figure it out together. With apologies, and hope for the best here on our little Some Place Social.
This entry was edited (today, 7:25 PM)
mastodon - Link to source
The media in this post is not displayed to visitors. To view it, please go to the original post.

Expect quite a few sites to return error pages today and possibly through the week. Here's my piece on the new PHP zero-day that affects about 70 percent of the Internet. We'll be updating the story with important new developments.

krebsonsecurity.com/2026/10/wi…

#php #zero-day #security

Widespread PHP Flaw May Cause Many Site Outages Today – Krebs on Security

krebsonsecurity.com
#security #php #zero
This entry was edited (today, 8:35 PM)
in reply to d
mastodon - Link to source

Alan Miller 🇺🇦

@d purity is an amazing thing, but perhaps not incredibly useful. It must be wonderful to be able to throw everything away and rebuild from scratch when a new programming language comes around.

Worth noting that WordPress (on which a large percentage of the Internet runs) is written in PHP. So are plenty of content management systems running major news sites.

@d
in reply to daniel:// stenberg://
mastodon - Link to source

daniel:// stenberg://

A related PR: github.com/curl/curl/pull/2354…

urlapi: check host for bad content after IDN decode by bagder · Pull Request #23545 · curl/curl

Turns out there are UTF-8 sequences that convert to characters that are illegal in hostnames, and might even be URL separators. Make sure return error. Unfortunately, since the URL parser does not ...
GitHub
in reply to Cassandrich
mastodon - Link to source

Cassandrich

OK, I think the fullwidth @ is valid because @ is valid *in domain name labels*. However it should not be represented as @ in the output, just like a . inside a label should not be represented as a . since that is a label separator. The @ should probably be represented in the output as \@.

The rules for hostnames are much more restrictive than for domain name labels, and do not allow either of these. So regardless of what libidn2 does, the result should be filtered for "is this label valid in a hostname?" before doing anything with it.