Search posts, papers, and topics
Flock ALPR cameras run on severely outdated Android 8.1 and Linux 3.18, missing years of security patches. Analysis of leaked firmware revealed hard-coded API keys and plaintext Auth0 credentials, allowing access to Flock's backend for any camera given its MAC address.
Reproduces Mold’s linker benchmarks on a 16‑core Ryzen, shows that configuration (filesystem, delete‑output, fork) explains most of the Wild vs Mold speed gap, and notes recent Mold releases and upcoming Wild tweaks that close the gap.
Built a clean‑room OpenGL ES 3.0 Linux driver for Apple‑silicon M4/A18 Pro GPUs in ~4 weeks, covering reverse‑engineered firmware ABI, a Rust kernel driver, a custom IR/shader compiler, and user‑space Metal translation; achieved 200 fps Minecraft and WebGL demos, with heavy LLM assistance for debugging and code generation.
The authors show that the classic trusting‑trust attack is not limited to compilers: by tampering with GNU strip they can inject a payload that propagates through NixOS's bootstrap and ends up in almost every binary of the final system. The attack succeeds on a real nixpkgs revision, building a full graphical installer while backdooring the majority of its binaries.
A DIY home NAS built from a repurposed Zotac mini‑PC, 6×8 TB WD Red drives in a RAIDZ2 ZFS pool, encrypted boot, Wi‑Fi, custom Noctua cooling, and a front‑panel ESP32‑S3 touch screen driven by LVGL. Runs Kubuntu 24.04 with Docker‑Compose services behind Caddy, plus a self‑written dashboard and API.
The author swaps postmarketOS for an Ubuntu rootfs on a Lenovo IdeaPad Duet, discovers the device boots via Depthcharge using a FIT image, and explains why a UEFI‑capable firmware like U‑Boot is needed to run Ubuntu's kernel.
A detailed, personal review of Paul McKenney’s free online textbook on parallel programming. The author, coming from a TLA⁺/distributed‑systems background, finds the early chapters excellent for building intuition about CPU caches, memory ordering, and false‑sharing, but notes gaps (e.g., shallow coverage of C++11 atomics and MESI). The review is concrete, cites specific chapters, and offers prac…
Mozilla rotated its GPG signing subkey for Firefox and Thunderbird after the previous subkey was accidentally exposed. Users must import the new key (and revocation) and, on older RPM‑based systems, manually replace the old key to keep updates working.
Kubernetes v1.37 adds two alpha‑level storage hardening knobs: per‑volume `bindMountOptions` (e.g. noexec, nosuid, nodev) that affect the bind‑mount the runtime creates, and an `emptyDir` `mode` field to set Unix permission bits (including the sticky bit). Together they let you enforce least‑privilege policies on writable volumes without init‑containers or CSI tricks.
