Polybius Biotech's Eastnor Spaceport has been taken over. Leaked security footage from the facility's final hours, shows the rebel forces… throwing a sick party.
erincandescent 💜
@erincandescent.net
immigrant | software engineer in card payments | I wrote the initial draft of ActivityPub and now spend a lot of thing thinking about how we design social systems with better dynamics | long-form: https://blog.erincandescent.net/
If there's one thing my LLM loving and hating friends all agree on, it's that Dario Amodei (CEO of Anthropic) should shut the fuck up with his sinophobic rambling
It has taken all of a couple of months for work to go from "everyone gets a Claude license!" to "Sonnet is blocked and maybe tomorrow we'll block Opus too". Incredible levels of own-goal scoring from team Anthropic lately.
"Why am I having so much trouble concentrating on work today?" wonders woman who's forgotten to feed her caffeine addiction
On finding bugs in Ceph(X) (https://blog.erincandescent.net/2026/09/on-finding-bugs-in-ceph-x/)
On finding bugs in Ceph(X)
On the 28th August 2026, the Ceph project released fixes for CVE-2025-30156 and CVE-2026-39944. I first reported these to the project on the 20th December 2024; they were independently rediscovered in the meantime. These are high risk bugs that are also _extremely_ difficult to remediate, and require coordination across a lot of projects (not just Ceph itself, but the Linux kernel, Rook, and other related projects). They also required implementing methods of doing cluster key rotations. On the one hand, I understand why it took so long to fix these; on the other hand, it is still disappointing that the resolution timeline took over 18 months. Nontheless, my thanks to the Ceph team for their handling of this. These were human findings. Today, I expect you could throw an LLM at the Ceph codebase and these sorts of bugs would fall out quite quickly, but that wasn't the case in 2024. ## Background Ceph RGW has functionality which integrates with OpenStacks KeyStone, and also emulates the AWS STS API. I was investigating how these worked, looking at the possibility of doing an integration. As I was doing this, I noticed that the same `CryptoKeyHandler` class was used for to hold keys for both HMAC-SHA256 MACs and AES-CBC encryption. This piqued my curiosity; mixing keys with different algorithms like this is a code smell. In the end, the same keys are never reused with both, so while this is suboptimal design it isn't a security problem as written. However, this lead me to look at the AES-CBC encryption code, where I discovered that fixed keys were reused with hardcoded nonces. AES-CBC is not an authenticated-encryption mode (meaning it does not protect against message alteration, though it does hinder it), and also degrades in security significantly when nonces are reused. As I discovered, this use of AES-CBC was the _only_ protection applied to messages protected with CephX, and to RGW session tokens. As the CLYSO researchers who also found this bug demonstrated, it is possible to elevate privileges on vulnerable RGW installs with simple bitflips. This is sadly not a complicated issue to find; any junior cryptographic engineer should have several klaxons going off in their head at the sight of a hardcoded nonce without good justification. I was not searching through the Ceph codebase for a critical security vulnerability; I just happened to stumble upon it. ## Takeaways Ceph is an old project; the design of CephX likely predates the wide dissemination of the AEAD construct. We should pay attention to other codebases of similar vintage which also sometimes had to hand-roll their cryptographic protocols out of necessity.
blog.erincandescent.net
That's certainly a way you can write a one of script for a tool call but I don't think it's a way you should, Sol
I see everyone in FFXIV will be walking around in plug suits and carrying buster swords
I'm once again reminded of the fact that people who have never worked in banking have no idea how ridiculous the level of absolutely, no questions, fraudulent chargeback attempts there are against adult content.
"In a way, it’s a bit harder for me to talk about the values and design goals of ActivityPub. It happened in a larger standards group and involved a lot of passing of hands. I think if I were to be robust about it, I would also ask Evan Prodromou, Erin Shepherd, and Amy Guy to weigh in..." (1/n)
Christine Lemmer-Webber@dustyweb.bsky.social · 2y agoThree weeks ago I wrote "How decentralized is Bluesky really?" dustycloud.org/blog/how-dec... Shortly thereafter, @bnewbold.net wrote his response: whtwnd.com/bnewbold.net... I have written my (final) response blogpost: dustycloud.org/blog/re-re-b... And as last time, 🧵. Buckle up.
BREAKING: PHP: it's been used by Facebook, but could it be used for good? Click here for the story.
BREAKING: Criminalising witch hats "on table" according to UK's home secretary. The country's dramatic u-turn on traditional programmer clothing is taking many by surprise, they're now mandatory in most EU countries.
Facts. Deny lists can and will be abused. They've been abused on every platform that has them. But, the solution for that is "build guardrails to prevent that abuse" not "let's never have deny lists."
mekka okereke :verified: (@mekkaokereke@hachyderm.io)
This isn't an exhaustive list, but these 3 are fairly straightforward ones. And they're not new. You can seriously find Black users asking for these going back to 2017. Even trying to discuss these often results in: * You just don't know how the Fediverse works! * Shared deny lists can be abused, so let's never have them! * You just love Twitter! You want quote tweets! You want Elon to hurt you again!
hachyderm.io
MNNH News is proud to reiterate its continued place at the forefront of online breaking news, with a new presence on the future of federated social networking – Bluesky. Follow @mnnhnewsenglish.bsky.social for coverage on Bluesky
The truth is that the only way to have a nice, friendly community is to cultivate it; norms and culture are easily destroyed, and though how this is done varies based upon political leaning, the capacity for both intentional and accidental destruction is universal
dr. rich traditions, JD@helldude.bsky.social · 3y agorecalling the great mastodon migration of a couple years back: the initial giddy euphoria of new platform and a better community. and how within a couple months it all fell to shit in a cacophony of lefty infighting and recriminations
Technical interview question: On a hypothetical social network blocks and likes are public. Here's a list of IDs for transphobic politicians and journalists [list] and a social graph [graph]. Design a system to generate a list of trans folk and their supporters for targeted harassment. (45 mins)
So like, if I block (say) Trump, a bunch of his fanbase who monitor the list of people who block him turn up in my mentions to call me slurs? Inadvertently, this makes blocking someone a very public statement; a statement you may not wish to be published
Bluesky@bsky.app · 3y agoImportant: Similar to your likes, your block list is public data! While users of the Bluesky app can’t easily find this list now, the data is public and enumerable at the protocol level. This means that third-party apps or clients can surface and display your list.
New blog post: Right of Reply, or: who should be able to reply to your posts on a social network, and how do we technically enforce that?
blog.erinshepherd.net
CONSERVATIVES WERE RIGHT. I moved to California and within WEEKS, this guy set up a tent IN MY HOME and REFUSED to leave. He won’t pay rent and authorities won’t help AT ALL. This country is in shambles.
i was musing with a friend about how i hadn't figured out a good way to teach coworkers how to write code defensively (i work in payments! it's really important!!) and their comment was like "i don't know if it's teachable, i think it's called having (had) anxiety" and damn checks out
Interesing to observe that of the Distributed IDs supported by ATProto today: * `did:plc` (https://atproto.com/specs/did-plc) centralises identity * `did:web` decentralises it, but makes it nonportable (ActivityPub style)
DID Placeholder (did:plc) | AT Protocol
A hosted, secure registry of user DIDs.
atproto.com