Home | Notifications | New Note | Local | Federated | Search | Logout
Federated Timeline
vertka@vertka@shitposter.world (2026-09-24 09:33:24)
early suya..
Reply to @gombang@social.nancengka.com
Gombang@gombang@social.nancengka.com (2026-09-24 09:17:34)
Trailernya https://itb.ac.id/multimedia/watch/meong-2026-trailer/4LI8k4Uo9pU/UUf2jprJ99sgJENjtPPvsfuw&sa=U
Reply to @icedquinn@blob.cat
ロミンありん@romin@shitposter.world (2026-09-24 09:15:31)
@icedquinn @anemone @feld @sun
>a common newbie failure is not checking points on the curve first
because you don't know when an ec operation is gonna land you on infinity, you need to check at every step and bail, that's why he introduced the twisted edwards representation, all points land on the curve no matter what, no exceptions
Reply to @icedquinn@blob.cat
Q.U.I.N.N.@icedquinn@blob.cat (2026-09-24 09:06:15)
@feld @anemone @romin @sun that being said when i read about ECC crypto i think djb had a comment that a common newbie failure is not checking points on the curve first. the whole point of the curvesafe stuff was to find ones that were hard to scuff. since ECC contains many curves, and its easy to forget to check a point in a domain somewhere, and this is one of those pwns that can even just legitimately be a simple mistake at 4am.
the part thats bonkers is they're using frameworks that already do all this for you. :blobcatwaitwhat: they correctly didn't roll their own, but they still just. failed to bother to put the data in the saltpack box in the first place.
i dunno how you even use libsodium wrong like this. it's hard to do. its specifically designed so you can't fuck it up. :cirno_for_reals:
Gombang@gombang@social.nancengka.com boosted:
@colincornaby@mastodon.social (2026-09-24 04:07:12)
RE: https://hachyderm.io/@thomasfuchs/117321763464226642
My theory is that there is a group of people that thought being a software engineer was an elite role that implied superior intelligence. Like being able to produce code made them the high priests of the computer. And after seeing an LLM generate code that compiles they’re undergoing a very public ego death.
Gombang@gombang@social.nancengka.com boosted:
@rchusid@universeodon.com (2026-09-24 08:19:49)
Report from ACLU & Amnesty International USA finds widespread suppression of pro-Palestine speech on college campuses.
https://www.aclu.org/press-releases/new-aclu-and-amnesty-international-usa-report-uncovers-widespread-suppression-of-pro-palestine-speech-across-college-campuses
Reply to @feld@friedcheese.us
Q.U.I.N.N.@icedquinn@blob.cat (2026-09-24 09:03:35)
@feld @anemone @romin @sun i feel like something like heartbleed is a very different story to "auth=none."
the JWT style breaches are so absolutely catastrophically bad in that they are so well documented that literally just asking claude to look at your code would have probably gotten you slapped. it's a special kind of incompetence.
Reply to @sun@shitposter.world
Only 3 Easy Payments of $19.95@feld@friedcheese.us (2026-09-24 09:01:03)
@sun @icedquinn @anemone @romin it's not like Debian or RHEL have ever fucked up something like that before
I know somewhere in the hall of shame is a completely new CVE caused by Debian trying to backport an Apache CVE fix and they did it wrong
Reply to @sun@shitposter.world
Blurry Moon@sun@shitposter.world (2026-09-24 08:58:18)
@romin @anemone @icedquinn do I know my linux distribution didn't fuck up one of its ssh backport patches for LTS? no, I don't.
Reply to @romin@shitposter.world
Blurry Moon@sun@shitposter.world (2026-09-24 08:57:38)
@romin @anemone @icedquinn yes it is because like I said I don't have the ability to check even a single security thing.
Reply to @sun@shitposter.world
ロミンありん@romin@shitposter.world (2026-09-24 08:56:27)
@sun @icedquinn @anemone git leverages https and ssh for the transport/auth stuff, it's not remotely comparable
Gombang@gombang@social.nancengka.com boosted:
@stanfromireland@mastodon.social (2026-09-24 01:10:12)
I'm happy to announce that the Python documentation is now available in Persian! 🎉
See the announcement for more information: https://blog.python.org/2026/09/the-python-documentation-is-now-available-in-persian/
Reply to @icedquinn@blob.cat
Blurry Moon@sun@shitposter.world (2026-09-24 08:54:35)
@icedquinn @anemone @romin I regret saying I'm moving to it but tbh I have absolutely no way to personally verify git or anything else either.
Gombang@gombang@social.nancengka.com (2026-09-24 08:54:26)
Film tentang kucing kampus ITB menang festival 😅
https://bandung.kompas.com/read/2026/09/22/191958778/kisah-siti-kucing-kampus-itb-bawa-film-meong-menang-di-festival
Reply to @romin@shitposter.world
Blurry Moon@sun@shitposter.world (2026-09-24 08:53:09)
@romin @icedquinn @anemone i have no problem vibe coding stuff but I'm personally not gonna vibe code cryptography except as an experiment
Reply to @romin@shitposter.world
Q.U.I.N.N.@icedquinn@blob.cat (2026-09-24 08:49:41)
@romin @anemone @sun i don't think i ever shilled it personally :blobcatgoogly: i remember posting about it very tentatively, trying it a little bit, and concluding the UX for private repos was very bad.
apparently it was so bad nobody bothered to notice it was entirely broken the whole time :cirno_for_reals:
Reply to @icedquinn@blob.cat
ロミンありん@romin@shitposter.world (2026-09-24 08:47:56)
@icedquinn @anemone @sun I find it extremely funny because I clearly remember reading that paragraph about the noise protocol months ago when some people were shilling it here, so aislop is the only conclusion to derive from this
Reply to @romin@shitposter.world
Q.U.I.N.N.@icedquinn@blob.cat (2026-09-24 08:44:09)
@romin @anemone @sun i did make the joke in meatspace "tell me you vibe coded this without telling me you vibe code" in response to how truly bad this is as a CVE.
Reply to @sun@shitposter.world
ロミンありん@romin@shitposter.world (2026-09-24 08:43:06)
@sun @anemone
meanwhile in their protocol guide:
>Connections between peers in the Radicle network are encrypted using a Noise protocol handshake. This begins with two peers performing a Diffie-Hellman key exchange to agree on a shared session key that is used for the duration of the connection.
It's like they asked an AI to write the docs and another different one to write the implementation :l_hehe:
Blurry Moon@sun@shitposter.world boosted:
@mangeurdenuage@shitposter.world (2026-09-24 03:07:10)
---Attachments---
image: https://media.shitposter.world/shitposter.club/19/38/88/1938886c8f817e326d1f0772c80b66361d29b2f45e6a3daa93ee7accdaa0037d.webp?name=qDqNaxClIea3Pw.webp
Reply to @tomkalei@mathe.social
Tony Vladusich@TonyVladusich@mathstodon.xyz (2026-09-24 08:36:59)
@tomkalei @johncarlosbaez
Hard agree. Stated bluntly: Fuck big tech and the high horse of “theorem proof” it rode in on.
Ron Chusid@rchusid@universeodon.com (2026-09-24 08:19:49)
Report from ACLU & Amnesty International USA finds widespread suppression of pro-Palestine speech on college campuses.
https://www.aclu.org/press-releases/new-aclu-and-amnesty-international-usa-report-uncovers-widespread-suppression-of-pro-palestine-speech-across-college-campuses
Reply to @anemone@ebiverse.social
Blurry Moon@sun@shitposter.world (2026-09-24 08:14:07)
@anemone apparently not I guess let’s go back to my gitea
Gombang@gombang@social.nancengka.com boosted:
@omgubuntu@floss.social (2026-09-24 08:02:22)
RE: https://floss.social/@kde/117322549131682125
Is Linux now an entertainment franchise?
I only hear of these continual dramas days after the fact. I’m not sure if it's a dereliction of duty (I write a blog about Linux) or, weirdly, the healthiest possible relationship one can have with the internet in 2026 (I do mute a lot of words 💀).
Either way, it feels like Linux discourse is now permanently hooked up to an IV drip of outrage. We'd have months without something to reflexively react to as a community – now it's barely 24 hours.
omg! ubuntu@omgubuntu@floss.social (2026-09-24 08:02:22)
RE: https://floss.social/@kde/117322549131682125
Is Linux now an entertainment franchise?
I only hear of these continual dramas days after the fact. I’m not sure if it's a dereliction of duty (I write a blog about Linux) or, weirdly, the healthiest possible relationship one can have with the internet in 2026 (I do mute a lot of words 💀).
Either way, it feels like Linux discourse is now permanently hooked up to an IV drip of outrage. We'd have months without something to reflexively react to as a community – now it's barely 24 hours.
Reply to @sun@shitposter.world
amenome@anemone@ebiverse.social (2026-09-24 08:01:19)
@sun@shitposter.world anything else like this not written by morons?
classic mametschko@mametsuko@mk.absturztau.be boosted:
@Erpel@hai.z0ne.social (2026-09-23 15:41:04)
TIL: There are model train layouts for rent in Japan, so you can run your trains without owning a layout yourself. :blobcatgooglyshrug:
classic mametschko@mametsuko@mk.absturztau.be (2026-09-24 07:46:32)
:blurbsleep:
Reply to @mangeurdenuage@shitposter.world
Blurry Moon@sun@shitposter.world (2026-09-24 07:38:10)
@mangeurdenuage whats this
Gombang@gombang@social.nancengka.com (2026-09-24 07:35:24)
Batak kontol?
RE: https://synthehai.z0ne.social/users/nonsense/statuses/01M385GWQCA2Q6ZHB95DEMA0R3
Older Notes