TL;DR: is your refrigerator running malware? If so, you better catch it!
Subscribe
Thoughts and musings from Xe Iaso
- Generator
- Lume v2.2.0
- Public lists
- davewiner/hackerNewsStars
- Fetched
Presigned URLs are technically a security vuln
A presigned URL is a replay attack you did on purpose.
Replayable auth tokens are the textbook way to create vulnerable systems, but
Tigris ships them as a first-class feature with presigned URLs and so does every
other object storage system on the pl...
The console wars have been lost
Valve wins by doing absolutely nothing
Agents are monads (but not that kind)
I managed to write this without using the word endofunctor once. Wait, shit, I just did. Uhhh, oops!
"No way to prevent this" say users of only language where this regularly happens
In the hours following the release of CVE-2026-8461 for the project FFmpeg, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix an out-of-bounds write in the MagicYUV decoder (libavcodec/magicyuv.c) c...
"No way to prevent this" say users of only language where this regularly happens
In the hours following the release of CVE-2026-55200 for the project libssh2, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix an out-of-bounds write in ssh2_transport_read() due to a missing upper...
I taught a bucket to speak git
What happens if I just point a git server at an object storage bucket?
Back when I was porting
agent sandboxes to Go, I
built everything on top of
billy, a filesystem
abstraction for Go. The whole trick of the project was teaching a Ti...
I hate compilers
You'd think that given the same bytes of input you'd get the same bytes of output. lol. lmao. No, you don't. It's complicated.
Why are cached input tokens cheaper with AI services?
TL;DR: the GPU doesn't have to math as hard
"No way to prevent this" say users of only language where this regularly happens
In the hours following the release of CVE-2026-45447 for the project OpenSSL, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix a heap use-after-free in PKCS7_verify(). This is due to the affected c...
Giving your Go apps Tigris superpowers
Tigris is S3-compatible, which means you can point the AWS SDK at it and most things just work. The catch is that the Tigris-exclusive features—bucket forking, snapshots, object renaming, and the like—need verbose workarounds because the AWS SDK doesn't know they exist.
...
IPv6 zones in URLs are a mistake
Run away while you still can, it's not too late for you to avoid the curse of knowledge.
"No way to prevent this" say users of only package manager where this regularly happens
In the hours following the news that Redhat Insights' JavaScript packages fell
victim to a supply chain attack via NPM, developers and systems administrators
scrambled ensure all of their projects were unaffected from a supply chain attack that steals credent...
Dancing mad with sandboxing
Kefka is a Go-native shell sandbox with coreutils, Python via WebAssembly, and more. Learn the works of madness that went into making this happen!
"No way to prevent this" say users of only package manager where this regularly happens
In the hours following the news that art-template fell
victim to a supply chain attack via NPM, developers and systems administrators
scrambled ensure all of their projects were unaffected from a supply chain attack where attackers have controlled the reposit...
"No way to prevent this" say users of only language where this regularly happens
In the hours following the release of CVE-2026-45250 for the project FreeBSD, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix a kernel stack overflow when validating permissions of the setcred(2) ...
"No way to prevent this" say users of only language where this regularly happens
In the hours following the release of CVE-2026-45584 for the project Microsoft Windows, site reliability workers
and systems administrators scrambled to desperately rebuild and patch all their systems to fix a memory safety vulnerability resulting in arbitrary code ex...
Amazonbot is finally respecting robots.txt
Thanks for giving me a viable business model Amazon!
I'm really frustrated that GitLab is doing layoffs
Winning at this could have been so easy
Maybe you shouldn't install new software for a bit
Oh boy yet more linux kernel vulns
Claude Code won April Fools Day this year
They gave people a heckin tamagochi, what's not to like?
Small note about AI 'GPUs'
They are graphical processing units that can't process graphics.
Homelab downtime update: The fight for DNS supremacy
Turns out everything DID NOT go offline somehow. Yay!
My homelab will be down for at least 20 days
Dang, guess I have to suffer.
I don't know if I like working at higher levels of abstraction
AI tools push us to higher abstraction. I'm not sure I like what that costs us.
Some Thorns Have Roses
Recovery gave me things I didn't ask for and I'm not ready to give them back.
Vibe Coding Trip Report: Making a sponsor panel
I needed to ship this before my surgery, so I vibe coded it. It turned out well enough.
Using Clankers to Help Me Process Surgery
At 4 AM in recovery, the machines that never sleep turned out to be exactly the right company.
Advice for staying in the hospital for a week
Hard-won wisdom from a week of fluorescent lights and beeping machines.
The Unbound Scepter
My post-surgery medication stack gave me the most on-the-nose dream of my life.