How hard could it be?
Prague, Czech Republic
Joined July 2016
- Tweets36.4K
- Following3.6K
- Followers1.3K
- Likes29K
Pinned Tweet
Got the Mazda Connect infotainment running under QEMU with software rendering using Astra
It had to implement many auxiliary modules (I didn't want to patch anything out except genuine bugs in the firmware) but did so in ~4h. Also have a worktree with a QEMU GPU implementation.
Patrik retweeted
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Patrik retweeted
I don't think you guys appreciate just how bad Gemini is at agentic work. The hallucination rates are truly surreal.
In one run, it hallucinated:
- line numbers (quoted line 173 in a 72-line file)
- random ip addresses
- command/script arguments
- function exports and returns
Patrik retweeted
Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server
Can @1Password stop fucking assuming my username/email is my legal name if it doesn’t see both in the form at the time of submission?
When would I ever fucking log in with my full legal name as the username to a website? Why is that the default fallback if it doesn’t know?
Patrik retweeted
>junior dev at a mid startup
>wednesday morning
>just want to push a minor bugfix to our php app today
>open laptop, check slack
>company group chat is an absolute warzone
>CTO typing in all caps about php2shell
>fucking php
>whatever, server hasn't blown up yet, I just need to get my code in
>open gitlab to merge the PR
>forced emergency logout because of a critical gitlab security patch release
>fucking gitlab
>pipeline fails because of some weird regex compiler bug
>spend 40 minutes fighting CI/CD
>i can just use AI to help debug
>fire up opencode
>api keys nuked because they were breached
>fucking opencode
>i’ll just get fresh LLM api keys from our corp proxy, LiteLLM
>it won’t connect? It’s down?
>look up LiteLLM news: supply chain compromise
>fucking litellm
>cold sweat forming
>slack alert: db connection error
>check our database connection
>we host on TiDB Cloud
>they just announced a security breach, unauthorized access via stolen service account credentials, data copied
>fucking tidb cloud
>full panic attack incoming
>figure fuck it, just ship the container to Railway and go home
>open Railway dashboard
>bright red banner: "Security Disclosure: Rotate all environment variables immediately. All builds paused."
>fucking railway
>try to open the app URL in browser to see if anything is even working
>NET::ERR_CERT_AUTHORITY_INVALID
>eMudhra intermediate certificates compromised
>4
>instantly untrusted by every major browser
>fucking emudhra
>stare blankly at mac screen for 10min
>random pop-up
>restarting in 10min to fix a critical vulnerability
>fucking macos
>close laptop
>leave office
>never come back
Patrik retweeted
New from Vercel Labs: tsc-ts
TypeScript was written in TypeScript
Then rewritten in Go
We ported it back to TypeScript
Compiled it with scriptc
And it's 2-4x faster than tsgo
Patrik retweeted
I really wanted to see what the HomeView setup UI looks like on device, so I adapted my little ESP32 Apple accessory emulator firmware to broadcast its Bluetooth advertisements 😅
Patrik retweeted
Please don't mess with ADB Sideload.
This is fine, but don't start pulling ADB sideload because you got pressure from one state actor.
Be strong and tell them no.
If you pull that down the road, you will guarantee the geeks go all in on Pocket Linux. And they'll credit you.
In the past we would make a general solution that lots of people can use and share it, nowadays everyone slops out their own version...idk I'm not a fan of the long term effects of this.
Also, the answer is Home Assistant, saved you some tokens.
