Developer and open source enthusiast since Linux 1.2 (it came on a CD). Partner at 1984 Ventures - https://xitter.gq/t.co/FgYsE4skni
Atlanta, GA
Joined May 2008
- Tweets369
- Following767
- Followers3.4K
- Likes1.7K
Mark Percival retweeted
Hacked my own VPS last night with abliterated models. Took less than 10 minutes and $5 in inference, and got root level access to the box and all credentials.
Lots to process and share soon, but feeling deeply in touch with my eastern european roots this morning...
This is especially galling for those of us with root passwords longer than 255 characters. All that wasted time typing!
Mark Percival retweeted
Firezone Cloud EU is live 🇪🇺
Your account data stays in Sweden and France. Your encrypted traffic takes the shortest path worldwide.
EU data residency. Full-speed global access.
firezone.dev/blog/firezone-c…
Now is the time to go through your connected accounts on Google and ruthlessly cut access to anything not absolutely vital that has elevated access. This is how your email get hacked, even with 2FA - myaccount.google.com/linkeda…
Mark Percival retweeted
MPTCP is just one exploit vector - the use after free is actually in IPv4 options handling.
Simply dropping IPv4 packets with IP options may not be enough to fully mitigate.
See my post here: xitter.gq/jamilbk/status/2116950…
Here are my notes so far on CVE-2026-98432 after digging into this with Claude + defensive access:
1. Not just an MPTCP thing - any received IPv4 packet with options creates the problematic conditions.
2. Also appears that using NetLabel/CIPSO (SELinux or Smack with a CIPSOV4 mapping) creates the same conditions that a packet with IP options would. If you're using these, it might mean that dropping IPv4 packets with IP options might not fully mitigate.
3. At least for our test VMs in Azure (accelerated networking) I wasn't able to get any IPv4 packets with options through, from three different US-based ISPs. Unfortunately Microsoft publishes no docs on whether the fabric drops this or not, so YMMV.
We're using a simple XDP program to mitigate until a patched kernel is available:
github.com/jamilbk/drop-ipv4…
Honestly, your main machine should probably become a very locked-down UI for interacting with sandboxes. The threat to developers is higher than it's ever been.
To be fair, this is where we all should have been headed for years, but we ignored the early risks.
Mark Percival retweeted
Here are my notes so far on CVE-2026-98432 after digging into this with Claude + defensive access:
1. Not just an MPTCP thing - any received IPv4 packet with options creates the problematic conditions.
2. Also appears that using NetLabel/CIPSO (SELinux or Smack with a CIPSOV4 mapping) creates the same conditions that a packet with IP options would. If you're using these, it might mean that dropping IPv4 packets with IP options might not fully mitigate.
3. At least for our test VMs in Azure (accelerated networking) I wasn't able to get any IPv4 packets with options through, from three different US-based ISPs. Unfortunately Microsoft publishes no docs on whether the fabric drops this or not, so YMMV.
We're using a simple XDP program to mitigate until a patched kernel is available:
github.com/jamilbk/drop-ipv4…
I kind of figured these encrypted USB sticks were BS, but I assumed it was likely a terrible crypto implementation and something awful on the fingerprint reader side (hardcoded key) - but this is hilariously bad, almost trolling level.
tomshardware.com/tech-indust…
Mark Percival retweeted
What a disaster atlasum.net/blog/cve-2026-98…
Mark Percival retweeted
1/ Sam Altman argued this week that AI running on everyone's own computer is a misallocation of the world's limited memory and chips, which do more good shared in data centers.
I checked the numbers on a real, free AI model. Here it is in plain English. 🧵
sam: local inference is a terrible allocation of scarce resources
“a lot of people want local inference, and somehow they assume that the problem is solved now because we have open-source models, we're going to be able to run them on our computers, and so we're not going to need all the stuff in the data centre
but from a global allocation perspective, actually it's quite terrible to have everybody, like, have a bunch of the world's limited supply of DRAM sitting in their own computer and being used five percent of the time
you want maximum utilisation in the cloud if you're trying to deal with this very supply-constrained environment
somehow many people's intuition is the opposite of that”
This will be endless, it won’t be possible to toss enough prompts in there to protect all IP. But on the plus side, Anthropic’s behavior has been a real boost for open weight models. You don’t even need abliterated, vanilla GLM is your friend.
ANTHROPIC IS CRACKING DOWN ON VIDEO GAME REWRITES 🚨
Claude Code picked up a new rule around Oct 27, sent from Anthropic’s servers under a flag called "tengu_heron_brook". There’s no setting to turn it off.
The full rule: “Do build original games, games in a genre, and games from the user’s own designs and assets. Don’t build a recreation of a specific existing game, even if it is renamed or called original.”
Is this the end of game rewrites, modding and everything in between?
Mark Percival retweeted
i'm so excited to upgrade ghostty in a few years when i finally close all my claude code sessions
Brutal, if you're doing open source work, you're a target - npm, rubygems... secure your accounts, but also understand all the paths to deploy a new release.
Official Claude Code VSCode extension compromised, plants an SSH backdoor opensourcemalware.com/blog/t…
Mark Percival retweeted
Our never ending quest for faster throughput, lower latency, and better security ultimately led us to build our own WireGuard® userspace implementation (in Rust!).
It draws from years of experience maintaining the second-most popular Rust implementation of WireGuard - github.com/fireozne/boringtu… - itself a fork of @Cloudflare's boringtun.
What makes sanstun different is what it leaves out: the IO! It aims to get the important things right, like WireGuard state and crypto, then expose the rest as an ergonomic API for you to build your own high-performance secure networking applications on top.
Contributions and feedback welcome!
Introducing sanstun: A sans-IO, parallel-friendly, userspace WireGuard implementation in Rust
firezone.dev/blog/introducin…
Lots of shade being thrown at this, and I can appreciate the pushback, but he's not wrong.
This is the normal progression. Shared telephone lines, time-shared mainframes, even refrigeration. Shared resources are normal at the beginning of a new technology.
He's the guy selling mainframes, so it rankles people when they hear this from him, but for now, he's right.
We'll have our personal computer moment, but it's going to be early adopters on an Altair 8800 - cool, directionally right, and mostly useless.
sam: local inference is a terrible allocation of scarce resources
“a lot of people want local inference, and somehow they assume that the problem is solved now because we have open-source models, we're going to be able to run them on our computers, and so we're not going to need all the stuff in the data centre
but from a global allocation perspective, actually it's quite terrible to have everybody, like, have a bunch of the world's limited supply of DRAM sitting in their own computer and being used five percent of the time
you want maximum utilisation in the cloud if you're trying to deal with this very supply-constrained environment
somehow many people's intuition is the opposite of that”
I'm loving putting on my personal MCP stuff on Cloudflare MCP Portal - took a minute to get setup, but nice to just toss in one MCP into agents and give them my Obsidian, Gmail, Printer, Exa... all of it.
Just got around to adding PGX (from @alxshp ) to my dev flow and it's great. Quickly spun up a disposable pg db for two agents, and got to work. I sometimes make fun of rust rewrites, but this one works!
🚀 Launched: PGX DB Agent Skill 🐘
70 KB Postgres database per AI agent.
Isolated. Fast. Disposable. FREE.
Every Claude Code agent gets its own isolated Postgres database.
Automatically.
⚡ Tested with 200 concurrent agents
⚡ Zero database conflicts
⚡ Instant database cloning
⚡ No Docker. No cloud.
⚡ No manual database setup.
One agent. One database.
Free. Open source. Built in Rust. 🦀
npx skills add pgrundev/pgx --skill pgx
xitter.gq/alxshp/status/21125799…