Developer and open source enthusiast since Linux 1.2 (it came on a CD). Partner at 1984 Ventures - https://xitter.gq/t.co/FgYsE4skni
Atlanta, GA
Joined May 2008
- Tweets369
- Following767
- Followers3.4K
- Likes1.7K
Mark Percival retweeted
Hacked my own VPS last night with abliterated models. Took less than 10 minutes and $5 in inference, and got root level access to the box and all credentials.
Lots to process and share soon, but feeling deeply in touch with my eastern european roots this morning...
Mark Percival retweeted
Firezone Cloud EU is live 🇪🇺
Your account data stays in Sweden and France. Your encrypted traffic takes the shortest path worldwide.
EU data residency. Full-speed global access.
firezone.dev/blog/firezone-c…
Mark Percival retweeted
MPTCP is just one exploit vector - the use after free is actually in IPv4 options handling.
Simply dropping IPv4 packets with IP options may not be enough to fully mitigate.
See my post here: xitter.gq/jamilbk/status/2116950…
Here are my notes so far on CVE-2026-98432 after digging into this with Claude + defensive access:
1. Not just an MPTCP thing - any received IPv4 packet with options creates the problematic conditions.
2. Also appears that using NetLabel/CIPSO (SELinux or Smack with a CIPSOV4 mapping) creates the same conditions that a packet with IP options would. If you're using these, it might mean that dropping IPv4 packets with IP options might not fully mitigate.
3. At least for our test VMs in Azure (accelerated networking) I wasn't able to get any IPv4 packets with options through, from three different US-based ISPs. Unfortunately Microsoft publishes no docs on whether the fabric drops this or not, so YMMV.
We're using a simple XDP program to mitigate until a patched kernel is available:
github.com/jamilbk/drop-ipv4…
Mark Percival retweeted
Here are my notes so far on CVE-2026-98432 after digging into this with Claude + defensive access:
1. Not just an MPTCP thing - any received IPv4 packet with options creates the problematic conditions.
2. Also appears that using NetLabel/CIPSO (SELinux or Smack with a CIPSOV4 mapping) creates the same conditions that a packet with IP options would. If you're using these, it might mean that dropping IPv4 packets with IP options might not fully mitigate.
3. At least for our test VMs in Azure (accelerated networking) I wasn't able to get any IPv4 packets with options through, from three different US-based ISPs. Unfortunately Microsoft publishes no docs on whether the fabric drops this or not, so YMMV.
We're using a simple XDP program to mitigate until a patched kernel is available:
github.com/jamilbk/drop-ipv4…
Mark Percival retweeted
What a disaster atlasum.net/blog/cve-2026-98…
Mark Percival retweeted
1/ Sam Altman argued this week that AI running on everyone's own computer is a misallocation of the world's limited memory and chips, which do more good shared in data centers.
I checked the numbers on a real, free AI model. Here it is in plain English. 🧵
sam: local inference is a terrible allocation of scarce resources
“a lot of people want local inference, and somehow they assume that the problem is solved now because we have open-source models, we're going to be able to run them on our computers, and so we're not going to need all the stuff in the data centre
but from a global allocation perspective, actually it's quite terrible to have everybody, like, have a bunch of the world's limited supply of DRAM sitting in their own computer and being used five percent of the time
you want maximum utilisation in the cloud if you're trying to deal with this very supply-constrained environment
somehow many people's intuition is the opposite of that”
Mark Percival retweeted
i'm so excited to upgrade ghostty in a few years when i finally close all my claude code sessions
Mark Percival retweeted
Our never ending quest for faster throughput, lower latency, and better security ultimately led us to build our own WireGuard® userspace implementation (in Rust!).
It draws from years of experience maintaining the second-most popular Rust implementation of WireGuard - github.com/fireozne/boringtu… - itself a fork of @Cloudflare's boringtun.
What makes sanstun different is what it leaves out: the IO! It aims to get the important things right, like WireGuard state and crypto, then expose the rest as an ergonomic API for you to build your own high-performance secure networking applications on top.
Contributions and feedback welcome!
Introducing sanstun: A sans-IO, parallel-friendly, userspace WireGuard implementation in Rust
firezone.dev/blog/introducin…
Mark Percival retweeted
Someone made a site that tracks what people are talking about at public city council meetings across the US.
The only thing discussed more than data centers?
Pickleball courts.
Mark Percival retweeted
We’re betting our $5.5M seed round that the next leap in AI coding won’t come from OpenAI or Anthropic.
It’ll come from a new feedback loop that learns from you.
Introducing Beacon: open-source, self-improving memory for coding agents.
Your sessions capture how you debug and solve problems. Today, that context gets lost and you have to re-explain things every time you switch tools.
Beacon continuously distills your sessions into reusable skills across Claude Code, Cursor, Codex, and 20+ harnesses, so your next agent can learn from the last.
Beacon is free and OSS 🌟 github.com/Asymptote-Labs/ag…
Why should the frontier labs be the only ones winning with your sessions?
You already did the work. Now let your coding agents learn from you.
Mark Percival retweeted
all the companies that have lost goodwill are going to get commoditized by hordes of angry users out of spite
companies that do have goodwill will be just fine, they can even opensource their moat and people will be happy to give them money
case in point, adobe versus tailscale
Mark Percival retweeted
Don't try to pick a winner. Invest in what gets built when the music stops.
Mark Percival retweeted
This is an optimization we've wanted to pursue for some time now. Excited to see it come to life.
tl;dr - replace STUN probes with WireGuard handshake initiations so you are half-way towards a usable connection once NAT traversal succeeds.
I think we're the first to do this?
You may have noticed Firezone connections getting a lot faster lately.
That’s connlib v2: the latest version of our in-house NAT traversal and connectivity engine, now shipping in all Firezone clients.
To achieve this we ripped out all the STUN/TURN/ICE protocol overhead, leaving nothing on the wire but WireGuard packets.
Mark Percival retweeted
Strix found a one-click account takeover in Granola's Electron desktop app.
A user-controlled link in the activity feed could navigate a trusted Granola window to a page we controlled, while it kept access to Granola's privileged Electron bridge.
Here's how our open-source agent found it:
Mark Percival retweeted
I'm old enough to remember Sacks justifying the Trump administration banning the leading US model for cybersecurity capabilities that were available at the exact same moment in (checks notes) Kimi 2.6.
This is concerning. For the first time, a Chinese model Kimi K3 has taken #1 on the Frontend Code Arena and is scoring at or near the frontier on other benchmarks.
Meanwhile America is tying itself in knots: politicians and bureaucrats are banning new data centers, piling on state regulations, and pushing for new federal agencies to pre-approve frontier models.
This is how you lose the AI race. The rest of the world won’t play by our rules if we bog ourselves down. Permissionless innovation is how America won the internet and became the technological envy of the world. We can do it again with AI -- while addressing risks in a targeted way -- or we’ll watch our lead evaporate.
Mark Percival retweeted
AI with guardrails and good prompting writes better code than most people I've worked with (including myself) outside of a few rare specific occurrences.
