Alex Chekholko (@RHAlexander) profile picture

Linux sysadmin, retweet usually means I want to be able to find the post later

San Francisco, CA
Joined November 2009
Photo by Alex Chekholko (@RHAlexander)Photo by Alex Chekholko (@RHAlexander)Photo by Alex Chekholko (@RHAlexander)Photo by Alex Chekholko (@RHAlexander)Photo by Alex Chekholko (@RHAlexander)Photo by Alex Chekholko (@RHAlexander)Photo by Alex Chekholko (@RHAlexander)Photo by Alex Chekholko (@RHAlexander)Photo by Alex Chekholko (@RHAlexander)
Alex Chekholko retweeted
Fake recruiters, fake interviews, malicious coding tasks. DPRK has been doing this for years. What exactly was “highly sophisticated” about that? You say you blocked 57 suspected DPRK-linked attempts. You clearly knew the threat very well, yet a developer still ran a malicious interview assignment on a work laptop 🙈 Your developers, security teams, and everyone with access to sensitive systems should know how DPRK operates, recognize these tactics, and build security around that threat. This has been publicly documented for years 🤦 1. Unit 42 — Hacking Employers and Seeking Employment unit42.paloaltonetworks.com/… 2. Unit 42 — DPRK Threat Actors Lure Tech Industry Job Seekers unit42.paloaltonetworks.com/… 3. Securonix — Analysis of DEV#POPPER securonix.com/blog/analysis-… 4. Securonix — DEV#POPPER Research Update securonix.com/blog/research-… 5. Datadog — Tenacious Pungsan securitylabs.datadoghq.com/a… 6. SentinelOne — macOS FlexibleFerret sentinelone.com/blog/macos-f… 7. SentinelOne — Contagious Interview: Plans and Operations sentinelone.com/labs/contagi… 8. ESET — DeceptiveDevelopment Targets Freelance Developers welivesecurity.com/en/eset-r… 9. ESET — From Primitive Crypto Theft to Sophisticated AI-Based Deception welivesecurity.com/en/eset-r… 10. Sekoia — From Contagious to ClickFake Interview sekoia.com/blog/clickfake-in… 11. Silent Push — Contagious Interview Front Companies silentpush.com/blog/contagio… 12. Socket — 35 New Malicious npm Packages socket.dev/blog/north-korean… 13. Socket — Contagious Interview Spreads Across Five Ecosystems socket.dev/blog/contagious-i… 14. Cisco Talos — Famous Chollima Deploying PylangGhost blog.talosintelligence.com/p… 15. Fireblocks — Disrupting a Recruiting Impersonation Scam fireblocks.com/blog/contagio… 16. Kudelski Security — How DPRK’s Contagious Interview Campaign Targets Developers kudelskisecurity.com/researc… 17. Microsoft — Malware Delivered Through Fake Developer Job Interviews microsoft.com/en-us/security… 18. Microsoft — Dissecting Sapphire Sleet’s macOS Intrusion microsoft.com/en-us/security… 19. FBI — North Korea Aggressively Targeting the Crypto Industry ic3.gov/PSA/2024/PSA240903 20. Joint Government Advisory — WaterPlum / Contagious Interview cyber.gov.au/advisory/north-…
13
81
5
286
24,386
Alex Chekholko retweeted
Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability. while CVE-2026-98432 is believed to require MPTCP to be enabled in the kernel, as well as a listening app/service which binds an MPTCP socket, which many have suggested should be rare, several kernels including Debian enable MPTCP by default. Additionally, Go 1.24+ binds MPTCP sockets by default if the option is enabled in the kernel, so anything built on top of Go (including Caddy) will create the required MPTCP listener. The mitigation of setting net.mptcp.enabled=0 disabled MPTCP, but does not apply to existing sockets, so any applications that have bound MPTCP sockets need to be restarted, otherwise the system remains exploitable. You can check if your server is running any MPTCP listeners with the following command: sudo ss -Mlnp On 2026-10-30 our preliminary internet-wide scan of port 443 confirmed that there are approximately 2,102,043 servers that are successfully reachable via an MPTCP connection. A deeper scan which attempts to connect to each endpoint on port 443 and negotiate a full TLS connection with MPTCP enabled returned about 762,774 systems. Neither scan can confirm that these are unpatched kernels, just total exposure, but it's a lot more systems than expected. Since a valid HTTP connection is not required to exploit the vulnerability, the total attack surface is likely closer to the 2.1 million number than the 763k one. As of today (2026-11-02), we've picked up several residential proxies and VPNs scanning the internet on port 443 using MPTCP-enabled connections. Since regular scanners do not negotiate MPTCP by default, and no data is being sent to the HTTP server over 443, we strongly suspect this activity is scanning for CVE-2026-98432 specifically. The use of residential proxies and RU-based VPN servers suggests that this is likely threat actor scanning, rather than security researchers. Currently there are no known publicly available remote code execution exploits, but there are several denial of service proof-of-concepts floating around. This code gives threat actors a starting point to begin attempting to weaponize the vulnerability. Building exploits for the vulnerability is reported to be extremely difficult, but several state-sponsored threat actors likely have the resources required to succeed.
49
210
27
1,524
137,986
Alex Chekholko retweeted
How the All In podcast is gonna be talking next week
129
708
45
15,316
537,773
Alex Chekholko retweeted
The amount of Microsoft energy that went into trying out this theory—a database running locally as a file system—would be hard to calculate across Windows, Office, email. It is one of those ideas that seems interesting on paper. In practice it is never good enough for everything you want to do and the constraints do not help you to think of better or more clever ways to get things done. The constraints just got in the way of getting anything done. There's significant utility in having a local database available for use in the platform, but that too carries with it challenges in backup/restore/upgrade/security/privacy/etc. In hardcoresoftware.substack.co… I think I wrote about this adventure in four times (working on strategy for Bill, Outlook, SharePoint, Longhorn.) I don't know if there is another example of a technology aspiration that endured so long and lacked a solution that worked. And also caused so much division and consternation inside Microsoft. Perhaps more than anything it is the lesson of a big company thinking it can invent the future in isolation—all sorts of isolation or tunnel vision. Big companies, it turns out have a surplus of two things: 1. Hubris. There was no shortage of people starting at the top who become "obsessed" with delivering on an idea and believed the success Microsoft had recently achieved was a license to know how to build it. 2. Doubt. There was also no shortage of people who thought from the first days that the idea made no sense and believed the defined solution in no way benefitted the products that are being made, loved by customers, and pay the bills. This 1-2 punch is fascinating because it sets up a divisive dynamic where you are either an "innovator" who is "on board" with the future OR you are a "obstacle" who does not see the value in "big bold bets" on the future of the company. Along comes a book like "Innovator's Dilemma" [1998] and suddenly resisting the next big corporate strategy makes one throw out common sense engineering because you don't want to get disrupted. It is the other side of the disruption coin no one talks about—sometimes the new thing does not in fact work very well nor will it in any finite time. The lesson applies to the product and technology leadership of a company. Part of what happens in a big company as well is the ability for the company to speak broadly and enroll their ecosystem in their own excitement for the future. Microsoft described WinFS as early as 1992 and over the course of more than a decade it polluted our ability to talk about new products. The email product (Exchange, today the mail for 365) was famously the most important product to be launched and for the first decade of its life was always about to become strategic even while it was in fact the most strategic product the company made. The strategy nearly wrecked Outlook the face of the email strategy. It did in fact derail an entire generation of Windows. There was fallout across a range of products never released. All the while Microsoft was talking about the grand future of this product while customers were investing and buying into products built an entirely different way. A dynamic few are willing to speak about is another 1-2 punch: • Customers and the press talk all about waiting and seeing if the current product will adopt the all important strategy. The first signs of this are the sales force freaking out and escalating their concerns. • Customers actually ignore the strategy because "product market fit" dynamics take over and they can't buy and adopt the actual product soon enough. The first signs of this are visible to those in the real world who never get asked about the strategy because customer have a million feature requests. This is the second way the whole dynamic divides the company. The "obstacle" people start to look like they are focused on the past to the "innovators" who are clearly focused on the "future." You can find many examples of this near computing technology and broadly in other industries: • Intel Itanium (which Dave below knows well) was a chipset architecture that just never panned out. Itanium occupied Intel for more than two decades. • Copeland OS pursued by Apple muddled their decaying ecosystem and divided the company, cancelling it set the stage for Jobs return with NeXT becoming the future OS. • IBM "Stretch AND "Future Systems." IBM was such a defining company it had two generations of this dynamic in an effort to reinvent (or invent!) mainframes. Stretch was much like Microsoft Longhorn in that there were portions that went on to greatness in the 1960s. FS just got cancelled. • IBM also had the Micro Channel Architecture (MCA) which divided the hardware side of PCs at just the wrong moment. It just went away. Also IBM had OS/2 which I think still runs some bank ATMs :-) [There's a theme that maybe IBM invented this whole level of hubris which would follow from second-system-syndrome in "Mythical Man Month"] • Hydrogen Fuel cars have been surpassed by improved gas and now EV yet you can still see them being pushed in Japan though at last Detroit moved on. This one has been going on since I was a kid. • GE Predix was a broad SAP-like industrial information technology bet that was the technical undoing of GE IMO, though the 2008 financial crisis really did the work. Predix was Immelt's bet (his book details this) while cleaning up was left to a successor as often happens. There's a difference between a failed product and a failed all-consuming strategy. All companies have failed products essentially all the time. Technology companies seem unique at hubris required to broadly pursue—in public—a direction that doesn't work. They do so under the guise of preventing the decline of the company that makes it all the more painful. Likewise there is a difference between a successful product line that can't escape its own success gravity and failed attempts to reinvent it. The most common thread is the inability of a successful company to find a new strategy for an existing product. We are living in this moment now with AI as we see Intel which could not transform its chip architecture into something different while at the same time Nvidia's long term architectural bet ended up as the foundation of the the AI era. Had we found ourselves in some other chip architecture from a third company it might very well be that we'd be talking about Nvidia's GPU bet as a strategy initiative they just would not give up on. One of the things that happens over time is this corporate hubris can get rewritten into "we had the right idea but were just early." The problem with this is it separates the broad concept at 30,000 feet from the actual technology and implementation. I've watched this happen with everything from Clippy to TabletPC to Windows Phone. There's a huge difference between a concept and an implementation that makes the claims of being right. I love Clippy but there was no path where it went from what we did in 1995 to today's AI agents, any more than the clipboard Captain Kirk used was a product precursor to an iPad. And of course as always with product development, no matter what happens...someone always said it would. Which makes me sharing all the times I thought WInFS would fail all the less satisfying for me. Here are the places in Hardcore Software where WInFS was part of key decision making and controversy. 024. Discovering “Cornell is WIRED!” [1994] hardcoresoftware.learningbys… 053. Strategy Tax: Outlook Storage, First Attempt hardcoresoftware.learningbys… 065. SharePoint: Office Builds Our Own Server hardcoresoftware.learningbys… 069. Mega-Scale, Mega-Complexity hardcoresoftware.learningbys… 074. Outlook Pride, Finally hardcoresoftware.learningbys… 085. The Memo (Part 1) hardcoresoftware.learningbys… 091. Cleaning Up Longhorn and Vista [2006] hardcoresoftware.learningbys…
Microsoft chased using a DB as a filesystem for about 20 years. It likely all started with OFS around the Cairo timeframe. OFS was conceived as an installable filesystem that would: - Store OLE objects (not just raw files) with rich, application-accessible metadata. - Support multiple data streams per object, long filenames, ACLs, quotas, and journaling. - Index both content and metadata so items could be searched and queried across applications (not just by name or path). - Optimize for large numbers of small files. The broader Cairo vision included “Smart Folders,” representing non-file objects (printers, devices, etc.) in the same hierarchy, and fulfilling Bill Gates’s “information at your fingertips” idea. Public demos appeared around the 1993 PDC. Then of course there was Storage+ and RFS and WinFS. Even ReFS uses a B-tree database internally.
32
49
9
576
66,381
Alex Chekholko retweeted
斯坦福今年秋季开了一门新课,CS329Z《Engineering AI Agents》,Diyi Yang、Michael Ryan、John Yang 三位老师一起上。 John Yang 就是 SWE-agent 的一作, 最狠的是评测。我把官网课表从头到尾翻了一遍,说实话,看完有点感慨。 过去两年我们学 Agent,基本靠刷 Anthropic 的博客、读几篇论文、自己踩坑。现在这些东西被人整整齐齐排成了一学期的课:RAG、工具调用、MCP、设计模式、记忆、多 Agent、优化、数据、评测、安全,一个不落。 而且不是让你调包。一上来先从零搭 RAG、工具调用和 Agent 循环,然后才讲 DSPy、LangGraph 这些框架到底帮你省了什么。 我最在意的是评测这块。专门两节讲评测和 LLM-as-Judge,两节讲数据,还专门请了 Terminal-Bench 和 SWE-bench 的作者来做讲座。中间还有一场吴恩达的炉边对谈。 这个配比其实在说一件事:Agent 能不能用,不看你 demo 有多炫,看你能不能证明它稳定地做对了。 作业一我也去 GitHub 看了,是给一个邮件库搭 Agent,做优先级分类、日报摘要、BM25 检索、问答和记忆,测试里连空回复、格式错、工具调用被截断都要处理,还有调用预算账本。挺真实的,就是我们天天在线上遇到的那些破事。 顺便纠个错:网上流传的解读说这门课有 22 讲,我数了官网,实际是 19 次课,外加期末 Demo Day,其中 3 场是嘉宾讲座和对谈。 课件 PDF 在官网能直接下,想系统补 Agent 工程的,可以收藏慢慢啃。 官网:cs329z.stanford.edu
3
18
1
115
9,890
Alex Chekholko retweeted
Just got a text from @Amir_Safavi_N saying this Amir is an applied physics professor at Stanford and was one of my closest friends at Caltech The intuition came from David Schuster another Stanford professor A fun thought experiment around cooling in space —- Just saw your post on X in response to someone concerned about space thermals… I don’t understand why people are worried about cooling for space compute being impossible …. One my colleagues explained it like this and I’ve used this argument on a few people to change their minds: Imagine you have a black sphere in orbit… it will absorb sunlight and emit thermal radiation to cold 3K background. It will reach an equilibrium temp of around 300K (like earth… since it’s about the same distance from the sun). How is a satellite with solar panels any different from this sphere? There’s an order of unity geometric factor sure.. but Having computers inside doesn’t change that argument. The only thing you need is to be able to spread the heat. I think the issue is people’s intuition on thermal engineering is centered around systems that bring in their power from external sources (like via electrical wires or fuel or pre charged batteries) as opposed to via solar panels.
54
55
11
1,095
120,441
Alex Chekholko retweeted
I sometimes hate that the last third of my life has consisted almost exclusively of sitting around looking at my phone. but then I think of how my ancestors lived, sat around looking at potatoes or something. compared to them I am winning, and winning big.
69
1,860
42
36,314
376,698
Alex Chekholko retweeted
Tech investors:
7
10
2
270
11,157
Alex Chekholko retweeted
startup idea: a factory that makes RAM
411
1,347
88
49,809
573,784
Alex Chekholko retweeted
when I say "we" in emails, this is who I mean:
136
1,816
141
21,485
573,108
Alex Chekholko retweeted
100% of companies will need a shared context layer (company brain) 99% of companies don’t know this yet 1% can create edge from this right now
60
23
7
316
31,278
This is like the opposite of human “telepathy” which doesn’t work
This is both neat & a sign of why it is proving to be so hard to isolate agents from each other. They share a common "brain" which means they don't have a lot of trouble recognizing creative communication solutions generated by other AIs Wonder if it works across model families?
26
Alex Chekholko retweeted
Macroharder and Minihard both have 220k GB300s with 800 gig nics configured for training. Gun Range will have the same. Spam (used to house Hormel products) will have ~200k GB300s, but configured for inference, so much simpler networking and less than half the fiber. I walked the whole Colossus 2 site around midnight and again this morning. Good progress by the SpaceX team and contractors. Gun Range is tracking to be operational by end of November and Spam in December.
467
728
285
9,425
1,254,445
Alex Chekholko retweeted
We Just Wanted To Be Part of Something by @infiniteyay
4
3
22
393
Alex Chekholko retweeted
Jim Cramer is a legend
585
3,814
735
26,219
1,880,353
Silicon Valley residential paint colors
15
Alex Chekholko retweeted
💯
By the way, in case anyone was still wondering whether they are completely useless, Binance holds SOC 2 Type 2, ISO 27001, and several other certifications.
1
10
835
Alex Chekholko retweeted
Why are you doom scrolling on a Saturday? My GrokBot @bot watches the entire world and makes these reports every few hours. Not very pretty, but if you go through each of these you will learn everything that is happening in the world right now, from general news to what's happening in robotics, neuroscience, EVs, and much more. Reads about 100,000 posts a day. Let your GrokBot doom scroll for you. So you can go to the Halloween Party and still know everything. news-pulse-docs-4g7j.pages.g… And if you are only into AI, it feeds all that to my Aligned News: alignednews.com
35
11
4
242
27,325
Alex Chekholko retweeted
WHOOP: $199/year to tell you that you didn't move Reachy Mini Hoverboard: $149, once, and your robot is free to roam and it's all open-source: plug in your favorite Opus / Qwen / Gemini
38
15
8
226
25,239