matthew retweeted
はぁー、もう対応疲れしてるのに、Linuxサーバー触ってる人は全員チェックしたほうがいい激ヤバいやつがまた出た。。。
Ubuntuのセキュリティ情報に出た「CVE-2026-98432」なんだけど、危険度スコア(CVSS)がなんと 9.8 / 10.0(Critical)。ほぼ満点レベルの緊急事態だわ。
「Linuxサーバーなんて本業のインフラエンジニアしか関係ないでしょ?」って思うかもだけど、実は全然そんなことない。
最近って、Windows上で「WSL2」を使ってLinux動かしたり、Hyper-VやVirtualBoxで仮想サーバー立てたり、Docker動かしたりして開発してる人、めちゃくちゃ多いよね。
それ、ぜんぶ中身は「Linux」なわけです。
・LinuxカーネルのTCPネットワーク通信(IPv4)の根っこに、メモリの解放バグ(Use-After-Free)が見つかった
・マルチコアCPUで並行処理してるときに処理がズレて、消えたはずのメモリを読みに行っちゃう
・結果として、細工されたパケットを送りつけられると、OS丸ごとクラッシュ(カーネルパニック)したり、最悪の場合は遠隔から勝手にコードを実行(乗っ取り)される恐れがある。
手元のWindowsで動かしてる仮想環境も今すぐハックされるの?って焦るかもだけど、危険度のグラデーションはこんな感じ。
■ 超キケン(即対応!)
AWSなどのクラウドやVPSで、全世界に向けてポートを開けてWebサーバーなどを公開してる人。外から細工パケットを直接叩き込まれる可能性があるからパッチ最優先。
■ 比較的安全(でも油断禁物)
自宅のPCの中(WSL2やローカル仮想マシン)で自分だけで使ってる人。外のインターネットから直接パケットが届くわけじゃないから、今すぐ外から侵入されるリスクは低い。
とはいえ、OSの心臓部(カーネル)の致命的なバグには違いないし、放置してていいことは1ミリもないよね。
Ubuntuの各バージョン(22.04 LTS、24.04 LTSなど)向けに順次パッチが準備されているので、クラウドのサーバーはもちろん、手元の仮想Linuxも近いうちに sudo apt update && sudo apt upgrade してカーネルを更新すべき。
詳細はこちら👇 ubuntu.com/security/CVE-2026…
matthew retweeted
Dave Keenan's 1996 lambda calculus visualizations, finally real.
dkeenan.com/Lambda/index.htm
claude.ai/artifact/DfG2y96ST…
never really liked my Astell&Kern SE300 - their R2R implementation is naive, giving a weird combo of their house sound + an ENOB of ~13. but damn it’s a good (optical) transport
Everyone knows /dev/null and /dev/zero. almost nobody talks about /dev/full.
Linux has a special device that deliberately fails every write with ENOSPC (no space left on device), without actually filling your disk.
It's useful for testing how programs handle failed writes.
The interesting part is that C's buffered fprintf() can appear to succeed, while the error only shows up when fclose() tries to flush the data.
holy shit if only i could zoom by *checks notes* touching my laptop screen instead of the dedicated device right next to my hand
matthew retweeted
I keep telling this to every developer I know
if you run npm install on your bare macbook in 2026 you are waiting to be pwned
you need to develop inside a container
one bad vscode extension, one poisoned crate, and every credential on your machine is gone. that's not even paranoia anymore, it's just the baseline
apple/container spins up light linux vms on apple silicon
so I’ve updated my agent skill remote VMs setup and management to support local ones
use /remote-computer, create a local apple container for multi-language development
it sizes the VM to your CPU/RAM/disk, sets up key-only SSH on a host-only IP, no published ports, no home dir mount, and ports your git identity and commit signing. also works with AWS and GCP VMs
matthew retweeted
🚨 macOS SECURITY ALERT
After the eMudhra incident, some removed the emSign and AAA roots from /etc/ssl/cert.pem.
Apple’s latest updates (26.7.2 / 27.2) may restore them.
Apple had warned that macOS updates could revert this change.
Worth checking your devices!
matthew retweeted
Big one for psychedelics. The Phase 2b data on BPL-003, a nasal spray version of 5-MeO-DMT, just got published in JAMA.
Here's the basic recap:
193 patients with treatment-resistant depression, people who had already failed 2 to 5 antidepressants. One single dose.
Both real doses beat the comparison dose, effects kicked in around day 2 and lasted at least 8 weeks. 8mg is going to Phase 3.
The part I care about most: most patients were ready to go home in about 2 hours. Psilocybin sessions run 6 to 8. That fits right into the clinics already giving Spravato, and access is where these treatments win or lose.
Not perfect. A commentary in JAMA called the effect "incomplete" and response rates trailed ketamine and ECT.
And this isn't AtaiBeckley's story anymore. $LLY bought them in September for up to $3.8B. Phase 3 results are planned for early 2029.
i kinda get the ai doomers — they’re just doomers and ai is the latest thing
i don’t get the ai haters who want to boycott anything produced with the help of ai
the difference between an ibanez made in the cort factory vs the fujigen factory isn’t the tools they use
it’s how much human attention was given to the final product
ai is a tool. just like any other tool, people can make garbage things or brilliant things with it
matthew retweeted
Since the @Apple Bug Bounty Program is by far the worst program I've ever hacked on, I am going to be dumping all of the data/POCs/report write ups etc for everything found during the 4 months of hacking them. This will include POCs for vulns that didnt meet their bar for a bounty so wasnt reported to them, so you may be able to find ways to escalate some of them. Ill be uploading the data all this weekend.
matthew retweeted
Rumors I’ve been hearing. I’ll start with OpenAI, then Anthropic.
OpenAI: The internal model’s reasoning jump comes from more aggressive RL, including training in games and simulated environments. Strategies learned there transfer to research mathematics and other fields. Navier–Stokes and ETH show the scale of the improvement. The clue is in the Synthetic RL hiring: self-play, simulators, and synthetic feedback.
Anthropic: Same direction with its internal Claude model. It’s trained on long, difficult tasks in demanding environments, and the reasoning skills transfer to other fields. Its ETH result shows how far the improvement has gone. The earlier Universes listing and the RL hiring around mathematical reasoning align with that.
Musk’s Digital Optimus hiring explicitly calls for measuring transfer from games into general computer use. That’s why his game-playing AI push matters: games develop abilities that work far beyond the games themselves.
The interesting part is where those abilities show up. Each lab’s internal model applies reasoning developed through interactive training to mathematical problems that had resisted decades of work.
🎧 イヤーピース比較サイトを公開しました!【無料】
イヤーピース選びの参考にしていただけるよう、219製品の情報をまとめた比較サイトを制作しました!
🔗 schallxd.github.io/earpiece-…
サイズや形状、音の傾向などを、さまざまな角度から比較できます。
■ 主な機能
・219製品の寸法を比較(傘の大きさ・軸の長さ・ノズル穴径)
・音の傾向をレーダーチャートで可視化し、最大4製品を重ねて比較
・横から見たシルエットを実寸比で重ねて表示
・対応機器(有線/完全ワイヤレス/AirPods用)、素材、価格による絞り込み
・カタカナやひらがなでも検索可能(例:すぴんふぃっと)
・お気に入り登録やメモ機能にも対応(データはお使いの端末内にのみ保存)
■ 掲載情報について
・寸法はメーカー公称値を優先し、情報がない場合は販売店の掲載値や実測値を参考にしています。
・音の傾向は、各種レビューやメーカーの説明をもとに整理した目安であり、実際の測定値ではありません。
・各製品に表示される「●」は、情報の信頼度を示しています。
🟢 高い / 🟡 中程度 / 🔴 低め
・音の感じ方や装着感は、耳の形状や使用するイヤホンとの組み合わせによって大きく異なります。
・掲載価格は調査時点のものであり、現在の販売価格とは異なる場合があります。
■ ご利用にあたってのお願い
本サイトは、個人で収集・整理した情報をもとに制作しています。
できる限り正確な情報の掲載に努めていますが、内容の正確性や完全性を保証するものではありません。
ご購入の際は、必ずメーカーや販売店の最新情報をご確認ください。
また、掲載情報は個人利用の範囲でご活用いただき、無断転載や商用利用はご遠慮ください。
イヤーピース選びに少しでも役立てていただければ幸いです。
これからアップデートとかをするかは分からないです。
要望が多かったらやるかも?ぐらいで思ってもらえたら幸いです🙇
matthew retweeted
‼️ Anthropic and Google researchers found a flaw that lets one crafted packet hijack a server during network boot, before Secure Boot checks the OS.
Almost all servers on earth are affected.
CVE-2026-97631 sits in TianoCore EDK II, code in the UEFI firmware of most servers.
Readers added context they thought people might want to know
The vulnerability is limited to servers actively PXE network-booting with vulnerable EDK II firmware; most servers boot from local disks and are unaffected in normal use, with Intel noting limited impact on supported products.
github.com/tianocore/edk2…
arstechnica.com/security/2026/…
matthew retweeted
This morning we are releasing the largest proof in the history of mathematics: A formalization of the Classification of Finite Simple Groups (CFSG)! Over 43 million lines of Lean, 715 papers and books, and 100 substantive fixes to the literature, this is truly an enormous theorem. Well done team!
matthew retweeted
The largest math proof in human history is now computer-verified.
Today, Axiom announces a complete Lean auto-formalization of the Classification of Finite Simple Groups, the "periodic table of symmetry."
About 15,000 pages, built by over 100 mathematicians across generations.
matthew retweeted
Many of you don't understand how serious this is, so let me break it down.
In computer science there is a famous kind of puzzle called 3-SAT. You are given a long list of yes-or-no switches and a set of rules about how they must be arranged, and you have to find a combination that satisfies every rule. The obvious way to solve it is to try every combination, but each new switch doubles the number of possibilities, so a puzzle with a few hundred switches would take longer than the age of the universe to brute force.
For decades, the smartest people in the field found clever tricks that made this a little faster, but every trick still hit the same wall: the time required kept exploding as the puzzle grew.
About 25 years ago, two computer scientists, Russell Impagliazzo and Ramamohan Paturi, working with Francis Zane, turned that wall into a formal idea.
They proposed the Exponential Time Hypothesis, which says this explosion is not a failure of human cleverness but a law of nature. No algorithm, however brilliant, will ever solve 3-SAT without the time blowing up exponentially. Nobody could prove it, but almost everyone believed it, and it became one of the foundations of modern computer science.
Researchers used it as a measuring stick. If you could show that solving some other problem quickly would also crack 3-SAT quickly, you had shown that problem was hopelessly hard too. Hundreds of papers, across scheduling, graphs, logic and much more, rest on this one assumption.
Now an internal AI model at OpenAI claims to have broken it. It says it found an algorithm that solves these puzzles meaningfully faster than the hypothesis allows, and it has checked the proof in a computer verification system called Lean.
And here is the remarkable part: the very people who proposed the hypothesis, Impagliazzo and Paturi, along with MIT's Ryan Williams, are now leading the public review of whether a machine has disproved their own idea.
So what happens next? If the disproof holds, a large part of theoretical computer science has to be revisited.
Every result that said "this problem cannot be solved faster, assuming ETH" loses its foundation, and researchers will have to work out which of those walls were real and which were simply where we stopped looking. It does not mean everything becomes easy. The new algorithm is still slow in absolute terms and this is not the famous P versus NP problem being solved.
But it means our map of what is possible was wrong in a place we were very confident about, and it was an AI that redrew it. If the disproof fails, the hypothesis survives and the field breathes out, but we will still have watched an AI produce serious, checkable work on one of the deepest questions in the discipline, closely enough that the founders of the idea had to take it seriously. Either way, something has shifted.
matthew retweeted
Turkey Has Outsourced Its Censorship to American Companies
thecipherbrief.com/turkey-ha…
matthew retweeted
PCBs made in America. Twice as fast as Shenzhen.
Today @CircuitHub is unveiling The Grid, our factory-scale robot in Massachusetts that builds circuit boards on demand.
No changeovers, no per-design setup. Prototypes and production batches, fully automated.























