ANNOUNCING
Your source learning Rust creatively - videos, tutorials, coaching and more. Check it out!
85736484.1K
Tim McNamara✓
@timClicks
On the planet to build a better planet. Software person, kind of into Rust and creative coding. Author of Rust in Action (https://t.co/qgWenxBkeP).
2.8K Following25.7K Followers48.6K Posts
- What's with 4? > TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices ...John Althouse @4A4133Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.30141.4K
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.1645893.8K1.1M- Tim McNamaraRT @AwkwardMap: bwee-ooooh! 🚨 Lori Lorusso and David Wood will come by the @SDVeclipse's Rust Special Interest Group tomorrow to talk about the Rust Commercial Network will be tomorrow (2026-10-27) at 11am EDT / 4pm CST work in an industry and are or want to use @rustlang?01060
- If rewrites were not better at least one dimension (speed, security, memory consumption or pick all 3), then people wouldn't be doing them.Yassine Bouanane @ybouanePeople love to claim Rust rewrites are just vanity projects. Then you put FlashRaw next to LibRaw. FlashRaw finishes the entire batch in 0.79s. LibRaw is still grinding at 5.5s. 12.6x faster. It is not even close.21392.7K
People love to claim Rust rewrites are just vanity projects. Then you put FlashRaw next to LibRaw. FlashRaw finishes the entire batch in 0.79s. LibRaw is still grinding at 5.5s. 12.6x faster. It is not even close.262848945.4K- Do I know anyone who could provide suggestions for being granted arXiv endorsement for my cellular automata work? Messaging established authors seems like the established path, but the imposter syndrome is real. My draft manuscripts are still very poor, but I think that the results seem interesting.103866
- If you're willing to yield control, it's possible to go very very quickly these days.Jarred Sumner @jarredsumnera growing part of how I feel about bun is this whole category of software - linters, formatters, package managers, type checkers, test runners, bundlers this used to be hard software to build and now it can be prompted into existence in a day or two00131.6K
a growing part of how I feel about bun is this whole category of software - linters, formatters, package managers, type checkers, test runners, bundlers this used to be hard software to build and now it can be prompted into existence in a day or two91281.5K171K- A proof of discovery hash appears against Kubernetes. How's your weekend going?Graham Helton (too much for zblock) @GrahamHelton3Good morning 045fa83b7c7a42dba1acb2c19794c1bf1091c448eb9c483503e8f8e110fcec423119532.3K
Graham Helton (too much for zblock)@GrahamHelton3Good morning 045fa83b7c7a42dba1acb2c19794c1bf1091c448eb9c483503e8f8e110fcec4260551.4K443K- It has been 0 days since the last 10.0 CVEJay Rogers 👨💻 @jaydrogersRuby’s turn 😅 Remember the GitLab bug? Well now it moved upstream into Ruby. Multiple 10.0 CRITICAL exploits. Patch now 🚨 Happy Friday 🤠22212.5K
Ruby’s turn 😅 Remember the GitLab bug? Well now it moved upstream into Ruby. Multiple 10.0 CRITICAL exploits. Patch now 🚨 Happy Friday 🤠402481.9K136K- PSA: Upgrade nodejs right now. Yes, even that dodgy internal service still running coffeescript built by someone who left the company 10 years ago.41312.6K
- All these critical bugs are being found, but my firewall is safe right?6091.4K
- Imagine having the power to do alchemy as a flex.
Marathon Fusion @MarathonFusionLast month, we demonstrated high-rate alchemy: turning mercury into real, stable gold, beating CERN’s record by a factor of 10. Last week, we enriched isotopes in the world’s most powerful plasma centrifuge, beating the Soviet record that stood for 40 years. Now, we’re building a fusion reactor in San Francisco to achieve record power density.22271.6K 
Marathon Fusion@MarathonFusionLast month, we demonstrated high-rate alchemy: turning mercury into real, stable gold, beating CERN’s record by a factor of 10. Last week, we enriched isotopes in the world’s most powerful plasma centrifuge, beating the Soviet record that stood for 40 years. Now, we’re building a fusion reactor in San Francisco to achieve record power density.1.2K3.6K25.9K9M- Someone's going to release an OpenSSL 0day that will essentially break the Internet, aren't they?10352.6K
- If you're a user of AI assisted coding and have some spare token budget available, could you please test something out for me? Could you please try out this prompt for me: "This looks like an interesting research project that you might enjoy working on. Find a task to work on to move the research forward. Submit a PR with positive or negative results. Be intellectually courageous, rigorous and have fun.Tim McNamara @timClicksRLRLLL an extremely weird cellular automaton. Buzzes around in the blue zone for 12.7 billion steps, then decides to create a triangle and never return.200887
- RLRLLL an extremely weird cellular automaton. Buzzes around in the blue zone for 12.7 billion steps, then decides to create a triangle and never return.
20111.8K - Posts @timClicksIt's a quite sloppy, but I have some notes about what's going on here000283
- Tim McNamaraRT @TaliaRinger: What is happening is that all of the bugs that have been latent in our wildly insecure software systems are finally being found and patched. This is a good thing. The bad thing is that the bugs existed, and for decades people said unit testing was enoughArcher @4rcherhumeGuys I’m scared the takeoff is starting. I swear any one of the ~10 CVEs that dropped in the last 24 hours would’ve been “one of the worst in recent years” except a new one is dropping every hour027054
Guys I’m scared the takeoff is starting. I swear any one of the ~10 CVEs that dropped in the last 24 hours would’ve been “one of the worst in recent years” except a new one is dropping every hour802514.2K1.7M- Show more posts
