

If anyone’s curious, here’s the leaker’s reasoning: https://www.openwall.com/lists/oss-security/2026/05/07/12
Basically he had no prior knowledge of the vulnerability, he saw the patch go in and wrote a PoC based on that.


If anyone’s curious, here’s the leaker’s reasoning: https://www.openwall.com/lists/oss-security/2026/05/07/12
Basically he had no prior knowledge of the vulnerability, he saw the patch go in and wrote a PoC based on that.
That guy is a tech reviewer on YouTube, it probably makes for good content, and he may not have even bought it.


Forky is from Toy Story 4, but I’m sure there’s still more original Toy Story characters to use, let alone more movies to come.


Also,
it doesn’t run some major software, such as Adobe Creative Cloud or Microsoft 365 desktop apps.
I don’t use it, but I’ve heard Adobe CC can work now. Microsoft Office also still works for me with CrossOver, although they’ve just given up on support for it. Sure, these are much more nitpick things, but I think the author could’ve at least done some research.


Damn, you didn’t even need to fake it, it’s already happening: https://lore.kernel.org/lkml/20260401074509.1897527-1-dwmw2@infradead.org/
Sure it’s still just a joke, but there is a follow up:
The date notwithstanding, I do actually think we should do most of this for real.
Its the same as the Print Screen key.
Seems weird that you’d sync before terminating and killing processes. I prefer “Raising Elephants Is So Utterly Boring”. Although some distros only enable the S, U, B/O anyway.


Interesting that PTP is on the roadmap. I find LinuxPTP a massive pain to configure properly since it’s split up into phc2sys and ptp4l, hopefully ntpd-rs can simplify things.
Someone would say something like ‘you can unlock a secret page on Facebook, just press F12 and paste this in’, and the snippet would upload the victim’s session token to the scammer’s server. So that they can use the account to promote a crypto scam or whatever.


You can snapshot them independently. E.g. I snapshot / on every update and boot, /home every boot, and temporary file directories such as /tmp & /var/tmp don’t get snapshot at all and are also mounted with nodev,nosuid,noexec flags.
He tweeted about being physically and sexually assaulted by police before he committed suicide.
I think what they’re trying to say is, if Windows was a community project those requirements likely wouldn’t exist to begin with.
Oh damn it’s a single ~2830 line powershell or python file depending on the OS. Neat idea, but I don’t trust it in the slightest.
There was a really interesting talk at USENIX a few years ago (Usenix 21 keynote with Timothy Roscoe
Thanks for this!
So you are not wrong about what you are calling bare metal, but that usage is more popular at the moment, but the older meaning of bare metal actually just means “no OS.” It’s still very common in embedded world.
Oh yeah I’m aware and I wasn’t disputing you, I just wanted to point out that in the context of servers that definition is quite ambiguous. But I did know what you meant.
For servers, it seems the papers are calling it “Bare PC” Example: https://doi.org/10.1109/HPCC.2009.34
This was also quite interesting and I’m actually surprised IIS did as well as it did. I’m actually looking for thesis ideas so I’ll add this to my list and potentially see how much things have changed 17 years later.
The os is a layer that mediates these devices.
The OS doesn’t just mediate the devices, it also provides a consistent interface for software to talk to the hardware. E.g. software doesn’t care if you’re using a USB or PS/2 keyboard, the operating system handles that.
I’ve seen some interest in bare metal web servers
Usually in the context of servers, bare metal means it’s not running in a VM, and you are dedicated to the hardware. E.g. one server may otherwise be running multiple customers all isolated from each other using VMs, with bare metal servers you are the only customer using the hardware. They’re supposedly more secure as there isn’t another customer that could use some VM escape vulnerability and read your data. It’s nothing to do with whether you are running an OS or not (although no OS is very not practical on production servers).


If you can’t find an easier way, compiling your own kernel isn’t too hard. After you’ve git cloned the new kernel, you can just copy your distro’s kernel config (they’re usually in /boot), and then use make deb-pkg -j$(nproc) to compile to a .deb file, so it’s easier to uninstall.
At the start of compilation it will ask about a few new options, you can just press enter to use the default option, or decide for yourself. Probably don’t worry about make menuconfig unless you want to.
There’s proper tutorials online if you wish to do this.


I’ve been using a pay as you go plan (not the always free) for years and I’ve never had anything deleted. As it’s still got all the always free stuff I’ve also never payed a cent. I believe it just removes the barrier to paying, but you can add quota limits just in case.
I have 3 instances running (offsite motioneye [arm], wordpress [arm], wstunnel [x86]), but I have daily backups to my home server and plans in place if they get deleted.
TBH, Australia is a bit of a mess, we used to use AS923, but we now use AU915, a lot of gateways are older (AS923), and some are newer (AU915), however AU915 is allowed to use more power, and AS923 is weaker.
As for my experience, I had to buy a gateway for my house, but a train station near my workplace already had a gateway professionally setup, and my university has a gateway too. So anywhere I’d usually take my backpack has coverage.
You can use a service called TTN Mapper to see the gateways near you with a heatmap to show their coverage.
I’ve also just left a comment on the Traccar forums with some useful info regarding the T1000.
Are there any (ideally waterproof) compact devices with long battery life (months~years)?
I’ve mostly built my own, but I did order a SeeedStudio T1000-A a few weeks ago, and it’s arriving next week.
It’s IP65 rated and estimated 4 months battery (with 1 hour updates). It also has WiFi that you can use with Google’s geolocation API when GPS is unavailable.
However like all LoRaWAN stuff, you do need coverage of a LoRaWAN provider. I use The Things Network since it partners with my city, but Helium is another option (although not currently supported by Traccar).
On the website I only found a long list of supported devices with brand name search and protocol type.
Traccar just supports The Things Network webhook API, in the TTN Mapper format (another tracking service, although public). Anything supported by TTN Mapper should work with Traccar.
If you really have to use Adobe Acrobat Reader, it works fine in CrossOver, which is paid but it supports the wine developers.
Also if it helps with getting it working in Wine, these are the installers that CrossOver uses: