Series of Tubes is absolutely lethal, I don't think I have been "minecraft-ed" that hard in a long time (in that I started at 10AM and suddenly it was 8PM)

If you are wondering how the emsign stuff is going with regards to patching, the bgp.tools banner was getting more than 1RPS+ of successful requests at the start when I deployed it (mostly from Chrome and Chrome forks running on Windows), now it's down to 1 every 10 seconds!

I think I've seen my new favorite esoteric exploit construction

The demonstrated packet composition creates a splice-backed UDP skb containing bytes from a file opened read-only, queues the packet to NFQUEUE, taps the resulting netlink skb through a netlink tap and nlmon, rewrites only the linear prefix into a valid authenticated ESP packet using traffic-control pedit, and redirects the packet to loopback. The nonlinear file-backed fragment remains attached. ESP then performs authenticated decryption over the retained page-cache-backed bytes.

Like check it out, it's Tony Hawks Pro Packet Mangler 2

Rube Goldberg Machine of a chain, love it, unhinged

[Stretches]

right, okay, what's next? Maybe OpenSSH could drop some devastating problem as a treat for the end of the week

I just had a scary trip to the local Tesco Express. People glowered at me, muttering "Happy now, PHP developer?". One woman shielded her kids, shrieking "Don't go near the nasty server-side man, kids". And when I got home, someone had posted a ColdFusion manual through my letter box with a message in cut-out newspaper text saying "learn to code, loser".

Need to quickly check your exposure to the compromised CA ? bgp.tools now has a banner that will show if it detects the dire situation.

https://bgp.tools

The real danger is not your browser (who will upgrade quickly), but your VPN Clients, Servers (if you are using badly configured client certs) and software updates that are entirely depending on TLS

RE: https://hachyderm.io/@golang/117470816794707999

Update everything that verifies certificates against public roots.

DZ: ukpol

I find it fascinating that my local (Labour) MP seemingly refuses to display his party on any of his flyers, even going to the point where all of the flyers have a very green colour scheme...

After the whole news of data center sites being valid military targets, my decision this year to colo some stuff in a former nuclear bunker seems less of a whimsical decision and more (unintentionally) prophetic

This weekend bgp.tools moved racks to a full rack!

Not that it needed more space, but having a full rack makes compliance, cable management and having tools and spares on site so much easier

Also having PDUs that I trust not to die makes a huge difference as well

I can highly recommenced bringing a friend who believes in cable management, I will forever now feel bad (and avoid it) about making the back of the new rack messy after this

bgp.tools rack migration status

Oh to be a tuxedo cat sleeping in the autumn sun

Happy birthday to benjojo.co.uk, who turned 17 years old today... I'm... old?

Kleine. Familie

#fotografie #photography #photoart #nature #nrw #naturephotography #norden #westerwald #duesseldorf #mushrooms #pilze #herbst

DZ: NSFW Story (But amusing)

Oh hey, it's October! One of the stories that stays in my head "rent free" is when I worked at a more "serious" company (A bank).

There was this time where the company was launching a new product which is effectively fixed savings account (where you are unable to withdraw your money for a duration, normally in exchange for a better interest rate), and these were called "lockable pots" (of money), and thus the marketing person went ahead and came up with the term "locktober" as the tag line to promote the new feature (given it was October).

This got all the way to a published corporate blog and social media posting, in where it was almost immediately discovered upon using the hashtag for locktober, that locktober was an already occupied term for kink reasons...

Needless to say upon this discovery, a new marketing term was very quickly figured out. Although due to the nature of blog post URL "slugs", bank grade locktober does still live forever in the URL for that particular blog post...

A good day overall, apart from maybe the social guy

DZ: ukpol

Andy, all I want is rejoining the single market (brejoining? idk) and maybe proportional representation

"how hard could it possibly be"

The next NetLdn is just around the corner (Thursday, 8th Oct), and not only do we have the venue confirmed already, we've also got 3 talks confirmed:

https://netldn.uk/2026/09/01/netldn-76-10-09-2026/

Cool CSS trick I stumbled upon,

html:has(.blah) :is(img, iframe, video, embed) {                       
  filter: hue-rotate(-120deg);                                                
}  

Need a different instance of something to have a slightly different color scheme so you can easily tell the difference? You can just hue shift _everything_ by 120 degrees!

I use this to tell the difference between my "corporate"/"personal" webmail client

Hate your landlord? Well for a bargain price of... 1000gbp/m you can get a whole 1m² of space in London with air conditioning, lots of power, 24/7 concierge, and incredible Internet (subject to who you connect to)

Must be deaf and able to sleep standing up though

Remarkably good Monday, obtained new glasses, connected a new 10G transit, and rolled a upgrade on bgp.tools that saved somewhere between 20k to 40k GBP worth of RAM! (after a cosy Sunday in front of a profiler)

🤔, so we know that PCIe over dupont connectors actually works (see picture, old twitter source here via @Toble_Miner

But can you get PCIe to come up via wago connectors?

Well, the job lot box of doom is here and I now have a lot of weird fiber patch cables (Like lots of SM APC SC-SC), including the first actual case I've seen MTRJ with my own eyes, some old 1995 to mid 2000's connector

I guess these are all either future victims of a yet to be imagined art thing or fusion splicer target practice

Some coastal forest hike photos when I was in Latvia this week

Innovation happening at Riga airport where someone said

"hmm, seating in airports sucks, but what if we instead replaced that with the thing they wheel you around in a asylum"

aaaaaaaaaaand properly home at last, Last 3 weeks was a proper series of events, Netherlands to France to (Surprise!) Ireland to Latvia.

Now to sleep and enjoy actually sitting at my desk for a the weeks until RIPE in Sofia

Fellow honk users, do you have the old honk tar balls on hand? I'm on 1.4.1 and I would like to patch in the last known versions before tedu disappeared

Whoever taught the concept of space filling curves to the airport duty free shopping people deserves being outcasted from industry for the collective waste of human time

@sherbang

I can't tell if the IBM s390x software porting team is the best gig ever or the worst, in that you seemingly get to spend a week or so trying to make every possible bit of open source software compile on the monstrosity computer.

This must be either very fun (in that any horrible task is surely not going to stick around that long), or the worst thing ever (moving from one train-wreck of software build system to the next train-wreck of software build system)

Regardless it always does make me smile seeing some software that is like:

"We are known to support amd64, aarch64, and s390x"

Successfully nerd sniped 2 tier 1's to setup peering in a continent they were not already peering in

I will be in Paris for a few days soon with probably a day to spare, does anyone have some recommendation for things like:

! interesting telco/science stuff

! architecture (see photos I post sometimes)

! decent parks (also see photos I post sometimes)

Not a massive museum person, but could be convinced if it's super "up my alley"

Friendly hackspaces or similar also work!

Every sign has a story, and I am wondering what the one was that lead to this check and error

(from https://www.youtube.com/watch?v=O1AcfyXf108)

This has a very similar vibe to SunOS's PREPOSTEROUS_YEARS being 2021 and above

Whenever I use AliExpress I realise that my own website's search engine is not as bad as it could be

haha, golang compress/gzip wat?

package main

import (
	"bytes"
	"compress/gzip"
	"fmt"
)

func main() {
	data := bytes.Repeat([]byte{0x00}, 64<<18+1)
	for lvl := -2; lvl <= 9; lvl++ {
		var b bytes.Buffer
		w, err := gzip.NewWriterLevel(&b, lvl)
		if err != nil {
			continue
		}
		w.Write(data)
		w.Close()
		fmt.Printf("level %2d: %d bytes\n", lvl, b.Len())
	}
}

Results in

level -2: 2097189 bytes
level -1: 32884 bytes
level  0: 16778522 bytes
level  1: 16628 bytes
level  2: 16628 bytes
level  3: 16627 bytes
level  4: 16627 bytes
level  5: 16627 bytes
level  6: 32884 bytes
level  7: 16304 bytes
level  8: 16304 bytes
level  9: 16304 bytes

Magical level 6 compression I guess

Ah polderbaan'd at AMS once more

Fedi god help me I am looking at another job of {A lot of a mixed type} of a thing on ebay and the last time I did this I ended up with what a pallet of PCIe cards that was easier to measure in "{N} tesco bags of NIC/HBA/etc"

But it's so tempting...

I don't know how to feel about being able to near-instantly identify the actual main chip in a PCIe NIC by just the PCB/component layout alone

The computer knows I am working on personal projects again

New found sympathy for the GitHub actions ops people after setting up and running everything via a Forgejo CI runner, like damn this workload sucks it churns [CPU/Disk Wear] like crazy

The UK Goverment petition website is a gem sometimes

I get that every software company just becomes a feature factory and the product gets slower/bloated because of it, but holy hell the stripe dashboard feels like wading through a 2000's Oracle application these days.

Single customer look ups sit there for ~5 seconds contemplating what I can only assume is the horrors of the internal dashboard application

And I'm not a large account by all means, no idea how about it is for the rest of the world

While doing a call out job this weekend I got to spend some time walking around the telehouse area and taking some A* future generic stock photos

This pigeon looks like they are done with it all

Reading back old (2018) n-gate.com posts and oh man... if it felt that the future looked stupid, 2018 HN looks almost reasonable/ironically prophetic now with "benefit" of hindsight

Messed up a bgp.tools deploy and ended up triggering a panic() on every single HTTP request (sorry if you were caught up in that!)

Anyway I now know that my panic() reporter that sends a blob to my XMPP clients buffers enough data that my phone will trigger enough push notifications that even if the standard paging stuff fails, my phone will quite literally vibrate off the desk (as I am slowly watching it do while I type this out)

omfg this is how people end up downloading vendor tooling with free implants, come on guuuuuys

Surely there is no reasonable universe where you need to know who I am to download this, I am not going to build a nuke out of IPMI tooling

Quite possibly every meal could be a caramelised onion meal if they didn't take such a large amount of babysitting to catch them from deciding that now is the time to perish/burn

💸

"EE Limited" transferred 31.99.153.0/24 to "Port 179 LTD"

https://social.bgp.tools/@transfers/statuses/01M1BW2AAQD7JC9XQDAK9XKWAN