It seems relatively clear at this point that we (the wider industry) now have an extremely good C/C++ linters, with the only downside that they are expensive (relative to previous tools) to run.

Much like the "if your company depends on running other people's x86 code, then Spectre/Meltdown/etc are devastating", I think if your company is/was depending on the user separation boundaries in the OS to work, then you are in a lot of trouble.

[Unauth'd file read/Local Priv Esc]'s have always kind of been low(er) hanging fruit, but they are nowhere near as cool/good at RCEs.

Now that we have machines to find these at reasonable competence and speed, it is probably a good time to look at anything that you run that [processes user supplied data, or speaks over the network] that is written in C/C++ and find memory safe alternatives. It's not those memory safe alternatives are going to be bug free, but they are far less likely to cause you to need to upgrade your kernel every few days to urgently catch up with local LPE's

Even if you are not going to use the new auditing systems for whatever reason, the "enemy" (whether that is your intelligence agencies, ransom gangs, etc) will have no problem trading a few 100$ for what used to cost $10,000's to do.

The Debian Bookworm -> Trixie upgrade path is by far the [worst/most explosive] I have in recent memory, on the same level of tricky as the sysvinit -> systemd migration

The sysctls location change being the #1 killer, but there are so many paper cuts in that particular upgrade to keep an eye out for

Despite the common consensus, self hosting your outbound email it's not impossible to do (*)

bgp.tools has been sending it's own outbound email since day one of having the ability to send email, while i have been doing a migration i have discovered that rspamd (for DKIM signing) was keeping it's own logs outside of journalctl, meaning they never got rotated (grrr)

The upside of this log rotation failure is that I can give you this graph: The total email volume sent per month via bgp.tools

I don't think it has been particularly hard (other than hotmail) to run this, and it means that I don't have to give customer emails to another 3rd party.

I think the only struggle for a lot of people is that it's quite difficult to find "clean" or at least "boring" IPs to send out from. i suspect you probably couldn't replicate these results with Hetzner/Digital Ocean/etc without some serious fighting or luck

(*) unless your service depends on sending to hotmail/live/msn emails, because that shit is impossible

Cracking open a new tube of toothpaste and uh, they shurnkflated the toothpaste 😢

The Kagi LinkedIn translate is honestly a incredible marketing tool for them.

Throwing the Cloudflare layoff blog post into it and putting it through a few round trips as the "English" translation gets shorter and more frank

Warnings of major disruption as trains across southern England disrupted by radio fault

Did someone/something break the UK's GSM-R stack?

Mildly interesting, it seems that one of the name servers for the .de DNS zone has all of their Cogent customers going via CNNIC (China Internet Network Information Center) all the way to China

A traceroute from Cogent in Frankfurt:

traceroute to 194.246.96.1 (194.246.96.1), 30 hops max, 60 byte packets
 1  * *
 2  be5200.ccr41.fra05.atlas.cogentco.com (154.54.76.169)  0.603 ms
 3  be7946.ccr42.par01.atlas.cogentco.com (154.54.72.117)  9.937 ms 
 4  be2780.ccr32.mrs02.atlas.cogentco.com (154.54.72.226)  20.813 ms 
 5  be2899.ccr21.hkg02.atlas.cogentco.com (154.54.0.42)  181.371 ms 
 6  154.18.9.165 (154.18.9.165)  185.283 ms 
 7  159.226.254.229 (159.226.254.229)  220.828 ms 
 8  * *
 9  218.241.107.69 (218.241.107.69)  221.520 ms !X *

Probably a mistake rather than anything malicious, but that's still some extra long haul miles for some DNS queries

Polymarket market for "next TLD or major domain to break DNSSEC" because it is not "if" but "when"

Another win for DNSSEC

Unmatched at turning small ops mistakes into country wide ops consequences

Forgot to post this last month, but there is a abandoned huge 32m satellite dish sitting in the Azores, with nature slowly reclaiming it with weeds and moss (as is everything in the Azores)

You can see a very similar (likely the same model) still being used in Pakistan for PTCL here on google maps

The Spezi people bring you: Bi-Sexual Cola

DZ: ukpol, elections

Observations from my letter box:

A) The green party sure do send a lot of paper to me

B) Labor seemingly have picked up the tricks of the Americans by sending me increasingly insidious smear letters about the Greens

Like, look at this stuff:

https://electionleaflets.org/leaflets/23707/

https://electionleaflets.org/leaflets/23685/

https://electionleaflets.org/leaflets/23701/

Perhaps my "favourite" (not my scan) is the this bullet point list: https://electionleaflets.org/leaflets/23702/

I uploaded all of my election letters to https://electionleaflets.org ( You should upload yours too! )

Picked up a AMS-IX mug from a recent conference swag table and I didn't realise it's like 70% of the size of a normal mug. Why! Surely you want your customers to use the mugs you give them, if bgp.tools was to have branded promo mugs it would be like the giant Sports Direct mugs where if you spill it you flood your fucking house

A yes, a massive "VPN" button wedged between back and forward, thanks firefox

Firefox might be a chrome advertising psyop

Otters!

Please enjoy this absolutely furious goose

HONK!

Fluffy!

When the crunchy bit of grass is just so good

"Bring back triple cheeseburger in McDonalds" https://petition.parliament.uk/petitions/768167

Iran claims US exploited networking equipment backdoors during strikes

Cisco, Juniper, Fortinet, and MikroTik devices allegedly rebooted or disconnected during the conflict.

Oh don't worry about the MikroTik's, they just do that (reboot unexpectedly in production at inopportune times)

There is something very funny that someone in Sun all of those years ago decided that 2021 was the start of "preposterous time"

#define PREPOSTEROUS_YEARS (2021 - POSIX_BASE_YEAR)

Sun Microsystems clearly accidentality hired a Cassandra because that was worryingly spot on

via https://mastodon.social/@zarbet/110823319981235740 / https://mastodon.social/@tubetime/110811949233318077

While travelling last week I came across this in my hotel room, this seems like a fantastic way to have your USB C powered device's chassis float to 120V live if you use it wrong enough in the dark

Birds, the angle you take a photo of them can change the vibe a lot

From a

>:|

to a

:o

On a ocean facing fence full of love locks full of people's relationship commitments, somebody was just like "well this one's probably more of a combination lock job to be honest"

scdaemon -> scDemons

The asynchronous_metric_log clickhouse table that has no auto expiry and just grows forever is a ploy by big SSD to get you to blindly buy more storage without checking if the cluster is just infinitely growing for no reason

I was in the Azores a few weeks ago, and it really does feel like a place where if humans suddenly decided to leave all at once, it would not take long for nature to reclaim everything

Great place to go for those who like [Moss, Ferns, Abandoned stuff]

How many TCP segments is a reasonable number for a TLS Client Hello?

Depending on your network set up, for connecting to bgp.tools until maybe a couple of hours ago the (non reasonable, but real) answer may have been up to 22!

It turns out on IPv4 bgp.tools has been advertising the wrong TCP window scale for quite some time and it's a true testament to TCP's flexibility that any of this was working in the first place.

Regardless, connection setups on bgp.tools should now work a little better on IPv4 now that your machine wont have to send 21 extra packets

inet_aton wins again

Here I was waiting for output on a tcpdump -ni any host 3306... that should have been port 3306, but of course in the world of inet_aton "3306" is a valid IP address of 0.0.12.234!

Thanks inet_aton!

Some other fun things I spotted in the Cogent Q4 2025 investor presentation:

A) Cogent is now averaging at 800 tbit/s of traffic

B) While their office broadband biz is 4%~ of their total traffic, it's 43% of their $ revenue! Not bad!

C) For their off-net IP offering (aka, they use another provider to do the last mile) over half of the cost to the customer is to the last mile loop provider!

Full thing here: https://www.cogentco.com/files/docs/about_cogent/investor_relations/presentation/Cogent_IR_Presentation_4Q25.pdf

Hah, Cogent CEO seems to recognize that having the ability for customers to make RPKI ROA's on their space (aka, signing a ARIN agreement) made its IPv4 rentable there's a lot more appealing to customers!

It's a outrage that Firefox only has these two adorable error icons for the mascot so far: https://github.com/mozilla-firefox/firefox/tree/4cbe9648c5d4c1cf600b7a8c3589e4589541ded5/toolkit/themes/shared/illustrations

🦎

As a emoji in work presentations connoisseur, it pains me that the best ✨ emoji implementation was the original Twemoji, before in 2017 it went from purple to just boring yellow sparkles.

( I also hate that sparkles has been used to signal AI features :( )

Also, always embed actual PNGs of your emoji into your presentations, to avoid a surprise jankmoji (normally the windows ones) when your stuff gets loaded on to the event presentation laptop

yeah sci-hub bird, I was surprised too

You know, somehow, a IDE update on April 1st is really unappealing, I'll pass

Sir, another "Customers should enact their disaster recovery plans" has hit the AWS status page

Blocked by the pope :(

Damn they really did save that day light last weekend didn't they

"Move wells cathedral to Keynsham so Keynsham gets city status" https://petition.parliament.uk/petitions/764430

Airport adverts are a genre on their own, like how many bong rips was required to come up with all of the HSBC ones in LHR?

"aaaaaaaaaaaaaaaaaaaaaaaaaa"

Netbox labs going for that Jurassic Park nostalgia with their "NetBox Visual Explorer"

https://netboxlabs.com/blog/see-your-infrastructure-introducing-netbox-visual-explorer/

Less than 1GW of fossil fuels on the GB grid klaxon!

I can only conclude that PeeringDB is increasingly vibe coded (in the fullest meaning) because they keep releasing busted code that clearly has not been tested. Today they email me and a lot of other networks with a non sensical email that tells me to do something that does... nothing.

https://github.com/peeringdb/peeringdb/issues/1936

I can sometimes understand the desire to use AI tools, but seemingly none of this stuff is actually going through even basic testing in a staging environment, so frustrating for a service that absorbs quite a lot of sponsor money from orgs

Making an account on something today when I came across a novel to me password restriction

why why why the does Thunderbird let you sort by email subject, I have never wanted to do this and I always do it if I "miss" trying to open the newest email, and when you have a 100k+ inbox this little maneuver's is gonna cost you 51 years of CPU time

[deepest possible sigh]

( and yes, it is a real job listing )

✅ Muted all RIPE Charging Scheme members-discuss emails

There is basically nothing new to discuss and everyone is just going in the same conversation loop, all at expense of filling my inbox with crap