Untra 💎 retweeted
publication in mathematics may soon align with the humanities: the unit of progress is the definitive book -- not articles, not proofs -- but a comprehensive framing of and advance in a specific area of mathematics, the reading of which would be a slow educational journey.
Untra 💎 retweeted
‼️ Ruby on Rails apps using ImageMagick can be made to write attacker-chosen files by one crafted image upload, no login needed.
Rated 9.8/10, it can also leak secrets like secret_key_base if uploads sit on disk.
Untra 💎 retweeted
Doing category theory is like solving a 4-dimensional Sudoku puzzle. This is part of the proof that coends are colimits over a twisted arrow category.
Untra 💎 retweeted
SSH PRIVATE KEY LEAK:
44444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444
*sshole is out
if you run sshd on alpine, openwrt or any musl box with password auth on: update now
official writeup: sshhole.com
Untra 💎 retweeted
I can't decide what's more annoying. That Coloradans would raise taxes on themselves in perpetuity for less than a temporary benefit of $1/day, or that calculating income tax in Excel now requires the LET, MIN, and MAX formulas instead of just *0.044.
Untra 💎 retweeted
We at @MacHomebrew been warning @Google about this for years. Sadly, they are too addicted to making money selling malware ads.
If someone senior enough at @Google wants to talk about this or, ideally, just fix the fucking problem: I'm easily contactable online.
RTs welcome.
Untra 💎 retweeted
An announcement that is as personal as professional:
18 months ago, we started collecting online prices in real time to track how Liberation Day tariffs were feeding into inflation.
A lot has happened since. The BLS commissioner was fired. The longest government shutdown in US history meant CPI wasn’t published for the first time. And the case for an independent measure of inflation became much stronger.
What started as a tariff inflation tracker has since grown into something much bigger:
The Bloomberg Price Project (BPP), our attempt to build the US CPI from the ground up using alternative data.
Today, BPP covers 87% of the CPI basket, across both goods and services (more new data will be added in coming weeks). Every month, we collect millions of prices from card transactions, e-commerce sites, grocery stores, pharmacies, rental listings, corporate data, Bloomberg Terminal market prices and government records. And more data are coming.
The payoff is detail. Official CPI data let you drill down to categories such as “uncooked beef steaks.” BPP goes much deeper — breaking the CPI basket into almost 700 line items, compared with roughly 200 in the official data.
Brought to you by: myself, Troy Durie, Daniel Ripperger-Suhler, Joshua Danial and Scott Johnson from across Bloomberg Economics.
Explore the Bloomberg Price Project at BECO MODELS BPP <GO>, or download the data at ECAN US BPI <GO>.
I believe the paywall on Bloomberg.com is coming down briefly so you can read this without a subscription (but you should subscribe!)
bloomberg.com/graphics/2026-…
Untra 💎 retweeted
‼️ Ubuntu and Red Hat still have no fix for a Linux kernel flaw that Anthropic says its unreleased AI model turned into a remote root exploit.
The bug, CVE-2026-98432, is a use-after-free in the IPv4 TCP handshake, rated 9.8 out of 10.
The exploit needs no credentials and targets servers with a multipath TCP listener, which Go 1.24 and later open by default.
The fix reached stable kernels on 11 October and Debian has shipped it. Ubuntu still marks every release from 16.04 to 26.10 vulnerable.
Red Hat now rates it Critical but has no patched kernel for RHEL 8, 9 or 10.
Anthropic has not released the exploit. By its count, it takes 48 minutes to leak a kernel pointer and five more to run commands as root.
Untra 💎 retweeted
Me and Krobus at red rocks for the special 10 year extravaganza concert. Thanks everyone here for coming and I hope you have a good time.
Untra 💎 retweeted
people blame this sort of thing on TikTok or whatever but it’s directly George W Bush’s fault. it’s crazy that teachers basically aren’t allowed to fail students anymore because of the No Child Left Behind Act.
Untra 💎 retweeted
Heaven is where the compile speed is from Go, the safety from Rust, the performance from C++, the libraries from Python, the macros from Lisp, the stability from Java, the types from Haskell, the ubiquity from JavaScript, and the error handling from Elm.
Hell is where the compile speed is from Rust, the safety from C++, the performance from Python, the libraries from Lisp, the macros from Java, the stability from Haskell, the types from JavaScript, the ubiquity from Elm, and the error handling from Go.
Untra 💎 retweeted
Hi,
We have just released a hotfix to address CVE-2026-109618 and CVE-2026-109619 for OPNsense 26.7.7, 26.4.2p3.
We strongly recommend installing this security update as soon as possible to ensure your systems remain protected.
Stay safe and open source,
Your OPNsense team
Untra 💎 retweeted
We wrote up how to find every PHP service you run, including the ones on odd ports, under sub-paths, inside appliances and containers, and how to patch and verify them.
Commands plus prompts for your coding agent.
We also started SecureTheWeb.org
It checks Chaos for services running an affected version and emails their security@ inbox for free, with the fix.
We are enriching Chaos over the coming months so the next time a bug like this lands, the affected services are mapped fast and remediation starts sooner.
Read: go.projectdiscovery.io/SIC1T…
Untra 💎 retweeted
I’ve been seeing the same pattern repeatedly with a certain type of account on X, and it looks like large-scale data collection.
These accounts usually have:
• Very low follower counts
• Attractive photos of women
• Almost no posts
• Recent join dates
• Bios that are minor
variations of the same text about being rich, helping the poor, and charity from a father
When you open them, the “Who to follow” suggestions are tightly clustered in one professional domain.
One set surfaces mathematicians, another neuroscientists, another software engineers, and so on.
The pattern is consistent
across different domains. These accounts appear to be deliberately seeded into specific professional graphs by mass-following people in a given field.
The recommendation system then surfaces others who share those follows, which places the accounts inside the networks of people working in those areas.
On a large scale this is an efficient way to scrape or collect data from targeted professional communities, profiles, connections, activity, and network structure, that can be used for AI training or other data purposes.
The accounts themselves stay mostly silent and look like ordinary romance/charity scam profiles, which keeps them low-effort and harder to spot while they sit inside different domain graphs.
If you keep seeing this, it’s not random. Different batches are pointed at different fields, and the “Who to follow” clustering is the visible signal.