Fall smell is leaf mold 🍁

I shared this with my trivia team and some unhinged weirdo was trawling through your github and then came back to me like "WHY ARE YOU FRIENDS WITH AN EXTREME RIGHT WINGER" and I'm like "wtf are you talking about?" and they go "THEY HAVE AN URBIT PROJECT IN THEIR GITHUB"

2026-10-27 00:54:26 UTC

This cat and mouse game redlib is playing with Reddit is funny
so Reddit finally locked down their JSON endpoints and it was discovered that percent encoding / as %2F worked around it
great, that worked for a while
then they finally caught on to that too. it looked like nothing was really possible to revive the ability to browse reddit without being tracked
so someone threw claude at it and they found the shreddit service exposes the data as raw html, but it's not in bulk so you have to make a bunch of requests to do it @ an endpoint like
/svc/shreddit/comments/r/{sub}/t3_{id}[/t1_{comment}]?sort=...
so they said fuck it, we'll just do that and reddit can deal with the increased load on their servers for being dicks, but it's missing some important metadata and stuff isn't sorted nicely
surprisingly it works without much latency at all because they batch requests
but now they've also found a graqphql endpoint they can use:
> **GraphQL comments**: Post pages fetch metadata through `/by_id` and comments through Reddit's Android `PostComments` operation, using the existing anonymous OAuth client. This handles Reddit's HTTP 403 block on the comments JSON endpoint. Comment sorting, focused threads, and cursor pagination work without a Reddit account or additional configuration. Each request loads up to 200 comments at 10 levels of depth; links load further comments and replies. The converter and rich text renderer are adapted from [polak14's implementation]

2026-10-26 17:40:47 UTC

- reply

These look great

2026-10-26 17:35:46 UTC

It's amazing how faster a database is than a filesystem at the same tasks
Restoring a backup from Bacula. It generates a virtual filesystem and you navigate through it like a shell and mark files/directories you want to restore. Mark my home directory, it instantly knows it's 93GB and 2.9 million files. Unmark the git directory as I don't need it, it knows it was 2.3 million files and 60GB.
Ridiculous.

2026-10-26 16:30:06 UTC

- reply

Wouldn't have mattered. Turns out they were serving an index.html file from PHP for like 18 hours so it was literally impossible to exploit

2026-10-26 16:29:23 UTC

Is Apple having an iCloud outage or something? I keep being pestered to log in to my Apple account but it doesn't accept my password
https://media.friedcheese.us/uploads/21/4f/37/214f3770b189f90dadd294119f2190e515c935feb363c73a3c0916799c56ef4a.jpg

2026-10-26 05:45:29 UTC

- reply

You were doing the challenge?

2026-10-26 05:18:37 UTC

@npub1hjv…drdr Make this game that never existed
https://media.friedcheese.us/uploads/5a/e1/43/5ae143853e7911d3cf42e58f79c6a5d4fc0054cfe026614c9bad30219a9e3df7.jpg

2026-10-26 05:12:41 UTC

So every exploit will need to be custom tailored to the target platform? 🤡 what happens if you build your own packages ? It won't match anything they can test against ?
https://media.friedcheese.us/uploads/d8/4f/5d/d84f5d0773dab396f54dd6accf1ba281b45cfc796c613b7148ece3fa9354e1c8.jpg
#note1j4l…n46t

2026-10-26 05:06:35 UTC

- reply

Someone got the bitcoin

2026-10-26 04:35:58 UTC

- reply

yeah these days I think we should treat it like a communicable disease. Hiding it from the public is not acceptable anymore when it's dangerous and potentially spreading

2026-10-26 04:33:40 UTC

- reply

> For example: Paris, the city of "love" and "the smell of pee" because visiting a public toilet will cost you 2 Euro / person.
NYC is worse. Piss (human and dog), shit (human and dog), vomit, rotting garbage everywhere. No public bathrooms at all. I almost shit my pants last time I was there begging places to let me use their restrooms lol

2026-10-26 01:22:31 UTC

Okay
https://media.friedcheese.us/uploads/24/26/f1/2426f15e4c4753cf952f7137dd824e70da91c2a3b4d25c3fc9d73e7cdc0a0b15.jpeg

2026-10-25 17:30:24 UTC

- reply

The maintainers can't always be trusted to be the good guys either. Like I said in another post, what happens if one of the devs is a Russian sympathizer and leaks the details to someone connected to the GRU so they can use it against Ukraine during the embargo period? And maybe they extend the wait before patching so attack campaigns can continue in secret? All entirely possible
None of this process really works the way we imagine. The guy who leaked the PHP details claims two people before him were never told there was an embargo. Person X told Y told Z who then posted the details on HackerNews and everyone in that chain claims to have no knowledge an embargo existed

2026-10-25 17:11:09 UTC

- reply

Did anyone steal the bitcoin yet ?
https://stealmybitcoin.com

2026-10-25 17:09:07 UTC

- reply

Coordinates / responsible closure exists to protect the wrong people from consequences. It lets companies and corps protect themselves and leaves everyone else like small businesses waiting until the last second to find out there's something to address which means as soon as it goes public they're the ones most likely to be viable targets of attacks because they didn't have time to process the information, audit their infra, and plan their patches. Sometimes the people with embargo details actually get the patch in secret as well
https://media.friedcheese.us/uploads/a7/b4/30/a7b430bc0fa4352f1cd1ab6401fb3ce50430d99db1e34f1e6d200fa150f2f1fc.jpg

2026-10-25 17:01:19 UTC

- reply

Yeah it's for protecting the economy and we should stop doing that for free. It's not our responsibility when the corps and govs aren't investing in this critical infrastructure.

2026-10-25 16:53:01 UTC

- reply

> on headscale v0.29.5 forwarding cannot be disabled — it is granted unconditionally on every accepted session, so until fixed, treat every headscale SSH grant as root-equivalent.
Yikes :yikes:

2026-10-25 16:51:15 UTC

- reply

> Connector translates traffic to attacker-chosen destinations with no validation; network ACLs are never consulted for the true destination
Haha I knew it. I suggested this as a possible problem a long time ago and people said "but that can't happen every node will apply the network wide ACLs!"
Guess they don't 😮‍💨

2026-10-25 16:47:09 UTC

Haha there's a whole ass website
https://tailworm.com/
#note175a…h42z

2026-10-25 16:44:21 UTC

Used to hang out with Erica in IRC back in the day. Glad she's doing well. Fuck your coordinated disclosure
https://media.friedcheese.us/uploads/bd/2d/7e/bd2d7eedacd7d653574d9ccc53f9ebdbed61713e415d8a4f2e8eb1ece8478f48.jpg

2026-10-25 05:05:22 UTC

Just another unhinged CNBC take
https://media.friedcheese.us/uploads/02/a8/78/02a878dcb79f44502db7229518f11a76bdfe7ddb7eab62e723e79c894f3a975e.jpeg

2026-10-25 04:40:04 UTC

- reply

Amen :amen: :pray:

2026-10-25 04:39:06 UTC

https://media.friedcheese.us/uploads/64/ab/69/64ab69be6bd97ca2145ed86cb3b00c51b172f60aed5b8983734f853d9f86465d.jpg

2026-10-25 02:43:38 UTC

Me: Jason (Vorhees as a kid) must have a strong neck with a head that big
Her: you know who didn't have a strong neck?
Me: who?
Her: Charlie Kirk
Me: damn that's good
Her: and what's the deal with Erica's "baby" she was pregnant with? And now she's got a boyfriend?
Me: oh man I forgot about that
Her: well they're terrible people so

2026-10-24 05:12:46 UTC

- reply

The bullies and the bullied

2026-10-23 23:54:55 UTC

- reply

MLB officials get to make the decision on the roof situation in the playoffs is what I've been told

2026-10-23 19:33:22 UTC

- reply

hoping we get Rayfish on iOS soon

2026-10-23 17:52:08 UTC

- reply

Allegedly they have a lot of stuff running on EOL PHP

2026-10-23 17:41:02 UTC

I said nothing to my wife at all about PHP
She came home from work telling me of a very stressed client who worked for Microsoft that was dealing with the fallout. Apparently they have a lot of PHP and it was very outdated

2026-10-23 05:07:11 UTC

> turning students into a bunch of mindless sheep
It's the authentic Catholic school experience
#note1k3c…dpsy

2026-10-23 03:01:57 UTC

- reply

Yes super proud of you man, you tackled a big crazy project out of love and made it materialize. It's a video game system. And it will have games. And they're real. The console will have to be documented as a piece of gaming history

2026-10-23 02:59:52 UTC

> At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
what did a fucking say about the inability for people to keep secrets? HOW MANY PEOPLE KNEW?
https://media.friedcheese.us/uploads/82/f9/9c/82f99c713d6cf97b940c6d0687827e5256627c40317fddb7dd7dd3744c795500.jpg

2026-10-23 02:53:28 UTC

- reply

You're gonna be pseudo famous for this.

2026-10-22 23:29:19 UTC

- reply

the resemblance! you have the same smiles

2026-10-22 23:28:44 UTC

it's kinda funny to me when people will spend like $500 on a tattoo but not a dentist

2026-10-22 19:21:55 UTC

- reply

I hope this is fake because goddamn it's weird

2026-10-22 18:02:00 UTC

tbqh this eMudhra key leak nonsense is less scary than people really make it out to be. Real targets will never be me and you anyway; the effort is too high and the payoff is far far too low.
OH YOU CAN FORGE CERTIFICATES, GOOD FOR YOU
Can you:
- Hijack BGP announcements to steal my traffic without me or my ISP/provider noticing? (RPKI now protects 70% of internet routes)
- Poison DNS and force my domain to resolve to your server for some subset of users on the internet? (who are you even targeting??)
- Hack my ISP/VPS provider and get on my layer 2?
- Hack my home and get on my layer 2?

2026-10-22 17:42:09 UTC

- reply

I have a new one:
Initial announcement: "A no-auth RCE has been discovered. We do not have a fix yet. The details will be published in 8 hours. We do not know when the fix will be available yet. For every $20,000 donated to our project we will delay publishing the details another 2 hours. The better funding our project has the quicker we can remediate these incidents. Thank you for your time."

2026-10-22 17:38:07 UTC

What's with Hawaii and inconsistent signage for their roads?
They have four terms for a speed bump:
Speed Bump
Speed Hump
Speed Table
Speed Cushion
The bump and the hump are the same thing
The table and the cushion are the same thing
But they're all just speed bumps so just call them speed bumps. We don't care about the specific design decisions; they're meaningless to drivers.

2026-10-22 17:34:48 UTC

What do you Choo-Choo Choose?
https://media.friedcheese.us/uploads/66/0f/07/660f0789c8546e0e9c675a18de48db44cd7dd3608b824f67c9d238236dd8f97a.webp
#note136y…nlq7

2026-10-22 17:21:59 UTC

- reply

I don't know why but my brain worked the same way for so long. And then I decided "imagine it's a person standing. They're leaning forward. It's a forward slash."
https://media.friedcheese.us/uploads/d7/d9/06/d7d906e61720decaa497f4268a7b794ec9be4f690595eb4e2fc6e0673de25f5c.webp

2026-10-22 04:55:55 UTC

- reply

Yesssssss

2026-10-22 04:52:46 UTC

Hahahaha
Full disclosure would have made this obvious because the adults in the room could have discussed this openly and come to this conclusion
https://eliastaylor.com/noexploit/

2026-10-22 03:44:11 UTC

New rule: no more embargoes. You disclose the vulnerability publicly, immediately.
Companies and governments will say "you can't do that! The entire world will be at risk!"
Good, this is your bargaining chip. Tell them to shutdown their sensitive services and wait for a fix.
When will the fix be ready? When it's ready. And if you want the fixes faster you will fund the development of the software.
People have been "saving the economy from billions to trillions of damage" for free because we live in a world now where it's impossible to have a "snow day" without hurting shareholders. They're using you. Make them stop.

2026-10-22 01:45:22 UTC

- reply

it's literally the trolly meme but you're choosing who gets to be saved from being hacked. We know for a fact that you can't keep things secret if too many people know about it, and we're way past the "too many people NEED to know about it" phase.
And do you not think that there will ever be a scenario where e.g., a Russian sympathizer works on a big important project like PHP, they know of the CVEs immediately after they were reported, leak them to their trusted contact in the GRU (if they're not a GRU member already), Russia uses these against Ukraine, Ukrainians die as a result?
These are the types of things we need to consider now and we should have been considering them a long long time ago.
If it was immediate public disclosure everyone would have a chance at the same time to assess their risk, begin watching extra carefully, take systems that are too sensitive offline
signed,
someone who has previously been privileged to protect lots of embargoed CVEs in the past

2026-10-22 01:18:19 UTC

- reply

embargoes have NEVER worked

2026-10-22 00:49:19 UTC

Getting shairplay-sync to work on FreeBSD is hell for some reason. The default path they want to push you down is using OpenBSD's sndiod but I can't get that to work at all. I can run things from the cli and prove audio pumps through sndiod just fine, but shairplay won't send anything no matter what I do??

2026-10-22 00:25:05 UTC

- reply

oh you've been fooled into thinking some datacenters will end the planet, what a shame.
The AI companies are liars. They've lied and lied and lied about how many datacenters they're going to build. They can't. It's literally impossible.
We don't have the grid capacity.
We don't have the electricians to actually complete their construction.
They've manufactured more hardware than we physically have the capability to bring online anywhere on the planet.
They all lied to their shareholders. A few datacenters are being built, but most of them are not. Because they're liars and they'll go to prison for it once our government has regulators again.
Yeah a few datacenters were built in communities where they shouldn't have been and are raising hell with the local community with noise and water pollution or sucking up the local water table. These are isolated incidents and they suck. That's America for you. We can't do shit about it until the harm has happened and then we'll deliberate it in the courts.
But also none of this matters. Because local inference is going to crush the dreams of every single one of these AI companies anyway and their valuations will fall off a cliff.
And then the biggest ones will become part of the military industrial complex and live off government contracts building lethal AI robots, so it will be our taxes bailing them out.
But they won't end the planet. Just like Bitcoin didn't end the planet. Or when Republicans said electric cars were going to kill the grid.
Stop believing all the propaganda, simple math will cut through the bullshit.

2026-10-21 23:25:55 UTC

- reply

> I'm sure the environment will feel just the same in another 10 years.
how old are you, 20?
The last 10 years of tech felt nothing like the 10 years before it or the 10 years before that. Every decade there's a massive disruption.
Shit changes. Adapt.

2026-10-21 17:45:43 UTC

- reply

nope

2026-10-21 17:31:02 UTC

Navidrome: "you can't delete the first/default library"
Fuck you I can't
sqlite> delete from library where id = 1;

2026-10-21 17:06:37 UTC

This wouldn't have happened if they rewrote it in Rust
https://media.friedcheese.us/uploads/0f/fd/8d/0ffd8d1562a4882184eed5d94cb3ab8ce063a5bd2cbfdab2be983953d76aff9e.gif

2026-10-21 17:02:36 UTC

an ongoing pandemic? who has time to think about a pandemic?!
Wake up people, we're still in the middle of the Late Cenozoic Ice Age

2026-10-21 16:56:59 UTC

It's great that the AI companies are donating tons of tokens to open source projects, but how about they donate *servers* to OS / distro projects for building packages so they can keep up with the churn?
#note18h6…w9a6

2026-10-21 16:44:58 UTC

- reply

we should have left this alone so only the NSA and GRU knew how to exploit it, regular people shouldn't have this kind of power

2026-10-21 16:42:04 UTC

this is the worst fucking take anyone on the planet could have, congratulations! You won stupidest post of the day!
https://media.friedcheese.us/uploads/54/0f/44/540f44f0ce0cdde50a5650d1b76822d5fd8dfbc45358cb25414047e441c853f4.webp
#note1zp2…7ldz

2026-10-21 16:38:36 UTC

- reply

upcoming FreeBSD announcement: we're sorry we don't have the latest PHP packages available on the mirrors yet, but they're waiting in line behind Rust and Electron packages and it's gonna be another 48 hours. Sorry we haven't upgraded our package building servers in 12 years.

2026-10-21 16:08:18 UTC

*pulling the ports tree and building the packages to get the PHP update*
sorry master you can't deploy the php fixes yet because they're waiting for Rust to compile

2026-10-21 05:50:20 UTC

- reply

You know you are too far from civilization when it's only like a 6ft wide shelf at the end of some aisle

2026-10-21 04:34:34 UTC

- reply

There literally is in Midwest USA lol

2026-10-21 02:15:14 UTC

is this because white people are afraid to walk down the ethnic food aisles at the grocery store?
https://media.friedcheese.us/uploads/8e/34/bb/8e34bb9e4675715e993372481b984557536303431a0eb6bf569e729ffc5a230e.webp

2026-10-20 22:15:41 UTC

- reply

jcs tried to shutdown the site in 2017 and then people begged for the source so it gave it to some people to keep it running
https://push.cx/lobsters

2026-10-20 21:47:12 UTC

- reply

Still, a unified CA store would be best.

2026-10-20 21:39:06 UTC

Still thinking about how Firefox refuses to use the system CA

2026-10-20 20:45:53 UTC

- reply

Nothing is safe to host on the public internet anymore. Self hosting is dead. The risk is too high, and even if you're skilled enough to keep the software updated or ensure your software auto updates you now have supply chain attacks that make running the bleeding edge risky.
Take it all off the internet, share it over private mesh networks with only people you trust. Make your attack surface as small as possible and your content readonly.
Anything you really want to run on the public Internet that isn't like a static blog should be vigilantly monitored and cared for. This is beyond the capabilities of the average person we encouraged to try to DIY / selfhost

2026-10-20 20:35:10 UTC

Honestly, with how good LLMs are at probing and finding vulnerabilities they're a bigger threat than Heartbleed was too
#note1mpt…q9eh

2026-10-20 20:32:17 UTC

- reply

I've been a Gerber boy for forever but Leathermans always seemed nice too

2026-10-20 20:30:50 UTC

- reply

My public HS had an excellent Civics course back in 2002-2003 😭
I've heard some schools don't cover anything at all

2026-10-20 20:17:43 UTC

- reply

It's crazy to me that there aren't real civics classes anymore

2026-10-20 20:16:56 UTC

> also patreon is taking another 10% cut of my income
Plz people just use crypto you are getting ripped off. USDC, even. Something that bypasses the payment giants
#note1dar…pxuk

2026-10-20 18:31:18 UTC

why is every commercial on cable TV about boner pills???

2026-10-20 16:30:07 UTC

- reply

There's always Postgres and Postgres replication waiting for you, and a tiny attack surface because no filesystem access is possible
aox.org

2026-10-20 15:39:14 UTC

- reply

Lobsters has been terrible since the original transfer of ownership away from jcs
The people running it now are one big clique and only enforce rules if it's not their besties breaking them. Leave and never return, it's the only sane choice

2026-10-19 06:14:53 UTC

- reply

Not enough information. Are you streaming over the Internet? Do you need HDR to work right? Etc etc

2026-10-17 00:13:54 UTC

- reply

hard pass

2026-10-16 03:32:49 UTC

GEICO literally won't let me cancel the policy for a car I don't have. It asks a dozen questions trying to invent reasons to have a policy and then refuses to let you cancel.
Sometimes if you choose a different reason for why you want to cancel the policy it eventually replaces the blue "Cancel Policy" button at the bottom of the screen with "Maintain Policy" to send you back to the main page. Other times the button disappears completely.
https://media.friedcheese.us/uploads/53/88/a0/5388a00deb7c6a4cd24353342a5598fc0048d85993c83740d0765e45798c9622.jpeg

2026-10-14 23:03:59 UTC

- reply

Yet another post-slavery compromise we can't shake

2026-10-13 19:12:15 UTC

how much money would it take to make GIMP not be so fucking slow? Anyone?
https://media.friedcheese.us/uploads/de/ef/32/deef32c4e47200c9e73d330cb27026d1116bf35497f1a9ba0e44691e02cec990.mp4
#note1np6…hpha

2026-10-13 19:02:02 UTC

Photocraft is so fast it's ridiculous

2026-10-13 17:26:22 UTC

- reply

true but it's not their primary compiler/toolchain so they'll continue leaning on GCC. They might even give up on LLVM. We'll have to see how that shakes out.

2026-10-13 17:19:44 UTC

- reply

it can't be an AI-free OS as long as it continues to incorporate 3rd party software that isn't AI-free. e.g., NetBSD will have to drop ZFS support.

2026-10-13 16:25:43 UTC

- reply

taking a nap

2026-10-12 17:36:23 UTC

Would be super funny if Tree Law was the thing that took Trump down
#note1ff4…pjlg

2026-10-12 05:52:04 UTC

> Hook, Spielberg's 1991 reimagining of J.M. Barrie's Peter Pan story starring Robin Williams as a grown-up Peter Pan and Dustin Hoffman as Captain Hook, celebrates its 35th anniversary in 2026 and Sony is releasing the film as a limited-edition 4K Ultra HD SteelBook on Nov. 17.
> The new release features the movie restored from the original camera negative in 4K with Dolby Vision, along with English Dolby Atmos audio.
Wait there's already a 4K Blu-ray with Dolby Vison and 7.1 Atmos. How is this different? It's not??

2026-10-12 05:45:49 UTC

Anyone else instinctively hit the button to the right which must be a send button or something but oops haha nope it's another cancel because whoever designed this at Apple Safari team is on fucking drugs ?
https://media.friedcheese.us/uploads/bb/06/0c/bb060c9a6aad661143aec337f4f41acad8a66ed85593deae878ad0b5cfd1c790.jpg

2026-10-10 23:16:58 UTC

- reply

I should clarify: the pf / netlink securelevel enhancements were intentional. Likely due to CVEs found. But breaking this specific functionality may have been overlooked
I'd file a bug report, there's even a forum thread about it from months ago when others hit it

2026-10-10 23:11:04 UTC

- reply

it happened here intentionally
https://reviews.freebsd.org/D56390

2026-10-10 16:55:09 UTC

- reply

what's his hacker name

2026-10-10 16:35:46 UTC

- reply

Ubuntu is Linux for humans so I'm sure it deters birds

2026-10-10 16:35:02 UTC

- reply

tools can be used and misused in many different ways

2026-10-10 16:32:11 UTC

- reply

Ben Affleck founded a company specifically for mastering AI training / generation as part of the movie production process. They train a custom model
on the dailies to speed up post production

2026-10-10 16:24:46 UTC

What's dumber: vibe coding/art or trying to fight back with vibe lawyering

2026-10-10 16:16:03 UTC

> you cannot make up any rules you like. An artist's moral rights are defined by statute and case law, not by the artist's own preferences. Where they exist, courts do enforce them (sometimes for large sums); where they don't exist, an artist's personal wishes are generally unenforceable. The catch is that the scope is much narrower in the US than in most of Europe, and in the EU they're governed by national law rather than a single unified regime.
Ok so this is useless
#note1w86…ac3r

2026-10-10 16:04:38 UTC

- reply

yeah my next UPS upgrades will be LiOn
The damage to a lead acid when discharged below 50% sucks

2026-10-10 16:02:28 UTC

- reply

Linux is drunk again

2026-10-10 15:49:39 UTC

- reply

Thousand Incompatible File Formats

2026-10-10 15:30:57 UTC

Good morning my Starbucks order is a venti half oat milk half mild salsa mocha frappe farta crappe with extra whip

2026-10-10 06:12:40 UTC

The existence of Anaconda (2025) doesn't make sense. Who approved it? It doesn't make sense; we know tons of viable projects get rejected all the time for being too niche. Is it just because Jack Black and Paul Rudd are extremely well liked and probably tested well?
The entire concept is asinine: instead of rebooting a classic that never had a sequel (I bet tons of scripts were done over the years), they make fun of Hollywood being unoriginal with their reboots by making a mockumentary about making the reboot while lying to the crew about having the rights to make the reboot, encounter the crew actually making the reboot, the movie monster is real, kills the other crew, and they get rescued by Ice Cube.
So then they end up actually having made an unauthorized reboot as the conclusion to the film presented to some ripoff film festival. Then Jack Black gets offered the job to make an official reboot. By J-Lo.
How do you explain this to investors? It's meta and illogical on so many levels.
But it works, and nothing else could ever copy this formula