Farbod

I make cool affordable mfg tech @takton and tinker with sensors at @sensemfg but I also tech talk with my bestie @NextBytePodcast 🇺🇸 🇮🇷

[Farbod @FarbTheBuilder]

@barbinbrad Brad AKA the god emperor of erp

[Officer's Notes @officer_secret]

An OpenSSH bug that took 46 years to ripen!

1980

UNIX puts * in the password field of system accounts. The idea is simple: it’s not a real hash, so it can’t be brute-forced and you can’t log in with a password.

2012

The musl libc developers decide that returning NULL from crypt() on failure is dangerous - programs often forget to check it and crash with a segfault. So they return an error string instead.

Guess which one?

The same asterisk: *.

Three weeks later they add a length limit: passwords longer than 256 bytes burn CPU. Anything longer is rejected. And since it’s an error, crypt() returns *.

2016

OpenSSH fixes a timing attack (CVE-2016-6210). If a user doesn’t exist, the server still hashes the password with a fake/borrowed salt so an attacker can’t tell valid usernames by response time.

2022

Alpine Linux changes the locked root password in /etc/shadow from ! to * so SSH keys work properly on cloud images.

… and the loop closes!

You connect over SSH as root (whose shadow entry is *).

You type any password longer than 256 characters (e.g. 300 As).

crypt() hits the length limit → returns * → OpenSSH compares it with the value in the database → that value is also * → you’re in as root.

That chain took 46 years (!!!) to complete.

Every individual change was reasonable. Together they produced a perfect * == * authentication bypass (CVE-2026-123158, nicknamed *sshole). Fixed in OpenSSH 10.6p2 and Alpine packages.

[Matt Brown @nmatt0]

Local HW and open weights is the way forward hackers.

[Mike Freedman @michaelfreedman]

Today we're announcing the public beta of @TimescaleDB Enterprise!

We're in the midst of a massive industrial buildout. New factories, expanding energy infrastructure, AI data centers, more capable robotics, and existing facilities being modernized and retooled.

But it's not just about building more. It's about building smarter. Operators want greater visibility, tighter control, and better ways to optimize operations, including AI agents that help investigate problems and recommend actions. That means more sensors, more software, and a lot more data.

We think it's time to rethink the industrial historian. Not just a database for storing tag history, but the data foundation for a new generation of industrial applications.

We've built TimescaleDB Enterprise around three priorities:

1. Scale & performance. High-speed ingestion, efficient columnar compression and storage, and fast analytical queries over massive volumes of time-series data, all on PostgreSQL.

2. Enterprise-grade reliability & management. High availability, disaster recovery, monitoring, and upgrades. The capabilities needed to operate mission-critical databases on infrastructure you control.

3. Manage the entire data architecture. Operate independent databases across edge, site, and enterprise, and control how data moves between them. Keep detailed history local while sharing data, aggregates, and context where they’re needed.

TimescaleDB Enterprise also provides the database foundation for the new Ignition Enterprise Historian, building on our partnership with Inductive Automation. We're launching the public beta alongside Ignition 2027 today.

And it's not just for industrial use cases. If you're running TimescaleDB on your own infra, we'd love for you to try it out.

https://t.co/r21HUYpYgY

[MyRadar Weather @MyRadarWX]

N722BD appears to have flown into a rapidly-growing thunderstorm cell, where pilots reported moderate icing.

The thunderstorm cell was even taller than pictured; we contoured the 30 dBZ radar isosurface. The ill-fated aircraft entered the cell at 12:48 p.m..

[Farbod @FarbTheBuilder]

@barbinbrad @danielmitchell 🫡

[Farbod @FarbTheBuilder]

@barbinbrad @danielmitchell This FarBod guy must be a mind reader or something

[Matt Brown @nmatt0]

Infosec community: This is why local AI matters.

I highly recommend diving it and learning about all the complexities of running open models.

[Mike Freedman @michaelfreedman]

It's crazy to me that companies would be willing to sell their internal emails, chat, and project data.

Oh, but "de-identified." Whew.

This will not end well.

[Farbod @FarbTheBuilder]

@nandinrocks @MorellCarson I won’t forget mine

[Carson Morell @MorellCarson]

Late night put stop at the world’s largest truck stop on i80 in Iowa after a long day of Sense installs

+ @FarbTheBuilder ‘s first blizzard

[Farbod @FarbTheBuilder]

Can’t rush him, this is his Sephora

[Farbod @FarbTheBuilder]

@MorellCarson @barbinbrad Webhooks next up for the one and only Brad! 🫡

[Brad Barbin @barbinbrad]

this is a general ledger entry with accounting dimensions created by a sense device. kind of cool

[Mike Freedman @michaelfreedman]

Today we're open-sourcing pg_vectorsearch, a new vector search extension for PostgreSQL.

The performance improvements over HNSW are pretty remarkable. At 100 million vectors:

◆︎ Faster queries, 4× less RAM: 6 ms vs. 8 ms at 95% recall, using 128 GB vs. 512 GB RAM. HNSW couldn't even build on 128 GB.

◆︎ 7× smaller indexes: 25 GB vs. 180 GB at 100M vectors.

◆︎ 50× faster index builds: 49 minutes vs. 42 hours on identical hardware.

And at 1 million vectors, PRISM delivers 15 ms queries at 99% recall on just 2 GB RAM, versus HNSW's 392 ms on 4 GB.

What leads to these improvements? Rather than traversing an HNSW graph with random memory accesses, our new PRISM index partitions vectors based on distance, compresses them using RaBitQ, and scans them efficiently using SIMD vectorization techniques. This takes better advantage of modern CPUs and memory locality.

This is actually our second open-source vector index. We learned a lot from building DiskANN-based pgvectorscale, including some important limitations of graph-based approaches. Those lessons convinced us there was a better architectural foundation, so we started over.

pg_vectorsearch is still in alpha, with more engineering ahead. But we believe fast, scalable vector search should live alongside your relational data, without requiring a separate vector database.

Released under the permissive PostgreSQL License, just like our pg_textsearch extension for BM25 keyword search. Together, they provide the building blocks for hybrid vector + keyword search in PostgreSQL.

Feedback and contributions welcome!

Code and blog post below.

⚡️⚡️⚡️

[Farbod @FarbTheBuilder]

@barbinbrad @tryramp

[daniel scott mitchell @danielmitchell]

teaching Maryland about AI in manufacturing

oops: I talked 10x more about mining data out of factories than building cool factories or using AI wrappers

that's where the real alpha is anyway 🤷‍♂️

thank you @3DRAMPMD, @MDBiz, and @TowsonU for giving me a chance to share!

[Brad Barbin @barbinbrad]

working on a new integration with the boys

[daniel scott mitchell @danielmitchell]

honored to get a shoutout in A2Z Manufacturing Magazine's 40 under 40 list alongside some of the smartest folks I know working on tough problems

very grateful for our world-class team putting in lots of work to bring thoughtful, impactful technology to shops in your neighborhood that make up the backbone of our industry

it’s so fulfilling to see the impact we’ve made in American manufacturing so far… and we're just getting started! 🇺🇸🫡