Paweł Małachowski

IT musings, #DDoS, #DPDK, #BGP, #AS57811; tweets are my own

[The Consensus @theconsensusdev]

Kumar Ujjawal, Apache DataFusion committer and Turso contributor, takes us behind the scenes to understand affinity and type coercion in SQLite, which differs in this regard from how many other major SQL databases work, in a new article for The Consensus.

[morphillogical @morphillogical]

With apologies to Clarke and Dawe.

INTERVIEWER: Thank you for joining us Senator Collins. Now this OpenBSD vulnerability that was revealed earlier today–

COLLINS: The one where the kernel panicked?

INTERVIEWER: Yes

COLLINS: Yeah, it's not very typical, I'd like to make that point.

INTERVIEWER: Well how is it untypical?

COLLINS: There are a lot of these packets going around the world all the time and very seldom does anything like this happen. I don't want people thinking that C is not safe.

INTERVIEWER: Was this C code safe?

COLLINS: Well I was thinking more about the other ones.

INTERVIEWER: The ones that are safe.

COLLINS: Yeah, the ones that don't panic the kernel.

INTERVIEWER: Well if this wasn't safe, why was it running at ring zero on millions of machines?

COLLINS: Well I'm not saying it wasn't safe, it's just perhaps not quite as safe as some of the other ones.

INTERVIEWER: Why?

COLLINS: Well some of them are built so that they don't segfault at all.

INTERVIEWER: Wasn't this built so it wouldn't segfault?

COLLINS: Well obviously not.

INTERVIEWER: How do you know?

COLLINS: Well because a selective ACK block placed 2^31 bytes away from the receive window, causing an int comparison to overflow, so the kernel concluded the same byte was simultaneously above and below the acknowledged sequence number, deleted the only hole in its SACK list, appended to a null pointer, panicking the kernel and pulling down the entire machine. It's a bit of a giveaway, I just like to make the point that that is not normal.

INTERVIEWER: Well what sort of standards is this C code written with?

COLLINS: Oh very rigorous software engineering standards.

INTERVIEWER: What sort of thing?

COLLINS: Well it's not supposed to crash, for a start.

INTERVIEWER: What other things?

COLLINS: Well, there are regulations governing which functions you're allowed to call.

INTERVIEWER: What regulations?

COLLINS: Well, gets() is out.

INTERVIEWER: And?

COLLINS: No strcpy. No strcat.

INTERVIEWER: sprintf?

COLLINS: Look, sprintf is fine if you're careful.

INTERVIEWER: Are people careful?

COLLINS: For the most part.

INTERVIEWER: What else?

COLLINS: Code's gotta be in source control. There's a test suite.

INTERVIEWER: What does it test for?

COLLINS: That it compiles I suppose.

INTERVIEWER: So the allegations that it's a dangerous language that does next to nothing to check whether code is doing what it's supposed to, that's ludicrous?

COLLINS: Absolutely ludicrous. C is a serious production language.

INTERVIEWER: Well what happened in this case?

COLLINS: Well the kernel crashed in this case by all means but it's very unusual.

INTERVIEWER: But Senator Collins, why did the kernel crash?

COLLINS: Well it got a packet.

INTERVIEWER: It got a packet?

COLLINS: The kernel received a packet.

INTERVIEWER: Is that unusual?

COLLINS: Oh yeah. Online? Chance in a million!

INTERVIEWER: So what do you do to protect the internet in cases like this?

COLLINS: Well we patched the bug upstream.

INTERVIEWER: …leaving other vulnerabilities no doubt unfixed.

COLLINS: No no no the bug has been patched. You might need to deploy it but–

INTERVIEWER: But this class of vulnerability–

COLLINS: It's not a class of vulnerability, it's a one-off bug caused by programmer error.

INTERVIEWER: Well what else is out there?

COLLINS: Nothing's out there.

INTERVIEWER: There must be something.

COLLINS: There is nothing out there. All there is, is code, and programmers, and fixes.

INTERVIEWER: And?

COLLINS: And untold numbers of exploitable kernel-level exploits.

INTERVIEWER: And what else?

COLLINS: And a 27 year old integer overflow.

INTERVIEWER: And anything else?

COLLINS: And large private models at AI labs discovering more vulnerabilities in secret. But there's nothing else out there.

INTERVIEWER: Senator Collins, thank you for joining us.

COLLINS: It's a complete void. Nothing worth thinking about. Oh, we're out of time? Could you call me a cab?

INTERVIEWER: But didn't you come in a self-driving car?

COLLINS: Yeah I did but…

INTERVIEWER: What happened?

COLLINS: Well the kernel panicked.

[Reuters @Reuters]

A Cuban mechanic, Juan Carlos Pino, modified his 1980 Polski Fiat to run on charcoal instead of gasoline, offering a cheaper alternative amid fuel shortages caused by US sanctions https://t.co/dr8jJyR4bE

[Damian Menscher @menscher]

In 2025 botnets started using residential proxy networks (like IPIDEA which Google disrupted in Jan) to spread to vulnerable IoT within home networks. DDoS quadrupled in size, a step change in the expected exponential growth trend (here shown on a log scale).

[Nouriel Roubini @Nouriel]

The Coming Crypto Apocalypse

By @Nouriel Roubini

The future of money and payments will feature gradual evolution, not the revolution that crypto-grifters promised. Bitcoin and other cryptocurrencies’ latest plunge further underscores the highly volatile nature of this pseudo-asset class; one only hopes that policymakers will wake up to the risks before it's too late.

NEW YORK – A year ago, the most pro-crypto president in US history had just returned to power after a campaign of pandering to clueless retail crypto investors, and having received massive financial backing from semi-corrupt crypto insiders. Donald Trump’s second coming was supposed to be a new dawn for crypto, leading various self-dealing evangelists to predict that Bitcoin would become “digital gold,” reaching at least $200,000 by the end of 2025.

As promised, Trump did gut most crypto regulations. He also signed the Guiding and Establishing National Innovation for US Stable Coins (GENIUS) Act; pushed for the Digital Asset Market Clarity (CLARITY) Act; profited personally from shady domestic and foreign crypto deals ; promoted his own useless meme coin; pardoned crypto crooks who had allegedly aided terrorist organizations; and hosted private dinners for crypto insiders at the White House.

Moreover, crypto was supposed to benefit from various macro and geopolitical risks, such as the ballooning of US and other advanced economies’ debt and deficits; the debasement of the dollar and other fiat currencies; new trade wars; and growing tensions between the US and Iran, China, and many others. Indeed, the heightened risk environment helps to explain why gold rose by 60% in 2025.

But “digital gold” fell by 7% in 2025. As of this writing, Bitcoin is down 35% from its October peak, below where it was when Trump was elected, and the $TRUMP and $MELANIA meme coins are down 95%. Every time gold has spiked in response to trade or geopolitical ructions over the past year, Bitcoin has fallen sharply. Far from being a hedge, it is a means of leveraging into risk, showing a strong correlation to other risky assets like speculative stocks.

Calling Bitcoin or any other crypto vehicle a “currency” has always been bogus. It is neither a unit of account, a scalable means of payment, nor a stable store of value. Even though El Salvador made Bitcoin legal tender, it accounts for less than 5% of transactions for goods and services. Crypto isn’t even an asset, because it has no income stream or function, nor any industrial or real-world use (unlike gold and silver).

Seventeen years after Bitcoin’s launch, the one and only “killer app” in crypto is the stablecoin: a digital version of old-fashioned fiat money, which the financial and banking industry already digitalized decades ago. Yes, whether digital money and financial services should be on a blockchain (distributed ledger) or a traditional double-ledger platform remains a question.  

But 95%  of “blockchain” monies and digital services are blockchain in name only. They are private rather than public, centralized rather than decentralized, permissioned rather than permissionless, and validated by a small group of trusted authenticators (as in traditional digital finance and banking) rather than by decentralized agents in jurisdictions with no rule of law.

[Paweł Małachowski @pawmal80]

vibe vs. kraft coding

[Ed Zitron @edzitron]

Newsletter: This is The Case Against Generative AI, a comprehensive analysis of a financial collapse built on myth, the markets’ unhealthy obsession with NVIDIA's growth, and the fact that there is not enough money in the world to fund OpenAI.
https://t.co/QY7rdrxfeL

[Enno Rey @Enno_Insinuator]

90th Minute: A First Look to Collateral Damages
and Efficacy of the Italian Piracy Shield
https://t.co/esuwFjMtIM [PDF]

[GREG ISENBERG @gregisenberg]

THIS chart is the CLEAREST signal of where the internet is heading.

social media time is SHRINKING for the first time in HISTORY, and young people are leading the pullback.

Brainrot is OUT.

they grew up online, saw the full cycle of social platforms, and learned early that endless scroll doesn’t make you happier or smarter.

they’re the LEADING indicator. their parents will follow in 3-5 years.

AI slop is the nail in the coffin.

every feed feels synthetic familiar faces, identical voices, recycled ideas. the “factory smell” of it all finally broke people’s curiosity.

but there’s an upside. every trend creates its anti-trend.

attention is shifting back to things that feel real, slow, and intentional.

people are paying for spaces that make them feel grounded, informed, and connected again.

the next $100M+ companies will engineer density, trust, and time well spent. they’ll build containers for meaning, then use AI to keep them organized, not optimized.

the internet’s oldest assumption that more engagement equals more value is breaking.

the white space i think is...

• "slow media" formats: weekly briefs, serialized content etc
• private groups that operate like clubs with applications and rituals
• provenance and identity layers that verify real creators and sources
• brands with offline gravity like real events, real belonging
• curated directories and vetted marketplaces
• paid memberships that deliver depth
• note: we share business ideas around this on @ideabrowser
• IRL anything - dinners, meetups, shared experiences

young people are abandoning social media faster than their parents are discovering it.

If you understand what that means, that's a big deal.

i can't stop thinking about this FT/GWI chart.

brainrot is OUT.

meaning is IN.

[Paweł Małachowski @pawmal80]

@edgenative @tompaseka @anurag_bhatia Thanks to that it will pass BCP38 checks.

[Paweł Małachowski @pawmal80]

@danieldibswe I've started high school in 1995. School was connected to NREN. I typed "ftp https://t.co/V4Zt4l1Alz" (address taken from a computer magazine), ftpd banner appeared and it blew my mind. Few months later I was granted supervisor rights on local Novell server.

[Paweł Małachowski @pawmal80]

@ghostinthenet @jcurranarin @TeamARIN and then FIBv6 size in DFZ will explode ;)

[CAIDA @caidaorg]

What's New: IRRegularities in the Internet Routing Registry https://t.co/naDEvM4fqz

[Daryll Swer @DaryllSwer]

Published a small blog post regarding #BGP zombie behaviour on #Juniper that I observed myself in real-time.

Affected both #IPv6 and #IPv4.

#JunosOS #JunOS #BGPZombie #BGPZombies #Routing

https://t.co/AK5oOTisqB

[Phil Eaton @eatonphil]

I spent some time looking into how various databases execute expressions in their query language.

Most of them have a tree-walking interpreter, some have a virtual machine, and some do just-in-time compilation.

Let's dig into some database code to see!

https://t.co/BIGtHKh1X4

[Eric Murphy @murphye]

Great three part blog series on HTTP/3 is full of details that I have not seen elsewhere. A takeaway is that HTTP/3 + QUIC is complex to implement and many HTTP servers are struggling to add support. https://t.co/NPQu7LXZLH

[Jason Livingood @jlivingood]

ISPs and video streaming platforms will find this ACM Sigcomm 2023 paper VERY interesting tomorrow! New ABR algo tested at Netflix reduces bandwidth bursts to smooth traffic, improving RTT & QoE & freeing up capacity. https://t.co/4AclHF03GD #Sigcomm2023 #videostreaming #QoE

[Paweł Małachowski @pawmal80]

https://t.co/iggd4QKbnK leaky fibers, from @theactionlabman

[Ben Cox (EOL @[email protected]) @Benjojo12]

New blog post, maybe the most painful/scary one yet.

---

"Grave flaws in BGP Error handling"

https://t.co/9yrcmef0Od

[Enno Rey @Enno_Insinuator]

Route to Bugs: Analyzing the Security of BGP Message Parsing
https://t.co/kn6JxyfTlz [PDF]