Sven Taute

Software/Performance Engineering & Security. Mechanical Sympathy Enthusiast.

[Erin Catto @erin_catto]

I’m happy to announce the release of a new open source 3D physics engine called Box3D. I’ve been working on this project for a few years now, but it represents over 20 years of experience writing physics engines for games. Read more here: https://t.co/2d9aVuUsxj

[Tim McNamara @timClicks]

Today in cursed code: a computer program that plays pong by modifying its own source code. (Each frame is a new compilation). https://t.co/kS2ACZ7r79

[Halvar Flake @halvarflake]

In the last years I wrote up what I learnt from doing two companies, zynamics and optimyze.

It is still work-in-progress, but it is ~27 pages, and I think helpful for everybody that is considering starting a company:

https://t.co/7tcUk8fNNS

[Tim Sneath @timsneath]

One of my personal favorite features announced at WWDC will I suspect be a sleeper hit: container machines, allowing your Mac to run a lightweight, persistent Linux environment with your home directory and repos automatically mounted: https://t.co/dOBdfOOVxC

[Dino A. Dai Zovi @dinodaizovi]

👉 "It not only produced a full chain exploit, but produced eight distinct exploits, at a cost of $15,700 in API credits—an average of about $2,000 per privilege escalation. The binding constraint to N-days is now just a few thousand dollars and API access, which expands the pool of capable N-day attackers dramatically."

[Trail of Bits @trailofbits]

We built four malicious skills to test whether skill scanners actually work. Three took less than an hour to conceive and implement. ClawHub, Cisco, and Vercel's https://t.co/nUlnRcQWyG marked them as safe. 🧵

[Calif @calif_io]

Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.

Blog post: https://t.co/WO9MeExoun

PoCs: https://t.co/NpVgEHBHPl

[Alex Matrosov @matrosov]

Previous generations of software protection (DRM perspective) have always relied on code complexity (for RE), compute limitations, and human limitations as the guarantees that kept hacking timelines reasonably long.

That's changed now. Beyond the acceleration in vulnerability research and malware analysis, the same new reality applies to software protection, and security by obscurity, or assuming the attacker is limited in compute and motivation, no longer works.

[Xavier Rivera @XavierRiveraX]

Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.

[Mitchell Hashimoto @mitchellh]

Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).

If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!

I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.

Feeling pretty swell about this mentality with all the supply chain attacks happening.

[Mitchell Hashimoto @mitchellh]

This is how performant PR review could be. On any forge. Pierre is showing us that the only thing holding that back is a skill issue. Excellent ship here! They’re on fire!

[Tobias Ziegler @Tobias__Ziegler]

If you're interested in SSD internals and how to use them efficiently, our paper, “How to Write to SSDs,” has been accepted to VLDB and is currently on the Hacker News front page. https://t.co/bwYAtPFTBg

[Mitchell Hashimoto @mitchellh]

I strongly believe there are entire companies right now under heavy AI psychosis and its impossible to have rational conversations about it with them. I can't name any specific people because they include personal friends I deeply respect, but I worry about how this plays out.

I lived through the great MTBF vs MTTR (mean-time-between-failure vs. mean-time-to-recovery) reckoning of infrastructure during the transition to cloud and cloud automation. All those arguments are rearing their ugly heads again but now its... the whole software development industry (maybe the whole world, really).

It's frightening, because the psychosis folks operate under an almost absolute "MTTR is all you need" mentality: "its fine to ship bugs because the agents will fix them so quickly and at a scale humans can't do!" We learned in infrastructure that MTTR is great but you can't yeet resilient systems entirely.

The main issue is I don't even know how to bring this up to people I know personally, because bringing this topic up leads to immediately dismissals like "no no, it has full test coverage" or "bug reports are going down" or something, which just don't paint the whole picture.

We already learned this lesson once in infrastructure: you can automate yourself into a very resilient catastrophe machine. Systems can appear healthy by local metrics while globally becoming incomprehensible. Bug reports can go down while latent risk explodes. Test coverage can rise while semantic understanding falls. Changes happens so fast that nobody notices the underlying architecture decaying.

I worry.

[Satoki@Kn0wl3dg3 @satoki00]

Pwn2Own Berlin 2026まとめ
・AIによって大量の0-day RCEが発見される
・運営のキャパを超える応募が殺到
・多くの参加者がリジェクト(賞金が貰えない)
・0-day RCEを持ったハッカーが野に放たれる
・リベンジ脆弱性公開を始める ←いまここ

[Jonas Andrulis @JonasAndrulis]

I'm currently doing a lot of interviews with some of the best technical talent in the world. This helped me realize a pattern about the European job market that is not that talked about but has massive impact on tech in Europe.

Wdyt? Are you a tech IC? Can you confirm?
https://t.co/zor2pkgtcZ

[John Carmack @ID_AA_Carmack]

Space launch was a clear case where there was a large difference in efficiency between what was possible and what was done in practice before SpaceX. A large part of that was due to everything being locked in to what (just barely) already worked, with huge risk aversion. WIth national prestige or a half billion dollar geosync satellite on the line, speculative engineering ideas that might result in a public debacle were not welcome.

When failure is not an option, success can stay very expensive. You need to experiment to improve, and that fundamentally means being comfortable with failure. If you know it is going to work, it isn’t an experiment.

I have long believed that nuclear power today is in precisely the same state as space launch two decades ago, but the even more pressing question now is if semiconductor fabrication might also be.

On the one hand, Moore’s Law has been a sequence of heroic miracles of technology at the wafer fabrication level, grinding out hundreds of compounding small improvements.

On the other hand, fabs are “too big to fail”, and there are elements of extreme conservatism at play. Intel’s “Copy exactly!” fab development exemplifies that mindset – instead of every new building being an opportunity to explore and optimize processes, it was deemed more valuable to just replicate.

While each individual machine may be straining against physical limits of technology, it is possible that the systems orchestrating them all together could be far from optimal.

The explore / exploit axis is fundamental to all decision making, but human risk avoidance probably biases away from optimal exploration.

[Dino A. Dai Zovi @dinodaizovi]

In my estimation, defenders (of organizations) have roughly 1 year before attackers have 10-100x'd their capabilities at vulnerability discovery and exploitation.

While top-tier projects such as Linux, Chrome, Firefox can remediate this volume of vulnerabilities, not all can.

[V4bel @v4bel]

💥 Introducing "Dirty Frag"

A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.

No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.

Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.

Details:
https://t.co/9nqku4svkY

[Mitchell Hashimoto @mitchellh]

Love this post by @antirez on developing Redis Array support. Its a great showcase of thoughtful AI usage and how AI can empower even the best developers while still producing high quality work. https://t.co/xc5KhcHb2P

[Dino A. Dai Zovi @dinodaizovi]

Patching is necessary, but not sufficient. I think of *known* vulnerability management as the absolute bare minimum of a security program.

Today, it's important to realize that discovering and exploiting latent vulnerabilities is getting ~10-100x cheaper and more accessible. In turn, excess attack surface is a liability increasing in cost at the same proportion.