math-u-t

@t_math_u
ボットじゃないです
cf,hono,ts,next,react,rustとgasなど雑
あとドメイン欲しい
サイトは建築中です(しばらくお待ちください...)

[math-u-t @t_math_u]

去年1年間の成果です

[math-u-t @t_math_u]

@rin_montblank ドメインはいくつ持ってるんですか？

[星野ロミ 漫画村で捕まった人 @romi_hoshino]

俺と一緒に人柱はこちら
(アフィでこのリンク経由だと俺に20%バックされるので良かったら）
https://t.co/C3LsgT4Lp9

[math-u-t @t_math_u]

@rin_montblank 短くてわかりやすくていいですね

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.

Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.

The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.

Result: the next time anyone runs that program, it lets the attacker in as root.

What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.

Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.

The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

[math-u-t @t_math_u]

@SakshiSugandhi MongoDBはマンゴーDBだと思っていた

[math-u-t @t_math_u]

https://t.co/3eZyKuefzM

[math-u-t @t_math_u]

去年1年間の成果です

[math-u-t @t_math_u]

昨日だけど

[math-u-t @t_math_u]

Xに登録した日を覚えていますか？ #MyXAnniversary

[Unfiltered @quotesdaily100]

Tools the internet doesn't want you to find 🔍

1. Shodan
A search engine for internet-connected devices. You can find cameras, servers, and routers exposed online.

2. Archive. ph
Saves a permanent snapshot of any webpage. Useful when articles go behind paywalls.

3. Similarsites
Enter any website and instantly find dozens of similar ones. Great for discovering alternatives.

4. Mailtrack
Shows you when someone opens your email. You see the exact time it was read.

5. Hunter. io
Type in a company name and it finds employee email addresses linked to that domain.

6. Photopea
A free Photoshop that runs entirely in your browser. No download needed.

7. 12ft .io
Removes paywalls from most news articles. Just paste the link and read for free.

8. Carbon
Turns your code into beautiful shareable images. Popular among developers.

9. Explainshell
Paste any Linux command and it explains exactly what every part does.

10. Tineye
Reverse image search that shows where a photo has appeared on the internet.

11. Namecheckr
Check if a username is available across all social media platforms at once.

12. Untools
A collection of thinking frameworks and mental models to help you make better decisions.

13. BuiltWith
Shows the exact technologies, tools, and software any website is built with.

14. GeoGuessr
Drops you anywhere in the world on Google Street View. You guess the location.

15. Virustotal
Upload any file or paste any link and it scans it with over 70 antivirus engines instantly.

[ぺもりんか🏳️‍⚧️ @MESUDANSHI]

【悲報】テレグラムを遥かに凌駕する匿名性を持つメッセンジャーアプリのSession、サ終を予告。

[KMiura @k_miura_io]

「公式」でAPIで郵便番号を取れる！
これはアツい
https://t.co/nV0wYF6OE2

[まろん｡(🌰•᎑•🌰) @rin_montblank]

ちなみにほぼバイ��コーディングしたんですけど情報漏洩しません

[PC Watch @pc_watch]

Claude 4.5 Opus匹敵「Qwen3.6-27B」無償公開、前世代397Bを圧倒 https://t.co/TkFvj2nOQ7

[math-u-t @t_math_u]

普通にskillsよりもスクショ渡す方がデザイン作るのは楽です☆

[math-u-t @t_math_u]

@vivoplt 日本ではちょうど3000円でcodexを使用できますがclaudecodeは3173円必要なので私はcodexを使用します
なお：1ドル=159円とする

[A C X @ceogalxe]

JUST INFO ‼️
GOOGLE BIKIN SENJATA RAHASIA BUAT DETEKSI FILE

https://t.co/o3ZsnQQ0X1

mereka udah pakai ini secara internal selama bertahun-tahun, dipakai di gmail, drive, safe browsing, buat ngecek ratusan miliar file tiap minggu

terus sekarang mereka open source-in

namanya Magika, dan tool ini bisa ngasih tau file itu sebenarnya apa, bukan cuma ngelihat dia pura-pura jadi apa

🔸malware diganti nama jadi "resume.pdf"? Magika tetap bisa tahu
🔸script disamarkan jadi file gambar? Magika tetap bisa tahu
🔸segala trik attacker yang mainin ekstensi file? Magika bisa nembus semuanya

AI ini dilatih pakai 100 juta file. dukung 200+ tipe konten. akurasi 99%. cuma butuh sekitar 5ms per file

cukup satu command :

pip install magika

tool yang sama yang dipakai buat ngelindungin miliaran user Google, sekarang bisa dipakai juga buat ngelindungin punyamu.

Ringkasan singkat :
Intinya, Google punya tool bernama Magika buat ngecek isi asli sebuah file, jadi bukan cuma percaya dari nama file atau ekstensi doang. Jadi kalau ada file berbahaya yang nyamar jadi PDF, gambar, atau file biasa, tool ini bisa bantu ketahuan. Sekarang tool nya udah dibuka ke publik, jadi orang lain juga bisa pakai buat keamanan file.

[Nav Toor @heynavtoor]

Someone built a tool that reads all your chat messages and creates an AI clone of you. It talks like you. Responds like you. Thinks like you. 16,400 GitHub stars.

It's called WeClone.

Export your chat history. Feed it to the tool. It fine-tunes an AI model on YOUR messages. Your slang. Your humor. Your tone. Your personality. Then it binds to a chatbot and becomes you.

Not a generic chatbot with your name on it. An AI trained on thousands of YOUR actual conversations. It learns how YOU respond to questions, jokes, arguments, and small talk.

Here's how it works:

→ Export your chat logs from WeChat, Telegram, or any messaging app
→ WeClone processes and cleans the data automatically
→ Fine-tunes an LLM on your conversation style and patterns
→ Captures your unique vocabulary, tone, humor, and personality
→ Binds the trained model to a chatbot interface
→ Your digital twin is live. People can talk to "you" when you're not there.

Here's the wildest part:

Your friends text your AI clone. They can't tell it's not you.

It uses your actual phrases. It mirrors your response timing patterns. It knows how you react to specific topics because it learned from real conversations where you did exactly that.

This is not a parlor trick. This is digital identity preservation. Your grandchildren could talk to an AI version of you long after you're gone. Your personality. Your stories. Your humor. Preserved.

The AI twin industry is projected to be worth billions. Companies charge thousands for custom digital personas.

This is free. Self-hosted. Your data stays on your machine.

16.4K GitHub stars. 1.3K forks. 422 commits. AGPL-3.0 License.

100% Open Source.

[Meng To @MengTo]

@hey__irish it's https://t.co/GqJwzEec6N - you can try with a free account!

[math-u-t @t_math_u]

@gitlawb Crab