Nowadays, I am happy to find a spam mail between all the CVE announcements. Makes for a nice break.😌

„Scheinriese“: a sky-piercing giant from afar, getting smaller as you approach, turning out to be a rather tiny fella face to face.

„Scheinreicher“: a super billionaire, until you come close enough to see all the things they lack, making you feel *almost* sorry for them.

Anything else we Germans can help with today?

Even if we rewrote #curl in rust, the just reported UAF RCE could still happen when integrating third party libraries like OpenSSL, nghttp2 and others.

Look at the linked source of ‚upki‘ the new lib for certificate validation. Most of the code is ‚unsafe‘ and memory pointers are stored in OpenSSL via „*_set_ex_data()“ beyond any guard of the rust compiler.

#curl used such an „ex_data“ pointer beyond its lifetime in the CVE. C or rust unsafe, makes no difference.

https://github.com/rustls/upki/blob/main/upki-openssl/src/lib.rs

In the Nuremberg trials, German scumbags tried the excuse „I was just following orders!“.

They should have gone for „I would have lost my job and health insurance!“ instead.

But understanding other cultures was not exactly their strength.💁🏻‍♂️

The version numbers of ignored macOS/iOS updates are increasing. I am left behind by myself.😌

Last maintainer of working Space source code has quit.

„I do not really like what software has become in recent decades.“ she explained, entering her capsule. „Glad to leave that behind!“

„I‘ll do some asteroid farming now and then decide what to do with the trillions that’ll earn me. Maybe save mankind. Not 100% sure about that…“

Lets Encrypt goes to 64 days of certificate validity in February 2027. And to 45 days in 2028.

This change to 64 will go live on their test servers (staging) next week.

https://letsencrypt.org/2026/10/07/64-day-certs.html

Really good blog by Joshua Rogers from Aisle about how to do vulnerability hunting using AI. The gist:

- if you set a goal, the AI will try *anything* it learned to reach it, including cheating. It has no morals, it just applies options.
- you need a non-AI gatekeeper to verify findings in various ways to confirm a vulnerability.

„…in some cases, the agents really will happily edit the source code of programs […] adding the vulnerability itself.“

https://joshua.hu/lessons-using-sanitizers-oracle-llm-vulnerability-triage

Frank Denis on zeroing secrets and why it may not work as desired or even be counter-productive.

https://00f.net/2026/10/06/zeroization-1/

iOS app: there is a 75% chance that a drop of water will fall in today’s 24 hours.

Me: Oh, it will be rainy today!

God: Don‘t listen to product managers from hell. I made a nice, mostly sunny day for you! Enjoy! You‘re doing great!

Someone is looking for rust projects with more than 1800 dependency crates.

It‘s for testing cargo, a valid cause as I understand it.

But the binary of such a project would contain them all inside. Given the current security findings, one rebuilds it fresh every hour? Or do the >1800 crates coordinate their disclosures?

Excuse an old man for wondering at such miracles!😌

Someone is a bit fed up that #curl limits individual cookies parsed from a file to 8200 bytes.

"the pedantic opinion of someone" has a nice touch, I'd say.

https://github.com/curl/curl/issues/23284