Damus

Recent Notes

Harry Sintonen profile picture
I, for one, hail our EU overlords for staying their ground and not bending over to Apple.

This EU regulation did not come as a surprise to anyone, and definitely not to Apple. Yet they decided to go all knee-jerky about it.

Food for thought: If you cannot implement an AI feature in an interoperable and safe manner, it likely should not be implemented at all.
Harry Sintonen profile picture
Credits and debit cards issued in Finland have two checksums instead of just one. The outer checksum is the standard luhn-mod-10 as usual, but the inner checksum is another method (variation of IBM Check with 7 1 3 multipliers). So why is this interesting?

The two checksums make it far easier to resolve partial card numbers. For example if you take a picture of your card by hiding 3 digits with you finger, such masked card number can be resolved to about 12 possibilities.

TL;DR: Never post pictures of your Finnish debit/credit card, even when hiding some of the digits.

I have no knowledge if cards elsewhere might have similar double-checksum feature.
noplasticshower · 2w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqmvfdung5whdgpwwllyqjggm5lrh4wylvjw3kgex9dxzcsjuc75fsgnuygl Microsoft is going down
Harry Sintonen · 3w
We've released #MorphOS 3.20 https://morphos-team.net/news
Harry Sintonen profile picture
This is the first major release in three years and constitutes some of the most extensive amount of changes ever. See the extremely long change log at https://morphos-team.net/releasenotes/3.20

Yes, it is somewhat technical and detailed at times, but condensing three years of work to mere "fixes and improvements“ would feel like demoting the amount of love that went into it.
Harry Sintonen · 3w
This is the first major release in three years and constitutes some of the most extensive amount of changes ever. See the extremely long change log at https://morphos-team.net/releasenotes/3.20 Yes, it is somewhat technical and detailed at times, but condensing three years of work to mere "fixes an...
Harry Sintonen profile picture
CVE-2026-47187: Symlink escape - rogue SFTP server -> local file read/write
Severity: Critical (CVSS 9.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
CWE: CWE-59 (Improper Link Resolution Before File Access)

A rogue SFTP server can return symlink targets (absolute paths or relative "../../../" escapes) that sshfs passes to the kernel unchanged. The kernel resolves them on the client's local filesystem, so an ordinary "cp" through the mountpoint can read local files back to the server or write server-controlled bytes to local files. transform_symlinks does not cover relative targets.

https://www.openwall.com/lists/oss-security/2026/05/30/3

#CVE_2026_47187
Harry Sintonen profile picture
Most web browsing has been using post-quantum secure algorithms for years now.

Why? Browsers and large CDNs have pushed for post-quantum key agreement implementations, such as X25519MLKEM768.

This has been a great success: No one needed to change or configure anything, or even know about it. This is the best kind of security: unobtrusive and transparent, without requiring user involvement for deployment.

#pqc #pqcryptography #cybersecurity #infosec

2
Harry Sintonen · 3w
The next larger visible disruption will likely be when it is finally decided that non-PQC connections are considered too insecure. This will likely lead to a phase-out similar to what happened with SHA1 signatures over ten years ago. - https://security.googleblog.com/2014/09/gradually-sunsetting-sh...
Harry Sintonen · 3w
About 70% of human traffic towards cloudflare is using PQC - https://radar.cloudflare.com/post-quantum