Juan Traverso

70 Followers
56 Following
253 Posts

Systems (and many other things) nerd. I break stuff for fun at Euskal Encounter, and for a living at some company.

Mainly I lurk, but I would engage in conversation if I like the topic. Interests are 3d printing, reading (either sci-fi or historical), all around tech/programming/systems, bit of infosec, Legos and gaming.

It's always DNS.

GitHubhttps://github.com/imobilis
LanguagesES/EN
PronounsHe/Him
This is the first time I'm posting anything here but I figured this may be the right audience.

I've never run into something like this and I don't quite know what to make of it. I'm the author and maintainer of libgpiod. The official git repository is the one at kernel.org[1]. There's also a github mirror[2] as well as a documentation page[3] at readthedocs that I maintain.

I noticed (purely by chance) that there's a new website at libgpiod.com that's been created recently. I have nothing to do with it. It's clearly AI-generated but it redirects to my github. It's a 2 month old domain, anonymized registrar, protected by Cloudflare and NeoProtect and a Swedish host behind that.

Clearly someone went to great lengths to stay anonymous. I'm afraid of falling victim to some new elaborate supply chain attack. What should I do about it (if anything)? Has anyone else experienced something similar?

[1] https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/
[2] https://github.com/brgl/libgpiod
[3] https://libgpiod.readthedocs.io/
Libgpiod - Modern C Library for Linux GPIO Hardware Control

Libgpiod is a modern C library for Linux GPIO control, enabling efficient hardware access for embedded and system developers. #Libgpiod

Libgpiod

PSA for #AsahiLinux users: Do NOT upgrade to macOS 27 Golden Gate!

Apple has changed how the boot picker and Startup Disk applications detect valid OS boot volumes. When using either from macOS 27, your Asahi partition will not be visible! We believe this to be a bug, and have filed a report (FB22994760).

If you have already upgraded to the beta and noticed that your Asahi partition has disappeared, do not stress. Your Asahi partition is still there, and you have not lost any data.

If you have already upgraded to macOS 27 and have a secondary installation of macOS 26 or below, set this as your default Startup Disk to restore access to Asahi. The Apple Silicon boot picker is a full-fat macOS app running in the default boot volume's recovery environment, so its behaviour is dependent on the default boot volume's macOS version.

If you insist on trying out macOS 27 as soon as possible, please ensure you install a secondary copy of macOS 26 first, or install macOS 27 itself on a secondary volume. We will not support users who have installed the macOS 27 beta without making contingency or rollback plans (such as ensuring at least one stable macOS version is installed).

We have patched the Asahi Installer to prevent it from running on macOS 27 until we have some idea of what's going on. It will print a version of this message and then exit if you try to run it from the macOS 27 beta.

Pedantic complaint: "0-day" does not mean a security vulnerability that hasn't been patched, it means a a vulnerability that the vendor is unaware of. The word for a security vulnerability that hasn't been patched is "unpatched". If you call an unpatched vulnerability that the vendor has known about for months a 0-day, that's just trying to play into a hype cycle, not actually caring that words do, in fact, mean things.

The four organizations who maintain your favorite open-source DNS software, ISC, CZ.NIC, PowerDNS and NLnet Labs, gave a lighting talk at @dnsoarc 46 about the avalanche of LLM-assisted security reports for their projects, and the effect it has on us and our users.

The last slide ends on a “Hug your OSS maintainer" note, but I think this is understating the gravity of this situation. I hope we put forward a stronger message during the repeat of this presentation at RIPE 92.

People need to consider that we are in a situation where developers with talent, purpose and experience have created something valuable for the internet community over the last 20+ years. They could have chosen to work at $MEGACORP for twice, three times the pay, but they chose to do something meaningful.

Now, the body of work they carefully designed and maintained over the last decades is being picked apart by an LLM. Yes, as a result the products become some definition of “more secure” but there is no reasonable prospect that this avalanche of reports will end. Ignoring them is not an option. Feature development has come to a halt.

As an employer, what am I supposed to tell my developers? Thanks for creating this amazing DNS software over the last 20 years, it looks like you’ll spend the next couple of years triaging and fixing bugs and coordinating CVEs with your peers.

How do we keep people motivated to do open source and even if we do, how do we keep this development model sustainable? We can’t pivot to the ‘agentic era’ just like that and even if we could, I think my colleagues do this job to create something amazing—artisanal if you will—not to to maximize output at all costs so shareholders get rich.

Practically though, encouraging organizations to purchase a support contract will certainly help on the short term, because:

- You will get access to world class support;
- You will get early security vulnerability notices under NDA, keeping your critical infrastructure safe from a whole new class of LLM fueled risks; and
- In the grand scheme of things, you will help keep this open source model sustainable so your favorite DNS software continues to exist and thrive.

#DNS #LoveDNS #LLM #FOSS #OpenSource #RIPE92

https://indico.dns-oarc.net/event/56/contributions/1233/

Este año he puesto un par de mejoras de Quality of Life en el mapa de selección de puestos del sistema de reservas de la Euskal... y no hay test ni framework que te prepare nunca para el stress de publicar nuevas funcionalidades en un apartado critico. Pero ha salido bien! #EE34 #EuskalEncounter
Menos de 24h para abrir reservas de la Euskal 😊
La pila de cosas que tengo que hacer para la Euskal me está empezando a mirar mal... habra que ponerse a ello.

This thread is such a massive failure of the community bug reporting process.

https://www.reddit.com/r/Fedora/comments/1s8jevj/a_message_to_fedora_devs_please_stop_interfering/

Apparently there's a small but significant fraction of users who see their browser home reset to the Fedora Home on Firefox updates or other circumstances... and they're all convinced this is some kind of evil intentional Fedora packaging feature that hijacks your preferences on every update, and that it must happen to everyone (it does not).

So far there is one known hypothesis for why this can happen (it involves Firefox Sync), but that doesn't cover all instances because some affected users claim not to use Sync. I reported this one upstream so hopefully there will be a solution soon. Nobody had until now...

Meanwhile, not a single affected user has bothered to write up reliable repro steps or follow through with maintainers on tracking down the root cause.

I've also looked at upstream bugs and found several shaped like "Firefox lost my prefs on upgrade", but none of them were followed through to a root cause either.

Of course, when Firefox loses the home page pref and it reverts to about:home, people shrug and set it back... but when Fedora Firefox does the same and it reverts to start.fedoraproject.org, it's clearly a Red Hat conspiracy to hijack people's browsers and they demand Fedora remove the default home page branding override entirely, instead of working with a developer to get the bug fixed...

the precise timeline of how OpenAI fucked over the RAM market

> October 2025: Sam Altman flies to Seoul and signs simultaneous deals with Samsung and SK Hynix for 900,000 DRAM wafers per month. That's 40% of global supply. Neither company knew the other was signing a near-identical commitment at the same time.

https://xcancel.com/aakashgupta/status/2038813799856374135

edit: this guy is a seriously bot-pilled pumper, but this seems to be a good summary of known facts. doubt the AI memory use trick he mentions is load bearing tho.

Aakash Gupta (@aakashgupta)

The timeline on this is genuinely insane. October 2025: Sam Altman flies to Seoul and signs simultaneous deals with Samsung and SK Hynix for 900,000 DRAM wafers per month. That's 40% of global supply. Neither company knew the other was signing a near-identical commitment at the same time. Those deals were letters of intent. Non-binding. No RAM actually changed hands. But the market treated them as gospel. Contract DRAM prices jumped 171%. A 64GB DDR5 kit went from $190 to $700 in three months. December 2025: Micron kills Crucial, its 29-year-old consumer memory brand, to reallocate every wafer to AI and enterprise customers. The company explicitly said it was exiting consumer memory to "improve supply and support for our larger, strategic customers in faster-growing segments." Translation: the AI demand signal was so loud that selling RAM to PC builders stopped making financial sense. March 2026: Google publishes TurboQuant, a compression algorithm that reduces AI memory requirements by 6x with zero accuracy loss. Cloudflare's CEO called it "Google's DeepSeek." The entire thesis that AI would consume infinite memory forever just got a six-month expiration date on it. Same month: OpenAI and Oracle cancel the Abilene Stargate expansion. The $500 billion data center vision that justified the RAM deals couldn't survive its own financing terms. Bloomberg attributed the collapse partly to OpenAI's "often-changing demand forecasting." MU is now down ~33% from its post-earnings high. Revenue up 196% year over year, EPS up 682%, and the stock is in freefall because the company restructured its entire business around a demand signal that came from non-binding letters and is now being compressed out of existence by a research paper. Micron bet the consumer division on Sam Altman's signature. The signature was worth exactly what the paper said: nothing binding.

Nitter