There is a new version of mat2: 0.15.0 , this is a big one, with two new added formats, and a bunch of fixes: Be more upfront about the limited HEIC support. As mat2 can't remove embedded ICC profile, HEIC files can now only be cleaned in lightweight mode …
It has been quite some time since I did some reversing, but with Binary Ninja's 10 year 35% sales , I thought that it would only be fair, given how much time I wasted spent in front of them, to actually pay for reverse engineering software once in my life. But …
In 2020, my friend anarcat published the CLA Denial-Of-Service attack , an interesting musing on the possibility of weaponising CLA, boiling down to: find a critical bug figure out a [non-trivial] patch for the bug publish the patch in their issue tracker forever refuse to sign the CLA The obvious solution …
I'm currently somehow or other writing a book, meaning that I'm spending a significant amount of time with markdown files open in my text editor, which happens to be (neo)vim. It's one of the least worst editors around, and I've been using it for more than 15 years I …
With the internet being crawled to death to feed the AI God, it's becoming seriously annoying to exposed web content on the internet. While anubis works, it's yet another layer of complexity. It might be worth deploying and tuning it for high-profile websites, but for my cgit instance , it's absolutely …
This blogpost is in French, as it explains how to block spam calls for Free Mobile customers. Le spam téléphonique fait partie de ces petites chose irritantes du quotidien dont on se passerait bien et qui continuent d'exister au mépris du bon sens. En attendant que la pratique soit rendue …
There is a new minor release of fortify-headers , namely 3.0.2. Minor releases means no new features, only bug fixes and improvements, mainly about portability regarding weird compilers. Oh and also a lot more tests. There are only 16 commits since the last release, so I think we can …
Since I published Carrot disclosure: Forgejo two days ago, numerous things happened: Friends of mine were reached out to, to "talk to me from a place of trust", or simply to convey to them in great details what an horrible person I am, which they found hilarious. The toot linking …
Since Fedora moved from Pagure to Forgejo , I finally had an incentive to take a good look at Forgejo 's security posture. The results aren't pretty to be honest: SSRF in a lot of places, no CSP/Trusted-Types, a bit of ghetto templating in javascript, cryptographic malpractices, overlooks in the …
I'm ~regularly doing lightweight security audits of the services I'm running exposed on the internet. One of them is calibre-web . After 2h and 17 security-related pull-requests later, I gave up and decided to write a replacement: swic . It only has 3 user-facing features: showing the ebooks as a list, a …
A recent article of the OpenBSD journal caught me attention: Pledge changes in 7.9-beta ( archive.org mirror as it's currently offline). The quoted message starts with: Previously under certain promises it was possible to open certain files or devices even if the program didn't pledge "rpath" or "wpath". This …
The mysterious unreadable kernseal.txt file on PaX' documentation page has been sitting there since 2003, described as "sealed kernel storage design & implementation." In 2006, it was described as : the problem KERNSEAL sets out to solve is kernel self-protection, that is, assuming arbitrary read/write access to kernel memory (by …
Thanks to the amazing work of the Asahi Team , Steam is running on my arm64 Linux on my Apple M2. Unfortunately, it seems that a recent update broke the ability for Steam to speak to the internet, with logs looking this like: [ 2026 - 03 - 17 23 : 11 : 20 ] Set status …
With more and more databases from stalkerware being made freely available , there were some internal conversations at Echap about what could be done with them to help victims. Everyone knows Have I Been Pwned , the website where you can put your email address and check if it appears in popular …
A friend of mine, namely Antide "xarkes" Petit , came up with a pretty good rule of thumb that I think should be elevated into a law, Antide's Law: If it's unclear what a cyber-security company is doing, what they're doing is pretty clear. For example, take a look at Offensive …
I just published a new release of Snuffleupagus , the hardening module for php7+ and php8+, version 0.13.0 , codename "Elephas", named after the genus of elephants . There aren't any new flashing features, only bug fixes, PHP85 support, minor improvements, and a security fix for CVE-2026-22034 ! Thanks to Thomas Chauchefoin …
There is a new minor release of fortify-headers , namely 3.0.1. Minor releases means no new features, only bug fixes. The C language doesn't really have the notion of namespaces: all symbols, except those marked as static are exposed. To mitigate the possibility of collisions, it's a good practise …
In 2025, I did, amongst other things: Read some books: Torture Taxi: On the Trail of the CIA's Rendition Flights Outlaws Inc : a lot of storytelling, not much meat, still interesting. Boniments : hard to find anything hiding under so much sarcasm. The Assassination Complex : drone-powered war crimes made in USA …
I gifted an Oculus Quest (that I got as a gift a couple of years ago) to my brother, but because we're in 2025 and everything computer-related sucks , one has to associate an online account with the device to make use of it. Imagine having to do this to use …
In late 2022, I started to contribute to fortify-headers , and the original author, sin, was kind enough to entrust the project to me. Unfortunately, I feel that I haven't lived up to the expectations, both from others, but also mine. I enthusiastically piled more code on top of it, instead …
I've been running some parts of the *arr stack on my hypervisor at home for quite some time now, but only recently did I notice that they were packaged in Alpine ! I trashed the container with all the carefully-deployed-by-hand binaries, created a new one running Alpine Edge , ran apk add …
Because the Freebox Pop is an underpowered piece of crap quite weak when it comes to NAT 'ing anything above 100Mbps, I decided to get a proper machine and slap OPNSense on it: I'm paying for the whole fiber, I'm going to use the whole fiber. IPv4 was trivial: Firewall …
There is a new version of mat2: 0.14.0 , with a new feature and a deprecation, to balance things out: Add webp support Improve reliability Correctly handle PDF with weird filenames Improve epub support Improve MSOffice documents support Add Python 3.13 and 3.14 support Remove bubblewrap sandboxing …
At Nos oignons , we're running Tor exit nodes , but also a handful of services, like our website, some git repositories, some lightweight monitoring, … but also internal and external mailing lists. For the latter, we're using mailman3 / hyperkitty with schleuder on top of it, making it an unholy pile of python …
My household recently acquired a Kitchencook TEATIME kettle. It's quite fancy, with a handful of features that I don't really use nor care about, but I'm quite content with its 1.7L capacity. Unfortunately, it beeps a lot . Here is a non-exhaustive list of things resulting in a dreadful unwanted …