69 entries · 13 years (2014–2026) · newest first
Mitigation code available
A 9.8 in the kernel's IPv4 TCP path, no fixed kernel for any Ubuntu release and a tracker page that lists no mitigation. The fix you cannot install yet still tells you what the bug needs, and what a bug needs can be taken away.
Seven of our remediation roles are public, with the shared library they depend on. The fixes themselves are a morning's work each. What took the time was deciding what a pack must declare and demonstrate before anything will run it as root across a fleet, and only some of those gates exist today.
Mitigation code available
PHP2Shell and the Brotli decoder bug were patched the same day. One got the emergency response, the other did not, and the quiet one is harder to find on your estate because the obvious version strings lie about it. There is a role you can run to work out what you have.
Microkernels, eBPF, WebAssembly, LoRa mesh and confidential computing are usually filed as five unrelated hobbies. They are one argument, running for about a decade, about where you put a boundary and what it costs to cross it.
Mitigation code available
Two unauthenticated remote code execution bugs in PHP core, CVSS 9.2, with upstream releases out the same afternoon. The patch is the easy part. CISA's first instruction is to inventory every system running any PHP, and on most estates nobody can do that tonight.
The hardware answer to the problem eBPF and WASM solve in software: a pointer that carries its own bounds and permissions, enforced in silicon. Still an unratified RISC-V extension, whatever the coverage implies.
The IPC objection to microkernels is fair, and it is the wrong place to stop the conversation, because what it buys you is a fault boundary that a monolithic kernel cannot sell at any price.
They share a radio layer and almost nothing else. One has a network server and a join procedure; the other has neither, by design. Conflating them makes both sound worse than they are.
Dismissed as hikers with walkie-talkies. Read the 2.8 release notes as an identity architecture instead: node IDs derived from public keys, packets signed and no registry to ask because there's nothing there to ask.
Hybrid key exchange is largely deployed; certificates and signatures are nowhere near. The real bottleneck is crypto-agility, because anything that hard-codes an algorithm or needs a firmware update can't pivot in time.
Qubit counts make the headlines. The physical-to-logical ratio is the engineering problem, and nearly everything else in the field sits downstream of it.
Agentic sessions are where our features get built now, which makes the harness they run in a piece of infrastructure. We are building our own, called micro-zero, and connecting it to the organisation's memory. The zero is where every session starts.
The Server SoC, Boot and Server Platform specifications are ratified. What makes it interesting is the specification being nobody's property, rather than the instruction set itself.
CFS gave way to EEVDF over 6.6 to 6.12. Most people who tune a scheduler are solving a problem that isn't a scheduling problem, and the cases where it really is are narrower than the tuning guides let on.
An assistant session starts knowing nothing about the organisation, and no context window is ever going to hold fourteen years of decisions. We pointed retrieval at our own vault instead. The idea is a weekend's work to try; whether it holds up in daily use is what we intend to find out.
Mostly discussed as flag-planting, which is a shame, because underneath it sits a specific engineering question: which capabilities could somebody outside your jurisdiction switch off, and what do you do then?
The UK has the power to issue a technical capability notice under the Investigatory Powers Act. Apple withdrew Advanced Data Protection for UK users rather than weaken it. Almost everything else about the case is secret, including whether the notice exists.
The internet was designed to route around failure. A large slice of it now routes through a handful of providers, and the failures that produces are not the ones the design had in mind.
Half the infrastructure in this notebook assumes it can ask the sky what time it is. Jamming and spoofing of satellite navigation are now routine over large parts of Europe and the Middle East, which turns a free, assumed-correct input into something an adversary writes. The engineering response is holdover, and almost nobody has specified it.
Quantised models running on a workstation, a Pi or a phone. The interesting constraint is memory bandwidth rather than FLOPS, which changes which hardware is worth your money, and a capable model on a machine you own means no prompt ever leaves the building.
We have photographs of engineers doing by hand, for nine years, the jobs a control plane now does: network boot, on-site backup, remote access built out of Raspberry Pis, a hundred laptops in a fortnight. The pattern in those photographs is the whole argument.
The verifier is the whole story, and you learn more from what it turns down than from what it waves through. A boundary built out of static analysis; you pay at load time and it is free thereafter.
Seven years of relicensing, three forks with foundations behind them, two walk-backs and one proprietary vendor ending perpetual licences outright. Read as supply chain rather than as community drama, the pattern is consistent: the licence on a dependency is a commercial term, and commercial terms change.
Engineers read standards as technical documents. They're the written record of what a room full of competitors could agree to, which explains most of their stranger features and tells you exactly where to apply pressure.
Since October 2022 the specification of an accelerator you are permitted to buy has been written partly in Washington, in units of processing power and interconnect bandwidth. Export control used to be a legal department's problem. It is now a line in the architecture, and it is the first time in this notebook's span that a chip's spec sheet has been set by policy.
Mitigation code available
Next.js used an internal header to mark its own subrequests, and anyone could send it. Authorisation checks made in middleware were skipped. The mitigation is a header strip at the proxy, which works because the boundary was in the wrong place to begin with.
The asymmetry cliché is true, and it is usually wheeled out as grounds for despair. Read properly it argues for a particular kind of engineering: reduce what has to be defended rather than defending it better.
Performance per watt stopped being a mobile concern and became the constraint that shapes datacentre architecture. Most software has no idea how much power it draws, and the first team to put a wattmeter in CI will find savings nobody else can see.
Every attestation chain ends in something you trust for reasons that have nothing to do with technology. Knowing where yours ends is more use to you than the chain itself.
The interesting part of WebAssembly outside the browser has little to do with portability. A module arrives with no ambient authority at all; it gets handles, not a filesystem.
What attestation proves, what the trusted computing base holds once you have counted the firmware and what becomes possible when the machine you rent cannot read the work you run on it.
NTP gets you milliseconds, PTP gets you microseconds and neither of them gets you an ordering. Most distributed-systems bugs involving time come from treating a timestamp as a sequence number.
Two years of government documents ask vendors to stop writing new code in memory-unsafe languages and to publish roadmaps for the old code. None of it is law. The clearest production-scale evidence yet that the roadmap approach works arrived last month: five years of Android results, published by the vendor rather than demanded by a regulator.
The backdoor sat in the release tarball and not in the git tree. Closing that gap is what reproducibility is for, and it's the highest-value control to come out of the whole incident.
The legislation deals with parts and manuals. The practical barrier has moved on to signed firmware, parts pairing and who gets to say a component is genuine.
Mitigation code available
regreSSHion is unauthenticated root on sshd, and the published workaround turns it into a denial of service. Five days of reading advisories to find that the only safe verdict a scanner can reach, on a lot of hosts, is "unknown".
Performance and efficiency cores, unified memory, accelerators on-package. The uniform-core model that every piece of scheduling and benchmarking folklore assumes has stopped being true, and the machine that replaces it does more per watt than anything symmetric ever will.
Mitigation code available
A backdoor in xz-utils 5.6.0 and 5.6.1, planted over a multi-year social engineering campaign against a burnt-out maintainer, and caught by one engineer who wondered why SSH was half a second slow.
A phrase that barely existed last year is now in ministerial speeches. It was introduced by the company that sells the accelerators, and the definition it carries makes buying those accelerators the proof of sovereignty.
Proof used to mean a paper. seL4 shipped a verified kernel, and verification tooling for ordinary languages is now something a working engineer can point at a bounded problem.
Why public-sector IT keeps producing the same outcomes: the failure sits upstream of any engineering, in a procurement model that selects for the appearance of risk transfer.
Almost every useful security tool is also an attack tool. The question was never whether to build dual-use technology; it is what you owe the people downstream of it.
Every platform eventually works out that the boundary it controls is worth more than the product inside it. Which is the very reason the boundary should be the thing you specify.
A first-person-view quadcopter with a warhead taped to it costs a few hundred pounds and destroys a vehicle worth several million. The airframe is a toy, the radio is a toy, and the only component that was ever hard is now a model that fits on a board you can buy. That is a cost inversion, and cost inversions do not reverse.
Mandated, useful and routinely oversold. A bill of materials answers "where is it running" in seconds, which is valuable because that question used to take days.
Metrics, logs and traces is a taxonomy a vendor can invoice against, not an engineering one. The useful question is whether you can answer something you never thought to ask.
A pacemaker, a cochlear implant and an insulin pump are embedded computers with firmware, update paths and signing keys. Every assumption this trade makes about patching, rollback and end-of-life was written for machines you can switch off, and none of them survives contact with a device that is inside somebody.
Replace rather than modify. The idea is sound, and the benefit comes almost entirely from a social commitment rather than from any tool you can buy.
Mitigation code available
PwnKit is a local privilege escalation in pkexec affecting every version since 2009. Qualys published a one-line workaround; Red Hat published a note saying do not use it. We shipped a role that does both things, and the interesting part is which hosts get which.
Mitigation code available
Six days after Log4Shell went public we shipped an Ansible role that stripped JndiLookup from every JAR it could find, a week ahead of the joint advisory. Almost none of those days went on the fix. They went on answering where Log4j was running, which is a question about your own estate rather than about Apache.
Memory safety without a garbage collector was a research position for thirty years. What changed wasn't the idea; it was a toolchain good enough that people ship with it.
We have rebuilt the same platform layer for every client we have ever taken on. This year we stopped. Andromeda is the internal name for the component framework underneath, and the name is an argument about scale: the structure that holds a hundred machines together has to be the one that holds four.
WireGuard shipped in Linux 5.6 at roughly 4,000 lines, against OpenVPN's hundred thousand and more. The size is the security argument; it isn't a happy side effect of one.
Containers won on ergonomics and spent the decade paying for the boundary they gave up. The answer that arrived in 2018 was a smaller virtual machine rather than a stronger container: tens of thousands of lines of Rust, a boot measured in milliseconds and a device model with almost nothing in it.
We have finished the first monitoring stack we run for clients rather than hand over. Prometheus, Grafana, Loki, exporters. The components took a fortnight; what took the rest of the year was deciding what an alert is allowed to wake someone for.
The architecture monoculture is ending, and that sits upstream of almost everything interesting in systems work. The hard part was never the instruction set; it is fifteen years of software that has only ever been built on one.
A neural network won CASP13 outright, and a sequencer that runs off a laptop's USB port costs less than a server. Biology is becoming a field where the expensive instrument is a model and the cheap instrument fits in a coat pocket, which changes who is able to do the work and who ends up holding the data.
Archive · The Network Factory
We are often asked for proof-of-concept and implementation of IoT and embedded solutions. One example of this was for a hospitality client, who asked us to help out with token-based access to their public Wi-Fi, via a printed till receipt given with each purchase.
Archive · The Network Factory
As with any company we evaluate our toolset offering. A lot of expense goes into training staff and maintaining support for products. Here at The Network Factory we regularly have technology reviews; what's working, what's not working, what's new on the horizon and where the industry is going.
Speculative execution was the free lunch of CPU design for twenty years, and it leaks straight across the privilege boundary everything else was built on. This is the week that will explain the next decade of isolation work.
Archive · The Network Factory
As we come to that funny little time between Christmas and New Year when many companies are on hiatus, all my obscure outstanding support tickets have been closed and I have reached inbox nirvana, it gives me time to reflect on the last twelve months.
Archive · The Network Factory
Here at The Network Factory, we set up a lot of computer systems from scratch. From virtualisation servers and company laptops to IoT and Raspberry Pi-based embedded solutions, we do a lot of software installation and configuration, so it's really important that this is done as efficiently as possible. Ansible is a crucial part of our approach to this process.
Archive · The Network Factory
First off we shouldn’t really use the term ‘legacy’ any more, and rightly so. Legacy has a bad rap. It’s always used as the go-to scapegoat word for anything in the organisation that is no longer shiny and no-one wants to take responsibility for. But let’s be realistic; your sunset app is probably one of your major revenue streams.
A great deal of software is still designed around a disk that takes ten milliseconds to seek. That disk hasn't been in the critical path of a serious system for years, and the clever architectures built to work around it are now the bottleneck.
SDN, DPDK, XDP and P4 get told as four separate stories. They're one: the moment the network stopped being something you configured and became something you programmed.
Five Raspberry Pis, a switch and a great deal of green cable. The compute was never the point; a real network between real machines fails in ways a single-host simulation will never show you.
Three waves in fifteen years: virtualise the machine, abstract the machine away, schedule against a pool. Each one solved the last one's problem and quietly introduced a subtler one.
Control groups shipped in Linux 2.6.24 in January 2008 and spent six years as plumbing almost nobody touched. The v2 rework is already under way now that containers have made the subsystem famous.
Docker hit 1.0 last week. What is spreading is a packaging format and a registry rather than a new isolation primitive; cgroups and namespaces have been in the kernel for years. The distinction matters, because the isolation we have just traded away is going to have to come back.
