Sign in

iiinova is part of the Atmosphere — an open, public network where you own your identity.

kpcyrd 🏳️‍🌈🏴

@kpcyrd.chaos.social.ap.brid.gy
10 followers 0 following 68 posts

Rust Developer 🦀, {Arch Linux,Debian,Alpine} Package Maintainer 📦, Reproducible Builds Enthusiast ⛓, Security Researcher 🦝, Anarcho Communist 🏴 🌉 bridged from ⁂ chaos.social/@kpcyrd, follow @ap.brid.gy to interact

PostsRepliesMedia
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 17/10/2026
Assisted-by: Microsoft vscode on my iPhone 18 Pro Max Burgundy
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 27/09/2026
I work in an environment with exposure to increased infection risk, but what truly scares me are hotels running open breakfast buffets for ~250 simultaneous guests :<
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 22/09/2026
ctime but instead of creation, it's the last time somebody truely cared about the file
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 10/09/2026
#digitalocean
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 27/08/2026
I physically can't access most of my computers right now due to motorbike logistics, and in the middle of nowhere I read about a buffer overflow in GNU gzip (CVE-2026-41992). Fortunately, I believe every place that matters I'm explicitly using a pure #rust implementation of gzip.
001 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 24/08/2026
computah, summarize the ballot options, make no mistakes
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 14/07/2026
I wish people would avoid #zig for software that is packaged in distributions. The zig standard library is pre-1.0, meaning zig software is always written for a specific compiler version that Arch Linux build servers may not be able to match. This specific […] [Original post on chaos.social]
error: Your Zig version v0.16.0 does not meet the required build version of v0.15.2
110 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 03/07/2026
Neat, russh 0.62.0 links to feedback I gave about their API regarding ssh channels, and did a breaking change to better accommodate `direct-tcpip`. :) github.com/Eugeny/russh/releases/ta…
github.com
Release v0.62.0 · Eugeny/russh
Breaking changes #686 - make channel confirmations truly async This changes the signature of the Handler::channel_open_* functions to allow you to make the channel accept/reject decision outside of...
010 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 17/06/2026
Why do people pretend C is a significantly more mature ecosystem yet here I am with "make 4.4.1 doesn't compile anymore because C23 added a new function to the standard library and the make C code from 3 years ago is now invalid". #rust #linux
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 12/06/2026
Something to consider for the current #aur incident, if you don't want to engage with the javascript ecosystem anyway - add this to your /etc/pacman.conf: IgnorePkg = npm IgnorePkg = bun Also make sure both packages aren't installed already and uninstall if necessary. #archlinux
001 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 08/06/2026
Am I missing something or is MITRE about to make #CVE requests require a Google account? mitre.github.io/mitre-cve-roles/cve…
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 07/06/2026
2026 is when you type "systemd journald change label from binary name to something else" into google and all results on the first page are garbage, so you paste the same search query unmodified into chatgpt and it points to SyslogIdentifier=, which turned out to be the correct setting I was […]
chaos.social
Original post on chaos.social
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 06/06/2026
How is landlock in allow-list mode meant to be used with glibc's dns? Generally there's the problem of "/etc/resolv.conf may be a symlink", but there's also NSS (name service switch) that may hook arbitrary code/shared objects into domain resolution. There is no way to know what files they are […]
chaos.social
Original post on chaos.social
010 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 18/05/2026
RE: fosstodon.org/@Antiz/11658027071432… This post made me really happy, much appreciated :3 Both designs are from ~2023/2024, I'm still trying to come up with good ones for this year. I'm generally aiming for positivity (green-cape vs red-cape designs), but current politics makes […]
chaos.social
Original post on chaos.social
010 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 14/05/2026
Dear opensource developers, I added an "adoption" list to the repro-env README, if you publish pre-compiled binaries and you successfully adopted it to allow anyone to reproduce them from source code to prove the absense of a build server compromise, you are very welcome to add yourself to the […]
chaos.social
Original post on chaos.social
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 14/05/2026
RE: chaos.social/@jacqueline/1165603657… I wish Gitlab would instead focus on fixing their code so Gitlab can run on the public internet again without needing ubiquitous hand-holding from anubis
chaos.social
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 10/05/2026
"Design patterns are a catalog of all the features your programming language lacks" lol
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 28/04/2026
RE: infosec.exchange/@jvoisin/116484271… Exciting, curious if codeberg is affected ✨
infosec.exchange
100 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 22/04/2026
This took me quite a bit of time, but I managed to boot postmarketOS on a currently unsupported devboard (commonly available for €25-30 where | live). Little bit proud, but it's not a proper port yet, I ripped the kernel and other parts of the pre-init […] [Original post on chaos.social]
Screenshot of postmarketOS booted into an interactive shellhtop on the booted system
020 2
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 12/04/2026
RE: mas.to/@frontenddogma/1163936288866… I vouch for the accuracy of this blog post, it's a spot-on writeup of (source-based) supply-chain security in 2026. If you have dependencies with zero cargo-crev reviews, be that person for one of them. Ultimately, there will be no way around […]
chaos.social
Original post on chaos.social
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 06/04/2026
I pushed curl-rustls-8.19.0-3-x86_64.pkg.tar.zst to Arch Linux, with this version it's now possible to encrypt the TLS client hello: curl -sSv --ech hard --doh-url='https://dns.mullvad.net/dns-query' 'defo.ie/ech-check.php' Should display: <p>SSL_ECH_OUTER_SNI: cover.defo.ie <br /> […]
chaos.social
Original post on chaos.social
001 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 27/03/2026
Somebody took the time to document the AMD GPU situation: lunnova.dev/articles/rocm-711-you-c… In case you've been wondering where the AI VC money is going - C build systems and build servers apparently. #linux
lunnova.dev
ROCm 7.1.1: you can (not) build
Comments
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 25/03/2026
"Germany won't be able to figure out regulation for synthetic sexual abuse material until there's deep fakes of their Doppelhaushälfte on google maps" - Levi
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 17/03/2026
For debian-rust packaging, instead of dealing with the fact that the libcrux stack is split into libcrux-intrinsics, libcrux-ml-kem, libcrux-platform, libcrux-secrets, libcrux-sha3, libcrux-traits, I decided to just port the post-quantum key exchange of russh over to the RustCrypto ml-kem crate […]
chaos.social
Original post on chaos.social
002 2
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 13/03/2026
Today I had #Linux problems - I run Debian sid in systemd-nspawn for packaging and my build environment broke: mounting /proc failed: No such file or directory at /usr/libexec/sbuild-usernsexec line 509. The kernel logged: `VFS: Mount too revealing` The fix was somehow this command, no […]
chaos.social
Original post on chaos.social
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 01/03/2026
Asking for support from my fellow followers: I recently mentioned I'm field-testing sha256 git repositories, I now noticed something that broke and I'm wondering what's the best way to fix this. I have code that fetches one specific revision from a git repository (by tag name or commit id). The […]
chaos.social
Original post on chaos.social
100 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 28/02/2026
Today I learned: Prisoner's Dilemma vs Stag Hunt Dilemma, and Nash equilibrium.
020 2
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 21/01/2026
[politics] Digital independence is nice and everything, but if the USA invasion of Europe starts a war, do I lose my .org domain due to not being able to renew? #diday #digitalsovereignty
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 12/01/2026
My #2026 resolution was field-testing sha256 git repos and I converted one of my minor projects, but since Github only supports sha1 I've moved the repository to codeberg: codeberg.org/kpcyrd/ssh-keyonly Everything else worked well. I'm also mirroring the repo to Arch Linux' Gitlab […]
chaos.social
Original post on chaos.social
113 3
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 01/01/2026
I did a writeup of things I was working on in 2025: vulns.xyz/2025/12/2025-wrapped
vulns.xyz
kpcyrd: 2025 wrapped
Same as last year, this is a summary of what I’ve been up to throughout the year. See also the recap/retrospection published by my friends (antiz, jvoisin, orhun). * Uploaded 467 packages to Arch Linux * Most of them being reproducible, meaning I provably didn’t abuse my position of compiling the binaries * 35 of them are signal-desktop * 29 of them are metasploit * Made 53 uploads to Debian * All of them being related to my work in the debian-rust team, that I’ve been a part of since 2018 * Also applied for Debian Developer status (with 4 Debian Developers advocating for me) * Made 14 commits in Alpine Linux’ aports * 13 of them being package releases * Made 2 commits in NixOS’ nixpkgs * Also joined their Github org * Made 4 commits in homebrew-core * With special focus on polishing the Rust development experience for the RP2040 microcontroller * Lost Onion, my cat of 13 years, to inoperable cancer. He has been with me throughout my entire open source journey (sometimes being credited as co-author) and who looked after me for my entire adult life. You won’t be forgotten. 🐈‍⬛ * Developed 6 hand-held games with embedded Rust, most of them being birthday gifts for people close to me * game-taco-burglar * A motorcycling lockpicker * game-antifa-syndikitty * A nurse with a secret double life * At that point the longest and most in-depth game I built throughout my life * game-chop-chop * A French tetris-spinoff, this was one of my Fusion projects this year * The hardware was specifically designed to be easy to solder/make from readily available parts (~€5 per unit) * I gave away a few devices I made, some people successfully built one on their own * game-ratatat * A space-invader like game about a very enthusiastic seamster * game-octo-space-irs * As an employee of the intergalactic revenue service, you tax the rich through reversing and cracking computer programs * I gifted another copy to a Tor directory authority operator I’m friends with, who was very excited about the concept and levels I designed * game-the-curse-of-the-headless-goose * A turn-based game about an underground kickboxing club * This one was meant to be a rogue-lite (which I needed the savegame library for), but only managed to build the introduction/tutorial unfortunately * Picked up work on apt-swarm again * Replaced the old database code with a custom engine, reducing RAM usage from multiple gigabytes down to ~9MB * Ran a small p2p network all over the world, with ~10-15 locations/countries on average * As part of this, found a bug in tokio that could lead to silent data loss in some cases * Had 2 of my projects explicitly mentioned in the Debian release notes in their “What’s new in Debian 13” summary * Was mentioned in multiple academic papers on arxiv.org: * Reproducible Builds and Insights from an Independent Verifier for Arch Linux (explicitly in the “Acknowledgments” section) * Beneath the Mask: Can Contribution Data Unveil Malicious Personas in Open-Source Projects? * Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack * Causes and Canonicalization of Unreproducible Builds in Java * Reproducible Builds for Quantum Computing (mentions rebuilderd) * Was referenced twice on LWN: * Hash-based module integrity checking (mentions me directly) * Fedora change aims for 99% package reproducibility (doesn’t mention me, but rebuilderd 10x) * Published a draft version of PlatypOS, an “Experimental toy unix-like userspace operating system with strong preference towards Rust”. As part of this: * Developed custom pacman-database tooling in Rust instead of bash * During this project I found and reported issues in uutils’ `install` (uutils/coreutils#8033) and `mv` (uutils/coreutils#8044) (both fixed shortly after) * The project stalled because it’s too big to side-quest * Had the first ever CVE issued for software I wrote: CVE-2025-52926 * Found, reported and fixed by a c’t Open Source editor * Published 9 repositories related to my embedded Rust work * embedded-mono-img for all the graphics in my games * rp2040-psp-joystick to demo use of an analog joystick input * rp2040-demo-st7789 to demo a higher resolution screen I experimented with * rp2040-demo-w25qxx to demo how to store data in NOR flash * rp2040-demo-at24cxx to demo how to store data in an EEPROM * embedded-graphics-colorcast a library I developed so I can keep using embedded-mono-img on ST7789/ILI9486 screens - I used tinybmp in one project but it was fairly slow * ch32v003-demo to demo and document the lowend ch32v003 RISC-V microcontroller, with devboards that are commonly sold for €0.50-0.70 on AliExpress (it’s cute but lacks the required 5.1kΩ resistors on the USB-C configuration pins that tell the host to provide 5V, so it won’t work with many USB-C chargers, which is quite annoying) * embedded-savegame an atomic/transactional savegame library, with powerfail-safety and wear-leveling, optimized for flash and EEPROM storage * djb2 a very lightweight non-cryptographic checksum algorithm that replaced my use of CRC32 in the embedded-savegame library, to make it more suitable for the ch32v003 * Contributed to the Reproducible Builds mailing list 30 times * Developed repro-threshold, an integration for apt to act as a rebuilderd client, enforcing a reproducible builds trust policy of your choice * The feature was suggested/requested by a CCC member during MiniDebConf Hamburg 2025 * Collaborated with an openSUSE engineer I’ve known for several years to debug and fix an issue in gtk-rs that caused indeterministic build output for many desktop programs * Volunteered at a soldering workshop for beginners for the 4th year in a row * Completed the first year of volunteering in an awareness team * Wrote 1 blog post (besides this one) * Attended FOSDEM, MiniDebConf, Fusion, the Reproducible Builds summit, the Arch Summit and 39c3 * Hosted sessions at both FOSDEM (1st time) and Fusion (2nd time) * Grew and harvested 2 plants * Traveled to * Denmark * Sweden * Turkey, visiting a good friend * Belgium * Austria * Made and printed * 2 new sticker designs * 2 new hoodie designs * Changed my medication plan * Got 4 new tattoos Thanks to everybody who has been part of my human experience, past or present. Especially those who’ve been closest.
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 24/12/2025
RE: fosstodon.org/@orhun/11577596949235… haha, maybe I can finally do android development now
fosstodon.org
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 24/12/2025
In other news, very happy to see the most popular #Rust http client library is switching their default TLS implementation from OpenSSL to #rustls. github.com/seanmonstar/reqwest/rele…
github.com
Release v0.13.0-rc.1 · seanmonstar/reqwest
👀 Discussion here if you give it try, thanks! Main breaking changes rustls is now default instead of native-tls rustls provider defaults to aws-lc instead of ring (rustls-no-provider exists if you...
111 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 24/12/2025
#netcat is both really popular with #Linux users, but also quite the train-wreck. There's multiple mainstream implementations, they all have incompatible commandline interfaces, two of them have been unmaintained for 20 years and lack ipv6 support (netcat-traditional and gnu-netcat). Debian […]
chaos.social
Original post on chaos.social
110 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 25/11/2025
Out of the 789 npm packages on the Sha1-Hulud list, only 4 have showed up in the dependency trees of any Linux operating system. Not in the affected versions, but ever. #supplychainsecurity #infosec
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 23/11/2025
I've published a writeup about the ongoing `hashFiles` incident on #Github Actions: lists.reproducible-builds.org/piper… #supplychainsecurity #infosec
lists.reproducible-builds.org
Github Actions and the hashFiles incident
010 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 13/11/2025
The sudo-rs CVE-2025-64517 is all over the news, but it looks like it's not really exploitable in the wild? It's a very cool find and I'm glad it's fixed, but it's not the unconditional local-root that people seem to think it is? Going from www-data to root with this bug seems to be almost […]
chaos.social
Original post on chaos.social
101 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 21/10/2025
While the bug in async-tar/tokio-tar dubbed #tarmageddon / CVE-2025-62518 is cool on a technical and code-correctness level, I'm calling bullshit on the #RCE claim. It's a severe overstatement that isn't backed by the advisory. Processing a tar stream with a vulnerable version won't execute […]
chaos.social
Original post on chaos.social
041 4
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 17/10/2025
In 2025 your options when making a website as a non-webdev person are "everybody is upset because it looks AI generated", "everybody is upset because it's bootstrap" and "everybody is upset because you decided the only css is going to be `body { background-color: #db7093; font-family: sans-serif […]
chaos.social
Original post on chaos.social
001 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 08/10/2025
Friendly reminder that many pseudonymous opensource developers are well prepared and equipped for things like "end-to-end encrypted chat gets outlawed". The cypherpunk movement never really died, it just wasn't necessary while regulators acted mostly reasonable and there are in fact some things […]
chaos.social
Original post on chaos.social
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 01/10/2025
I always feel a little fancy when I get to decide about random implementation details during my #debian adventures, like how this error should be handled. The code assumes an outdated API of the library, that returned either a list of certificates, or a […] [Original post on chaos.social]
error[E0277]: the `?` operator can only be applied to values that implement `Try` - the `?` operator cannot be applied to type `CertificateResult`
101 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 18/09/2025
Just found this option in Github repository settings :) Very happy this is getting emphasized.
A screenshot of Github repository settings:

Enable release immutability - Disallow assets and tags from being modified once a release is published
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 13/09/2025
For the memes, there's now an apt-swarm node running in Nepal: 38.54.71.220:16169 Joining my collection of "p2p nodes running in countries with active conflicts". map.apt-swarm.orca.toys
map.apt-swarm.orca.toys
Map of apt-swarm p2p locations
🌏⛏ hack the planet 🌈✨
000 0
Reposted by kpcyrd 🏳️‍🌈🏴
trurl:~# :bli_cur: @trurl.hal9.ooo.ap.brid.gy · 13/09/2025
Sticker in der Post!!
001 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 29/08/2025
"Open Source is one Person" opensourcesecurity.io/2025/08-oss-o…
opensourcesecurity.io
Open Source is one person
Comments
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 29/08/2025
If you do #embedded #Rust on the #rp2040 with elf2uf2-rs, and you struggle with the recent "Unrecognized ABI" error due to a change in Rust's elf header for `thumbv6m-none-eabi`, I've landed StripedMonkey's patch in both Arch Linux and Homebrew, so if you use those packages, things should work […]
chaos.social
Original post on chaos.social
086 8
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 26/08/2025
I locked myself out of an account by: 1) starting the process to enable 2FA 2) saving the TOTP secret into bitwarden/vaultwarden 3) enter the confirm code and continue 4) the website askes me to "add a security question", which I didn't want to do, I cancel the setup 5) I delete the TOTP secret […]
chaos.social
Original post on chaos.social
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 11/08/2025
When I did my first Debian install, I didn't see coming that a tool I authored would be explicitly mentioned in the Debian release notes ~15 years later. 🖤 www.debian.org/releases/trixie/rele…
010 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 06/08/2025
For future reference, to crack the passphrase of your gpg secret key: ``` progpick -e 'env GNUPGHOME=/backup/.gnupg/ gpg --batch --passphrase-fd 0 --pinentry-mode loopback --export-secret-keys YOUR_FINGERPRINT' "$(cat pattern.txt)" ```
000 0
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 25/07/2025
Malware was recently found in some popular npm pkgs: socket.dev/blog/npm-is-package-hija… I checked the affected versions against the whatsrc.org dataset, while most of the packages (eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core […]
chaos.social
Original post on chaos.social
001 1
kpcyrd 🏳️‍🌈🏴 @kpcyrd.chaos.social.ap.brid.gy · 17/07/2025
For transparency: my #archlinux signing key is expiring, and other packagers have kindly started re-uploading my pkgs with different sigs (also taking care of updates meanwhile). I struggle to jump through the necessary hoops to recover the pgp key needed to renew my subkey - I chose "better […]
chaos.social
Original post on chaos.social
001 1