caution: pure vibeslop. use at own risk
Join the Untangle, a Tangled client beta
Available on iOS
testflight.apple.com
Samuel@samuel.fm· 29 Octim tangling on the duo rn
Samuel@samuel.fm· 29 OctSamuel@samuel.fm· 29 Octwe’ve been working really hard on this! please let us know what you think
alex benzer@alexbenzer.com· 26 Octwe're testing a new beta version of the Notifications tab!
it has new tabs to help you notice priority notifications, and it uses new grouping logic to reduce noise (e.g. when one person likes a bunch of your posts).
disclaimer: it's a beta, not a final version. send us your feedback! :)
what the hell. sure
CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory
kb.isc.org
that's right everyone, you guessed it. we're adding the long-awaited much-requested feature: chromebook support
Declare camera as optional on Android so Chromebooks can install by mozzius · Pull Request #12035 · bluesky-social/social-app
Fixes APP-3489
Why
Google Play lists many Chromebooks as unsupported in Production, e.g. google octopus_cheets (Intel Gemini Lake):
Doesn't support required feature: android.hardware.camera
W...
github.com
![Worked for 53s >
Yes—the private key really is the integer 4. I independently checked the published certificate for EM OV TLS CA – G3C: deriving a P-384 public key from private scalar 4 produces exactly the public key in that certificate. [GitHub]
I checked the other seven too. All eight private keys fit in a single byte:
4, 56, 66, 115, 155, 156, 230, 237
They should have been sampled securely from an enormous, roughly 384-bit range. These can instead be recovered by trying the 255 nonzero byte values and comparing the resulting public keys with the certificates. The published proof of concept does precisely that.
[Fluepke/emudrahahahahaha: Private Keys · GitHub +1]
These are CA signing keys: possession lets someone issue fraudulent certificates that clients still trusting those chains could accept. Mozilla explicitly confirms that consequence. [blog.mozilla.org]](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:5hhbgkktcpofpw4ovz6kjjau/bafkreih4y6apxnh2gjuws446gkry33eg7sxjuqlxomwusahgidquitncnm "Worked for 53s >
Yes—the private key really is the integer 4. I independently checked the published certificate for EM OV TLS CA – G3C: deriving a P-384 public key from private scalar 4 produces exactly the public key in that certificate. [GitHub]
I checked the other seven too. All eight private keys fit in a single byte:
4, 56, 66, 115, 155, 156, 230, 237
They should have been sampled securely from an enormous, roughly 384-bit range. These can instead be recovered by trying the 255 nonzero byte values and comparing the resulting public keys with the certificates. The published proof of concept does precisely that.
[Fluepke/emudrahahahahaha: Private Keys · GitHub +1]
These are CA signing keys: possession lets someone issue fraudulent certificates that clients still trusting those chains could accept. Mozilla explicitly confirms that consequence. [blog.mozilla.org]")
kahvi now compiles to WASM, so you can try it out in your browser here: kahvi.mozzius.dev
oh and that website is made with hono. the runtime? you guessed it, kahvi ;)
Samuel@samuel.fm· 16 Octthis week, I made a javascript runtime from scratch by way of a custom harness (which I lovingly refer to as my haiku sweatshop). just managed to get it running social-app!
all on the $20 claude plan
now with dynamic opengraph images, generated on the fly by kahvi via satori that uses asm.js to run yoga
kahvi playground
A JavaScript engine written from scratch in Rust. Try it in your browser.
kahvi.mozzius.dev
(another one to prove its dynamic)
kahvi playground
A JavaScript engine written from scratch in Rust. Try it in your browser.
kahvi.mozzius.dev
this week, I made a javascript runtime from scratch by way of a custom harness (which I lovingly refer to as my haiku sweatshop). just managed to get it running social-app!
all on the $20 claude plan
11 8 80repo here. it’s not very fast, but it does work! and it didn’t exist last week!
GitHub - mozzius/kahvi: a javascript runtime
a javascript runtime. Contribute to mozzius/kahvi development by creating an account on GitHub.
github.com
shoutout hailey for this one
Bluesky@bsky.app· 16 Octv1.135 is live!
You can now browse quote posts by Top in addition to Latest. And posts keep their thread numbering when quoted.
These changes are rolling out now. If you don’t see them yet, try refreshing your browser or visiting the app store to make sure you’ve updated to the latest version.
v1.135.0 is rolling out. some awesome features in this one which we’ll announce soon… but this one has some really notable performance improvements, especially on android. hopefully you can feel the difference!
13 8 75opus 5.5 is *really* good at performance profiling. like superhuman. our findings will be upstreamed into core React Native hopefully soon
1 33