The last week was mostly dedicated for my own personal organization, and trying to rework on my projects. This week though, some of them advanced a little bit. After few days of thinking, the internal design of chored seems to be a bit better than the initial draft. Even if it's still unusable, it's a good project to think about more important topic, like memory management (including garbage collector), algorithms to store efficiently the data and re-read UNIX/POSIX C documentations. We will talk more on the second publication about chored.

To stay focus, my home office was a bit updated. Writing code on a modern laptop with graphical interface is having a negative result on productivity (thanks to all social networks and notifications). A new small dedicated computer, with Alpine Linux (without windows manager) has been successfully deployed and is ready to be used. In fact, chored will be designed here and also on an OpenBSD server.

Remember the kanell project, the pipeline-like module in Dart created few weeks ago. I'm currently working on it, or at least, a part of it. The pipeline is working, but it's not really what I want. I would like to have a way to create composable/traceable finite state machines, powered by something like a pipeline structures, a kind of flow-based programming.

Coding

▶️ Simple Instructions, Weird Algorithms: a great and short introduction to SIMD (Simple Instruction, Multiple Data) by Core Dumped on Youtube, one of the first step to understand GPUs.

📝 Introducing BlocSignal: Unidirectional Data Flow Meets Reactive Signals: Randal Schartz published a series of posts talking about Bloc and Signal (or BlocSignal) with Dart/Flutter: BlocSignal Architecture & Practice Series' Articles. A must read (and follow).

📑 Contract Based Verification of Non-functional Requirements for Embedded Automotive C Code: Non-functional requirements (e.g. restrictions on control flow and data flow) can't be specified using classical tools like ASML/Frama-C and are usually done by manual code review. VerNFR Frama-C module was created to solve this problem.

📑 FlowLog: Re-thinking Datalog for Fast and Extensible Static Analysis: FlowLog (implemented in Rust), is a Datalog compiler used for static analysis. A tutorial is available.

▶️ Stanford University CS107 - Programming Paradigms: the full programming paradigms courses from Stanford. Never watched this one, but the content seems quite interesting, even more if you are doing low-level programming or if you need to review the basis.

📑 Simple Garbage-Collector-Safety: a quite old paper about garbage-collector safety.

📑 Precise Garbage Collection for C: a publication describing the Magpie garbage collector written in OCaml, designed for long living process.

📑 A Parallel, Real-Time Garbage Collector

📑 A Study of Concurrent Real-Time Garbage Collectors

📑 The Specification Paradox: Rethinking Requirements Engineering in the Age of AI

📑 Etna: An evaluation platform for property-based testing

📑 To WASM or Not to WASM: Evaluation of Browser Fingerprinting Defenses Under WASM based Obfuscation

📑 Phoenix: A Modular and Versatile Framework for C/C++ Pointer Analysis

📝 High-Throughput, Formal-Methods-Assisted Fuzzing for LLVM: an interesting way to apply fuzzing by using mutated tests on LLVM. If it works on that, it should work on other application as well, right?

System

📝 EFS & FreeVxFS File-Systems Get Booted While FailFS Merged For Linux 7.3: failfs will permit to use the fchroot syscall and then allow unprileged users to use chroot (based on the git commit message).

📑 KernelScript: Cross-Boundary Typed DSL for eBPF Applications

📑 Concurrency Testing in the Linux Kernel via eBPF

📑 Xkernel: Principled Performance Tunability of Operating System Kernels

📝 Using the OpenBSD ports tree with dedicated users: a very old post about OpenBSD, ports management and privilege isolation by Solene. I was working on some OpenBSD ports recently, and forgot how to apply correctly the isolation. I did not find it on the official documentation though.

📑 CombiSan: Unifying Software Sanitizers for Comprehensive Fuzzing:

📝 NetBSD microvm: things are moving on NetBSD, and I discovered this week the NetBSD MicroVM kernel. The final result? less than 10ms to boot it on qemu. As usual, it can also be customized based on your needs. Always amazed to see those improvements in the BSD world.

Network

📑 Presto: A Match-Action TCP Stack for the Terabit Era: Presto is a re-implementation of a TCP-stack using Reconfigurable Match-Action Table (RMT) pipelines. This implementation is mostly on the hardware side and is focused on low-latency/high-bandwidth network (e.g. DC or perhaps core-network).

Even with state-of-the-art kernel bypass TCP stacks, applications spend up to 48% of perpacket CPU cycles in the stack [...] ASIC transports, such as TCP offload engines (TOEs) and remote direct memory access (RDMA), are highly efficient, but inflexible and operationally brittle in the cloud [...] We present Presto, the first TCP stack tailored to the RMT architecture. Presto reimagines TCP as a pipeline of light-weight match-action operations, enabling line-rate processing without buffering and delivering practical TCP at terabit speeds while preserving high throughput, low latency, energy efficiency, flexibility, and interoperability.

📑 SoK: Insecurity of Cellular Basebands: cellular baseband attack surface summary. This publication is about the security of the chips/CPU/devices used in mobile network (2G, 3G and so on). AT command can be used to communicate to the baseband (good to know). The surface is huge, but I think the investment to start attacking all of that, at least the most modern equipments limit most exploitation. Furthermore, the complexity of each protocols, especially from 2G and 3G, is also a wall. A layer of opacity due to the closed source software and firmware is also another problem.

📑 SoK: Security of Cyber-physical Systems Under Intentional Electromagnetic Interference Attacks: see also IEMI Research Database, gathering other publications from this kind of attacks.

Database

📝 SQLite's Durability Settings are a Mess: a short publication on setting SQLite more durable using journal_mode and synchronous parameters.

📝 Rethinking Database Programming: writing database queries and defined schema using Elm. It's a matter of time before they discover Prolog et Datalog...

📝 Loongson loong64 packages on apt.postgresql.org: while loongson architecture is being removed from OpenBSD, PostgreSQL is now offering packages for this platform.

Embedded

📝 Amaranth HDL (previously nMigen): "The Amaranth project provides an open-source toolchain for developing hardware based on synchronous digital logic using the Python programming language, as well as evaluation board definitions, a System on Chip toolkit, and more." Here the documentation link.

📑 Xilinx JTAG Programmer Guide: an old (<2000) Xilinx manual to program Xilinx FPGA.

📝 Extracting firmware from devices using JTAG: a quick but complete post on using JTAG interface to debug and dump a firmware.

📝 Nibbler 4 Bit CPU: an homebrew 4 bit CPU called Nibbler, created for educational purpose. It could be nice to create an emulator for this CPU, it could be an easy way to understand CPU architecture from scratch.

📝 Deep Dive Into PCB Manufacturing Techniques: Milling: a quick introduction to milling with digikey. Always great to read this kind of publication.

📝 Learning to Decapsulate Integrated Circuits Using Acid Deposition: a nice post showing lot of experiment to decapsulate integrated circuits.

🌐 Zero ASIC releases Platypus 12nm eFPGA product: zeroasic (previously known as Adapteva, the conceptors of the Parallella board) released a the Platypus eFPGA product. I discovered the Logic FPGA tool chain via the news from their website.

Security

📝 Everything is about to “go dark”: Matthew Green fears about too much security due to AI usage, and the risk of agencies losing control over that. Law enforcers and agencies will then ask to add more backdoors. Is it really necessary? Most of the devices and hardware we are currently using are not open-source, they are being crafted in an opaque way, they are embedding unverified/uncontrolled firmware and then, can't be trusted. Furthermore, no one is able to recreate them in their own garage due to the cost of the infrastructure to make them, but also because of the copyright/laws protecting the manufacturers. In such environment, the backdoors are already there, and governments are just asking to use them, not to implement them. More than 10 years ago, Snowden revealed that hdd firmware were already backdoored (and not only there). They did not stop, they continued. What's the solution? More open-source, more makerspaces/hackerspaces, more trusted hardware/devices made from small groups and not big companies. In short: more transparency. They can't stop everybody. But don't worry, there is more. Do you remember when Ken Thompson was thinking about trusted compilers? Well, an LLM is basically the same, you ask for something, you get it, but can you trust it? In our current situation, LLMs are all managed by big companies, already infiltrated by agencies. Then, can you really trust your application generated by your LLM?

📑 TrustMee: Self-Verifying Remote Attestation Evidence: define the "self-verifying remote attestation evidence" concept. A proof is generated in WASM and checked by a verifier. Even if the WASM VM was created as an isolated sandbox, it could be used against the protocol. Interesting anyway.

Security/BlueTeam

📝 How to Read Linux Audit Logs During an Intrusion: a summary of the actions to take on CentOS/RHEL distribution during an intrusion.

📝 Cracking the Crackers: reverse-engineering of x86_64 and arm64 cracked softwares. It always amazes me to see the level of complexity in this domain.

📑 The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web: a long study about adopting physical passkeys. The authors are offering interesting service publicly at passkeys.tools. A must read for someone who wants to implement this kind of authentication on his website or application.

Security/RedTeam

📝 The Axios npm supply chain incident: fake dependency, real backdoor: a short review of the Axios NPM supply chain attack.

📝 Build simple fuzzer, part 6: A long series to write a fuzzer (in C, rust and python).

📑 BADControl: Backdoor Attacks Against Control Systems: the first backdoor against controller with physical triggers. A car/robot is used as example in this publication to see what can be done with such attacks.

📝 Knock Knock! Who's There? - An NSA VM: an interesting way to hide a service, listening on demand based on interface activity with the help of libpcap. It's a bit like the port knocking technique for a firewall, but on the user land side, perhaps more accurate as well, because all packets can be inspected (including their content).

Security/Cryptography

📝 WhatsApp forensics in 2026 and what survives end-to-end encryption: in short, WhatsApp is still secure, but never forgot end-to-end encryption was created to protect the data one the wire to avoid anyone outside of the two part of the line to read its content, but don't protect the end-points. Data can still be found locally on the device, cracked and then extracted. WhatsApp is using crypt15 puzzle (previously crypt12 and crypt14) when storing data locally.

📑 Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED: defines a new cryptanalysis method called "video-based cryptanalysis", used to perform side channel attack to recover an ECDSA key. It has been used against iPhone 13 and Samsung Galaxy S8 while plugged to an USB hub. Another crazy side-channel attack!

📝 Testing the Security of Modbus Services: a quick introduction to testing Modbus using the M-SAK tool. I worked a bit with this protocol in the past, but never had time to read all the specs and understand it clearly (thanks to all the abstraction layers used).

📑 End-to-End Encrypted Collaborative Documents: a protocol to use Signal encryption scheme for collaborative documents, called SignalCD.

📑 LLMs won't break symmetric crypto: in short, using LLM to find vulnerability in cryptography is a good thing but LLMs will not break popular cryptographic schemes. why? (1) high level structure is secure (2) not related to mathematical structures like asymmetric algorithms or hash functions (3) differential cryptanalysis (4) empirical: flaws and issues are found from experiments (5) time/battle tested for many years. A nice quote: "Symmetry cryptography is the strongest part of our security systems".

📑 Fully Homomorphic Encryption with Chosen-Ciphertext Security from LWE: the level of mathematics is too hard for me, but I think the next buzzword for the next 10 years will probably be homomorphic encryption. Following the news on that will be important. I'm also waiting for the next marketing term to sell it.

📑 SafeHub: End-to-end encrypted Git hosting system: a way to encrypt transaction in Git. unfortunately, I did not find the repository, not sure if it's open-source, but the full protocol/design is presented in the paper.

Update/Upgrades

Linux Kernel 7.2 Officially Released, This Is What’s New: Linux Kernel 7.2 has been released. It improves AMD GPU support, a better GPU scheduler, few CPU improvements... More can be read on kernelnewbies.

Rust: Supply chain attack on arrayref: a supply chain attack on one important crate. You can be "memory-safe" and avoid lot of bugs, but it seems it's still hard to be safe in the whole ecosystem. The rust team was reactive though, the create was removed after few minutes (100minutes). Kudos to them.

Mathematics

▶️ The Single Most Undervalued Fact of Linear Algebra: discovering the relation of linear algebra and graph theory through visual explanation. brilliant.

▶️ Ancient Babylonians Cracked This Before Modern Math Even Existed: a short video explaining how Babylonians did an approximation of sqrt(2) via the Babylonian algorithm, and comparing it with the Newton-Raphson method. Another visually brilliant video from The Palindrome.

Misc

📑 Does Fixing Break Security? An Empirical Study of Security Degradation in Iterative LLM-Driven Infrastructure-as-Code Repair: From the conclusion: "(1) Regression is real: 13.8% of scenarios regress in standard mode, 3.3% in strict mode ... Resource restructuring is the dominant root cause (79.0%), ahead of configuration drift ... Self-correction is common but unstable: 36.6% of standard-mode regressions self-correct, yet 28.5% of scenarios oscillate. Interesting report, checking a second time the content of the publication (more deeply) is required.

📑 Don't Let AI Agents YOLO Your Files: Information and Control in Agent-Native Filesystems: the first sentence of the abstract is enough: "AI coding agents operate directly on users' filesystems and regularly corrupt data, delete files, and leak secrets. We conduct the first systematic study of agent filesystem misuse, analyzing 290~public reports. Our study reveals two fundamental gaps: users and agents have limited information about filesystem effects and insufficient control over them."

📝 Living with impostor syndrome: a good post about impostor syndrome. I think we are more or less all impacted by that in the field, perhaps a bit more when one is working in security due to all the things to check every time and not trusting anything. Anyway, my solution? Doing something outside of my field, like reading philosophical books, or doing sport. When it comes to IT, just do small tasks, one by one. Stop asking too much questions, in fine, no one cares.

🌐 1-bit computing: a CPU architecture using only 1 bit, but the opcodes were 4 or 8 bits.

🌐 4-bit computing: CPU using only 4 bits, used for calculator in the 70s.

📑 FreeToken: Efficient Edge-Native MoE Serving with Bandwidth-Adaptive Execution: Faster than Ollama locally, released as open-source project, seen that on X/Twitter via @akshay_pachaar.