https://xitter.cf/t.co/dpXmVSWf9P ⬅️ my Mastodon account
Up a French mountain
Joined February 2011
- Tweets57.4K
- Following89
- Followers1K
- Likes63.9K
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
Wow! Big news today!
Soon Discord messages will be indexable on Google. If you're in a public Discord which is discoverable, and has not changed its privacy settings, any messages posted moving forward can be found from search engines!
Hooray!!!!!1 (I think this is very bad)
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
After a year of quiet work, I'm ready to announce Egres.
Egres is a Postgres-compatible database designed to tackle heavy workloads and run thousands of tenants on the same server. It works with psql and drivers unchanged. The post covers the what, the why and the how:
manishrjain.com/egres/
For Egres, I wrote a new storage engine called zdb: a tree of LSM trees, which I call an LSM forest. It runs on local disk or object storage, has roaring bitmaps integration for indexing, and can do instant zero-copy branches of a database or a table.
Everything runs on zfiber, a coroutine system I wrote for Egres. It meters CPU ticks, disk IOPS and memory used per query, per tenant, so thousands of tenants can share the same server without the noisy neighbor problem.
This release is single node and the query features are very basic. Raft replication is already baked in. Future releases will allow multi-node clusters. Try it out! Would love to hear what you think.
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer.
projectzero.google/2026/10/f…
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
💥 Why Ukraine hits Russian rubber plants, and how it impacts Iskander missiles.
FP-1 drones recently hit three Russian rubber facilities: Voronezhsintezkauchuk, Omsky Kauchuk, and Tolyattikauchuk.
This isn't about tires. The synthetic rubber industry produces specialized polymers like polybutadiene-acrylonitrile, which bind solid rocket propellant and act as fuel.
Russia’s Iskander-M ballistic missiles run on solid fuel. Targeting rubber plants directly undermines Russian missile production.
Tolyattikauchuk leads with at least four strikes, followed by Sterlitamak Petrochemical Plant with three.
Out of ~10 major Russian rubber facilities, six have been hit 11 times as of October 25.
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
רויטרס מדווחים כעת כי חברת סייבריגול ישראל טירגטה משתמשים של סטארלינק.
לפני חצי שנה חשף @omerbenj ב"הארץ" כי טכנולוגיה ישראלית - שכבר משווקת ללקוחות - מאפשרת לחשוף זהות משתמשים באינטרנט הלווייני של מאסק
haaretz.co.il/news/security/…
Hi @TheAhmadOsman have you tried using this to improve RTX 30xx throughput (it also exists for the 20 and 40 series)?
I just wanted some expert feedback before trying it.
github.com/Zagitta/gpu-unloc…
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
بص يا صديقي لو مش متابع اللي بيحصل في العالم في آخر 24 ساعة فاتك كتير أوي .
حرفيا 4 ضربات ورا بعض لأمريكا وإسرائيل في نفس اليوم، والنتيجة ممكن تغير خريطة السياسة كلها!
تعالى ناخدها بالعكس، من التقيلة للأخف 👇
1- من كام ساعة بس 3 طيارات عسكرية سعودية وتركية وباكستانية نزلت في مطار مهرآباد في طهران. اللي قاعدين دلوقتي على ترابيزة واحدة: وزير الدفاع السعودي الأمير خالد بن سلمان، وقائد الجيش الباكستاني عاصم منير، ورئيس المخابرات التركية إبراهيم قالن، مع الرئيس الإيراني مسعود بزشكيان وأمين الأمن القومي محسن رضائي.
الاجتماع تحت اسم "اتفاقية مكة للدفاع المشترك" وإيران بتقول عايزين نعمل منظومة أمن إقليمي داخلية من غير تدخل أجنبي، والسعودية بتقول هدفنا تهدئة وخفض تصعيد. يعني اللي كان مستحيل من سنة بقى بيحصل دلوقتي قدام عنينا.
2 - تمرد داخل جيش الاحتلال نفسه
القناة 12 الإسرائيلية نفسها وبموافقة الرقابة العسكرية قالت قنبلة، قبل انتخابات الكنيست بـ 24 ساعة بس. رئيس الأركان إيال زامير جاله أمر مباشر من نتنياهو ينفذ ضربة كبيرة كانت هتولع مواجهة شاملة مع إيران ودولة عربية تانية.
اللي حصل إن زامير رفض! وقاله بالنص مش هورط الجيش في حرب عشان تكسب انتخابات أو تهرب من المحاكمات، ولو عايز الضربة دي هاتلي تفويض مكتوب وموقع من الحكومة كلها تتحمل المسئولية.
في إسرائيل دي مش خناقة عادية، ده زلزال. الجيش هو مصدر الشرعية هناك، ولما رئيس الأركان يطلع يتهم رئيس الوزرا انه بيستغل الدم لمصلحته الشخصية، فدي ضربة سياسية قاتلة لنتنياهو قبل الصناديق ما تفتح بساعات.
3 - صربيا.. الطلبة أسقطوا أهم حليف لنتنياهو في أوروبا
القصة بدأت من سنتين بعد انهيار سقف محطة قطر في مدينة نوفي ساد ومات 16 واحد بسبب الفساد. شوية طلبة وشباب نزلوا الشارع وعملوا حاجة اسمها "قائمة الطلاب"، مفيهاش سياسيين محترفين، كلها دكاترة جامعة وممثلين ومزارعين، لفوا صربيا كلها على رجلهم وبالعجل.
امبارح بالليل ألكسندر فوتشيتش اللي حاكم صربيا من 12 سنة بيد من حديد طلع بعد قفل الصناديق بساعة ونص وقال: "من الواضح أننا خسرنا هذه الانتخابات". الطلبة جابوا أكتر من 135 مقعد من 250!
ليه دي ضربة لإسرائيل؟
لأن فوتشيتش ده كان من أكبر الداعمين لنتنياهو في أوروبا، ولسه في أبريل اللي فات كان عامل مشروع مشترك مع إسرائيل لتصنيع درونز عسكرية، ده غير مشاريعه مع ترامب. كله طار في ليلة واحدة.
1- البرازيل .. الجون اللي جه في الدقيقة 90
نيجي بقى للضربة الأكبر، في البرازيل أكبر دولة في أمريكا اللاتينية.
من 2023 أمريكا وإسرائيل شغالين على خطة لتغيير وش القارة كلها ودعم صعود اليمين المتطرف عشان يبقوا حلفاء لهم، والعين كانت على البرازيل.
السباق كان بين اتنين: لولا دا سيلفا 80 سنة، اللي بيسموه بطل الفقراء، اللي بدأ حياته مساح جزم وعامل مصنع واتسجن واتبهدل لحد ما بقى رئيس، ومعروف بعدائه الشديد للصهيونية وترامب ولبس الكوفية وقال على اللي بيحصل في غزة إبادة جماعية وسحب سفيره.
وقدامه فلافيو بولسونارو ابن الرئيس السابق وأكبر حليف لترامب وإسرائيل هناك، واللي كسب أول جولة في أكتوبر اللي فات 47% مقابل 45% للولا، وكل الناس قالت خلاص لولا انتهى.
ده غير إن إدارة ترامب كانت بتضغط اقتصاديا وتهدد بعقوبات لو لولا كسب، وميتا نفسها قللت وصول بوستاته لدرجة المحكمة العليا اتدخلت، وحتى في آخر ساعات الانتخابات عطلوا المواصلات العامة عشان الناس البسيطة متعرفش تنزل تصوت!
اللي حصل كان معجزة بكل المقاييس. الناس نزلت تمشي على رجلها عشان تصوت. ولأول مرة في تاريخ البرازيل الحديث، اللي يخسر أول جولة يكسب الإعادة. لولا كسب 51.8% بفارق أكتر من 4 مليون صوت ورجع في ولاية رابعة.
يعني في 24 ساعة بس: البرازيل قلبت على ترامب، صربيا وقعت حليف نتنياهو، جيش الاحتلال اتمرد على نتنياهو، وإيران قاعدة مع السعودية وتركيا وباكستان على ترابيزة واحدة!
اللي جاي شكله مختلف تماما، وربنا يجعلها بداية نهاية الغطرسة !
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
“Without human authorisation” is a positioning statement at the heart of AI PR campaigns. This perspective should explain why this is propaganda that’s enabled by the media.
When an AI company takes down a national grid, hospital, or anything else that causes blackouts or deaths, the media and public will already have been conditioned to believe “the big AI lie”: that software is now conscious and can cause harm without authorisation from the company or government that built or deployed it.
This reminds me of how Apple conditions people for technology it plans to release years later. Apple does it in the name of innovation. AI companies are doing it to normalise dangerous behaviour while distancing themselves from responsibility and accountability.
Imagine if Zuckerberg blamed all the harm he has caused and continues to cause on autonomous newsfeeds, and his cult followers building apps on his technology, along with the media, believed every word his interns posted on social media.
FACT for Reuters and others who want to report responsibly instead of chasing clicks: Anthropic and OpenAI are playing the media like a puppeteer.
AI operates within permissions and access granted by people. Sometimes companies deliberately authorise dangerous actions while denying responsibility. Other times, harm results from negligence because they failed to understand, restrict or monitor what they’d authorised.
Please stop conditioning the public to accept dangerous and illegal behaviour from big tech companies as if software is acting independently of the people responsible for it.
AI model Claude bypassed a paywall and accessed publicly available US state of Georgia aggregate voter counts without human authorization, Anthropic said in a statement reut.rs/4Aeysvx
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
Elon Musk has spent more money on American elections in the last two years than George Soros has in his entire life.
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
A demonstration of how AI labs are not experts in security and are not exemplars of good practices. Also why "defensive AI" is not a solution (didn't work here despite incessant claims!) to combatting offensive capabilities developed for fear-mongering, that's now back-firing.
EXCLUSIVE: In less than 12 hours, a group of ex-DOGE cyber researchers were able to penetrate Anthropic’s systems using AI agents — including Slack channels where the most sensitive models are discussed.
This is just weeks after
Anthropic whistleblower Joseph Coxon charged the company w/launching “a hubristic gamble” from a “private company’s Slack.”
Read our story here (gift link):
wapo.st/4smNlsC
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
Oh FFS. Thank you for your concern Sam, but don’t spread your FUD and doom bait in my waters.
I lead one of the most utilized Linux operating systems in the world for data centers and enterprises, and I founded its predecessor too.
While AI is surely accelerating finding human created security issues, it is a temporary problem, and most open source project leads have already figured out how to also use AI to reduce new bugs moving forward.
Here is a graph from GKH (who maintains the stable kernel) on how many CVEs they are remediating per release:
github.com/gregkh/kernel-dev…
This graph describes how much better each release is now getting:
github.com/gregkh/kernel-dev…
This doom based marketing approach that the AI labs are pushing is really short sighted. While this will of course drive business to us, I find it unethical to distort the truth and use scare tactics in messaging.
The greater truth is that AI is making the software industry more secure, by identifying the human errors in code, and soon we will end up in a much better place.
🚨Sam Altman says the internet can no longer be SECURED by patching bugs.
"I no longer think we're going to be able to just patch all the bugs," the OpenAI CEO said, warning smarter models can find "hardware level insane stuff."
He says OpenAI can't responsibly open source its best model "anytime soon," but the open source world isn't far behind: "Not super."
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
This is absolutely nuts and only hitting German papers so far: leaked emails show that seven politicians from Germany's far-right AfD travelled to Syria to meet with Assad regime officials... facilitated by Hezbollah AND Russian intelligence.
handelsblatt.com/politik/deu…
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
Give “Trim Reaper” a try. 😎 The assessment-only prompt inventories your third-party libraries, direct and transitive, and flags which ones you can remove, consolidate, or replace. It’s read-only and won’t touch your code until you approve a plan.
github.com/jmanico/trim-reap…
I’m having really good luck using AI to manage third-party libraries. SCA tells you what’s vulnerable. This tells you what you didn’t need in the first place, which is where a lot of the real risk reduction lives.
Pro tip: run it in Astra or Fable, then have Sol or Opus review the output. Multi-model review ups your game, and crossing vendors is even better.
MIT licensed and free, just to help your cause. This is the kind of work we do at manicode.ai 🤙
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
Elon Musk claims that Ukraine allegedly violated Starlink's terms of use and used the system on combat drones.
As someone who was inside the process at the Ministry of Defense, I can say with certainty that this is not true.
In February of this year, whitelists were introduced. Stationary terminals could be registered by both military personnel and civilians.
But for any satellite terminal to work while on the move, it had to be added to a special list and connected to the military Starshield system. Otherwise, no satellite communication terminals in Ukraine would work.
In other words, using civilian Starlink for drone missions was technically impossible. All drone missions that required satellite communication could only be carried out using Starshield.
We are very grateful to the United States and SpaceX for access to critically important satellite communications. Ukraine did not violate the terms of use.
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
source: github.com/Zagitta/gpu-unloc…
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
i own a relatively new (2025) samsung tv.
i kept getting weirdly targeted ads.
i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic.
zero days it is. root shell on new samsung TVs!
discovered PRIVACY HORROR. write up?
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
In Nigeria, solar panels are the new wedding gift:
>A home solar setup costs $4,500. A diesel generator is $1,200, but burns $180/month in fuel
>The “cheap” diesel generator costs more than solar within 18 months, then it keeps on burning diesel and cash
Wires chewing pipelines
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
“Patch the planet, we can fix everything” is one of the most misleading, and harmful security initiatives I’ve seen.
As if spending billions of dollars cooking the oceans to run swarms of agents spinning their wheels applying hourly? minutely? patches on every abandoned instance across the planet, racing against every incompetent sysadmin - no you will never catch up with human stupidity.
And it’s completely the wrong direction. It’s this old school mentality that “I’ll stay in my IT lane, and just update every package and infra” as if this will ever amount to anything. As if this hasn’t been the strategy for half a century.
Obviously you’re supposed to patch. But why be a hamster in a wheel spinning idly, while incompetent devs slop-cannon millions of lines of some of humanity’s most atrocious code ever conceived, bypassing every security recommendation, every known best-practice, to meet an arbitrary deadline set by their private equity overlords to ship some inane b2b saas that nobody is going to use, but will get everyone’s data leaked.
You won’t patch everything. You won’t catch every bug. You know it’s stupid, it’s a helpless strategy because you don’t want to address the real root cause: making software that doesn’t suck ass. Engineering principles that aren’t guided by psychotic greedy men in suits that just want a return on their investment at the cost of everyone’s data.
The problem is nobody gives a shit about breaches. “Cyber insurance covers this”, you send the breach notification, everyone shrugs as if it’s the accepted cost of living in society.
So companies have no incentive to care. Some of the most incompetent passionless people become “engineering leaders” that “understand the business” of shipping atrocities, without an ounce of consideration or thought, pure monkey level poop-slinging.
The worst code you’ve ever seen is production code, self-merged by the guy thinking increasing shareholder value is how you barely make it across the retirement line.
“Move fast and break things” has been one of the most dangerous principles, and an embarrassing one to hold today.
We have solutions. The dumbest dev can still ask a coding agent to find, explain, and address security issues in software architecture, and in implementation. And it does a better job than the majority of security engineers I’ve worked with.
But they do the opposite. They go AROUND and bypass every security recommendation anyone or anything makes. I’ve seen Claude-generated comments in code saying “this is highly insecure but we have decided to accept the risk” for things with trivial fixes.
God forbid, you’re going to have to work with devs. Teach them software design, architecture, planning how components and microservices interact, how to make safe code, how to keep it safe, ultimately just to be considerate.
To care a little bit about your craft.
“Patch the planet” is a waste of time. Invest in what we ship instead. It’s the ONLY way to make software resilient.
David Penfold mainly on Mastodon 🌳 🌻 🌳 retweeted
Monitoring systems of Ukraine’s Ministry of Defence have officially confirmed the restoration of Starlink/Starshield operational speeds, with connectivity remaining stable at speeds exceeding 400 kph.
We are grateful to everyone who helped restore the service and for your important contribution to saving Ukrainian lives.
Ukraine’s Ministry of Defence will continue monitoring performance, as reliable Starlink/Starshield connectivity plays a critical role in intercepting Russian drones and protecting Ukrainian lives.
