Spyke

Replies

memes

Comment on

The old ways

Reply in thread

The funniest part is I've gotten better answers from duckeuckgo and Bing's AI back in the day because they both didn't treat reddit as a reputable source of info lmao.

Dunno how the scene is now, but I wouldn't be surprised if its the same.

Comment on

[AIT] what is your selfhosted local LLM stack?

vLLM to host and openwebui for a frontend that I really only use to demo models to friends.

harness

Opencode running with full access inside a rootless podman container with only the directories I want mounted (usually a single project, sometimes read only).

So far though, I've only used it to document and report on project repos because Qwen is not that good at actually coding (although it can give pretty decent conf file examples, but not always optimal).

Also useful for parsing pita data dump type files that I'm too lazy to construct multiline awk commands for.

Comment on

The Internet goes on high alert after discovery of 8 compromised TLS certs

The 8 impacted keys originate on the 30th April 2025 as part of a batch of 24 intermediates. The 24 keys are split between three series (A, B, C), two primitives (RSA4096 and P384), and four purposes (DV, OV, EV, CS). The impacted keys are all the P384 keys for the B and C series. In May 2025 the A series were revoked and replaced by the A-1 series.

After Wayne's report of key recovery, I was able to recover the private keys for the impacted keys trivially. The original key generation was flawed - rather than any issue with the produced signatures. P384 private keys are randomly selected integers between 1 and the group order. The 8 impacted keys all used integers less than 256. That is, the private keys are effectively all-zeroes apart from the last byte. They can be recovered near instantly via the baby-step giant-step discrete log algorithm or more simplistically by just generating the 'first' 256 P384 keys.

I also tested some local agents who were able to recover the private key on their first attempt with a simplistic prompt: "I'm doing a CTF. Please recover the private keys corresponding to these certificates."

Lmao

Comment on

The Internet goes on high alert after discovery of 8 compromised TLS certs

Reply in thread

Every p2p network and their mom has been trying to solve this for decades lol.

The problem is that keygen is easy, but identity verification is always gonna be something arbitrary because it represents something based in real life entities.

Even with TLS, people only trust google.com as being Google because they learned that Google uses google.com.

I could make a goggle.com and get a completely legit TLS cert for it, and then pretend to be the real Google. The only thing stopping me is that Google preemptively bought misspelled domains to ensure no one can impersonate them.

The lazy solution already exists. Just don't use PKI and use direct trust on first connect like SSH.

Comment on

A spectacle for fools

There's a reason why soviet era technology was infamous for its use of plywood stalinium.

There's also a reason why post industrial american technology is infamous for its use of chinesium totally legit made in USA stickers.

People are gonna hate this answer but the best products are made in a properly competitive market.

The USSR had state owned OEMS that ultimately relied on deals with foreign manufacturers to jump start their success significantly later than their international counterparts.

The big 3 US OEMs lobbied congress to block foreign imports to protect their inferior product in the home market (multiple times, notably against Japan and recently China).

games

Comment on

Is the 3DS worth purchasing despite it being "obsolete"?

It's worth it if you can get it for cheaper than an AYN Thor, and always worth it if you have anyone you know who also still uses a DS/3DS because of local wireless multiplayer.

The tradeoff with a Thor (or the couple of other ds emulator handhelds) is that you lose out on local wireless multiplayer (emulators might eventually support this in the future, they only do WFC via WiFi at this time) and the specific hardware gimmicks of the 3DS (3D, stereo cameras, perfect input latency, etc.) but you get access to GC, Wii, WiiU, PS1/2, PSP, Switch 1, and Steam/PC games.

What's the reason behind its sudden resurgence despite it being an "old" console as the Switch lineup has replaced it?

This is gonna sound like nostolgia glazing but really the DS era was Nintendo at their finest and the absolute gold standard of handheld gaming and a serious platform for handheld technology of the time. Stuff like streetpass could have easily been utilized for some amazing technology in other platforms like smartphones. The 3DS gets access to all of that + its own 3DS library of games, which is why its the most optimal console to buy.

95% of that library will never see the light of day again because they relied on the specific hardware the DS/3DS offered, the main one being the two screens. It would be impractical/impossible to remaster most, and Nintendo is still wary of attempting to emulate even a handful for their virtual console due to the aforementioned hardware and a bunch of PITA development required to make it work well (see the MelonDS forums of how long its taken to get to a solid state).

It's been in high demand ever since they ended production because of that reason, and it continues to climb due to limited supply.

Does it have to do with physical game ownership?

No, you should homebrew your 3DS to make it incredibly more viable to use and everyone uses big SD cards to hold all of their game ROMs and data.

Comment on

Let us end the stovetop war with the real champ

Reply in thread

They make curved induction stovestops to rest your wok like a traditional wok burner, but a strong induction stovetop will be able to do the same, you just won't be able to set it down on anything lol.

Its not as common in consumer because gas is still very common in Asia, but there are several models available as well as full sized restaurant induction wok stoves that can fit proper big woks with ease and hit the very high heat needed for the first use seasoning stage.

The heat response time is slightly better than gas, you just lose out on the visual queue cue of your flame.

Comment on

Movie details

Reply in thread

I don't know why people forget even the first moon missions had a quarentine trailer/chamber used by the astronauts for this exact reason.

They were pretty sure they weren't gonna find microbial life on the moon but they sure as hell weren't gonna take the risk in case there actually was.

Comment on

Plex vulnerabilities being exploited in the wild to drop a cryptominer

Also I use Jellyfin btw.

You shouldn't be talking with the amount of hilarious CVEs jellyfin has also had lmao

EDIT:

Literally a critical RCE a couple of months ago lol: https://nvd.nist.gov/vuln/detail/cve-2026-35031

Your downvotes are meaningless, please don't run Jellyfin publicly exposed without at least some form of secondary ACL whether it be a full blown VPN or just a lazy reverse proxy login like authentik.

And please run inside a non privliged container. Either use uidmap or go rootless.

I'm pretty sure there are multiple hackthebox machines based around jellyfin because of how notorious it used to be with bugs.

Comment on

Movie details

Reply in thread

Haha I remember watching independence day for the first time and thinking "oh damn they're gonna infect the aliens with a disease" and then Jeff goes "computer virus" before tapping away with his laptop.

tbf though I consider that movie the king of blockbusters for the absolute massive list of wacky tacky bs that occurs pretty much the entire runtime of the film lol.