David Pope in Canberra Times

@daedalus A frosty morn to you too!

https://theonion.com/netanyahu-calls-iran-strikes-necessary-to-prevent-war-he-just-started/

“The absolute rage the activist inspires in the world's worst men is one of her most admirable qualities.”

#GretaThunberg

https://www.wonkette.com/p/everyone-definitely-having-a-normal

The history of Nazis holding rallies in left-wing areas of Weimar Germany, instigating street fights, and then telling the press that only they could save Germany from the "violent communists" seems like an important thing for people to be studying right now.

@jrdepriest Totally agree on the corporate speak stuff. Sometimes, when I feel there is no other way that will actually get them to respond, I will use one word, but I try hard not to get sucked into their corporate cult.

"Let's take this offline" is my favourite hate phrase btw. It generally means, "Stop talking about this topic because it is making me feel uncomfortable in front of my manager". There are very few people who will actually ever discuss the topic after the meeting when they use that phrase.

Countries with Military Parades for the Leader’s Birthday:

1. North Korea

2. Russia

3. Turkmenistan

4. Belarus

5. United States

@jrdepriest I have difficulty understanding when it is my turn to talk in a conversation. In video conferences I am usually the one annotating the conversation in the chat until those talking notice.

@shortridge While working tech support, I got a call on a Monday. Some VPNs which had been working on Friday were no longer working. After a little digging, we found the negotiation was failing due to a certificate validation failure.

The certificate validation was failing because the system couldn’t check the certificate revocation list (CRL).

The system couldn’t check the CRL because it was too big. The software doing the validation only allocated 512kB to store the CRL, and it was bigger than that. This is from a private certificate authority, though, and 512kB is a *LOT* of revoked certificates. Shouldn’t be possible for this environment to hit within a human lifespan.

Turns out the CRL was nearly a megabyte! What gives? We check the certificate authority, and it’s revoking and reissuing every single certificate it has signed once per second.

The revocations say all the certificates (including the certificate authority’s) are expired. We check the expiration date of the certificate authority, and it’s set to some time in 1910. What? It was around here I started to suspect what had happened.

The certificate authority isn’t valid before some time in 2037. It was waking up every second, seeing the current date was after the expiration date and reissuing everything. But time is linear, so it doesn’t make sense to reissue an expired certificate with an earlier not-valid-before date, so it reissued all the certs with the same dates and went to sleep. One second later, it woke up and did the whole process over again. But why the clearly invalid dates on the CA?

The CA operation log was packed with revocations and reissues, but I eventually found the reissues which changed the validity dates of the CA’s certificate. Sure enough, it reissued itself in 2037 and the expiration date was set to 2037 plus ten years, which fell victim to the 2038 limitation. But it’s not 2037, so why did the system think it was?

The OS running the CA was set to sync with NTP every 120 seconds, and it used a really bad NTP client which blindly set the time to whatever the NTP server gave it. No sanity checking, no drifting. Just get the time, set the time. OS logs showed most of the time, the clock adjustment was a fraction of a second. Then some time on Saturday, there was an adjustment of tens of thousands of seconds forward. The next adjustment was hundreds of thousands of seconds forward. Tens of millions of seconds forward. Eventually it hit billions of seconds backwards, taking the system clock back to 1904 or so. The NTP server was racing forward through the 32-bit timestamp space.

At some point, the NTP server handed out a date in 2037 which was after the CA’s expiration. It reissued itself as I described above, and a date math bug resulted in a cert which expired before it was valid. So now we have an explanation for the CRL being so huge. On to the NTP server!

Turns out they had an NTP “appliance” with a radio clock (i.e, a CDMA radio, GPS receiver, etc.). Whoever built it had done so in a really questionable way. It seems it had a faulty internal clock which was very fast. If it lost upstream time for a while, then reacquired it after the internal clock had accumulated a whole extra second, the server didn’t let itself step backwards or extend the duration of a second. The math it used to correct its internal clock somehow resulted in dramatically shortening the duration of a second until it wrapped in 2038 and eventually ended up at the correct time.

Ultimately found three issues:
• An OS with an overly-simplistic NTP client
• A certificate authority with a bad date math system
• An NTP server with design issues and bad hardware

Edit: The popularity of this story has me thinking about it some more.

The 2038 problem happens because when the first bit of a 32-bit value is 1 and you use it as a signed integer, it’s interpreted as a negative number in 2’s complement representation. But C has no protection from treating the same value as signed in some contexts and unsigned in others. If you start with a signed 32-bit integer with the value -1, it is represented in memory as 0xFFFFFFFF. If you then use it as an unsigned integer, it becomes the value 4,294,967,296.

I bet the NTP box subtracted the internal clock’s seconds from the radio clock’s seconds as signed integers (getting -1 seconds), then treated it as an unsigned integer when figuring out how to adjust the tick rate. It suddenly thought the clock was four billion seconds behind, so it really has to sprint forward to catch up!

In my experience, the most baffling behavior is almost always caused by very small mistakes. This small mistake would explain the behavior.

www.abc.net.au/news/2025-06.... #Auspol. They took 45 minutes to notify authorities about a fire they accidentally started. Shocking

Inquiry finds ADF crew made 'e...

@subm3rge I try to get as many changes in during that period as possible.

@cR0w I block common public DNS on principle because I don't want devices avoiding my PiHole without making them at least put some effort in.

So they about to bomb Iran apparently.

https://apnews.com/live/donald-trump-news-updates-6-11-2025

(comic) Fast paced environment https://workchronicles.substack.com/p/comic-fast-paced-environment-873

Great. I just finally take up posting on #iNaturalist as a new hobby and its leadership goes in on the enshittification cycle with Google and AI. There seems to still be quite a bit of ambiguity about what this will mean, but for me it means no more posting until this gets resolved. If they continue with Google anything, I'll delete my account and demand they delete the data.

Can't we, for just fucking once, have nice Internet things? This is why I like the fedi so much 🥰

If I'm reading that right, it sounds like the log parsing touches a shell somewhere and maliciously-formed logs can inject commands. Yikes!

Oh hi there Palo Alto privesc!

An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.

https://security.paloaltonetworks.com/CVE-2025-4232

@cR0w Could be doing it to let rate limits expire so they aren't permanently blocked by systems that don't use threat lists and just block locally.

Russia's chief negotiator Medinsky claims Moscow wants to end the war quickly and that Ukraine's refusal to compromise will lead to further territorial losses.

This is textbook imperial behavior: invade, then pose as a peace-seeker while blaming the victim for resisting territorial concessions.