I am the journeyer from the valley of the dead Sega consoles. With the blessings of Sega Saturn, the gaming system of destruction, I am the Scout of Silence… Sailor Saturn.

  • 0 Posts
  • 86 Comments
Joined 3 years ago
Cake day: June 29th, 2023
  • Sailor Sega Saturn@awful.systemstoTechTakes@awful.systems•Stubsack: weekly thread for sneers not worth an entire post, week ending 9th August 2026English
    14·
    14 days ago

    There was a cryptocurrency wallet hack the other day which has so far gone unremarked here because the popcorn is stale and we all pivoted to AI. And yet there are dozens of voices of bagholders crying out in pain wanting to be heard. This is their story.

    For some reason the best explanation comes from a boring company that makes point of sale credit card readers https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware

    COLDCARD firmware contains an RNG integration error that causes ngu.random to use MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware RNG.

    Oh hey they got the most important thing not to get wrong wrong in the regulation free money settlement layer of the future.

    The bug? Well in one file they wrote #define MICROPY_HW_ENABLE_RNG 0, and a library they depended on had this code:

    # ifndef MICROPY_HW_ENABLE_RNG
# error "get a HW TRNG plz"
# endif

    This should have caused a build failure, but since MICROPY_HW_ENABLE_RNG was defined, to zero, it did not and instead continued down an insecure codepath.

    As a C++ programmer this isn’t an unheard of sort of mistake to make in the moment. Many libraries use undefined for preprocessor variables, but there are some people who also use zero.

    But it’s less excusable to not catch it when this is literally the most important thing to get right in a bitcoin wallet. Did they not trace the code path when writing the code? Did they have no integration tests or unit tests for RNG seed quality? Poor RNG seeding has come up a ton in literature, so is the sort of thing people writing cryptographic code should check for…

    We’ll have to addend that old saying: “don’t roll your own crypto unless the other person’s crypto is from a blockchain developer in which case you’re probably better off rolling your own after all.”

    I personally don’t want to sneer at the bagholders too much here. It’s 2026 and at this point it just feels kinda sad. But I’ll end this comment with this glowing review:

    I thought I was secure because Cold Card was always praised as one of the best and most secure wallets. It’s open source, so anyone can verify.

    “It’s open source, so anyone can verify” – unfortunately for them the verifier was also a hacker.

  • Sailor Sega Saturn@awful.systemstoTechTakes@awful.systems•Stubsack: weekly thread for sneers not worth an entire post, week ending 19th July 2026English
    0·
    1 month ago

    Oh no every day sneerclub teaches me about a new guy.

    So he’s basically arguing that the Borg did nothing wrong (note: the Borg do not actually exist, note #2: the Borg are space fascists).

    Worthy Successor: A posthuman intelligence so capable and morally valuable that you would gladly prefer that it (not humanity) determine the future path of life itself.

    This isn’t the first time I’ve seen this idea in rationalist circles: that is bad / wrong / irrational to be biased in favor of humans and or humans to succeed in particular. Often the idea is taken as obviously true, but I cannot understand it at all.

    Like I don’t care if you can make a computer “better” than me or less sad than me or less likely to eat an innocent shrimp than me. I am not that computer-- if it’s a choice between me and them I’m fighting on team me. There is nothing wrong with wanting to make one’s space in the universe or to “selfishly” want self-actualization or to want humans to thrive.

  • Sailor Sega Saturn@awful.systemstoTechTakes@awful.systems•Stubsack: weekly thread for sneers not worth an entire post, week ending 3rd May 2026English
    11·
    4 months ago

    The future of AI in Ubuntu

    This post has all the usual cliches, exaggerations, lies, and unfounded optimism you’d expect in a blog post about a company forcing AI down their workers and user’s throats. I’ll try to avoid sneering at every sentence.

    Delegating elements of Site Reliability Engineering to an agent does not necessarily introduce an entirely new class of risk; it should inherit the constraints of existing production systems. Well-run production environments already rely on strict access controls, audit trails, and clear separation between observation and action. […] In that sense, the challenge is less about “trusting the agents”, and more about building trust in the same guardrails we already apply to any production system.

    This might sound good to at first, but falls apart under the slightest scrutiny. There is a reason that companies don’t open their intranets to the public despite having fine-grained access controls. Or in other words, "I’m getting a lot of questions already answered by my ‘does not necessarily introduce an entire new class of risk’ T-shirt.

    Imagine being able to ask your Linux machine to troubleshoot a Wi-Fi connection issue, or to stand up an open source software forge that’s pre-configured, secured, and reachable over TLS.

    And right after arguing that LLMs are safe if you have a perfect permissions model, now he’s proposing letting one #yolo configure a git server or something? This is the sort of thing that could easily easily lead to random security issues.

    I suspect that “Troubleshoot a wi-fi connection issue” will work about as well as existing network troubleshooting wizards (e.g. terribly), and that we don’t actually need to reinvent the software wizard but less deterministic.

  • Sailor Sega Saturn@awful.systemstoTechTakes@awful.systems•Stubsack: weekly thread for sneers not worth an entire post, week ending 12th April 2026English
    14·
    4 months ago

    It’s bad for me too.

    I’m trying to hang in there until I get some healthcare stuff taken care of over the next year or two but it is getting increasingly difficult. Most of the the good people at my job have been driven out, quit, or been poached by other (AI) companies.

    By this point a majority of the programmers at my job (or at least the one’s most active on the mailing lists) are LLM true believers who think that the end times are near. My management chain has explicitly said that LLM programming is required, and that a subsequent increase in “productivity” is expected with it. My department got renamed to something with “AI” in the name. I constantly field questions from people who want me to read a screen full of LLM nonsense, or who push back when I tell them something claiming that the chatbot said differently.

    There’s always some frantic push to adopt “MCP” or “Skills” or whatever the next fad will be without any guidance as to how or why. If I ignore this I get nastygrams from my manager.

    And at my last doctor visit I had elevated blood pressure :)