Egregoros

Current status.

If you rely on Bitwarden, they've changed leadership and are now on the PE extract-and-exit track. Start working on your backup/exit strategy as soon as you reasonably can.

https://blog.ppb1701.com/the-quiet-renovation-at-bitwarden

Oh, lovely. FYI copy.fail, dirty frag and so forth are a class of bugs now, and the newest member of that class is called "fragnesia".

https://github.com/v12-security/pocs/tree/main/fragnesia

Patches have to be applied manually, I don't think anything is upstream yet. Patch details are here:

https://lists.openwall.net/netdev/2026/05/13/79

For the next few months I think we have to assume that userland security barriers don't exist. Once somebody's got a shell it's over. Once somebody has physical access it's over.

@freddy I feel like we're going to have to revisit the fundamentals at some point here. Like, now that we know the germ theory of disease is real how could we be doing the whole surgery thing differently.

@freddy The thing about our guy here is…. As ridiculous as it he looked, everything there is there with a reason, _and mostly, kinda, worked_. Those lenses meant to ward off the “evil eye”, that beak full of potpourri to protect you from the “mal aria”, it also kept people from coughing on your face. Those waxed robes kept bodily fluids off you. This whole thing is a hazmat suit for a demon-haunted world, where we have some learned practice but no grounding theory. This is infosec right now.

It's kind of amazing how many veteran Linux greyhairs I've seen, downstream of the age-check-in-systemd decision, saying well I guess I need to get comfortable with a BSD now. Thirty plus years of deep-grooved Debian/RedHat muscle memory to a one, quietly tidying up and looking for the exits.

A picture of Margaret Hamilton, programmer for the Apollo space program, standing next to not one single microsoft error message or bluetooth problem.

@feld "they deserved it" is a childish, bullshit response to systemic problems.

Links:

https://grith.ai/blog/clinejection-when-your-ai-tool-installs-another

https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7

The more you look at it the worse it gets.

https://github.com/systemd/systemd/pull/40954

Just absolutely no regard for security at all. None. The entire burden of self-protection shifted to humans alone at their endpoints in systems and communities entirely, foundationally built on mutual trust and trustworthiness.

We should start a rumour that the real reason Gallup isn't doing presidential approval ratings anymore is that Trump's approval ratings have gone negative and a codebase full of unsigned integers is too expensive to fix.