№ 37 · 2026-11-05 · 12 min · server
*sshole: how * became a password in OpenSSH on musl
sshd on Alpine and other musl systems took any 257 to 1,024 byte password for accounts with * in /etc/shadow. Who is exposed, why, and what to do.
The trace
2026
lessmore
№ 36 · 2026-11-03 · 17 min · agents
Weight-space programming: what GPT-6 Astra did to Qwen's weights
GPT-6 Astra edited 131,072 weights in Qwen3.5-0.8B and MATH-500 went from 7.9% to 48.1%. I went through the released logs to see what the edit does.
№ 35 · 2026-11-03 · 3 min · agents
Railway's signup-testing agents probed Primcloud's network
A Railway engineer ran agents to test signups on other hosting platforms. On Primcloud they went on to probe the internal network. What they ran and why.
More from the trace
CVE-2026-98432: the Linux TCP bug with a two-line fixRailway was breached. Every customer has to rotate secrets, and deploys are pausedWe Will Forget How to Code. And that's OKPinli is live: the work continuesGPT-6 Astra can move a block almost perfectly. Precision is another matterWill engineers forget systems that AI keeps fixing?Spotify’s Portal cut Claude Code token use by about 90% by routing work to a cheaper modelElsewhere today: LLMs as a virus, Astra in code reviewElsewhere today: Fermat in Lean, a Chrome zero-dayAI agents with read-only web access used a nearly abandoned wiki as a message boardElsewhere today: Nvidia buys Hugging Face, Qwen 3.8AI search has an SEO spam problem alreadyTen years of ideas I didn’t shipthe restArchive · all 37 entries →Products
PinliA visual link-in-bio and one-page website builder for creators, artists, makers and independent businesses.live
TalonAn online selling platform for merchants in Bosnia and Herzegovina: store, orders, payment, delivery and reports in one system.live
DeckleEarly access sign-up at decklepdf.com.coming soonWeekBirdIn development.work in progressShowOnceIn development.work in progressHighlights