Networks and low-level work

All topics

A seven-layer diagram makes far more sense once you see the actual packet crossing it. The same goes for a TLS handshake, or for the chip that holds your keys: the theory stands on its own, but the capture is what convinces. This work is done on my own traffic and my own hardware, not on textbook examples.

12 pieces

News2026-10-31«SMS of Death»: an invisible text message can knock your Android off calls, even emergency onesOn 29 October 2026 a flaw was disclosed, nicknamed «SMS of Death» (CVE-2026-58882) and rated critical by Google: a special text message that never shows up in your inbox and hides who sent it can knock the call service off Android phones running 12 to 17, drop calls in progress including emergency calls, and, with a handful of messages, leave the phone rebooting every minute and a half. Google fixed it in the October security update for Android 14 to 17; versions 12 and 13 will likely stay unpatched. Here: who is affected, how to check your patch level (I checked it on a real phone) and what to do if yours no longer gets updates.#Android#Security#SMSArticle2026-10-23Isolating a coding agent with gVisor or Kata: what it costs compared with Docker, measuredI measured what it costs to run a coding agent's work isolated in gVisor and in Kata Containers 4.3 (with QEMU and with Cloud Hypervisor) instead of a plain Docker container. Kata takes 6 to 7 s to start against 0.22 s for runc and leaves 199 to 302 MiB per container against 11.5; gVisor starts in 0.33 s, uses 48.6 MiB and ties with runc on a workload of thousands of small files.#Containers#Security#AgentsArticle2026-10-14Asterinas 0.19, the Linux-compatible kernel in Rust: I reran its benchmarks on my machine and 13 of 23 hold upAsterinas is a kernel written in Rust that runs Linux programs unchanged, and it publishes a nightly comparison against Linux. I reran 23 of those benchmarks with its own scripts, three times each, on a Ryzen 7 7800X3D. In 13 the result reproduces. Asterinas booted twice as fast and won on sysbench's thread latency; Linux won on the simple system calls, the file reads and writes and the nginx tests I measured, and on schbench with 8 CPUs. On fork the winner flips from what is published.#Rust#Linux#BenchmarksArticle2026-10-08The DNSSEC root changed its key on 11 October: what broke, hour by hour, and which environments already trust the new oneOn 11 October 2026 the DNS root started signing with KSK-2024. I watched ten resolvers every five minutes. For example.com, counting from the first round with the new key, Ubuntu 24.04's systemd-resolved started failing after 20 minutes, the unbounds holding only the old key between seven and a half and thirteen and a half hours later, Pi-hole v5 stayed up and Yandex stopped marking its answers as validated. Before the switch I measured which distros, Docker images, routers and resolvers already trust it.#DNS#DNSSEC#SecurityArticle2026-09-20Rust Coreutils 0.12 vs GNU 9.12: almost everything works the same, starting a process costs nearly three times more, and mv between disks loses the datesI measured Rust Coreutils (uutils) 0.12 against GNU coreutils 9.12 in containers with limits: the GNU test suite, 157 commands with their output compared, and process start-up. uutils is slower in 91 of 157 cells, takes 2.8 times longer to launch 5,000 processes, and mv across file systems loses the modification dates.#Rust#Coreutils#GNUArticle2026-09-13A chat on Amazon Bedrock AgentCore for my blog: I broke it with 64 messages and rebuilt it with rules outside the promptTutorial: LangGraph chat on Amazon Bedrock AgentCore with an S3 Knowledge Base and guardrails, tested on a 64-message chat. Costs and a local option.#AI#AWS#SecurityArticle2026-09-08I measured 320 Chilean sites: half already use post-quantum cryptography, and almost none of them chose toI probed the 320 most visited .cl domains: 145 negotiate X25519MLKEM768 (47.7%), but only 9 of the 128 with their own infrastructure. Measured cost: 0 ms.#Post-quantum cryptography#TLS#ChileArticle2026-09-07I built a fully post-quantum handshake, then went to see which of my servers could do itRustls turned ML-DSA certificates on by default, but only for private hierarchies. I built an mTLS where the key exchange, the server signature and the client identity are all post-quantum. I measured what the chain weighs, which version of each server supports it, and corrected a number I had got wrong: the private key is not nineteen times bigger, it is 128 bytes.#Post-quantum cryptography#TLS#mTLSArticle2026-08-26I built a public sandbox for Chile's Open Finance System, and Keycloak alone did not get thereChile has an open finance regulation and no public sandbox to test it against. I built a complete unofficial one, faithful to the Technical Annex: participant directory, bank, authorization server and requesting application, with mandatory PAR, an encrypted request object, mTLS and RAR reaching the token. Keycloak 26 covers much of it through configuration, but the consent model Chile picked does not exist in the product: it had to be written from scratch.#Seguridad#Arquitectura#ChileArticle2026-08-15The chip that guards your keys is broken: I audited all four machines in my swarmTwo flaws rated CVSS 8.5 and 8.3 in firmware TPM affect Ryzen 3000 through Ryzen 9000 and Intel up to Ultra 200. I checked my four machines: two are affected, one has had a patch since July and the other was abandoned by its vendor in 2022.#Security#Hardware#LinuxArticle2026-08-15PhantomRelay: why your automation gives itself away before the first HTTP byteA Node HTTP client is distinguishable from real Chrome in the TLS handshake, before sending a single header. How I built a browser relay with a Rust addon over BoringSSL, cost-based escalation and nearly 900 tests.#Systems#NetworksArticle2026-08-14The OSI model explained: the 7 layers and encapsulationWhat the OSI model is, what each of its 7 layers is for, and how a piece of data gets encapsulated into segments, packets, frames and bits as it travels across the network.#Networks#Low level

All writing