incertia

Zola 0.23.6

2026-11-01T00:00:00+00:00

The website has been upgraded to Zola 0.23.6. That being said, all that really had to be done was to set the ZOLA_VERSION environment variable to 0.23.6 inside the Cloudflare Pages settings page. This upgrade removed shortcodes in favor of components and I upgraded the previous pages as well, so everything should still theoretically work as expected. There were also a few config migrations needed for my theme but those were all fairly easy to make as well.

I'm not sure when I plan on writing some actual content, but one can hope that something exciting will appear in the near future.

Security Panic Retrospective

2026-10-30T00:00:00+00:00

Setting the stage

October 21, 2026 was surely a day to remember in the cybersecurity space. We start the day before (the 20th) with someone disclosing that the private key for one of eMudhra's signing keys is 4. Yep, you read that right, just 4. Now, this wouldn't be so bad if eMudhra was some nobody, but it turns out that they chain to several roots that are trusted by your standard trust stores, Microsoft, Apple, Mozilla, Google, etc, and therefore by many other downstream trust stores. We are still not quite sure how they were able to become an intermediary CA with such poor cryptography but what's done is done. You can check to see if you are still vulnerable by visiting eMudhra we have a problem. As a consequence of this disclosure, a lot of people, including me, found out how everybody likes to vendor their own root stores, so making sure that all devices and other services were updated was a lot more annoying.

The downside is that these certificates are still likely buried in the root stores for a bunch of IoT devices. Luckily for us, the attack surface for these devices is not large. There is not much reason for an off the shelf router to visit a random webpage and trust any of their certificates, and proper mTLS implementations should be checking for a signature from a specific certificate, but it does feel kind of bad. Especially in the case of old medical equipment, which may have to send data to a web service. However, such an attack would likely require prior compromise on the local network or be the result of a larger network infrastructure attack, both of which have more severe consequences to worry about.

In the end, though, eMudhra is now no longer an intermediate CA and has stepped away from the certificate business.

Data breaches and other vulnerabilities

We were also notified of large number of data breaches on the same day, several of which demonstrate somewhat concerning behavior. Railway was breached, and all users are recommended to rotate secrets. For some reason, they decided that sitting on this information was the best course of action. Apparently NCC Group sat on a year old audit report for TiDB and it also got breached a month later.

LiteLLM suffered another supply chain attack and a malicious version was published featuring a credential stealer. Gitlab released a patch for an RCE. NodeJS also had its own RCE.

PHP

And thus we are at the elephant in the room. Two separate but related bugs lead to essentially zero click RCE on any PHP server. You can read the detailed writeup by Calif here. This is definitely a huge bug. PHP powers over half of the web. Wordpress, Laravel, MediaWiki, etc, all run on some form of PHP. We should certainly sound the alarms for a MUST UPDATE TODAY announcement. However, the news surrounding this bug seems to have been fear mongered into oblivion. Several cybersecurity posers who have never exploited a single live memory corruption vuln have told me that this has the security community quaking in their boots. In reality, nobody is really panicking. We go to our software distributor and we download the newest version of PHP, and we systemctl restart php-fpm.service. At the end of the day, all the "public" PoC scripts were mostly LLM slop and none of them work against a vanilla PHP installation. In fact, many of the public PoCs also require additional vulnerabilities coexisting on the PHP server, such as local file inclusion, which is roughly synonymous with cat /etc/passwd levels of damage. So in that sense, maybe it is not as easily exploitable as the true "we're fucked" vulnerabilities of times past, i.e.

Log4Shell, by setting User-Agent: ${jdni:ldap:}
Heartbleed, by setting Content-Length: 99999999
Rails YAML, by sending any POST body with some bad YAML
EternalBlue, resulting in the 2017 ransomware apocalypse

There are probably a lot reasons this particular RCE has gotten the press that it has gotten, mostly in part due to

The prevalence of LLMs. A lot of people now believe they are experts in fields they really are not.
We like to clown on PHP.
Some PHP team member said this was cataclysmic.
The looming AI apocalypse.

But the reality of the situation is that the exploit is not so easy. It took over 19 hours for an attacker to exploit a public challenge for $2000 in BTC, several days after the vulnerability was disclosed. It's not like threat actors are suddenly going to switch their MO to exploiting a specific PHP vuln when it is not their specialty. @MalwareTechBlog explains it best.

Anyone claiming they were "easily" able to generate a working php2shell exploit with AI is either:

a) a world-class exploit developer with an extreme case of imposter syndrome.

b) currently looking at some very confident-sounding but wrong LLM output.

And that is with AI assistance. There are certainly live and working exploits, but these are in the hands of very skilled exploit developers. Given how finnicky this exploit seems to be in practice, it is certainly not as world ending as it may have initially seemed.

Funnily enough, patching your system to protect against the eMudhra certificate issue (affects everyone) likely takes more effort than upgrading PHP (only affects PHP server owners). Of course, this is not to downplay how severe the vulnerability actually is. It exists, is exploitable, and results in a RCE under a lot of conditions. However, on the scale of meh to we're fucked, perhaps this time the exploitability of php2shell was vastly overstated.

Personal upgrades

As a result of these vulnerabilities, I begrudgingly updated many personal services. My mail server was running an old version of dovecot, as version 2.4 introduced breaking config changes that I never bothered migrating last year. Therefore, upgrading PHP meant also upgrading dovecot since Archlinux is a rolling release distribution.

My home router is a pfSense installation. It was running 2.4.5-RELEASE and at some point I had tried doing a manual upgrade and broke my pkg-static binary, in the sense that the new binary that I had was not for FreeBSD 11.3, and thus had broken syscalls. This was back in 2024. Fast forward to 2026, and my router is still chugging along on 2.4.5. The entire pfSense web configurator runs on PHP, and there's a near zero-click PHP RCE going around. Granted, the web configurator was only accessible on an internal subnet, but this finally prompted me to perform the upgrade. I don't know why the new installation process uses this crazy store download product, so what I did was download a 2.7.2 ISO from a mirror, backed up my config.xml, and went to town. I reinstalled pfSense, which only took like 5 minutes after booting into the USB image, spent another 5 figuring out how to mount a USB drive and manually restore the old config because I could not access the web configurator, and then 2 more system upgrades to 2.8.1 and 2.9.0. Luckily, the system upgrades were fast, and took around 7-8 minutes each on a gigabit connection.

As a side effect of upgrading my pfSense, though, I could no longer host my Unifi controller software on the machine. Ubiquiti somehow decided that they would release an all-in one software for all their products that only runs on Windows, Linux, or macOS. Luckily, I was prepared and exported by network config, reset my UAP-AC-Lite, imported the old config into the new software on a different machine, readopted my AP, and reprovisioned the networks. I then discovered the next day that my Elgato light no longer wanted to connect to the network it used to be set up with so I had to reset that as well. So I guess I am in the market for a more sane managed access point when I decide to upgrade.

Fraudulent Educational Streamers

2026-07-18T00:00:00+00:00

Introduction

I really didn't want to make this post, but recently I've been tuning into more and more "educational" streams and have gotten incredibly tilted for one reason or another. I've done some thinking and I've come to the conclusion that the reason I am so upset is because it usually boils down to some sort of fraudulent representation of credentials to some degree.

Background

To some extent it all started back in Hololive and Kureiji Ollie. It is directly quoted in the wiki that

She has hosted math streams in which she discussed university-level topics such as polynomial division, differential equations, and proving that .

Somewhat surprisingly, Indonesia's standard math curriculum is about as backwards as the USA's, but perhaps the only truly university level topics would be derivatives (not differential equations), and the proof that . Polynomial division is taught at an Introductory Algebra II level across many countries, and many countries offer Calculus I as a high school class. So at best, she is just regurgitating some first year undergraduate mathematics to the viewers. Additionally, her "proof" of only summarizes the general idea in Volume I of PM. It contains none of the meat, i.e. what , , or a successor function is. It is in fact, somewhat trivial, to show that , given a theory of natural numbers.

While I think it is admirable that she is bringing attention to mathematics to the general population, I don't think the entire act of putting these accomplishments (mostly equivalent to having a basic education in any country) on a pedestal is correct. Regardless, I don't actually have any problems with Ollie herself, and the fraud is limited to the fraudulent elevation by her audience. It just serves as some random starting point for my rant.

The Present Past

Fast forward to a few months ago, 4-5 years into the future. Streaming has exploded in popularity and there are educational streams aplenty (ok not really, but it is nice to see them here and there). We are fresh off the drama of Areayo being a fraudulent 25 year old MIT PhD graduate, and I catch an educational math stream out of the corner of my eye. Someone is helping high school students with homework problems! This vaguely catches my interest, and we are off to a good start.

Ok maybe I don't quite agree with the curriculum being taught but it is what it is and the streamer seems to be doing a somewhat decent job. Not bad! Then we arrive at the following problem.

What is even going on here? The streamer is applying rotation matrices to the points and trying to solve a nasty series of quadratics. If we use some geometry, we can recall that the area of this triangle is one half base times height, and because it is an isosceles right triangle, if we let the base be AB, the answer is just the square of the height to AB. Then a careful application of the point line distance formula yields

so our final answer is just its square, . Streamer has just wasted over an hour on what should be a 5-minute problem at the maximum. In fact, when confronted about the point line distance formula, the streamer had never heard of it and was convinced their method, which never finished solving the problem, was superior. If our supposed educators are unable to teach students the most effective ways of solving tedious homework problems, what hope do we have left in education? If we are going to be a good educator, we should at least be humbled when we learn something new, and aim to apply it in the future, especially if it saves time.

This time, although streamer is bringing attention to mathematics, I am very displeased with their methods. The sort of fraudulent behavior where you insist your methods are superior and insist on remaining uneducated is not the look I think educational streamers should mold themselves after.

Present Day

We are now going to veer off topic into the land of programming and computer science, and present what I consider to be the most egregious example. Enter a new streamer, whose qualifications are as follows:

Occupation: Programmer
Years of experience: 10
Stream goals: educational web development, beginner programming tutorials and leetcode

If we were to judge books by their cover, this actually sounds quite good. Prospective students can learn programming topics and solve example problems with presumably a senior developer and gain real world insight into the software industry. However, we are once again very quickly disappointed.

The setting is LeetCode 1089: Duplicate Zeros. Your goal is as follows. Given an array of integers, for every 0 you encounter left to right, modify the array by inserting another 0 and shifting everything over to the right, while keeping the array size fixed. i.e. [1, 0, 2, 0, 3, 4, 5] -> [1, 0, 0, 2, 0, 0, 3] and [1, 0, 2] -> [1, 0, 0]. The goal is to perform this transformation in-place. Streamer says they want to start off with the naive forwards approach. That sounds perfectly reasonable. Then we get the first red flag. Their algorithm, which is summarized by shift all remaining elements then write, runs in ? Surely a senior developer easily computes sized loop inside sized loop is , right? Then the second red flag appears. I suggest writing the output array backwards. This is the optimal solution, as you only need to write elements that are shifted multiple times once into their final position, but it takes them multiple minutes to understand this seemingly trivial strategy of going through an array backwards. This starts setting off every alarm bell possible in my head.

Fast forward a couple of weeks, and they try to implement a singly linked list interface, but as a challenge from their usual language, TypeScript, they decide to do so in C. This is perhaps the most damning evidence. During the implementation process, we learn that in their ten years of programming, they have never heard of the term heap allocation nor the function malloc. Now that, is incredibly surprising, as being in the industry for ten years means they graduated university around 2015-2016. I guess React did start getting super popular back then but supposedly if you studied coding at all in any university during that time period you would have been exposed to at least one of C or C++ and at least heard of manual memory management, right? We can also spy on their initial stream, where streamer struggles to distinguish the behaviors of ++i and i++ in native TypeScript. It also takes them a minute to recall how [...Array(n)].map iterates over its indices.

Overall, this has the makings of someone who understands TypeScript code but has not spent any significant amount of time doing any sort of algorithms. I guess 10 years of programming is technically correct but my guess is that it is more specifically 10 years of UI component programming, and they are completely new to any sort of standard computer science knowledge or algorithm type programming at all.

Were my expectations too high? The vibe definitely feels more like the streams titled "grinding leetcode", "leetcode practice", or "learning ts by doing leetcode", and not "streamer teaches you typescript". What really threw me over the edge was their OffKai handout resembling a midterm and one of the questions was to evaluate a JSFuck expression, which nobody in their right mind would do. I'm going to be completely honest. I don't think this stream has any capability of teaching besides the viewer learning alongside the streamer, and that goes completely against what I think the stream is trying to present itself as.

Conclusion

In the end, this is just me ranting about what I observe as "the current state of online education content". Of course, there are always better resources, and I don't exactly have any power to police streams, but the overall direction of everything just feels wrong to me. There are more and more AI slop videos re-explaining the same topics over and over again. Actually good educational content is still coming mostly in the form of YouTube videos but those are few and far between. How does all this relate to the literacy crisis as education becomes more and more online? Is this just a stepping stone towards the ideal state or are we slipping off of an unstable equilibrium? Who knows? What I know for certain is that I am not a fan of the current state of things.

Initial Post

2026-07-10T00:00:00+00:00

Welcome

I guess this is the official welcome to the new blog. The font is URW Classico, which is a free alternative to TeX Gyre Pagella in a sans serif style. Research has shown that sans-serif styles are easier to read than than serif styles, although I still heavily prefer using serif for math printouts. Hopefully I am able to adjust to sans-serif without too much difficulty.

Motivation

They say that writing is good for the soul, and I might as well put any mathematical/cryptography ramblings on the internet for public consumption. Hopefully I do not make too many mistakes, as that would be slightly embarassing.

Math

Speaking of math, hopefully your browser is able to display mathematics. I will be using two types. Inline mathematics, much like the name, is displayed inline, such as: Let $\mathds{N} = \mathds{Z}_{0}^+$ denote the set of natural numbers. Display math, on the other hand, should be centered. For example, here is Hölder's inequality:

\[ \left(\sum_{i = 1}^n a_i\right)^p \left(\sum_{i = 1}^n b_i\right)^q \geq \left(\sum_{i = 1}^n \sqrt[p + q]{a_i^p b_i^q}\right)^{p + q}. \]

Since the source file is in markdown, I must be careful as the writer to write \\[ and \\] so that the backslash is properly escaped into the rendered HTML, but that is not a huge deal.

We can also prerender SVG files to display them.

With some Zola shortcode magic which is soon to be unsupported once CF pages upgrades to 0.23, we are able to inline our SVG with currentColor paths, so any default black text is automatically converted to our theme's text color, which is cool. There should be a dark/light toggle somewhere on the page. Try it out!

We can also try to prerender SVG files for inline math. Let denote the set of natural numbers. This has the unfortunate characteristic of not playing nice with long lines. For example, with MathJax, let $\mathds{N} = \mathds{Z}_{0}^+$ will automatically wrap to the next line. However, if we try something similar with an SVG, let , the entire SVG will overflow to the next line. I think it is fairly obvious to the viewer that part of the SVG could have been split like the MathJax rendering.

It is probably up to my sanity whether or not future posts will use MathJax or full inline SVGs, but it may be the case where the initial post is written with MathJax and the final product is converted into inline SVG to ensure the font issue discussed in the next paragraph does not manifest.

We set up the math to use TeX Gyre Pagella fonts though, so that they have slightly more visual impact. The blackboard font is from the dsfont set, which unfortunately bolds the wrong side of the blackboard double stroke compared to pazo, so you may catch these inconsistencies when moving between MathJax and pre-rendered SVGs. In fact, they are on full display two paragraphs ago! Additionally, pazo and px blackboard fonts look very similar, but px's Z is left bolded while the rest of the characters are right bolded. The Y also looks a bit odd to me, so we use pazo instead.

About

This new site should also contain an about me page, which should consist of a short bio and some other reference links.