Pesky's links

[link] Glacier mice

Sun, 08 Nov 2026 12:19:09 +0000

Glacier mice are a groups of mosses found on some glaciers and surrounding regions, they're able to retain heat and moisture providing an environment for "microorganisms that otherwise could not live on a glacier". One of the most intersting things about them, to me, is that they move very slowly as a herd.

I can't help but think they look like Tribbles.

I discovered them through Hacker News.

[link] More than voting - Demystifying democracy

Sun, 08 Nov 2026 12:13:42 +0000

This zine quite cleverly describes democratic process, and outcomes through three examples. It also highlights the importance of deliberation and the inclusion of experts in the process and access to information.

[link] A tricky problem I had to be thoughtful about.

Sun, 08 Nov 2026 11:58:01 +0000

As phones get larger, reaching the top parts of the screen gets much harder. My one regret with my current phone is that it's too large, I wish I'd prioritised having a smaller screen more, but for the price, camera and battery performance, this was the best I was able to do. Marcin Wichary writes that the iOS browser Quiche Browser handles this by letting users adjust how far up the screen they want UI elements to sit in "Comfort Mode".

When laying out the icons on my home screen, I do something similar. The weather and time widgets go at the top since I rarely have to interact with them, and the most frequently used apps go at the bottom right so I can easily reach them with my thumb.

[link] Keolis zet oude dieseltrein DM '90 tijdelijk in op Valleilijn

Fri, 30 Oct 2026 19:44:12 +0000

There have been some rumours floating around but it's finally official! MD Rail's DM '90 will be used on the Valleilijn starting Monday. This diesel train type was built in the 90s and was in service until 2017. It will one again be used to move passengers while covering for the modernization of the Protos train sets, which is delayed.

[link] Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot

Thu, 22 Oct 2026 20:08:43 +0000

Oh boy.

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.

[link] eMudhra to Exit global SSL/TLS Certificate Business

Thu, 22 Oct 2026 19:12:35 +0000

eMudhra in all their wisdom has come up with the worst press release.

Due to increasing data sovereignty & compliance requirements, complexity and cost associated with this business is increasing over the years. This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI of this line of business also has considerably reduced for eMudhra when measured against our cumulative revenue base.

They aren't leaving because they're incompetent, it's just not good business. Also don't bully them online:

the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business.

Reading the whole thing is a good laugh.

[link] Today's PHP Security Release, and How We're Strengthening PHP Security

Thu, 22 Oct 2026 18:35:32 +0000

The PHP foundation's write-up if the two critical vulnerabilities that allowed for remote code execution. That cover the work that went into discovering it, external AI-assisted audits, and shortcomings.

The shortcoming included problems with resolving a known OOM issue that was later find to be more serious. They have outlined changes made with how security is handled moving forward. There were also issues with disclosure of the vulnerabilities by vendors. Rumours of the vulnerabilities started to circulate, security research firm, Calif, accidentally released a video of the exploit, and Chainguard broke the embargo by publishing a patch early. Yikes.

Now that the patches are officially out: - Calif released their detailed write-up with a teaser of php3shell, whatever that means. - Calif used GPT Sol so OpenAI had their moment. - Wiz having also discovered this vulnerability around the same time as Calif released their write-up. - Their discovery was powered by Gemini Argon and it is now Google's turn to bask in the sun. - Lobste.rs user, Yogurt, linked to the code change that fixes these vulnerabilities. It's large! - This entire ordeal was messy, ShellSharks gathers somes observations of their own.

[link] Laatste Plan V-treinstel nu echt met pensioen

Wed, 21 Oct 2026 18:40:56 +0000

The last Plan V goes back to retirement today. 🫡

Number 904, owned by the 2454 Crew, was brought back into commercial passenger service on the Kippenljn by Keolis as their fleet went under modernisation. The Plan V remained in service a bit longer than expected but it's going back into retirement today.

[link] Upgrade your PHP installs immediately to protect against php2shell

Wed, 21 Oct 2026 18:27:03 +0000

Between the eMudhra certificate compromise and two critical PHP vulnerabilities it's been a hectic day and probably will be until the weekend. While I haven't been too affected I'm glad I run a simple home lab so there's both much to worry about there.

Don't have much else to say but I wanted to note this down somewhere and Jeff Geerling's post resonated.

[link] Minder treinen rond Utrecht door afscheidsborrel verkeersleiders

Sun, 18 Oct 2026 13:02:15 +0000

Fewer trains between Utrecht Centraal and Gouda, Amersfoort Centraal and Bodegraven, among other places, last Friday evening because of a shortage of traffic controllers. This is because of the autumn break, sick employees and a farewell drink for two departing employees!