2026-06-08 · To my students

Transcript

Transcript. Paraphrased; sources in notes.md.

HostWelcome to the podcast. It is June 8th, 2026, and today we are digging into some fascinating, and frankly, a bit unsettling corners of the tech world. We have a professor’s open letter on ethics, a deep dive into sandboxing, and a new HTTP/2 exploit that is making the rounds. Alex, I see you have your gear laid out already. You look ready for a siege.

GuestSiege is the default state, Daniel. I saw the topic on the HTTP/2 bomb and my pulse didn't even skip. It is just another Tuesday in the graveyard of network protocols. You assume the pipe is poisoned, you assume the parser is malicious, and you sleep like a baby. Or, you know, you don't sleep, because the log files are screaming.

HostI think that is a perfect segue. Let us start with something a bit more philosophical. Over on Lobsters, there is a discussion about an open letter written by a computer science professor, Brent Yorgey, to his students. He is basically lamenting the state of the industry, pointing out how hard it is to maintain moral boundaries when the industry is chasing short-term profit, training models on biased data, and building surveillance tools. He is worried we are teaching students to build tools that exploit people.

GuestIt is a valid scream into the void. The problem is, ethics is often a luxury item in the current job market. One Lobsters user, harrigan, nails it. You can talk about moral boundaries all day, but when you are staring down student loans, your ethical compass starts to look a lot like a suggestion rather than a rule. It is easy to preach from a tenured position.

HostThat is exactly what one commenter named mccd brought up. They mentioned that even when people intend to only stay at an ethically gray company for a year, the systemic pressure and the paycheck make it incredibly hard to leave. They actually struck a deal with themselves to quit after two years no matter what, just to keep their sanity.

GuestThat is the only way to play it. You have to treat your own career like a compromised container. If you stay in the environment too long, you are going to pick up the malware. You have to purge and redeploy somewhere else on a schedule.

HostMoving from ethics to architecture, let us talk about sandboxing. There is a project called Kefka, which is a Go-native shell sandbox that helps run untrusted code by mapping commands to specific Go implementations. Kefka, for the record, is a tool that acts like an operating system's sandbox, isolating potentially dangerous processes so they cannot wreck the host system.

GuestNow, this I like. The author, Xe Iaso, is playing the game correctly. The article is a long, winding look at how hard it is to actually pin down what an operating system even is. But the takeaway is the execution. A Lobsters user named Cloudef brought up the real tragedy here: the lack of standardized, performant ways to reject syscalls across different platforms.

HostCloudef noted that while they wish other operating systems acted like OpenBSD, they are struggling to find a reliable way to block syscalls on macOS or Windows.

GuestBecause Apple is effectively allergic to the idea of you actually owning your own hardware's security boundary. A user named viraptor put it well, pointing out that Apple is outright hostile to third-party sandboxing. When the OS vendor considers your attempt to secure your own code as a threat to their walled garden, you know you are fighting a losing battle. I actually keep a small library of these syscall-blocking hacks on my internal drive. When I am testing a new dependency, I drop it into a restrictive container and watch it try to phone home. The silence when it fails to call out? That is the best sound in the world.

HostLet us finish up with the HTTP/2 bomb. This exploit, discovered by Codex, is a denial-of-service attack that targets the default configurations of major servers like Nginx, Apache, and IIS. Essentially, it uses a compression bomb technique to balloon header allocations and a flow-control hold to keep the server hogging that memory.

GuestAnd they managed to make a home computer with a standard connection take down enterprise-grade servers in seconds. It is classic protocol abuse. The headers are supposed to be compressed, so the attacker sends a tiny frame that expands into a massive memory allocation on the server side. It is brilliant, and by brilliant, I mean it is a total nightmare.

HostThe thread on Lobsters is pretty heated, not about the exploit itself, but about the attribution. A commenter noted that they are uncomfortable with crediting an AI tool for the discovery, arguing that it leans a bit too much into marketing-speak. They would prefer the human researcher, Quang Luong, get the spotlight, rather than the proprietary LLM.

GuestI am with them. If I find a buffer overflow, I do not credit my keyboard, and I certainly do not credit the compiler. Another user made a great point about the difference between tools like Valgrind or AFL, which are honest, open-source workhorses, and these opaque corporate AI boxes. We should be cheering for the tools that give us visibility, not the ones that just act as a black-box marketing layer for a hyperscaler.

HostIt is a fair point. If we are going to automate discovery, we at least need to know when the tool is hallucinating a vulnerability versus finding a real one.

GuestExactly. If the tool is just guessing, it is not helping. But hey, I have a feeling HAProxy is probably going to be the only one laughing here. They have a history of surviving these protocol-level meltdowns.

HostWell, on that note, we should probably let you get back to auditing your own supply chain, Alex. I have a feeling you will be spending the rest of the afternoon staring at firewall logs.

GuestYou know me too well, Daniel. I am actually going to go see if I can find a way to verify the checksums of my coffee maker’s firmware. It has been acting suspicious lately.

HostThat sounds like a long weekend. Thanks for sitting down with me, Alex. And thank you to everyone for listening. All of today’s stories and the lively debates behind them were sourced from the community over at Lobsters. We will be back tomorrow, so keep your headers small and your sandbox tight. See you then.