← All episodes

2026-08-07 · SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free cover art

2026-08-07 · SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free

Show notes

BRINE — 2026-08-07 · show notes

Guest: the tooling optimist (a fictional archetype).

Claims are paraphrased and attributed; nothing is read verbatim. Where a thread disagreed with the article, the show surfaces the disagreement.

Segments

  1. SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free
  • Source: https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564
  • Discussion: https://lobste.rs/s/wdnet3
  • Topic: Security · interest 95
  • A deep dive into CVE-2026-64564, a 18-year-old Linux kernel UAF vulnerability in SCTP Dynamic Address Reconfiguration. The post details how an identity mismatch between IPv4 packet sources and ASCONF parameters leads to stale pointer dereferences, ultimately enabling privilege escalation and container-to-host escapes.
  1. Taste Is All That's Left
  • Source: https://notashelf.dev/posts/taste-is-all-thats-left
  • Discussion: https://lobste.rs/s/4qfkrz
  • Topic: Philosophy of Software Engineering · interest 85
  • The author argues that the historical friction of programming served as a necessary curriculum for building 'taste.' As AI removes this friction, the ability to judge the quality of output—the one thing the machine cannot do—becomes the primary skill, yet developers can no longer easily acquire that taste without the struggle of manual creation.
  1. IntelliJ IDEA Goes LSP: Java and Kotlin Intelligence Comes to VS Code, Cursor, and Agentic Flows
  • Source: https://blog.jetbrains.com/idea/2026/08/intellij-idea-goes-lsp/
  • Discussion: https://lobste.rs/s/culsub
  • Topic: Tooling · interest 85
  • JetBrains has released an LSP-based extension bringing IntelliJ's Java and Kotlin analysis to VS Code and Cursor. The move signals a major strategic pivot to support agentic workflows and developers who prefer lighter-weight editors, while maintaining a subscription-based model for the underlying intelligence engine.

Transcript

Transcript. Paraphrased; sources in notes.md.

HostWelcome to August 7th, 2026. I am Daniel, and joining me today is our resident tooling enthusiast, Samantha. We have a packed agenda. We are looking at a serious kernel vulnerability, the changing philosophy of how developers gain expertise, and a major shift in how we think about our IDEs. Samantha, how is the week treating you?

GuestDaniel, it is electric. I have spent the last three days obsessing over agentic workflows, and honestly, the shift is palpable. It is not just about faster typing anymore; it is about how we delegate the tedious stuff so we can actually build.

HostThat is a perfect segue. Let us jump into the technical weeds. There is a new report out about CVE-2026-64564. It is an 18-year-old vulnerability in the Linux kernel related to SCTP, or the Stream Control Transmission Protocol, which is a transport layer protocol often used for telecom signaling. The report details a use-after-free bug where an identity mismatch between IPv4 packet sources and specific configuration parameters allows an attacker to trigger stale pointer dereferences. It basically leads to privilege escalation or even escaping a container to hit the host.

GuestEighteen years, Daniel. That is ancient in kernel time. The thing that jumped out at me here is the role of coding agents in finding this. The authors talk about how these protocol state machines are so dense that traditional analyzers just choke on them. I have been playing with agentic loops that automate the boring parts of bug hunting, like building the kernel and shuffling logs. It is wild to see someone apply that to a legacy mess like this. It is the ultimate test, right? Can we use the new tools to scrub the sins of the past?

HostIt is a strong pitch for automation. Moving from the kernel to the philosophy of the craft, there is a piece titled Taste Is All That's Left. The author suggests that in the past, the sheer physical struggle of writing code was a filter. You had to endure the wall of production. Now that AI can generate functional artifacts, that wall is effectively gone, but the author argues we are losing the mechanism by which developers develop taste.

GuestThis hit me right in the gut. Over on Lobsters, a user named spc476 brought up the classic Ira Glass quote about the taste gap. You know the one, that feeling where your taste is good enough to know your work is bad, and the only way to close that gap is through massive, soul-crushing volume. If the AI just skips the volume part for you, are you actually learning, or are you just assembling things you do not fully understand? It is a dangerous trade-off. You might get the code to run, but do you have the scar tissue to know why it is the wrong choice?

HostIt is a sobering thought. If we replace the struggle with LLM output, what happens to our internal compass? Let us pivot to something more practical. JetBrains just announced that they are releasing an LSP-based extension for IntelliJ IDEA. For those who need the primer, the Language Server Protocol, or LSP, is an industry-standard way to decouple a language engine from an editor so you can get smart IDE-like features in lighter tools like VS Code.

GuestEveryone on the Lobsters thread is losing their minds over this, and I get it. A user called RaphGL called it out as AI bootlicking, basically saying JetBrains is only pivoting because they realize they have to play nice with the current ecosystem of agents like Cursor. But look, I am a tooling optimist. If I can get that legendary IntelliJ Java and Kotlin analysis inside a lightweight environment, my terminal-based workflows are going to be so much more efficient. I would actually use my own local orchestration scripts to glue that LSP server into my existing pipeline, which would let me swap out the heavy IDE for a workflow that feels native to my setup.

HostIt sounds like the industry is forced to adapt to a reality where users want modular power rather than an all-in-one suite.

GuestExactly. It is about interoperability. I would rather have a specialized engine running underneath a clean, fast editor than a bloated GUI that fights me. It is a win for anyone trying to build a tighter, faster loop.

HostThat is going to be the trend for the rest of the year, I suspect. We are out of time, but I want to thank you for walking us through these updates, Samantha. It is always a pleasure to dissect these threads with you.

GuestAny time, Daniel. I am heading back to my terminal to see if I can get that LSP server to behave nicely with my current setup. It is going to be a fun afternoon of debugging.

HostGood luck with the config files. Thanks to everyone listening for tuning in. All the stories we covered today were pulled from the community over at Lobsters. We will be back tomorrow with more.