Nicolas Seriot

Just got two Apple CVEs (minor bugs). Short write-ups and PoCs: - CVE-2026-112554 IOStorageFamily - kernel memory disclosure and panic seriot.ch/security/ios... - CVE-2026-112554 Quick Look - file names leak seriot.ch/security/qui...

C'est quand même bigrement commode de la part de la police française d'être tellement incompétente quand il s'agit d'assurer la liberté de manifester sans casseurs qu'ils sont obligés d'interdire les manifestations dont les revendications les embêtent. Bigrement commode.

Thank you for the live feed 😄 here are the slides seriot.ch/computation/...

This is very cool but I predict it will not stop the conspiracy theories www.anthropic.com/research/ecd...

This is wild - somebody did a deep dive into the real stories behind this famous XKCD: sheets.works/data-viz/hol...

New article! ncurses terminfo can simulate a two-counter Minsky machine, making repeated parameter expansion computationally universal seriot.ch/computation/... demo: a parasitic Fibonacci computation inside /usr/bin/top

That's clearer with a diagram. Give this post a heart if you'd like more of "anatomy of a bug" soon!

☠️ support.apple.com/en-us/149226

New "anatomy of a bug" write-up: why CFXMLParser crashes on a 7-byte input? seriot.ch/security/cfx...

New short write-up! For years, four Mach calls could reboot macOS and iOS devices because two lines in XNU were in the wrong order. seriot.ch/security/ipc...

What if Jira, Unicode, basic text utilities or even a printer can compute far beyond their intended role? At hack_lu 2026, I'll present UNINTENDED COMPUTATIONS: from unexpected computers to a security methodology for finding hidden execution surfaces. 2026.hack.lu/agenda/

QuickGPX: macOS QuickLook plugin for GPX files. seriot.ch/misc/quickgpx/

Paged Out! #9 features two or my articles: 🧩 Computiles: 10 tiles, designed with my son Émilien, that enforce binary arithmetic through geometry. 💻 An Unexpected Computer: universal computation from echo, ed, test and exec. Free PDF: pagedout.institute @pagedout.bsky.social

I built Cartopolis. Today's Switzerland rendered as 1999-style GIFs. seriot.ch/cartopolis/ No filters. Client-side rasterization from vector packs. Fully static architecture. seriot.ch/drawing/cart... Bake your own region using github.com/nst/Cartopolis @openstreetmap.bsky.social

"Finis tes pesticides sinon la FNSEA sera très en colère !"

I've been wondering for a while if anything in Unicode could accidentally compute. I've just shown that @unicode.org UTS#35 transliteration rules are universal, computing Collatz with just 3 rewrite rules running on stock ICU, shipped with every major OS. seriot.ch/computation/...

@atlassian.bsky.social Jira is actually Turing-complete, after all. I've built the proof the folklore was missing. seriot.ch/computation/...

RFC Esolang is a new programming language, in which the specification document IS the source code. esolangs.org/wiki/RFCEsol... Requirement levels like MUST, SHOULD, and MAY act as control flow. Executing RFC 9379 outputs the powers of two. Pre-existing RFCs form the standard library.

I’ve updated ScreenTime: seriot.ch/screentime/ It’s a tiny macOS utility that creates a movie from automated screenshots. Let me know whether it works for you.

Paged Out! #8 is out! pagedout.institute @pagedout.bsky.social In "An AWKward Modem" (p. 28), I show how to write a tiny modem in 5 lines of AWK and shift it into the near-ultrasonic range. 🔊

Thank you for nominating my Print to Play article :) I also completely agree with you about the LNK talk at Black Alps.

My colleague Marc-Olivier Fleury wrote an article about how we are guiding the transition of Swissquote's software architecture to Self-Contained Systems using Fitness Functions at scale: medium.com/swissquote-e...

Acompanhe já a live, rolando palestra do @mauricioszabo.bsky.social agora e teremos ainda muito mais depois! www.youtube.com/watch?v=bO4B...

GAMBICONF 2025 ESTÁ EM PRODUÇÃO!!!

PostScript Brainfuck interpreter down from 6 lines to 5 :-) github.com/nst/bfps Did I mention how much I love PostScript?

Paged Out!, a free mag of one-page reads on programming and hacking, has just release its #7 issue. Learn how to install a Tic-Tac-Toe game on your printer by copy-pasting a few lines of PostScript from my “Print to Play” article (page 38). #hacking #printers #programming #postscript

Lecornu démission !

Fake Mac Apps on GitHub: mjtsai.com/blog/2025/09... #mjtsaiblog

Good news about the cutting-edge AI tools from the $3-trillion-dollar company.

Curious about passkeys? I created a quick PoC with Claude seriot.ch/pk/pk.php Then I sniffed the network with Charles and documented the protocol informally seriot.ch/pk/202508_pa... I also identified a few security smells.

Swissquote has launched official support for GrapheneOS for their main app instead of it only being available for Yuh: play.google.com/store/apps/d... > What’s new > - We now officially support GrapheneOS! > - Bug fixes and minor improvements They're verifying GrapheneOS via hardware attestation.

Convert several JPG files into one PDF file with magick *.jpg x.pdf I wish I had known that earlier! quickies.seriot.ch?id=631

Mon talk à @lu.voxxeddays.com sur la programmation en langage PostScript est disponible sur YouTube en français www.youtube.com/watch?v=2ree... Au menu: - histoire, principes et environnement - jeux sur imprimante et dans GhostScript - code golfing, sécurité Merci à @zepag.fr et toute l'équipe!

Can't wait to present in Brazil 🇧🇷 and meet crazy, like-minded artists, developers and hackers 😃

The fastest way to detect a vowel in a string austinhenley.com/blog/vowels....

Love this. In his “I Agree” installation Dima Yarovinsky-Yahel took the content from terms of service statements for companies like Facebook, Snapchat, Instagram, Tinder and printed them out on A4 paper with a standard font size for legal contracts to demonstrate the length of these agreements.