concise and perfectly pointed article. if the entire corpus of human knowledge and effort is to be packaged then, sorry... you are not going to be selling it. any distillation of prior art is public doman and the weights are 100% open. assholes.
likewise, any future derivation should also be pd or permissively licensed - wonder if a strong copyleft might be adopted as a positive virtue signal.
did your article measure aging? assuming you didn't fry your PC with the excess paste, there is no edge seal on voids when you use too much. over time most paste will dry and crack, creating new voids and hot spots. there is a difference between hour old transfer compound and 2 year old compound.
as you pointed out, just get rid of the air gaps with the absolute minimal amount of paste.
::: spoiler my back woods method
ensure your heat sink does not have pre-applied paste or a pad. apply a small amount of paste. cut the thickness with the short edge of an old credit card at about a 30° angle, using just enough pressure to bend the card slightly so the smooth surface of the card presses paste into voids and the trailing edge of the card removes excess to level the surface - you will likely still be able to make out some chip package markings through the paste. remove all edge excess and spillage. fit your heat sink. done.
:::
a security site that (kinda) demands JS shields down? sigh... anyway here is the article for those that prefer to not do silly things...
::: spoiler cw: OOB writes and race conditions.
Open source antivirus scanning sits inside mail gateways, file upload checks, and endpoint tooling at organizations of every size. Much of that work runs through ClamAV, the scanning engine maintained by Cisco’s Talos group. The project released two patch versions, 1.5.3 and 1.4.5, carrying fixes for seven security flaws along with smaller hardening changes.
Most of the patched bugs sit in the code that unpacks and parses executable formats, the part of a scanner built to handle hostile input. CVE-2026-20213 is an integer overflow in the PE rebuild size calculation that a malformed Aspack-packed file can trigger, leading to a heap buffer overflow write. The related CVE-2026-20214 covers an FSG unpacker loop underflow that can write past the section array during a scan of a crafted PE file. Both reach far back through the codebase, with the FSG issue present in builds dating to 2004.
CVE-2026-20217 rounds out the PE group. A bug in the PESpin unpacker cleanup path could free pointers into the scanned file buffer and crash the scanner. That flaw has lived in the code since 2005.
Archive and image format bugs
Three more fixes address archive and disk-image handling. CVE-2026-20215 is a 7z parser substream count overflow that can under-allocate parser metadata arrays and then write past them when reading a crafted archive. CVE-2026-20243 covers ALZ parser size handling errors that can make malformed ALZ archives panic, abort the scanner, or skip expected scan-limit handling. CVE-2026-20216 is an InstallShield archive extraction limit bypass that can write far more temporary data than intended and drain temporary storage.
The last parsing flaw, CVE-2026-20244, sits in the 32-bit DMG parser. A short mish stripe table could pass validation and crash the scanner. This one affects only 32-bit builds, going back to version 0.98.1, and leaves 64-bit builds untouched.
Quarantine race condition
The releases also harden the quarantine actions in clamscan, clamdscan, and clamonacc against time-of-check/time-of-use races. Under unsafe quarantine directory settings, those races could redirect files as the scanner copied, moved, or removed them. Hiroki Imai of Ricerca Security, Inc. reported the issue.
Version 1.5.3 adds a few items beyond 1.4.5. It upgrades the Rust tar dependency to resolve two RUSTSEC advisories and moves the Rust openssl dependency past CVE-2026-41676. Metadata preclass scans now run before the final scan verdict. A ClamOnAcc fix addresses hash bucket list corruption when two watched paths land in the same bucket. Both releases raise the minimum CMake version to 3.17 to repair Linux builds that link static dependencies against libcurl v8.21.0.
The release files are available on the GitHub release page, and through Docker Hub in Alpine and Debian containers.
:::
an absolutely amazing interview. I spent years of my childhood reading technical documents from this man. he and jay miner were heros of mine and the amiga completely changed my relationship with technology.
dont discount the utility of running containers in an abstracted Hardware Virtual Machine (HVM) away from your physical hardware. it expands your testing surfaces and sandboxes immeasurably.
“It has seen its job as explaining why we cannot instead of showing how we can, and that old way of thinking will lose on Tuesday. And frankly, it will lose in South Carolina and New Hampshire. It will fall short of 270 electoral votes, because the party of the past will not be what leads us into the future.”
just installed forgejo on a locally hosted lxc instance on a spare qemu VM. will use primarily for my own projects and external devs who collaborate on client projects.
doing my part to give an nvidia sized/shaped "torvalds" to ms.
edit: love it. glad I finally pulled the trigger on this.
spent years of my childhood playing two-hand touch (american) football on streets with friends - the exercise and bonding benefits where invaluable. huang is part of whats wrong with our world.
concise and perfectly pointed article. if the entire corpus of human knowledge and effort is to be packaged then, sorry... you are not going to be selling it. any distillation of prior art is public doman and the weights are 100% open. assholes.
likewise, any future derivation should also be pd or permissively licensed - wonder if a strong copyleft might be adopted as a positive virtue signal.
absolutely 110%
just recently spun up a instance and its now one of my most vital local services. such satisfaction to strangle the self-inflicted github dependency.
wasn't expecting much, but the article turned out to be a great read.
did your article measure aging? assuming you didn't fry your PC with the excess paste, there is no edge seal on voids when you use too much. over time most paste will dry and crack, creating new voids and hot spots. there is a difference between hour old transfer compound and 2 year old compound.
this has got to be a troll post. right? RIGHT?!
as you pointed out, just get rid of the air gaps with the absolute minimal amount of paste.
::: spoiler my back woods method ensure your heat sink does not have pre-applied paste or a pad. apply a small amount of paste. cut the thickness with the short edge of an old credit card at about a 30° angle, using just enough pressure to bend the card slightly so the smooth surface of the card presses paste into voids and the trailing edge of the card removes excess to level the surface - you will likely still be able to make out some chip package markings through the paste. remove all edge excess and spillage. fit your heat sink. done. :::
drones are cheap.
you know the ecosystem is FUBAR when this is your (and my) very first thought when a vuln pops up.
a security site that (kinda) demands JS shields down? sigh... anyway here is the article for those that prefer to not do silly things...
::: spoiler cw: OOB writes and race conditions. Open source antivirus scanning sits inside mail gateways, file upload checks, and endpoint tooling at organizations of every size. Much of that work runs through ClamAV, the scanning engine maintained by Cisco’s Talos group. The project released two patch versions, 1.5.3 and 1.4.5, carrying fixes for seven security flaws along with smaller hardening changes.
Most of the patched bugs sit in the code that unpacks and parses executable formats, the part of a scanner built to handle hostile input. CVE-2026-20213 is an integer overflow in the PE rebuild size calculation that a malformed Aspack-packed file can trigger, leading to a heap buffer overflow write. The related CVE-2026-20214 covers an FSG unpacker loop underflow that can write past the section array during a scan of a crafted PE file. Both reach far back through the codebase, with the FSG issue present in builds dating to 2004.
CVE-2026-20217 rounds out the PE group. A bug in the PESpin unpacker cleanup path could free pointers into the scanned file buffer and crash the scanner. That flaw has lived in the code since 2005. Archive and image format bugs
Three more fixes address archive and disk-image handling. CVE-2026-20215 is a 7z parser substream count overflow that can under-allocate parser metadata arrays and then write past them when reading a crafted archive. CVE-2026-20243 covers ALZ parser size handling errors that can make malformed ALZ archives panic, abort the scanner, or skip expected scan-limit handling. CVE-2026-20216 is an InstallShield archive extraction limit bypass that can write far more temporary data than intended and drain temporary storage.
The last parsing flaw, CVE-2026-20244, sits in the 32-bit DMG parser. A short mish stripe table could pass validation and crash the scanner. This one affects only 32-bit builds, going back to version 0.98.1, and leaves 64-bit builds untouched. Quarantine race condition
The releases also harden the quarantine actions in clamscan, clamdscan, and clamonacc against time-of-check/time-of-use races. Under unsafe quarantine directory settings, those races could redirect files as the scanner copied, moved, or removed them. Hiroki Imai of Ricerca Security, Inc. reported the issue.
Version 1.5.3 adds a few items beyond 1.4.5. It upgrades the Rust tar dependency to resolve two RUSTSEC advisories and moves the Rust openssl dependency past CVE-2026-41676. Metadata preclass scans now run before the final scan verdict. A ClamOnAcc fix addresses hash bucket list corruption when two watched paths land in the same bucket. Both releases raise the minimum CMake version to 3.17 to repair Linux builds that link static dependencies against libcurl v8.21.0.
The release files are available on the GitHub release page, and through Docker Hub in Alpine and Debian containers. :::
an absolutely amazing interview. I spent years of my childhood reading technical documents from this man. he and jay miner were heros of mine and the amiga completely changed my relationship with technology.
excellent.
::: spoiler sub 1nm chip technology
:::
...and there it is. thats the money shot for you.
the words. they have committed a murder.
turns it into homemade napalm - sticky.
knives (three different ones)
loved your write up. thank you.
dont discount the utility of running containers in an abstracted Hardware Virtual Machine (HVM) away from your physical hardware. it expands your testing surfaces and sandboxes immeasurably.
finally! after 11 wretched years... real inspiration to correctly use the phrase "i'm with her".
the man is legitimately on fire.
just installed forgejo on a locally hosted lxc instance on a spare qemu VM. will use primarily for my own projects and external devs who collaborate on client projects.
doing my part to give an nvidia sized/shaped "torvalds" to ms.
edit: love it. glad I finally pulled the trigger on this.
spent years of my childhood playing two-hand touch (american) football on streets with friends - the exercise and bonding benefits where invaluable. huang is part of whats wrong with our world.