Lost Archives, Risky BMCs, and Solar Quantum Leaps | Tech News of the Week

Ned Bellavance (00:03)
I am going to single handedly cure insomnia this year. You're welcome.

Chris Hayner (00:09)
I mean I'm rooting for you. I'm not gonna subscribe to your channel, of course, but I'm rooting for you.

Ned Bellavance (00:14)
That's fine, it's not gonna be on the channel. You have to pay for this privilege. It's gonna be on plural site.

Chris Hayner (00:18)
well then I'll definitely check it out.

Ned Bellavance (00:23)
You know, you're a great friend. I say that all the time. Deep

Chris Hayner (00:27)
Ha ha.

Ned Bellavance (00:28)
love in my heart.

Hello, alleged human, and welcome to the Chaos Lever Podcast, Tech News of the Week edition. My name is Ned, and I'm definitely not a robot. I'm a real human person with hair and eyes and dilithium crystals. With me is Chris, who is also here. Hi, Chris.

Chris Hayner (00:51)
Did we ever even

discover what dilithium crystals were, like as a thing?

Ned Bellavance (00:56)
They're crystals made from dilithium. Duh.

Chris Hayner (01:00)
God, I really do feel pretty stupid sometimes.

Ned Bellavance (01:03)
You take two lithiums, you put them together, and you stack

them as a crystal. That's where the dye comes from. Jeez. Get

Chris Hayner (01:10)
Two

great lithiums that lithium great together? I don't think that no, that doesn't work.

Ned Bellavance (01:17)
No, no, I guess we'll have to workshop it. Let's talk about some other tech garbage.

Chris Hayner (01:24)
St. Louis PBS station, at least temporarily, loses access to fifty terabytes of archival footage. So PBS, you might have heard of it. It's not a monolith. They actually have a lot of local stations running across the country. Each one is pretty much independently owned and operated and is responsible for, among other things, their own infrastructure. This, unfortunately, for the station in question, includes

Backup and archiving.

Ned Bellavance (01:55)
Mm.

Chris Hayner (01:57)
This station, known as nine PBS, has been working with a cloud storage vendor called Open Source Storage. Not a great name right off the bat, but they had been storing their backups and archived data there and only there since 2019. The cloud is of course perfect and will never fail, right? Well

About that. Long story short, open source storage went through a whole bunch of what we're just gonna call corporate fuckery and basically stopped existing.

Ned Bellavance (02:36)
that seems bad.

Chris Hayner (02:39)
so does this mean 9PBS is completely shit out of luck and will never see their data again? Maybe. It turns out that the actual data and the actual servers existed and were stored at Iron Mountain, which as everyone knows is a mountain made of iron.

Ned Bellavance (02:56)
Mm-hmm.

Chris Hayner (02:57)
And even though a court ruled that 9 PBS has rights to its own data, Iron Mountain has thus refused to hand said data over so far because

claiming that is still owned by OSS. OSS, which, as we just discussed, doesn't seem to exist anymore. So now nine PBS, who has already said they would pay reasonable costs to get back their own data, which a court says they are legally entitled to, has to sue Iron Mountain. Because America, I guess. One can only hope that this goes through the courts faster than Iron Mountain's

Auto delete processes goes through delinquent accounts. I'm sure they have such a thing. and maybe, just maybe nine PBS needs to run a story about the three two one backup strategy that has been known by that name since 2005, and known in concept since at least the nineteen seventies. So the lesson this week, as always, the cloud is fine. But the cloud is still just somebody else's computer.

Somebody else's hard drive and hard drives like companies, like managing partners, like your faith in humanity, can and will disappear. So if you care about your data, back it up, then back it up somewhere else, and then back that up too.

Ned Bellavance (04:24)
AI model roundup. This may be the first in an ongoing series of Tech News of the Week entries. There are entirely too many new models dropping on a weekly basis for me to recover them all effectively. So I thought I'd put all of the AI related news in a single item and summarize.

I think I did alright. First, a new release from the worst of all AI companies, XAI, which I think is now SpaceX AI. Somehow they made it worse. They announced Grok 4.6 with input pricing starting at $2 per million tokens. Don't use Grok. I don't care if it's any good or has passed a bunch of

Benchmarks with flying colors, Grok, XAI, and Musk all suck monkey balls.

Chris Hayner (05:32)
That's a technical term.

Ned Bellavance (05:33)
Indeed. I refuse to even add a link to this story. If you want to spend your money wisely, give it to Cards Against Humanities Design Committee for the Elon Musk is a sad little bitch with no friends monument. It's the best $10 you'll spend all year, and I will put a link to that.

Moving on to other terrible humans, Zuckerberg's Meta released a new open weight model called Muse Glimmer. The model is a distillation of their Muse Spark model, and it received post-training to fine-tune it for agentic work. Glimmer is meant to be run on local hardware, albeit somewhat hefty local hardware, given its 30 billion parameters. Still,

If you have a GPU with 24 or 32 gigs of VRAM, you can comfortably run the 4-bit quantized version. The last bit of model news is the opposite of a release, in the sense that OpenAI is now saying they are reducing internal work on their next model called Astra. Apparently, the model is just too dangerous. Edging close to critical level cyber capabilities. And for reference.

The newest model, GPT 5.6 Soul, only made it to the high level for cyber capabilities. The key difference is that the critical level capabilities can, quote, identify and develop functional zero day activities in hardened real world critical systems without human involvement. End quote. Like I said last week, while this may all be true, it's also a way for open AI to stay in the AI headlines and make me rehash their bullshit here.

So I guess it's worked.

Chris Hayner (07:24)
The original never updated security nightmare on motherboard management components continue to be a problem.

We as IT people spend a significant amount of time on security. Securing users, securing the network, securing the applications that we allow to run on our devices. Okay, okay. Ideally we do all that. But you know who seems to be absolutely allergic to it? IoT device manufacturers, for one, looking at you, still hackable light bulbs. Light bulbs

Light bulbs.

Ned Bellavance (08:07)
You you can hack

Chris Hayner (08:09)
What was I talking about? I'm upset about light bulbs.

Ned Bellavance (08:12)
I don't know.

Chris Hayner (08:13)
motherboard manufacturers. So

Ned Bellavance (08:15)
yes, them too.

Chris Hayner (08:17)
like twenty years back, give or take, manufacturers decided it would be super helpful for IT admins to be able to log into the motherboard. These are BMCs or baseboard management controllers if you're nasty. And manufacturers argued that adding these BMCs to everything everywhere.

Would allow admins to manage computers even when a system as a whole was powered off. Now

Ned Bellavance (08:44)
Mm-hmm.

Chris Hayner (08:45)
this is not a terrible idea. Being able to power cycle a computer without having to be there in person made fixing something at 3 AM a lot more tolerable. That's just facts.

Ned Bellavance (08:58)
yeah.

Chris Hayner (08:59)
But something else the manufacturers brought to the table when they introduced BMCs was a complete disregard for the very concept of security.

Firmware security expert HD Moore of Run Zero presented at Black Hat this year. And although his talk wasn't titled BMC Security Has Always Been Shit, Why the Shit hasn't this shit been fixed yet? Pretty much should have been.

Ned Bellavance (09:24)
Mm.

Chris Hayner (09:24)
Now the actual title of the talk was Lights Out, BMCs are still broken and now we have the receipts, which is not as good as my idea, but I think still gets the point across.

In the session, Moore presented new research showing weaknesses that were identified as far back as 2013 in BMC hardware are still present.

But we do like to keep things fresh here. He also revealed more than a dozen new flaws affecting BMCs from all the major manufacturers. Moore's own summary doesn't pull punches, calling this quote, a pervasive, under monitored, underpatched, parallel attack service, unquote, and adding that the whole BMC ecosystem is, quote, well behind the curve in terms of code, quality, and architecture. Damn. While this alone is

was bad enough, he also showed that a ridiculous number of BMCs are open to the internet.

I just checked and BMC is not something that is on the okay to put this device on the open internet list. And just a quick reminder, if you needed a refresher, the it's okay to put this device on the open internet list contains NOTIN. Nothing should be on the open internet.

Ned Bellavance (10:44)
Your router. Maybe.

Chris Hayner (10:47)
Maybe. So if you insist on using BMC, and obviously we don't think you should, for dog's sake, at least keep it on a leash. See what I did there? It's

Ned Bellavance (11:00)
I do. Well done.

Chris Hayner (11:01)
a tightly controlled, difficult to access, private network.

Ned Bellavance (11:05)
Mm-hmm.

Chris Hayner (11:06)
Not next to the web server.

Ned Bellavance (11:09)
Probably not.

Chris Hayner (11:10)
Moore also released a simple open source scanner called OOB scan, which is intended to allow admins to scan entire fleets for accessible BMC weaknesses. So that's cool. He'd not just whining about a problem while simultaneously doing nothing to help. Because he knows full well that's my thing, dammit.

Ned Bellavance (11:30)
Indeed. There's a company called Oxide and they manufacture rack scale compute and they found that the BMC controller and software were so bad that they wrote their own when they were building the system boards.

Chris Hayner (11:47)
Amazing.

Ned Bellavance (11:47)
Yep.

Cisco scaring customers into upgrades. During the Q4 2026 Cisco earnings call, yes, it is August, and somehow also Q4, Chuck Robbins, the CEO, made casual mention of the Mythos effect on out-of-support hardware. He shared a story of an enterprise CEO he spoke to that was deeply worried about their out-of-support hardware.

Running inside the organization and was formulating a plan to retire and replace it all soon, due to the fact that Mythos is now a thing and it might easily crack into their systems. That's the mythos effect Chuck is referring to. It's the fact that Mythos and other similar models have vastly increased the pace at which vulnerabilities and exploits are being found for all kinds of devices, including and especially network gear.

Now, whether that story he told was true or apocryphal, I think you can guess. The thing about network gear is that it only tends to be replaced once it starts breaking. And that's especially true of campus gear that can operate for a decade or more, silently pushing packets with Naria blip. Those devices tend to be locked away in difficult to reach places and are costly and disruptive to replace, so why bother?

Even if your catalyst switch is 20 years old and way past the last day of service life, does it really matter? I mean, I guess it might if suddenly there's a vulnerability found that could let a hacker gain access to your whole core network. But really, what are the chances of that?

Will the threat of Mythos be enough for Cisco customers to leap into action, adding acceler adding an acceleration to what Cisco is calling a network supercycle? I don't have time to get into that. Will whole campus refreshes be undertaken out of security concerns? If we're all being honest here, I really doubt it. If you're the kind of organization that has let a significant portion of your network gear

Reach end of service life, are you really going to pay for a full refresh because Anthropic says their new model is super dangerous? You've already demonstrated that either A, you don't care about security, or B, you do, but can't afford the upgrade. So to Chuck Robbins, I say, simmer down. You've got plenty of money already.

Chris Hayner (14:24)
Scientists create entangled photon pairs utilizing sunlight instead of lasers.

Ned Bellavance (14:30)
Lasers is cool.

Chris Hayner (14:32)
I was gonna say, I know what you're thinking. Why? Everybody knows that lasers are awesome. And it's true. Lasers are awesome. Did you know laser is an what's the thing called where you make the letters into a word? An acronym?

Ned Bellavance (14:46)
Yes.

Chris Hayner (14:46)
Lasers are actually an acronym and it means awesome.

Ned Bellavance (14:51)
I'm certain that's true.

Chris Hayner (14:53)
Lasers are excellent at creating entangled photons. The light is clean from a single wavelength, you can control it completely turning it on and off at will, and if Brad down the hall doesn't turn his goddamn music down, you can accidentally cut him in half with it.

Ned Bellavance (15:09)
Accidentally.

Chris Hayner (15:11)
Things happen.

Sunlight has its advantages too though. First off, it's plentiful, it's free, and it does not require expensive equipment to create. If sunlight could be used to help create these entangled pairs, it would reduce our reliance on laser equipment. So scientists thought about this problem and decided to do something dramatic. They went outside. I know.

A team of researchers from the Max Planck Institute for the Science of Light based in Germany and from the University of Ottawa in Ottawa succeeded in generating pairs using sunlight. The light was collected using a giant Fresno lens focused using a custom built solar concentrator into quote a very thin optical fiber. Over three days of testing.

The team reported a ninety four percent fidelity to a perfect entangled state.

So yes, this does mean that the entanglements produced were not as good as laser driven sources, but the very fact that this is possible at all raises interesting future engineering questions. The team made it clear that this was a proof of principle and is working on ways to get even cleaner light from the sun, which should make better entangled pairs. This, they hope, will open quantum computing to previously unthought of solutions. The sun, as we have discussed, is

at least for the time being. A free resource. One example that they used was generating quantum encryption keys in satellites. That is one way to get around the whole, well, what if it's cloudy out argument?

There's no clouds in space, Ned.

Ned Bellavance (17:02)
Heard that. Except for Magellan clouds. Magellanic? Anyway,

speaking of space, Voyager 2 software upgrades are successful. At this moment, the Voyager 2 spacecraft, launched in 1977, is 13.3 billion miles away from Earth. It is one of two interstellar man made objects that have passed through the heliopause and into the interstellar winds.

Possibly the most amazing thing is that NASA continues to send and receive data with Voyager 2, albeit on a 20-hour delay. Or really a 40-hour delay if you want to send and receive a response. The continued operation of the probe is due to the Herculean efforts of engineers at NASA continually finding ways to eke out more power. To keep our interstellar traveler running until its 50th anniversary,

The team at the Jet Propulsion Lab have successfully updated Voyager 2's onboard software with a package they call the Big Bang. This is meant to solve two problems heat and power. Voyager 2's power comes from decaying plutonium in a radioisotope generator, which is awesome. Over time, that reaction has slowed, and Voyager loses about 4 watts of power each year.

The drop in power has led to several of the instruments on the probe to be being shut down to conserve what energy is left. At this point, there are only three functioning instruments on the craft, which led to another problem. Running the instruments generates heat, and that heat is required for the propellant lines to operate, which is how the antenna is aimed back at Earth. Big Bang turned off two dedicated heaters and a digital tape recorder.

Instead, opting to generate the heat through alternative means. Now, from what I can tell, they are switching devices on together instead of one at a time, which generates more heat while saving power, which allows the propellant lines to continue to operate. The software update was successfully pushed and installed on August 4th, and it should keep the Voyager 2 kicking for at least another year. Just amazing.

Chris Hayner (19:27)
I wonder if Voyager two is on the open internet?

Ned Bellavance (19:31)
I'm gonna go with no

Hey, thanks for listening or something. I guess you found it worthwhile enough if you made it all the way to the end. So congratulations to you, friend. You accomplished something today. Now you can go fire up Meta Glimmer and ask it why Grocs sucks so hard. You've earned it. You can find more about the show by visiting our LinkedIn page, just search Chaos Lever, or go to our website, chaoslever.com, where you'll find show notes, blog posts, and general tomfoolery. We'll be back next week to see what fresh hell is upon us. Ta-ta for now.