Neom is kinda like if the dude who only has a TV, a Playstation, and a recliner for furniture were tasked with designing a city.


Custom UI for Windows? Written in #RustLang??? github.com/eythaann/Seelen-UI


Getting pretty tired of Pocket. Considering either Linkwarden or Wallabag as a self-hosted alternative, but unsure which would be better. Things I'd like:

- Multi-user platform
- RSS feed publishing
- Reader View
- Notes/annotations

Anyone have any thoughts/preferences?


If you're willing to use a generative model for your article's illustration, why should I trust you didn't use one for your article's text?


nostr:npub1y73vysnzf05yr90zadgehvpuqmr9umxlqvsmmwxz75es4tpzzydql9kqds You betcha.

matrix.to/#/#taggartinstitute:taggart.social
matrix.to/#/#infoseclounge:infosec.exchange
matrix.to/#/#cybersecurity:matrix.org


nostr:npub18c7wjmr8txk9u3xzrxl5rsx8mpt4dr84nyluufn4qg4x9xnar52qller9d Yeah so for me, as a business owner and (gag) brand promoter, it's useful as hell. The insights I get about engagement are super valuable.

Not for nothing, but also pretty handy for OSINT work.


Super cool that paying for LinkedIn Premium means I now have an unavoidable AI suggestion box on every damn post.

Well, that's why we have uBlock Origin custom rules I guess.


Taggart :donor:

Displaced Philly boy. Threat hunter. Streamer. Educator. Dad. #infosec, #programming #rust, #python, #haskell, and #javascript. #opensource advocate. Cofounder of @thetaggartinstitute. Made wtfbins.wtf. Co-creator of github.com/mttaggart/OffensiveNotion. Not your bro. All opinions my own. #fedi22 #searchable


Saw this meme on Threads but felt it belonged here with us nerds.

Favorite spaceship! Reply with a GIF.

https://media.infosec.town/media/9afe11fc-af4a-44f0-b933-9b53b2fe3724.gif


Aaaand closed as not a bug. Welp.


LET'S GO PHILS


And back up!


Great timing for dying, Discord.


Hm. All's well now. As you were.


So Splunk let their download site cert expire.

https://media.infosec.town/media/30b5da60-21ba-4425-a05b-e989e23e4096.png


nostr:npub1uud3g5xn0hd07tezkvsuq6dy2wj0a4vy4400w70xzfghryfmqxzs0q4kdc It's so powerful


nostr:npub1x0dajq3q8m9dnvw2v3eygycc89tulqhe4ru80nu3ygdgvx83hxmqpasyar Masto wants to translate all my posts because Firefish hasn't set a language.


nostr:npub1cztuwcj8fkkd9pz4jp8qdsfyvemxutxdw27fut006agzcfs8n6xqadmzas That's a great term as well, yeah.


sed 's/soft skills/interpersonal skills/g'


nostr:npub1pdj9m9yfqfhsn2pz06rj7pmkz7fwtuawtdknvlkz94gj9grkzemsvjp8d3 nostr:npub1pdvvr0addxmc35crn9jh3e0smxsqmmkxkjqgkzhg5f66dxnny9lstdgqz2 Loved Artemis so much! Also, it was a great exercise in team building with students.

To some degree, Star Trek: Resurgence fits the Lower Decks bill: https://www.youtube.com/watch?v=N9riy3BhlkE


nostr:npub12gftys3mje738huhtw8n8lp3s7n3hqcecgtwwjr7nh0mftdevgzqnqfuvz The LA Times is nothing if not pro homeowner.


nostr:npub1serm3rpc95c2zcxgzv7pmu8stcknmgjwk05nljxcu3rmjgflke7sdu2lht What even is this

https://media.infosec.town/media/db80fa30-2623-409e-b7d0-a57d44bbe1ab.png


This is what happens when you don't give the design firm a clear brief.

https://news.patreon.com/articles/patreon-redesigned


nostr:npub1nu80zf8fqyrjqzraewdyasvr8x07qeayn2v6t2nnh6mxfnav98hsy9kavg nostr:npub17lgy0rj5a2nwpnyc4hup6ufpfz7wz6dzcgd3crm6fm2yd34dcz0qlk9uux That is demonstrably false. Here is my Firefish instancing using its proxy to request the page from TC, and the response. Now my instance is not hosted in the EU and the request is triggered client-side, but maybe that means the cookie issue is global! Let's see what happens when I cold request the page from a CLI tool that passes no cookies.

Ah ha, the page loads appropriately.

Sorry, this is not about cookies.

https://media.infosec.town/media/f09aadf7-f04e-47cc-96b7-c51dbc24f8a3.png

https://media.infosec.town/media/04c561fb-49ba-43e7-a883-0ca7f9a741f2.png

https://media.infosec.town/media/eceffdff-735d-4433-ad87-1769363a563d.png


nostr:npub1xm947t6redwsgzahq8pqljv9e4gcx5352r6z2m207jgza7ct266qzn26zl It is literally impossible for anyone but landlords to feel bad for this guy, who is sitting on some of the most absurdly expensive real estate on earth and actively contributing to the lack of housing in LA County.

#OccupyAllTheADUs


nostr:npub1ex328w5w0hjweznw8t6f9epk5w5xy4ak6kzyc7y93lfjtelxuymsk9c58j nostr:npub1nu968lpe4mqdkjzurvz00e70yfdyqypay2q2xrr2ae9h4eljxcjqykl6r5 As an Angeleno, I am actively looking for luxurious ADU short-term rentals to become my forever home.


nostr:npub17lgy0rj5a2nwpnyc4hup6ufpfz7wz6dzcgd3crm6fm2yd34dcz0qlk9uux I asked about this some time ago, and apparently it has to do with how they handle the Masto User-Agent. It gets routed to the Terms of Service page instead of the article itself.


nostr:npub1x0dajq3q8m9dnvw2v3eygycc89tulqhe4ru80nu3ygdgvx83hxmqpasyar The problem is that it is hard and very few are good at it. And also, "good" can be technology-specific.


Oh, you thought one cloud of sky-obscuring satellites was bad? Well, now the plutes are competing there too. https://www.newscientist.com/article/2395991-amazon-is-launching-its-first-internet-satellites-to-rival-starlink


Python 3.12 is here! Lots of great improvements. https://docs.python.org/dev/whatsnew/3.12.html


nostr:npub19dcw0knrgdehpgmajm08hnwz73yu5j2xymu83yzprkselh00nplscw2uxg The T is actually for Tank and I love them.


Ah, FLARE-ON, the annual reminder of how much more there is to learn about #ReverseEngineering.


nostr:npub18s5f5czpjgu4egcngznjepysu6zt47xms7kzglk0rxfresj28w3qvg873w nostr:npub1hykucplphuhelaxutcw4jw3vuu7gcg42czhqmk7jhchs8vdga4fsj73p33

(looks at books on shelf)

They appear to be fine with the initial purchase I made.


11:18 WHAT THE HELL


Tired: "You're a very gifted student. This should be easy for you."
Wired: "Your brain works differently from a lot of other kids. That means you can do very well at some things, but struggle with others that seem easy for your peers. But it's okay! We'll learn how these work for you together."


nostr:npub1ja9xuu0z8lll7rqzh88fm0zj3936d8nkyajt2n5ggx7j4nt3eadqc5egyf Good news is the patch is available and on its way: https://sourceware.org/git/?p=glibc.git;a=commit;h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa

Already in Debian Sid.


nostr:npub1serm3rpc95c2zcxgzv7pmu8stcknmgjwk05nljxcu3rmjgflke7sdu2lht I have not


I just...

There's no way this is the prime timeline. I need that Sliders remote to shoop on outta here.

https://www.404media.co/bing-is-generating-images-of-spongebob-doing-9-11/


A note on fuzzing: although we discovered this buffer overflow manually, we later tried to fuzz the vulnerable function, parse_tunables(); both AFL++ and libFuzzer re-discovered this overflow in less than a second, when provided with a dictionary of tunables (which can be compiled by running "ld.so --list-tunables"But tell me again how it's fine that we keep using memory-unsafe languages.🙄

Full technical writeup: https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt


Don't feel left out, Linux! https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so#potential-impact-of-looney-tunables


Trash behavior from trash people. If you can't understand why there is a need for spaces that don't include you, why not simply leave them alone and not make things worse for everyone?

https://www.404media.co/grace-hopper-celebration-conference-anita-b-2023/


Couple days ago, I wrote that I have issues with the term "enshittification." Nothing against nostr:npub1hykucplphuhelaxutcw4jw3vuu7gcg42czhqmk7jhchs8vdga4fsj73p33, because I generally agree with the concept. But I try to be wary of buzzy language that feels too easy to describe phenomena.

This morning, it occurred to me that we already have a slightly-less-buzzy term to describe what is taking place:

Rent Seeking

The ghouls making the internet worse are simply standing in the way of you living your life and asking for more money for the same service. Why? Well because they can, and you don't have a choice.

But we know better, don't we? There's a choice.


nostr:npub1fq0gfrhyl3lk8z3vpxkupqu77andnsxt7rjvuhzl064vk0h0m65svx6t28 What is not clear is why Teams was not patched for 5217. This is a weirder vuln, regarding vp8 encoding, not decoding. Even so, I'd like an explanation as to why Teams is not vulnerable.


IT IS DONE.

The new Electron App Tracker is now tracking #CVE_2023_4863 and #CVE_2023_5217, and has the capability to track future vulnerabilities.

The code deeply scrapes repositories looking for package.json files, and we've already picked up some new patches!

Get the data here, in both CSV and JSON format for your convenience. https://github.com/mttaggart/electron-app-tracker


Microsoft says they've patched #Teams, among others, for #CVE_2023_4863 and #CVE_2023_5217, but that doesn't track with their published Update History. Or at least, it's unclear how the patch was applied. I guess not with a patched Electron version!

https://msrc.microsoft.com/blog/2023/10/microsofts-response-to-open-source-vulnerabilities-cve-2023-4863-and-cve-2023-5217/


Working on an update to the #CVE_2023_4863 tracker that

- Searches repo subdirs for package.json
- Automatically updates the CSV List
- Dates access for clarity
- Tracks #CVE_2023_5217 as well
- Creates both CSV and JSON

It's time to hold Electron apps accountable. The architecture of this will allow it to track further CVEs as appropriate.


Just used "Twister" to make the case for honeypots.

Go get the data you need. Put the sensors into the tornado.


nostr:npub1hz9nt3mh37pjqk3mtezhpaurzdtw00u7skwk62qrv9tgnkyaylgs9l6rsm nostr:npub1kj5fezkt4n4t0hvyxx07vhkeefsnty8hs9zxtd5lvufzlwr9drnqsq4vu8 Grep van Winkle returns to his slumber


nostr:npub1a8e7nzyyx7wvw5yyj0lgfyp92u6gcjw39nyvgd6agxydq2qhtpxqdtywga May I just add: use an adblocker everywhere

We're seeing so much malvertising and SEO poisoning-related stealer activity, it's essentially criminal negligence to not deploy browser-based ad blocking to your users at this point.


nostr:npub1kj5fezkt4n4t0hvyxx07vhkeefsnty8hs9zxtd5lvufzlwr9drnqsq4vu8 Oh no oh crap


Say it with me:

America

Hates

Kids

Almost every single policy decision made in the last fifty years has materially harmed children and made raising them safely and healthily in the United States more difficult.

As a corollary, America also hates schools and teachers, which is about to come home to roost.  The pay penalty for teachers—the gap between the weekly wages of teachers and college graduates working in other professions—grew to a record 26.4% in 2022, a significant increase from 6.1% in 1996. You can not fill schools with quality new teachers—teachers who likely went to grad school and have loans to pay off—at these rates. They'll have to find other work. Nor can you fill the classrooms with experienced teachers who know their worth and have to support families.

So American education is facing a looming crisis, and it isn't even in the top ten list of priorities of any policymaker. Now will it be, until suddenly massive school work stoppages impact the national economy.

https://www.epi.org/publication/teacher-pay-in-2022


Happy Monday! jq has a new home and a new release! https://github.com/jqlang/jq

Even some additions/changes to the language!


It's a long essay, so here's the relevant bit:Thus far, we've largely discussed the intentional application of LLMs and the potential outcomes. But the second-order effects of the technology are also cause for concern. What happens when language models begin training on their own output? I don't mean corrective training based on feedback on their responses; I mean as initial data. If the volume of synthetic language approaches what I fear it might, it's inevitable new models will be trained on massive amounts of the output of prior models. The snake shall eat its tail.

How many iterations of this training will it take before any trace of human intent or meaning is erased from LLM responses? When it happens, will we even be able to tell?

This is the moment I fear above all—when language, this human miracle, loses the ability to convey truth to anyone. Truth is inextricable from intent and meaning, but LLMs have neither. This argument I'm making may feel too nebulous for you. So is truth, if we're being honest. It's a gossamer thing, made largely of trust between two communicating parties. You watch what happens when amoral math problems do most of the talking for us. See how much we can believe what is before our eyes. A world awash in the language of LLMs is a hyperreal world, completely abstracted from original meanings.


It is all coming to pass, just as I have foreseen: https://taggart-tech.com/ai-llms/

RE: https://fedia.social/notes/9k8wbwdjnawy0860

nostr:note1uk4ttpkmremn8ey82zn0zlsr944my8jywnv3p4nchvtk4xz6mj6sfdzy79


A lot of folks seem confused about how this list was created. I tried to be maximally transparent on this account about my process (and got teased for my rapid prototyping Python for my troubles!).

Here's how the list of Electron apps was assembled.

Recognizing that the Wikipedia list that one security research firm was using was woefully incomplete, I went to the Electron Website to see what they had to say about it. 700+ apps were listed, which seemed like a good starting point.

Every app listing had a name of course, and if it was open source, a link to a repo. Since I was already there, I used a little JavaScript to slice the page and grab the app name and repo in a usable CSV format.

I then imported that list into Python for further work. Using requests, I attempted to locate a package.json in the root of each repo (I'm working on improving this process for common subdirs). If the file mentioned electron as a dependency, the version was extracted and assigned. The version was checked against our known-patched versions, and further evaluated.

What is not happening is me manually reviewing a couple hundred repositories, nor me installing 700+ electron apps to ascertain versions.

This list is best effort. It is by no means perfect. But I'm going to try to improve it some in the next day or so.


nostr:npub1hkl57kues9fpagyutlq0rr97ke63gmzs2cmaeeywnlgw4t5arl5qcsrgsc At the moment, the single biggest motivator for me to spin up a Matrix server.


Anyone else having trouble with Discord loading server content?


nostr:npub1n6kppu7w2nr5gm2c69xaxmue8h6jv8lscjv22vuxpcld7feyv9pszjj7h7 I don't believe so. I don't think Electron existed when Skype shipped.


nostr:npub1akz7ttaqv3y4m7eu3n56d8lcchpx0w5fa56nzf4vrshv5h8npnrs8qfcqj I'm kind of on both sides of this. I definitely default to sudo apt install, but I also see benefits to the containerizing and sandboxing of apps. What's important to keep in mind, I think, is that the isolation of these apps is, at best, a mitigation of the threat, not an elimination of it. And at worst, it provides a false sense of security about these app formats.


nostr:npub1akz7ttaqv3y4m7eu3n56d8lcchpx0w5fa56nzf4vrshv5h8npnrs8qfcqj And flatpak. As I said, nothing is safe.


One the one hand, I'll happily take a jab at snaps for enabling malicious activity while masquerading as a security barrier.

On the other hand, is there such a thing as a "good" cryptocurrency app?

Seriously though, no provider of software is immune to these supply issues.

https://www.omgubuntu.co.uk/2023/09/snap-store-uploads-restricted-following-possible-security-incident


What a week, huh?

Glad to have shared a bit of it with you fine folks as we keep up the good fight.


nostr:npub1t2wre5khx0p0t5m7r4tzml72ljpazmd74nyl2vfddsm0tet0m4ts32azxn I have not! Looks cool. Does it import Postman collections and/or OpenAPI specs?


If you, like me, often have to analyze WordPress attacks, this repo of known PHP web shells is a secret weapon: https://github.com/1337r0j4n/php-backdoors


nostr:npub1e7rqcsp5pypj3ac5wxnvgnwxmdl5the60wggwlqytaxm9kql0cdsp8uf8g nostr:npub1hcnwck8w0a6p4hfhng7vjfs78psfrkwpgjz3mzr387rm96ezp63qama3xv Understood! Apologies if I misunderstood. Although, that exact scenario has occurred more than few times for us.


Don't sleep on CVE-2023-40044.

#WS_FTP #CVE_2023_40044

https://media.infosec.town/media/766de1d2-20b0-4970-8a08-6c6d7b7c0c59.png


This document really is quite something. Coming from State, it appears to assert the US's position that China, not Russia, is our primary adversary in cyber operations. That may always have been true, but this is the most explicit statement of such that I've seen.

https://www.state.gov/gec-special-report-how-the-peoples-republic-of-china-seeks-to-reshape-the-global-information-environment/


nostr:npub1e7rqcsp5pypj3ac5wxnvgnwxmdl5the60wggwlqytaxm9kql0cdsp8uf8g We are not a city, but nostr:npub1hcnwck8w0a6p4hfhng7vjfs78psfrkwpgjz3mzr387rm96ezp63qama3xv maintains inclusivity and welcoming of all learners as a core value. I'm sure they could find a welcoming space with opportunities with us, if they like. https://discord.gg/taggartinstitute


I've updated the #CVE_2023_4863 Google Sheet to allow anyone to comment (gulp). That way, if you know of a version that is missing or has changed, you can take action!

https://docs.google.com/spreadsheets/d/1QLLFYCO0FMAu1ob6mnYCapW8dnx-HXunbf_zc9QLXlM/edit#gid=1774064991

Comments are of course also enabled on the Gist version:

https://gist.github.com/mttaggart/02ed50c03c8283f4c343c3032dd2e7ec


nostr:npub1uud3g5xn0hd07tezkvsuq6dy2wj0a4vy4400w70xzfghryfmqxzs0q4kdc You and me both, buddy.


Once again, this is the Fediverse. You aren't convincing anyone with your Firefox proselytizing. We already know, fam.


nostr:npub1c0cqqasj2rkpz9d4yha7t6jrfkh6gegvkz8geaftljndua6nm70qrgcyzj I don't think we can blame Chromium for this one, but I do think Electron is a bit of a crutch for devs these days.


nostr:npub1e5um568dd4l73t6sa7lpfmuqy06khctfznvwlv9hkq2v593uwa9sx09p24 Thank you, Jason!

This kind of took off in a way I did not expect. I may have to convert this to a Git repo for PRs.


Client appears back now.


So Discord is having a meltdown this morning.

In addition to earlier API trubz, now it appears that desktop clients are showing "blocked."

Updated desktop Electron app and Chromium browsers don't appear to work, but Firefox does.

Is this a weird #CVE_2023_4863 mitigation attempt?

https://media.infosec.town/media/f1a07cb2-f5aa-4724-bffa-2c72ed474a46.png


nostr:npub1az9lfgl6sjvya200fl45np42tcvf4c8ldnwy0jn279yhqzjr9mes3lswru Great work!


Kind of a fun discovery during this whole fiasco.

GitHub's API is limited to 10 requests/min. But depending on what you're after, web scraping can be really effective with GitHub! Check this out:

Visit any GitHub repo and choose a listed file. Right-click on the file and copy the link address.

The URI will have the format of /blob/<branchname>/file. And if you manually paste that address into a browser, GitHub loads it normally.

But if you run the same through cURL or another tool? You get raw JSON!

Within that JSON is a blob.rawLines key that will contain the raw text of the file!

All this to say for certain kinds of scraping, you can make regular HTTP requests to GitHub, rather than going through the rate-limited API.


nostr:npub1j60kkdphh79dshpzav9r0fur9vgy450mlhuneretv5zqcq5mnrsqrrmjct I block anyone who is complimentary of Richard Stallman. Works wonders.


Someone just suggested (I won't engage and amplify them) that rewriting software in memory-safe languages was pointless because "computers are inherently insecure."

It's been a minute since I've seen someone unironically trot out the old "imperfect solutions are not worth it," chestnut, so it's nice to know someone's keeping the classics alive.

Will rewriting all C code in Rust or another "safe" language solve 0-day vulnerabilities? Of course not. It won't even solve memory safety, due to plenty of edge cases.

But like...we don't have to lean into it by continuing to use languages which have shot us in the foot for decades, with no sign of us getting better at using them safely.


nostr:npub16m90c43jfx52ut8z45vy2rfu4x02jve7t6wrvtfkyqenpmp9facs5talct nostr:npub1hykucplphuhelaxutcw4jw3vuu7gcg42czhqmk7jhchs8vdga4fsj73p33 And as I was saying elsewhere, it feels accelerated in the last few months?


In addition to the Electron apps that use Chromium, the Chromium Embedded Framework enables apps to embed Chr.-based browsers in their apps. https://github.com/chromiumembedded/cef

And yes, it uses libwebp.


nostr:npub1ar95x5fn2c7f0m07jrg7mnv4rcgpxzhwcx0yh89ltdu9j8x69ylqt55q0l And is Fuchsia still happening or...?


If Google Classroom makes it to 2025, I will be gobsmacked.


nostr:npub1x0dajq3q8m9dnvw2v3eygycc89tulqhe4ru80nu3ygdgvx83hxmqpasyar Yep. I scooped 'em! https://killedbygoogle.com


Put it on the board, but not the Jamboard.

Another service down.

https://media.infosec.town/media/f844a1c7-6ada-40b5-9431-ea8712594985.png


nostr:npub1f30wgxvqc8rdepyytja3gatf3zugqd3prmag4hhg8jaul4s39txskdxs7u It does, but at least you can add E2EE to it


I believe we are witnessing the platform become an active, willful, and potent threat to fair elections.

RE: https://press.coop/users/WIRED/statuses/111144382249418776

nostr:note1ll88a4h98hdheqh22mc5c2v8h09qd4t5t8zrf8d3z4tlg4d8v9vqe73hlv


nostr:npub18vr6xq6hataxjv5au46nwa7m5nt29tjjtvgdvkrgjvdgg58v788qat3wc0 Well my data is already for sale, so I might as well be able to toss cars.


Relatively bummed that Insomnia moved to requiring an account to use its API testing suite. The fact that you didn't need to was a big reason I recommended it over Postman.


Is it just me, or has the last, like, quarter, felt like a really rapid increase in the pace of ruining the open web?*

* I don't like the e***********tion term, but that's what I mean


This cyberpunk dystopia bloooooows

https://www.404media.co/serve-food-delivery-robots-are-feeding-camera-footage-to-the-lapd-internal-emails-show/

We get the surveillance state, but I don't get cybernetic enhancements?!


nostr:npub19lyzdppahjwjwaucqj62uex0au59u7yw0yhpkexwcpx3azdy8vts6qk833 Well, buckle up, because I think libvpx (CVE-2023-5217) is about to make libwebp look like small potatoes in comparison.


nostr:npub19lyzdppahjwjwaucqj62uex0au59u7yw0yhpkexwcpx3azdy8vts6qk833 😭🙏


Here we go again: https://thehackernews.com/2023/09/update-chrome-now-google-releases-patch.html


nostr:npub19vvmyg9nvnj8htyc5t2d98mudeaqcramh0le7uq0na2qz2m9u7qqptdhxy Well, thoughtful developers seems to over it. Ask any 10 users and I think you'd find maybe one who grokked what was going on with their Slack/Discord/Teams apps.


As I journey through these code repos seeking vulnerable Electron versions, I have found that many apps listed on Electron's site as Electron apps are no longer.

It seems there is a growing trend to rewrite apps in other technologies. I'm seeing Qt; I'm seeing Tauri (!!); and I'm seeing simple webapps with ad-hoc servers.

We love to see it.


nostr:npub1grpgypd4npecdggg5jzggx3dygmz7crst0t73wfecqdtwmgvvxhsgf9uc0 It would be kind of annoying, but it's possible. Since YARA uses positive detections, and all but a few versions are vulnerable, you'd basically have to add every possible Electron version string except the patched ones.


nostr:npub17a0z0l7whzayvt6zz7egkes5vdnp4meuddt3ufew3hplzam8c6jsz2q5fl Very yes, if those versions are accurate!


nostr:npub17yp6975yw8wl8hpwr63wn5q3lqhnzd95py0hp9aj4dzp3sfhmwxsd3jsl4 This CVE has already been revoked in favor of its predecessor.


nostr:npub1hyp0snlqyw66uwuep7tnkwqhgpg7qspvf928v0mm8d9penuwee0srvaehm nostr:npub1udr6t3ma5srclvn2vm5gtpr7s6fvfkjx8pe7dy2hna76perpaqmqta8gc6 nostr:npub15rf5cq2fzh38f8pefkh99zyeu22xt6zww5lt3w57m5czsvm6pafskhkgj6 nostr:npub1regxy3tk0ry5u8pju0rmqcw73xd65n080mvcslnx33jtfn0gj36qhssat9 nostr:npub16m90c43jfx52ut8z45vy2rfu4x02jve7t6wrvtfkyqenpmp9facs5talct I didn't think 1Password wasn't patched. I wanted the Electron version. As for Signal, this is pulled from the package.json on their GitHub repo. https://github.com/signalapp/Signal-Desktop/blob/4d2910d696fc22fd74dd36c3fa3749fb855e184a/package.json#L272C3-L272C3


nostr:npub1lw6ga68ury5snt4egae767t74xkeyga89pf7xx3drtwkt60svmqs7mlt76 EXCUSE ME


nostr:npub13cc0d3r3nqgzapsw3sfrua58vmkzlqzjy0x4n29qcq6694u3q0vska8nxu It is, but originally 5129 was created as the more general CVE. But I guess NVD had a change of heart? ¯\_(ツ)_/¯


nostr:npub16m90c43jfx52ut8z45vy2rfu4x02jve7t6wrvtfkyqenpmp9facs5talct :blobsalute:


Wait what? Now it's not a valid CVE anymore?

#CVE_2023_5129

https://media.infosec.town/media/250ce0de-b070-4523-b429-cd61f1e5ec1d.png


nostr:npub1udr6t3ma5srclvn2vm5gtpr7s6fvfkjx8pe7dy2hna76perpaqmqta8gc6 Thanks! It was a very goofy creation process!


nostr:npub1x0dajq3q8m9dnvw2v3eygycc89tulqhe4ru80nu3ygdgvx83hxmqpasyar Go jump on a Codeberg


Update: There is now!

RE: https://infosec.town/notes/9k5swp89shc4t888

nostr:note1upxm3l637jjs6fp6v92w6hn56zcpguuuhah8mchpxlmmehq7mtuq7cr4z3


Okay, a continually-updated list of Electron apps and their Electron versions, and whether they're vulnerable to #CVE_2023_5129.

https://docs.google.com/spreadsheets/d/1QLLFYCO0FMAu1ob6mnYCapW8dnx-HXunbf_zc9QLXlM/edit?usp=sharing

And for those of you who refuse to click on Google links: https://gist.github.com/mttaggart/02ed50c03c8283f4c343c3032dd2e7ec


nostr:npub1hv0dzm5h640v02ydwaplmtmuq8p27jje3vn87w6rw7eshv4vqraqfjmrh9 Exactly!

For the longest time, I was afraid to share my work. I have gained the confidence to do so; I know I know how to write good Python, which is why I'm confident to show works-in-progress.

But yeah, code snobs have no place here.


It's extremely lame behavior to crap on people's prototype code as they're prototyping.

Yes, I know the code I just posted is messy. It's rapid prototyping.

I'm out here trying to solve a damn problem. I don't need to have the cleanest code to make this work.

Sorry, just so annoying to have randos decide they want to comment on code style instead of engage with the relevant issue.


nostr:npub1ngmj8c63x0hu3y4a00kv99z3kafeq537fxne4tx9cvg77sykgggs9xr3ya Don't do that. This is rapid prototyping. This isn't production; I'm trying to scrape the web quick and dirty, and it's working.


nostr:npub1ngmj8c63x0hu3y4a00kv99z3kafeq537fxne4tx9cvg77sykgggs9xr3ya ¯\_(ツ)_/¯


Let's goooo

https://media.infosec.town/media/b7a55bbb-59d3-4bb7-99bb-c1441b600bb6.png


This was always going to end in a Jupyter Notebook, wasn't it?


nostr:npub1avw0gt7853nmctzxa0rg884v4jnrgkeewren8ql32ltmswlddfgq3qn6va nostr:npub1hyp0snlqyw66uwuep7tnkwqhgpg7qspvf928v0mm8d9penuwee0srvaehm nostr:npub1wej9lp4m0xt8cavt678dkmrqeuqtyxxhtctcgxgs7ukn85lvvl3qvrcwd8 The version of Electron it's using is craaaazy old.


nostr:npub1wf44gvmu4g6x0gwwjgrnlw0f8dxmvx7h929k057wwv8hwa8clq6snr94wn

- Google allows criminals to exploit their ad platform
- Google actively works to bring about the end of effective ad blocking.
- ???? (AI makes malvertising even more effective)
- Profit! Off the backs of victims, but still!

Kinda seems to me like the Goog's incentives align with criminals, not users.


nostr:npub1pfev3tn7khfm8ptlvjw808kfp7wdz9qutjjnny7g879ag803qseqh2jtly Every case for dismantling copyright that I've ever seen require s a complete restructuring of the global economy to be beneficial.


COVID Booster updater: Welp, definitely effective! :blobfingerguns: 🫠


nostr:npub1ju25n9estvdsg7vrlg0f0petyqfrvud3lqgedu40h49xftjxsfcs7vt9ns That is good to hear! Although you may have a stronger constitution than I. Every one of these has resulted in a night of convulsive shivers for me.


nostr:npub1x0dajq3q8m9dnvw2v3eygycc89tulqhe4ru80nu3ygdgvx83hxmqpasyar I've done exclusively Moderna from the start.


Counterpoint. Things are looking great for the cyberpunk dystopia we all thought we wanted. Also, y'know, piracy.

RE: https://infosec.exchange/users/malwaretech/statuses/111129732627804494

nostr:note1luq880es6gu9q98y6l5x2gcephxqux2msu0530vsjzfze9h08twsn7dja6


Got my double-jab Flu/COVID. Can't wait to find out how hard this knocks me over this time, aww yiss.


nostr:npub15rf5cq2fzh38f8pefkh99zyeu22xt6zww5lt3w57m5czsvm6pafskhkgj6 Every web app and use case is so different, my best recommendation is to walk through a full CSP creation, using a tool like this as a guide: https://report-uri.com/home/generate

Start with aggressive defaults, then ease off as you find things that break your site, but choose secure alternatives. For example, use nonces or hashes for script-src.


For GPU.zip to work, a malicious page must be loaded into the Chrome or Edge browsers. Under-the-hood differences in the way Firefox and Safari work prevent the attack from succeeding when those browsers process an attack page. Another requirement is that the page linked to in the iframe must not be configured to deny being embedded by cross-origin websites.Almost every one of my web app engagements involves a deep discussion of appropriate Content-Security-Policy implementation. Here's another reason why.

https://arstechnica.com/security/2023/09/gpus-from-all-major-suppliers-are-vulnerable-to-new-pixel-stealing-attack/


nostr:npub17cvl3u92ss48egfhr9w73x50fp4rrwejf9vg28yychufc0sqr9eqmh9p2q nostr:npub1su4t3c2h2fl2ws6hfcnn5r7jdn87qvhvaafe5uv3hcwygxz3rjssf6a0dw nostr:npub1hyp0snlqyw66uwuep7tnkwqhgpg7qspvf928v0mm8d9penuwee0srvaehm Oh come on


nostr:npub1r3n08ljcwy5smnd8wvpl999ky4tyjnckplu492dl59egnpmr6m6svtqv63 nostr:npub14dl6rmty8l7rf0w6nrqczzx08cusx23sgda26jtdelfe3zct6r0sjfa40d Every day a new reason to love this app.


Aaand there it is: https://www.bleepingcomputer.com/news/security/google-assigns-new-maximum-rated-cve-to-libwebp-bug-exploited-in-attacks/


If your in-person training could have been virtual with no difference in content, you're getting robbed.


nostr:npub18zgs65acfwj5e8ave8m70n0jxamctlw6wa0cx27yr54r9lu60eqqrspu6e Hahaha sorry I missed it! 😅


nostr:npub18zgs65acfwj5e8ave8m70n0jxamctlw6wa0cx27yr54r9lu60eqqrspu6e I'm not sure what this means. Can you say more?


Excellent thread detailing some of the vulnerable apps: https://infosec.exchange/@TomSellers/111126339492371432


Hey, good job patching all your browsers for the latest WebP vulnerabilities (there's a new one today, btw).

Know what probably didn't get updated?

Yeah, all those Electron apps.


nostr:npub137jz4ps20g466v9wv3lchxw2n7zwkpsfr34zhszkusfyt2xgwccqzcztkl

cd_evil() { cd $1; chroot ./ }; alias cd=cd_evil


I have no idea why this repo has only 2 stars, but if you're using #Zeek with #Elastic, you owe it to yourself to add the nostr:npub1avl9l6kand8xhpxuzamukm6tppmj7yf2ywdq6egtm8vzd7d6tfgs95lmzw rules to your stack. Don't bother going through SOCPrime; just get 'em here: https://github.com/corelight/Elasticsearch_rules


Hey, before you run that poll, just remember you're running it on Selection Bias: The App.


Ah, felt great to be streamin' again. Missed it.


nostr:npub1udr6t3ma5srclvn2vm5gtpr7s6fvfkjx8pe7dy2hna76perpaqmqta8gc6 I specifically wrote this to not have to deal with Hashcat mask syntax.


Once again using one of my least-popular projects, but one I find extremely valuable. A simple rules-based mutator for wordlists to aid in dictionary/brute-force attacks. https://github.com/mttaggart/pwfuzz-rs

Of course, written in #Rust.


nostr:npub13t5apyz9nrl82te5c709edjks6whc4wzk05atpg2tmq59lc9d46q2vqflp I'm just tired of OMG ALIENZZZ taking over the conversation instead of, hey why are these clustering around military aviation operations, and what is happening in the waters near our training bases?


Freaking...finally. https://theconversation.com/nasa-report-finds-no-evidence-that-ufos-are-extraterrestrial-213528


There it is: https://masto.ai/@emsc/111077035990067720


nostr:npub1ke68qh59qkyeel06lqg32kr29yud4tk6dm4lxp7624lefqr74xdqazz7av Oh yeah; just a lil bump. I do miss the instant confirmation of whether it was a temblor or just a big truck we got from Twitter.


Was that just an #Earthquake, #SoCal #losangeles folks?


nostr:npub1qelvq7u8mt06d29epp634n7j9t5xuhg8tn94ks6g4a6wf73gdz3spp3ggq I will try to get a blog post going soon!


The big trick is you need to pregame the DNS zone and make sure your domain is using Azure nameservers. This means Terraform can create the A record, and Traefik can successfully make the cert request.


Ugh, it took all day, but I finally have a working config to press one button and get a LetsEncrypt-signed service up on Azure using Traefik.


New C2 from Tim MalcolmVetter just dropped.

https://github.com/malcomvetter/Periscope


What are you looking at here? 👆🏽

About a year ago, I uncovered an ongoing campaign to compromise websites—including government and non-profit organizations—via either WordPress attack or subdomain takeover, with the objective of hosting "Slot Gacor" Indonesian gambling sites.

Gambling is illegal in Indonesia, but this method of hosting allows a rotating set of sites to be used and proxies to without anyone ever catching on. And because they're hosted on legitimate domains, detection for interested parties (i.e. Indonesian law enforcement) is difficult.

What is not difficult is the exploitation of the sites. Either by searching GitHub for open secrets, basic brute force, or WordPress plugin vulns, criminals are able to easily get their content onto host sites. This is largely how WordPress and Joomla sites are infected.

But that's actually the harder version. The easier attack is subdomain takeover, in which users of services like GitHub Pages or Pantheon have deleted their sites, but left the DNS record pointing to that service's CNAME. An attacker need only create a page on the same service and claim that domain. Without additional controls (which some services have, although not GitHub, insanely), the domain now points to the attacker's site!

And unless you're paying close attention to your external assets, it can be very easy to miss.

Here's a video of me and HuskyHacks demoing subdomain takeover.


Just checking in on an old friend.

Oh no.

https://media.infosec.town/media/98d4b912-2506-4420-a9ed-d616715ac107.png


I had so many people on LinkedIn tell me they were still on Twitter because they "valued free speech" or didn't want to use media "controlled by the police state."

What is the antidote to these brainworms?

RE: https://mastodon.social/users/arstechnica/statuses/111070724089000823

nostr:note1jwlwadwfqfzvzlfe24et7jx67d4gvsrgzwnge22jszcq6clmqw3q97w70a


nostr:npub1uay3geenxplx736um2f9myu7mv6hnnmaz8ajdpguj3yeyr8r923sjrgycs What da-

You told me to use a better tool! I asked if there was one that met my criteria! If not, okay, but that's why there's Bash involved.


nostr:npub1c0rmlyecva9r3crqs7sfqx0j87hy7yzmjztdg7fw9khnpv0qrkyq8w6pkx There was a dark era where I wrote all my macOS fleet provisioning scripts for DeployStudio in

Ruby.


nostr:npub1uay3geenxplx736um2f9myu7mv6hnnmaz8ajdpguj3yeyr8r923sjrgycs Please tell me how I can do better than Terraform and, without using two tools, provision a new VM and install Docker from scratch. Remember, one tool only, Vasily. No Ansible, etc. allowed.


nostr:npub1x0dajq3q8m9dnvw2v3eygycc89tulqhe4ru80nu3ygdgvx83hxmqpasyar In reality, but that sure ain't the sales pitch. And of course now my Bash is wrapped in HCL.


"Do DevOps," they said. "You'll never write Bash again," they said.

I have not written more Bash than when trying to automate stuff with DevOps tools.


Basically just putting this here for every dang time I need to look up Azure VM sizes and don't feel like going through Microsoft's whole thing about it. https://azureprice.net


nostr:npub197fwxpnd8ge08z956rygxvj6k4570ggzanl6rftf0pdn4atnentss26tvl Exactly. A boondoggle where there should have been real help.


Still thinking about this thing and what could have been.

https://en.m.wikipedia.org/wiki/One_Laptop_per_Child

https://media.infosec.town/media/86359069-daf6-41ab-afc6-425a96987fa0.png


nostr:npub1pfev3tn7khfm8ptlvjw808kfp7wdz9qutjjnny7g879ag803qseqh2jtly Good. Gooood. Embrace the power of the dad side and fulfill your dadstiny.


nostr:npub129gvast08lj986yftn7q5qlnj8yfqufxx0m33s9u5xssjm8c64rsve4kwg Thanks; I've been looking for a good Rust-based editor. I'll give it a go!


For those of you who deploy #honeypot resources or other active deception, how do you represent them to regulatory audits, or programs like FedRAMP? Are there specific steps you take to clarify that these are intentional "misconfigurations?"


Added a few long-overdue submissions to #WTFBins! More base64-encoded commands, and a really interesting side-effect of sharing a Windows folder with "Everyone!"

https://wtfbins.wtf


Lil update to Bolus, the easy mode #Rust shellcode injector library. In addition to the goofy base64 evasions, I added the tried-and-true XOR!

https://github.com/mttaggart/bolus


nostr:npub18wsargqdmqzq02jju2f0g5vftcycr2j208f3rdw60mhhvfg9wlnq82cd25 Honestly, pretty much just LazyVim and making sure Rust is added to tree-sitter. Works great out of the box.

Maybe add a comment plugin.


Currently writing some #Rust in Neovim with a mostly-default LazyVim config, and I'm not missing VS Code at all.


nostr:npub1ar35qqejrwrgdcdnhzr4rv2vullexwknk5y687vjp040t8c2pcgsz2h7er These apiarists are everywhere! I keep seeing their abbreviation in software, and like, how much code do bees even need access to?!


nostr:npub1ac7r5sz4tn2gevyj8gtzudvqj7h7jn9usd4l2xj8648amc8hxvmsljk5uf Or that it will cost you significantly to do so, because Vader has changed the terms of the agreement, and you can only pray he does not alter it further.


nostr:npub168rnr6gmyvy82v29j779a6wt3ueulya2vxvu9drpgpgnyvc522wq9jjsp5 I may be honorable, but I ain't right.


Love a title drop-down with "Lord" and "Right Honorable" on there.

https://media.infosec.town/media/c0478efa-5f4b-48a6-92a0-4a0d61ec98fe.png


nostr:npub16uk4yyw47haxwl0klhh7lcx3qatkyqmpc6gc4hwru3qedaeuueeqqkpv7k I'm glad you made that work for you, but I'm also sure it was a moral imperative to do so. That needn't be the case for everyone, and I think you'll find most people face far more blockers than enablers in excising non-free software. For every Dave, there are 1000 devs who must contend with things like Windows every day, and that isn't the most important fight for them.


nostr:npub16uk4yyw47haxwl0klhh7lcx3qatkyqmpc6gc4hwru3qedaeuueeqqkpv7k I am saying that it's okay to pay people for software they made. I'm also saying proprietary software is unavoidable, so figure out how to handle it when greed gets the better of the company you're in business with.


Holy crap; what a massive W: https://www.bleepingcomputer.com/news/security/new-windows-11-feature-blocks-ntlm-based-attacks-over-smb/


nostr:npub1y4zsl3mej95qnl0ndw9sckuj37vtpc3g00pe093rdxpj3j6jwzls3l9pc2 nostr:npub1e2wkef2r3j8pkhv6pes7s5j59pq342d49v0xulzam8p4uvd9jqhsle6w8j I've always wanted to be heralded!


I'm worried what you heard was "Never use proprietary software."

That's not how risk works, and also it's not a reasonable position.

I'm saying this is part of the risk you accept when doing so, and it should be accounted for.


Actually, big thanks to #Unity for elegantly demonstrating a huge part of the risk model of proprietary software.


nostr:npub19vvmyg9nvnj8htyc5t2d98mudeaqcramh0le7uq0na2qz2m9u7qqptdhxy I'm on Alder, and Plasma.

I don't know what to tell you. I'm not making it up.


nostr:npub19vvmyg9nvnj8htyc5t2d98mudeaqcramh0le7uq0na2qz2m9u7qqptdhxy Intel Iris


Switched back to X11 after the 3rd hard lock in a week on Wayland. Thing's just not ready, which is risible.


If your concern about "censorship" is that there will be consequences when you say whatever you want to people, you're not a "free speech absolutist." You're just a jackass.


nostr:npub1gqqfyqytqythzdjjpdg9xkyjgxqz9q3stcskl3sryj3tgpzclqhsdcxzlh Well I'm grateful for your persistence, and your purchase! I hope you really enjoy it! Hope to see you around our Discord as well.


nostr:npub1uud3g5xn0hd07tezkvsuq6dy2wj0a4vy4400w70xzfghryfmqxzs0q4kdc Had a friend catch jury dury during the last NFC championship run, and the judge literally led the jury in the song and sent emails about wearing jerseys.


nostr:npub1s89llystyyz0rynjy0ax7kzmjp50v3v6hrh5ws5q40etqr89ukrs8jf0yf Hold on, they're seeking retroactive fees? That's a lawsuit waiting to happen. That's like...not how contracts work.


Hey hey #GetFediHired, #InfoSec edition: my team is still looking for the right candidate for this amazing opportunity! It's well-compensated, and a chance to do some important work you'll feel proud of. https://www.uclahealthcareers.org/job/18786122/cybersecurity-analyst-hybrid-remote-los-angeles-ca/


I know gaming is not my beat or whatever, but I can't stop thinking about what an obvious footgun this pricing model was. No matter how hard up for cash they were, couldn't someone have said to them, "Hey this plan is actually an elaborate brand self-destruct mechanism." Maybe someone they pay for relations? To the public?


nostr:npub1xhcqdaqrmpmnehrd5npkqhp32ckmqm2x8ll2d8kmjdq2jx3k9h7q72mkc5 It's just such a wildly different set of priorities


Oh my.

It's done.


Yooo, nostr:npub15c0uz3l55klsrq6l9zlvmtkvxwv2wy7q0rm7y249qkmzxpaj5gks5thxke ain't messin' around. https://vivaldi.com/blog/news/alert-no-google-topics-in-vivaldi/


Hey nostr:npub1rn2y9m58jg6a3jf8pk8fafu4auumhp00x0f6gw6gacxqv5mpxh2sycggwn, thanks for continuing to maintain RSS feeds! Now, please stop blocking FreshRSS User-Agent strings. That can't be a major source of scraping for you, but would mean the world to some of us.


Honestly the idea of never running npm again has me even more excited to use Deno for things.


It's like the only thing I want to use the robopal for, but it'd be crazy useful


Is there yet a ChatGPT-powered tool for deobfuscating malware samples? Most of what I'd want to clean up is too big to paste directly.


If you have people in Marrakesh, you may want to check on them as soon as you can. https://www.bbc.com/news/world-africa-66759069


nostr:npub10rkv3a3qlz54n4petajs5ch76ppveufh2v3zw6epzun628aulmsqryk4ve nostr:npub10g9ac90qetgw8lntm8d454kdh4djtccdtevpqkdnlkpf6vk5mc6qmlv4df I mean I'm literally writing a book about homelab automation with Packer, Terraform, and Ansible, so tell the kettle I said what's up


nostr:npub10rkv3a3qlz54n4petajs5ch76ppveufh2v3zw6epzun628aulmsqryk4ve The corollary of "There's nothing more permanent than a temporary solution" is "Nothing costs more time than automating rare time-intensive tasks"


Hey nostr:npub1umr5n2fwxlcjgjqmva9g435tardmf46syuz2gh3083txdpf0gu6qpz0yvm and nostr:npub10k72v2h56j98750zjfuu92m206fh6p6latxmup869ym4espay6eqwplp63, is it just me, or is 2023 shaping up to be a banner year for school cyberattacks? Or are they just better covered, in large part thanks to your efforts?


nostr:npub1skj6tkgacjcruxkyy9uw2at4ze8qela9t7evvutdnr5vsfryh86qsvft45 Right now I'm having a lot of fun with Deno in general, so I might take a look at Fresh meself.


nostr:npub1skj6tkgacjcruxkyy9uw2at4ze8qela9t7evvutdnr5vsfryh86qsvft45 A thick volume could be written on how client side code became so bloated, but React arrived at the right time to win over a lot of devs/shops from heavier frameworks, while still capitalizing on the surfeit of JS devs in the market. That tide has turned significantly at this point, and optimizing for performance on many axes has left React feeling a bit dated.

Also, the love affair with Redux didn't do anyone any favors. I even wrote Elm apps and, while I loved the syntax, the data model was unreasonably rigid.


nostr:npub1623w6tvcc3ghmsdeh7qgdvs9apsksy3xze59squ87909u5y5cqzqmvkfjx Hey you and me both. Until we get another leak like we did with Conti, it's all highly speculative.


React was designed seven Taylor Swift albums ago, for a world where John Mayer and Jennifer Aniston were still dating.

(Seven new Taylor Swift albums ago, that is. That doesn’t even count the Taylor’s Version releases.)https://joshcollinsworth.com/blog/antiquated-react


nostr:npub1623w6tvcc3ghmsdeh7qgdvs9apsksy3xze59squ87909u5y5cqzqmvkfjx I am a threat hunter, not an intel analyst, however I would point out a couple things here.

First, MOVEIt exploiters were mostly ransomware actors, who will buy 0-days, but not necessarily develop them.

There's a temporal component here as well. I'd have to check the numbers, and it's still early, but it doesn't seem like there's a massive uptick in network device 0-days being released since MOVEIt, which makes sense, given the amount of R&D a brand new 0-day usually takes to develop.

It's also the case that cl0p et al were not specifically targeting tech companies with MOVEIt.

I suppose it's possible that successful compromise of some vendors led to the discovery of undisclosed critical vulns, but that seems like a rarity.

The increased development of network appliance 0-days has been business-as-usual for a while now—at least since CVE-2019-19781 (original Netscaler RCE).


nostr:npub1nazwkctjw5ng0xumnplhaew5nkkrh6ej24nlv3pj67eg0j6qrfcqx2jqps Ah thank you. That's super disappointing.


A good morning from our pals at Cisco https://www.bleepingcomputer.com/news/security/cisco-warns-of-vpn-zero-day-exploited-by-ransomware-gangs/

#ThreatIntel


nostr:npub1nazwkctjw5ng0xumnplhaew5nkkrh6ej24nlv3pj67eg0j6qrfcqx2jqps I think I'm a bit out of the loop here. What changed?


nostr:npub19nx3x6dau4xr37qs03zqv8k9nawklluf8x8lspghf2dy8qfa3hws02tdw3 I confirmed it is not malware. But yes, this obfuscation is very similar to the kind you'd see from things like SocGholish or some Loader variants.


nostr:npub1tas4wretzwtzgnn5yqzvvdvcyjc9gnpsngrrgvcpz2ww67p4rnps84zf83 nostr:npub15c0uz3l55klsrq6l9zlvmtkvxwv2wy7q0rm7y249qkmzxpaj5gks5thxke And has a killer built-in reading list and RSS reader.

_That's right chooms, an RSS Reader_


nostr:npub1vkdrg4yn2df8vw640zlavxev4syhfpjmkkltdetdy0fntzrur40qna98hs nostr:npub15c0uz3l55klsrq6l9zlvmtkvxwv2wy7q0rm7y249qkmzxpaj5gks5thxke Brave and their COVID-denying, transphobic, homophobic CEO, weird crypto stuff, and proprietary ad system can bite me.

I'm not trading one ad ecoysystem for another, and certainly not interested in helping out Brendan Eich.


I really think that scene in "Minority Report" where the car tries to take Tom Cruise to the cops made me want as little connected technology in my car as possible.


nostr:npub1c3qrykvp7zhp5k8hvc075jv0ww3zrcksy7cczfqcnyunacmuhhjqwxhk4q I appreciate the insight!


Look at this garbage.

Looks like obfuscated JavaScript malware, right? No human would create functions like this.

But in fact, this is the Human Verification/CAPTCHA code from AWS CloudFront.

Looks just like malware to me. No clue why they would do this.

https://media.infosec.town/media/27003b3b-c74b-4e9e-9606-a4ad6dd25c3b.png


nostr:npub1xd8xfukvjuyxc5z2srr7fk2wur49mr32x2f3tgsfu6yzel8etkhqe98qee nostr:npub15c0uz3l55klsrq6l9zlvmtkvxwv2wy7q0rm7y249qkmzxpaj5gks5thxke nostr:npub1q2wcaykt4mpqs0ehf2spg3mkjvqcy5de8qpfxkj60kd9x67vnukslg6ht6 Yes, just as they've committed to removing the site integrity garbage.


nostr:npub1jmae6q0wrv8l5rt8nu5qa489sjxee7h8pj4f8qyf4mhz7w3gg23sm50as2 On this we agree completely!


nostr:npub1s89llystyyz0rynjy0ax7kzmjp50v3v6hrh5ws5q40etqr89ukrs8jf0yf Absolutely. As always, it is not possible to make immoral choices without, y'know, choices.


nostr:npub1jmae6q0wrv8l5rt8nu5qa489sjxee7h8pj4f8qyf4mhz7w3gg23sm50as2 Okay you literally said "don't discriminate," so I don't see how else I could have possibly interpreted that.


nostr:npub1jmae6q0wrv8l5rt8nu5qa489sjxee7h8pj4f8qyf4mhz7w3gg23sm50as2 I don't believe I was discriminating against anyone. I was merely speaking to my community.


nostr:npub1hdtsg03dmwrqsnka38h3jdm2xxn3wyt48wrafjvn480eexf95fvsa3ar89 If your claim is that it's impossible to not know that Twitter has been co-opted by Nazis, I think you'd be surprised by how little news some folks consume.

If your claim is that ignorance is no excuse, well, I guess we're all monsters for using something.


nostr:npub1hdtsg03dmwrqsnka38h3jdm2xxn3wyt48wrafjvn480eexf95fvsa3ar89 It's very easy to overestimate how much a lot of people pay attention to what you and I may care deeply about. That is not an excuse, although there is an argument to be made that support requires knowledge and intent, and I suspect a large number of Twitter users have neither knowledge of what's going on with the platform, or intent to support it.


nostr:npub1q2wcaykt4mpqs0ehf2spg3mkjvqcy5de8qpfxkj60kd9x67vnukslg6ht6 nostr:npub15c0uz3l55klsrq6l9zlvmtkvxwv2wy7q0rm7y249qkmzxpaj5gks5thxke Okay but Vivaldi does and I have never once found a site that works in Chrome that doesn't work in Vivaldi.


I'm still really tentative about calling continuing-Twitter users bad people for using it, although I believe it is an immoral act of one shade or another.

But if you're a Starlink customer?

Yeah you need to have a real hard think about that.


And if that wasn't enough, even more tracking so that, in the future, they can be the only ones tracking you. https://arstechnica.com/gadgets/2023/09/googles-widely-opposed-ad-platform-the-privacy-sandbox-launches-in-chrome


I can't opt out or mark sites as actually safe?

Screw.

        That.

I'm not about to trust The Goog to decide unilaterally what I can and can't see. Also, this feature means you literally can't opt out of Google getting every URL you visit. Google account or no.

Please stop using Chrome. If you want to stay in a Chromium browser, there is nostr:npub15c0uz3l55klsrq6l9zlvmtkvxwv2wy7q0rm7y249qkmzxpaj5gks5thxke.

The best time to get friends and family off Chrome was a while ago. The second best time is now.

https://blog.google/products/chrome/Google-chrome-new-features-redesign-2023/


TIL that nostr:npub1pgs0t3ppz4wtsnpkh4aqfxgy6u644ntkzg4ju6gha2v6qsvpltaqt7gyss's built-in HTTP server runs Hyper under the hood. Meaning you can:

- Write #TypeScript
- Get #Rust power


(This has been corrected.)


nostr:npub1kk5synd8ht0sn7eagg9gudz2cxtvcr06pt8v72qxd4u78pa5jtqszee0ds Adding #lawfedi for reach.


nostr:npub1uud3g5xn0hd07tezkvsuq6dy2wj0a4vy4400w70xzfghryfmqxzs0q4kdc The real question is what anime girl would xXP0ntif3XXx use as a pfp?


nostr:npub1tngdnsdgxaxnd9306vuk0saajld82vy92rtqvv2lx6vxp8drt3nsk2jkdg I really hope you enjoy it!


nostr:npub1tngdnsdgxaxnd9306vuk0saajld82vy92rtqvv2lx6vxp8drt3nsk2jkdg I can't say it'd be superior. Change is experienced as loss, and if you're the kind of person who doesn't like upending their workflow, this'll be a bad time until ti's not.

I personally like Krita a lot, and certain aspects are much more sensible to me than G—. But in terms of recency, I can't say it's changed drastically in the last few months, so if you found it distasteful then, you probably will now.


nostr:npub1tngdnsdgxaxnd9306vuk0saajld82vy92rtqvv2lx6vxp8drt3nsk2jkdg Nah I don't have any responsibility to sell you on anything. Try it or don't, but it kinda seems like you don't see an issue with the name of the other app anyhow, which was the original point.


nostr:npub100hcc4mkxgjz22j4rgg23qhgw9qdlaejlf2ukgz5z8w68mm2dlvsehs6u4 For those of us who use a lot of additional languages with their own package managers, it can be a pain to keep it all straight.

Or like, in Windows, it's harder than it should be to install Python, then get python and pip as part of env:PATH.


nostr:npub1tngdnsdgxaxnd9306vuk0saajld82vy92rtqvv2lx6vxp8drt3nsk2jkdg When was the last time you gave it a shot? I agree it's primarily for drawing, but I use it successfully for image editing all the time.


The sublime peace that comes from knowing your $PATH is actually configured correctly.


nostr:npub1sdtvw8y3yhksws5jf8ttl45vru06krpuuus2fys3u5exucvc4ywquf96z3 nostr:npub1074dk2mqqxl7kgukea6th3xaa9fdgx7vty2x8zger32uydyf6e3qzhz2j6 I'm saying they didn't cause the race condition at all. It reads to me like they simply read the dump from where customer dumps are kept.


nostr:npub1sdtvw8y3yhksws5jf8ttl45vru06krpuuus2fys3u5exucvc4ywquf96z3 nostr:npub1074dk2mqqxl7kgukea6th3xaa9fdgx7vty2x8zger32uydyf6e3qzhz2j6 As I read it, they didn't trigger the dump; they discovered it while on the machine with access to the debugging environment. This [compromised] account had access to the debugging environment containing the crash dump which incorrectly contained the key.


Putting the final touches on the book, and I was pretty happy with this passage.This is going to be a challenge for you. That's good—anything worth doing should be a little difficult. You'll grow and learn through the process of creating this lab, and that's the real objective of homelabbing and of this book. Still, sometimes it's going to be frustrating. You will make mistakes. You will have to start parts over. You may even run into bizarre edge cases that this book didn't account for, and that the internet struggles to provide answers for.

When this happens, and it will happen, I want you to remember three things.

First, you are more than capable of building this lab. The knowledge and techniques here may be new to you, but they are not so complicated as to be out of reach. I only know what I know because of a career's worth of mistakes.

Second, mistakes are good. Nothing teaches quite like them, and in fact you can't learn without them. Getting something wrong doesn't feel great in the moment, but just like the discomfort of physical exercise, mistakes are what happens when you expand your mind. Recognize that, take breaks when you're getting too frustrated, and come back when you're ready to try again. You'll emerge victorious in the end.

Third, you are not alone. One major goal of this book is to bring the community of homelab enthusiasts together. There are a lot of us hanging out at The Taggart Institute right now, and we love a good puzzle, helping out folks who are stuck, or just chatting about this odd hobby. Come join us, and you'll soon see that we all find ourselves lost from time to time. Reaching out to others is a virtue, not a weakness.

Okay, ready to do this? Yeah you are.


nostr:npub1r3n08ljcwy5smnd8wvpl999ky4tyjnckplu492dl59egnpmr6m6svtqv63 I understand the economics of newspapers, thanks.

I still don't enjoy having the one I pay for put charlatans above the fold.


My stance on the awfully-named open source image editor is that you should be using Krita anyway.


The touchscreen was a choice, not an inevitability. And there was an opportunity cost for chasing a vision of the future as imagined by the production designers of Star Trek.

Look what they stole from us.

https://media.infosec.town/media/f4aefca6-99b7-4a80-ac0e-63d09d6f37ff.png


Can we just for a moment reflect on the thoroughness of the attackers to find that Microsoft signing key? That was a non-obvious location to find secrets—and in fact by rights the file was not supposed to include such secrets anyhow. So either the Chinese threat actors knew about the race condition leading to dump files containing secrets, or they were so thorough they looking at everything they could touch, once the Microsoft employee's machine was compromised.

Either way, this is an actual advanced persistent threat. And it makes you ask how much more they know that not even Microsoft knows about the edge cases of their products.


This...seems like a very big deal? And quite concerning. https://proton.me/blog/online-safety-bill-encryption