@buherator@infosec.place
@buherator@infosec.place avatar

buherator

@buherator@infosec.place

A drunken debugger

Heretek of Silent Signal

This profile is from a federated server and may be incomplete. Browse more on the original instance.

buherator, to random
@buherator@infosec.place avatar

RFC for 700 HTTP Status Codes

https://github.com/joho/7XX-rfc

gsuberland, (edited ) to random
@gsuberland@chaos.social avatar

normal EMF things

#emf2024

buherator,
@buherator@infosec.place avatar

@gsuberland lowercase v for Volts, atrocious!

buherator, to random
@buherator@infosec.place avatar

Bugs of the Year Awards results are in (still from X :P)!

“The Most Impactful Parser Bug Of The Year Award is given to the WebP 0day” - awarded to @benhawkes

“The hardest to fix parser bug goes to the http://Binarly.io team for the LogoFAIL bugs.”

“The Best Parser Differential Awards goes to the inconsistent interpretation of YAML foods between Go and Rust.” - There is a link on the captured slide, and I’m pretty sure it’s @joern ‘s bug, but I can’t find a proper CVE anywhere…seriously people, references!

“The Weirdest Machine Award goes to Ian Beer @i41nbeer @benhawkes and @saelo “

Full thread with runner ups:

https://x.com/jvanegue/status/1793801911650676915

buherator, to random
@buherator@infosec.place avatar

[RSS] Inside the iOS bug that made deleted photos reappear

https://www.synacktiv.com/en/publications/inside-the-ios-bug-that-made-deleted-photos-reappear

buherator, to random
@buherator@infosec.place avatar

We should start using phrases such as "AI infested" in regards to software.

Viss, to random
@Viss@mastodon.social avatar

you know what?
ai would be beter than this, i think.

buherator,
@buherator@infosec.place avatar

@Viss What if I told you that sometimes their job is precisely to be an obstacle?

whitequark, to random
@whitequark@mastodon.social avatar

found some extremely Normal code in one of my projects

buherator,
@buherator@infosec.place avatar

@whitequark that "almost all" looks like a fun challenge for future you :)

buherator, to random
@buherator@infosec.place avatar

LangSec Bug of the Year Discovery awards
https://langsec.org/spw24/bug-of-the-year.html?s=09

buherator, to golang
@buherator@infosec.place avatar

This latest writeup by @joern mentions the of Go’s filepath.Clean is “not really obvious” when dealing with relative paths.

I think this is something all devs should be aware of to avoid similar vulnerabilities.

The language is kind of amazing:

  • Step 3. only applies if there is a parent path to be eliminated together with the subsequent “..” (“/foo/..” -> “/“)
  • Step 4. only applies to “rooted” (absolute) paths, so “/../foo” would become “/foo”, but “../“ is left untouched (as there is no relative parent path to eliminate either).

This makes the docs technically correct (“the best kind of correct!”), but even with the solution at hand it took some head scratching to figure out the true meaning.

GossiTheDog, to random
@GossiTheDog@cyberplace.social avatar

Microsoft's CEO has emailed the company telling everybody to prioritize security. My thoughts, which 4 people will read.
https://doublepulsar.com/breaking-down-microsofts-pivot-to-placing-cybersecurity-as-a-top-priority-734467a8db01

buherator,
@buherator@infosec.place avatar

@GossiTheDog Medium's half-screen sign-up form certainly doesn't help with audience conversion. Just a tip.

buherator, to random
@buherator@infosec.place avatar

No, LLM Agents can not Autonomously Exploit One-day Vulnerabilities

https://struct.github.io/auto_agents_1_day.html

buherator, to random
@buherator@infosec.place avatar

Who does updates over HTTP and without signature enforcement in 2024? Of course it's an AV: https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/

buherator,
@buherator@infosec.place avatar

avpwn++

https://github.com/v-p-b/avpwn/commit/41b16f9adbb174f37addcbf4a89439013fcbae2b

buherator, to random
@buherator@infosec.place avatar

Let me get this straight: on-prem Exchange doesn't support DMARC/DKIM, but if you want to send e-mail to O365 users your messages need to be properly demagnezited by The Hawk himself?

https://learn.microsoft.com/en-us/answers/questions/1071500/dmarc-and-pkim-for-exchange-2019

buherator, to random
@buherator@infosec.place avatar

[RSS] This Man Wants to ‘Save the World’ By Letting You Jerk Off Into a Computer

https://www.404media.co/orifice-ai-sex-toy/

A true hero!

zhuowei, to random

Was Sleeping Beauty/Briar Rose's kingdom, castle, or town receive names in any major adaptation?

Neither the Perrault, Grimm, Tchaikovsky, or Disney versions had names for the castle/kingdom/town.

Disney's Maleficient did name the kingdom "Ulstead", but spin-offs doesn't count, and anyways, it doesn't name the castle or town.

buherator,
@buherator@infosec.place avatar

@zhuowei /cc @TarkabarkaHolgy

troed, to llm
@troed@ioc.exchange avatar

I see lots of posts here on Mastodon where people state that today's "AI" (LLMs) have no use, waste energy and are just doing copyright infringement on a vast scale.

I don't get it.

I just put together "summarize.sh" - a bit of glue between some open source and self-hosted LLMs. It takes a Youtube URL as its only parameter, and outputs a summary in text of the important parts of the spoken words in the video.

That is, I run yt-dlp, Whisper and finally Mixtral 8x7b. And I no longer need to sit through someone yapping about for a few minutes to tell me what should've been a short blog post.

Example output from a 4 minute video:

"The text describes a video tutorial on how to reset a Corsair keyboard when it's not working properly. The keyboard in question has three white flashing lights at the top and is experiencing issues with its RGB lighting and key input. To reset the keyboard, the user should unplug the USB cables from the computer, hold down the escape key, and then plug the USB cables back into the computer while still holding down the escape key. After releasing the escape key, the keyboard's lights should flash, indicating that it has been reset. The tutorial notes that this method has worked for other Corsair keyboards as well."

How is this not a great thing to have?

#LLM #AI #Whisper #Mixtral

buherator,
@buherator@infosec.place avatar

@troed how do you know this is in fact what is presented in the video?

buherator, to random
@buherator@infosec.place avatar

[RSS] Advisory X41-2024-001: Weak Chilkat PRNG

https://x41-dsec.de/lab/advisories/x41-2024-001-chilkat-prng/

buherator, to random
@buherator@infosec.place avatar

Bold emphasis is mine:

“So we have the ability to get text on demand that looks like legal contracts, or looks like medical diagnoses, or looks like therapeutic conversations, or looks like a news article, or looks like scientific research papers. But it actually is none of those things, because in all cases the textual artifact isn’t really the point; the point is rather the thought processes and relationship-building that led to and follow from the textual artifact.” - @emilymbender

https://buttondown.email/maiht3k/archive/doing-their-hype-for-them/

buherator, to random
@buherator@infosec.place avatar

"For example, someone would need to have the skills, time, and enough long-term interest specifically for [maintaining xz].”

It turns out someone had all three!

Great post about xz's takeover:

https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interactions-in-open-source-projects/

simon, to random
@simon@simonwillison.net avatar

I put together some detailed notes showing how I use Claude and ChatGPT as part of my daily workflow - in this case describing how I used them for a 6 minute side quest to create myself a GeoJSON map of the boundary of the Adirondack Park in upstate New York
https://simonwillison.net/2024/Mar/22/claude-and-chatgpt-case-study/

buherator,
@buherator@infosec.place avatar

@simon

"and it was clearly wrong" - Here's my theory: LLM's are useful if results are easy to verify.

In your example eyeballing can easily tell if the resulting shape is similar to the input area. As I understand your use-case doesn't require too much precision, which is totally fine, but it's important to ask how much harder your problem would get if you wanted to make sure the input and output shapes are precise matches? Would you use an LLM to write some verification code? How do you decide if that code is correct? (I think in this particular case actual verification could be actually pretty easy, but I wanted to stick with the example)

buherator,
@buherator@infosec.place avatar

@simon Now let me put on my Grumpy Security Guy Hat:

Verifying code is incredibly hard. One of the main dangers of LLM's I see is that it's really easy to conclude that the code is correct because it works in the general case, but it will break havoc in edge cases. Worst, you won't be able to reason about those edge cases because you wouldn't know how the code works (you can figure it out of course, but then there goes your claimed efficiency).

Now for toy problems this is all good and well. On the other hand we've all seen toy scripts ending up in production...

buherator, to random
@buherator@infosec.place avatar

The real problem with anonymity - by @pluralistic

"There is a category of person who reliably uses a certain, specific kind of anonymity to do vicious things that inflicts serious harm on whole swathes of people: corporate bullies."

https://pluralistic.net/2024/03/04/greater-corporate-fuckward-theory/#counterintuit-ive

buherator, to random
@buherator@infosec.place avatar

MS Word autocorrects "HTTP" to lowercase, but it doesn't do so with "HTTPS".

I'd like to request a CVE.

buherator, to random
@buherator@infosec.place avatar

To commemorate its death, here are some of my favorite pieces of journalism from Vice:

https://medium.com/@therealsexycyborg/shenzhen-tech-girl-naomi-wu-my-experience-with-sarah-jeong-jason-koebler-and-vice-magazine-3f4a32fda9b5

https://www.wired.com/2012/12/how-vice-got-john-mcafee-caught/

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • megavids
  • thenastyranch
  • magazineikmin
  • ethstaker
  • InstantRegret
  • tacticalgear
  • rosin
  • love
  • Youngstown
  • slotface
  • ngwrru68w68
  • kavyap
  • cubers
  • DreamBathrooms
  • provamag3
  • mdbf
  • cisconetworking
  • GTA5RPClips
  • modclub
  • khanakhh
  • everett
  • Leos
  • osvaldo12
  • normalnudes
  • tester
  • Durango
  • anitta
  • JUstTest
  • All magazines
    •