dude

remember when google's internal motto was "don't be evil"? I remember that. I wonder why they stopped using it

this day only: free advice for any and all sorts of questions from a 20-something who works in appsec, whose letterboxd consists mostly of animated movies, and is extremely ill-prepared for combo breaker in less than 10 days

vibe coders mashing together whatever agentic-skill-harness-wiggum-orchestration things they have together hoping that they've rigged their code slot machine has the same energy as maldevs shoving techniques ad hoc into the same payload hoping it won't be caught by AV/EDR i will not explain further

I haven't seriously played any CTFs since maybe 2023/24, mostly because I'd burn out if I did security stuff 24/7, but this isn't the first time I'm hearing that AI has killed CTFs as we used to know them. kabir.au/blog/the-ctf...

new post on the blog, more of a brain dump this time following some on-site testing that went beyond a single network or application. maybe my worst work yet on the thumbnail. notateamserver.xyz/blog/restaur...

sometimes I see infosec courses that people are selling and for how much and I think about what life would be like if I didn't feel a moral obligation to do something good with people's money

actually peak gaming

This is the kind of thing a rich CEO says at the beginning of a science fiction movie to establish for the audience that he is a sociopath and the villain.

genesis x3 melee predictions

if someone ever tells you to stop trying or that your work is pointless, remember that nikto is still being updated to this day

The datafication and repackaging of our human creativity into chatbots that are sold back to us as a digital replacement for our own labor, critical thinking, and social relationships is another kind of detention center.

(Dude suddenly stops pushing his broom across the floor of the Death Star) Does this look like a big laser to anyone else

does anyone have a link to a blog that went through a bunch of malware buzzwords (e.g. indirect syscalls, native apis, VEH) and then took a very measured approach to explain where each one was useful and where they did nothing because people have a tendency to just stack techniques and pray it works

maybe the true unbeatable was the "game where music is illegal and you do crimes" we made along the way

At least four videos show what really happened when ICE shot a woman in Minneapolis on Wednesday. DHS has established itself as an agency that cannot be trusted to live in or present reality. @evystadium.bsky.social has more. Full story by @josephcox.bsky.social: www.404media.co/dhs-is-lying...

trying a youtube thing for topics and ramblings I don't feel like putting on the blog: www.youtube.com/watch?v=qr3V...

The most powerful narrative device a game can deploy is "throw you back to the main menu but it's different"

candy tierlist (most of these are vaguely from memory)

The most profound threat posed by generative AI is the fervent belief it engenders. Its most ardent believers are in a cult, whether we want to say so or not. We might as well say so.

NEW: 404 Media is suing ICE. We have filed a lawsuit demanding the agency release its $2 million contract with Paragon, a company that makes powerful spyware to break into phones and read messages from encrypted chat apps www.404media.co/were-suing-i...

The Trump regime is adept at leveraging actual long-simmering policy issues in decades-long morass in congress, "Doing Something" that kinda super fucks it all up in a totally new way, then basking in opponents insisting everything was fine before – which voters know it wasn't. Sick hack though...

Genuine question for the math people out there - do you think your undergrad Real Analysis or Abstract Algebra class was harder? Some people are commenting on a video I made over a year ago saying "acktually you should have used a harder abstract problem to make this fair 🤓" and it's bothering me.

curse of ra on any developers that encrypt the data within the https traffic, not making my life or yours any easier 𓀀 𓀁 𓀂 𓀃 𓀄 𓀅 𓀆 𓀇 𓀈 𓀉 𓀊 𓀋 𓀌 𓀍 𓀎 𓀏 𓀐 𓀑 𓀒 𓀓 𓀔 𓀕 𓀖𓀗

wondering if I could be the Sajam of infosec and make the same videos every 6-12 months about - why certifications aren't everything - why ctfs are good and bad - responsible disclosure - something something AI - etc. I suppose it could always be blog format but just talking is way easier 🤷‍♂️

"Computer science isn't political!", they said. "I'm just going to develop AI products for startup cash and to draw cute girls", they said. "You're over reacting and making everything political", they said. We need ethics training in engineering.

GET IT TWISTED 🌪 , NEVER DO DYNAMIC ANALYSIS ✅ . PLEASE OPEN IDA 🕵️‍♀️. RELABELING SYMBOLS IS AN INVESTMENT 🎰 AND AN INVESTMENT ONLY 🤑 . YOU WILL PROFIT 💰 , YOU WILL WIN ❗ . YOU WILL DO ALL OF THAT 💯 , YOU UNDERSTAND ⁉ YOU WILL BE SECURE 💵 📈 AND REBUILD YOUR FUCKING LIFE 🤯 .

new blog after who knows how long - a deep dive into how a bunch of web protections fit together and also an example of how you can mess that up so bad you find CSRF in a GraphQL API notateamserver.xyz/blog/cors-xs...

another fun ccdc qualifier event pastebin.com/srwy8Df0

Finally got around to writing a new blog post - this one's all about writing pentest reports, mainly because I don't think any certifications really do the topic justice right now notateamserver.xyz/blog/pentest...

GET IT TWISTED 🌪 , ROLL YOUR OWN CRYPTO ✅ . PLEASE START ROLLING YOUR CRYPTO 👍. CUSTOM ENCRYPTION IS AN INVESTMENT 🎰 AND AN INVESTMENT ONLY 🤑 . YOU WILL PROFIT 💰 , YOU WILL WIN ❗ . YOU WILL DO ALL OF THAT 💯 , YOU UNDERSTAND ⁉ YOU WILL BE SECURE 💵 📈 AND REBUILD YOUR ******* LIFE 🤯 .

2024 has been the best year of music for me, this is awesome