My random number generator just did a Dilbert

Did you know Facebook has a Certificate Transparency monitoring tool? Never mind then, they're shutting it down anyway :-) developers.facebook.com/tools/ct

Just noticed that my PHPStan extension to detect disallowed calls, methods, attributes, constants etc. has been installed more than 15M times, wow! Not bad for a weekend project (a long weekend since 2018). PHPStan itself has 300M installs, so 5% of all PHPStans installs use the extension, nice! :-)

HTTPS certificates can exist without the CN (Common Name) field. It's not used for validation, instead browsers use the SAN (Subject Alternative Names) field. But if your tool uses CN for anything, e.g. to show a "name" for management purposes, check whether the tool works with CN-less certificates

There should be an HTTP response code in the 4xx range that would instruct the client to refresh their stale DNS records. Even after 48 hours some bots (looking at you Palo Alto Networks) are using the old IP for a hostname, while the DNS records have TTL of 5 minutes or so.

Here's one information for you: should be more specific when phishing IT folks

GiveWP (the donations WordPress plugin) managed to leak donors' emails into the donation form. And then they managed to mess up the communication :-( Nice resume of the problem at the Pi-hole blog as they were one of the affected sites pi-hole.net/blog/2025/07... Go and learn how to communicate.

Setting up a new server and I'm so happy I can do it remotely because it must be absolutely cold in the data center

My last name (Špaček) means starling in Czech. This guy used my veeery distant relative to store an image, nice 😁 Looking forward to an update to RFC 1149 where you don't need a small scroll of paper but instead use the carrier itself to store the data.

I was today years old when I found out that the name of the company who's created Wolfenstein 3D and Doom, id Software, is pronounced "id software", "id" as in "kid", not "eye dee software" That's some 30 years after playing the games... en.wikipedia.org/wiki/Id_Soft...

It's been 0 days since git reflog saved my ass (and files) again. Instead of rebase this branch, I did reset this branch, losing my commits. `git reflog`, find out what happened (reset at {46} and {48} in the pic), then `git branch name id` (id ends with 67 at {50}, commits are back.

What do you do when you can't sleep? I fine-tune my HTTP reasons 💤

I've asked ChatGPT to generate me a temp profile picture and when I've praised the creation it didn't know what to say, so it gave me back some JSON with a prompt that has resembled my instructions. ChatGPT then claimed, multiple times that I asked for the JSON 😁 I haven't talked about JSON before.

Stored XSS via an archive file stored in a RAR archive, nice 😁 Fixed in WinRAR 7.12 released yesterday.

I have a battery powered outdoor camera, it can last several weeks on a single charge in that environment. But suddenly, the battery went from 20% to 0% overnight. I was curious what happened so I checked the last pic it has recorded. Yeah, thanks little fella 😂

1) I call BULLSHIT on this latest claim of a 16-billion record data breach "that no one's ever heard of". Let me explain why (thread). cc @dangoodin.bsky.social cybernews.com/security/bil...

My mobile Chrome got bored and started spinning the site settings icon whenever I reload the page. It does that on 2nd reload but only on this particular site. What sorcery is that? What is Chrome trying to tell me? I don't see anything unusual when I click it. Or am I just tripping?

When your boss tells you to go phishing but you can't just be bothered today.

🔐 Discover how Sec-HTTP headers and Content Security Policy (CSP) can help you create fast, good, and cheap solutions all at once. At WebExpo 2024, @spazef0rze.bsky.social explained how fetch metadata protects public tools like an internal email generator without needing extra logins.

CA/B Forum, a group of certificate authorities and browsers, voted for reducing HTTPS server certificate validity period from 398 days to 47 days eventually. The changes are currently in a review period, soon to be added to the so called Baseline Requirements.

Certbot, the tool to get HTTPS certificates from Let's Encrypt and other CAs, has released version 4.0. Notable changes are the support for profiles, which is how you can select which certificate type you'd like. The 6-day certificates from Let's Encrypt later this year will be a special profile.

It doesn't happen very often, but a new timezone was created earlier this year in March. It's called America/Coyhaique and has been created because a region called Aysén has stopped shifting from UTC-4 to -3 and will stay UTC-3 all year round, joining the Magallanes region below.

PHP has a function to compare two hashes (non-password hashes): hash_equals. It has two parameters: known_string and user_string and I never knew which one is which, because even the known_string was a user string once 😅 The manual page was rewritten some time ago and it's now much better:

Newcomers to password cracking should learn that in 1991 the 1st well known password cracker @alecmuffett.bsky.social's Crack introduced applying rules & permutations to dictionary words, such as substituting numbers for letters, reversing words, appending digits, & other common user habits. 1/3

Some time ago, my mobile Chrome seemingly removed the option to view page source by prefixing the URL with `view-source:`. It always goes to Google whenever I hit Enter on the on-screen keyboard. Not sure why, but now you have to select/tap the other item in the URL bar, the one with the globe.

New Safari is going to show a warning when HTTPS uses 3DES cipher suites which should not really be used anymore github.com/WebKit/WebKi... The warning will be similar to the TLS 1.0/1.1 warning. Safari Tech Preview 213 already shows it webkit.org/blog/16461/r...

Let's Encrypt is ending their certificate expiration notification emails in June letsencrypt.org/2025/01/22/e... I liked the service not as primary means of notifying me I should renew my certs, but as a notification that the renewal has failed. A renewal failure usually means I messed something up.

Nice 0-click deanonymization attack targeting Signal and Discord using Cloudflare cache metadata in the Cf-Ray HTTP header that contains the data center code (e.g. PRG for Prague). The reporter found a way to ask Cloudflare datacenters if the resource is cached there gist.github.com/hackermondev...

Had to send someone a hard drive with some data and wanted to know if no one had copied them when the drive was in the hands of the courier company. Yes, that's "tamper-evident" nail polish and tape 💅

"We and our 1276 technology partners ask you to consent to the use of cookies to store and access personal data on your device." 1276... technology... partners. I don't usually see those popups, my content blocker hides them, but this one caught my attention... that's a crazy number.

Let’s Encrypt will begin offering short lived certificates (6 days) next year! letsencrypt.org/2024/12/11/e...

It is quite interesting, but not unexpected, that rejecting an invalid CVE takes more time than publishing the invalid CVE. Publishing an invalid CVE can be (ab)used to DoS builds or CI/CD pipelines when you also check for vulnerable 3rd party libs (which you should) and block the build when found.

Safari 18.2 released 3 days ago has HTTPS-first/by-default mode: "Safari 18.2 on iOS, iPadOS, and visionOS will always try to load webpages over secure connections first, i.e. HTTPS by default. Only if the secure page load fails will Safari fall back to non-secure HTTP." webkit.org/blog/16301/w...

Just discovered a cool fact: "the last day of February, April 4 (4/4), June 6 (6/6), August 8 (8/8), October 10 (10/10), and December 12 (12/12) all occur on the same day of the week in any year." This year it's Thursday, today. en.wikipedia.org/wiki/Doomsda...

I love website easter eggs! og:image is a pic displayed when the link is shared on Facebook etc. and in this case it's just a logo but still. Nice one altisport #iddqd

A planned DSL outage earlier today, but luckily they gave me unlimited mobile data to use during the outage, or so they thought. Turned out the cell tower was also affected 😆

I was worried for a second that browsers like Chrome, Edge and Firefox will soon run out of version numbers (all are version 131 now) but then I checked my Teams version number: You have Microsoft Teams version 24295.605.3225.8804.

nginx 1.27.3 released yesterday disabled TLS 1.0 and TLS 1.1 protocols by default, nice nginx.org/en/CHANGES

Currently listening to @scotthelme.bsky.social and @troyhunt.bsky.social talking about PCI DSS (Payment Card Industry Data Security Standard) 4.0.1 new requirements, Magecart attack (more like attacks, sadly) and stuff.

Signature-based SRI is being spec'd right now: wicg.github.io/signature-ba... This will be useful for many use case and become relevant for PCIv4 compliance which requires assuring the integrity of sourced scripts (6.4.3). Please chime in and share your use cases: github.com/WICG/signatu...

Hey BlueSky! I case you missed it: I've created cspbypass.com A site where you can search for known CSP bypass gadgets to gain XSS. It already contains a bunch of useful gadgets with contributions from your favourite hackers. If you have some CSP bypasses to share, feel free to contribute!

Origin, site, eTLD, eTLD+1 and PSL are the terms I use in almost every post or talk and I needed a place to explain and compare them. This post started as a talk about something completely different, so... now I have to write the original one, too 😅 www.michalspacek.com/origin-site-...