I need a target.

Posted this a couple days ago, but going to post it again. Such great and interesting research www.sentinelone.com/labs/fast16-...

Brain reaching cave man like processing capacity as I churn way too many simultaneous tasks.

Sitting in the garden and there is so much pollen on everything.

Added a sticker. Thanks @efrowning.bsky.social This machine certainly tries to kill this packet.

Threat model and Threat modem are way too close for comfort. 😅

Caught this dude chilling in the sun.

why is it called Claude team subscription and not token hire

Well it's 0-day Friday

What I’m grateful for today? The pigs have not realized that if they worked together they could easily open the gate with weight alone. I’ve updated my risk register tho.

New, by me: App and website hosting giant Vercel says some of its customers had data stolen *prior* to its recent hack, suggesting that the company's security incident is far broader than first known. Vercel also said it's identified additional customers who had data compromised.

I think companies with bug bounty programs should pay a "we didn't patch fast enough" dupe penalty the longer away it is from the original report date to incentivize patching faster because you need to optimize this in the age of AI

For those that have been around the internet for a few loops and know exactly what I'm talking about, AI has just made the loop faster is all I think.

Sometime later… Why does the AI keep drawing “fuck zuck” in cursive with the mouse between every click on this agent workflow?

First crash on my one wheel. Fine but ouch! Managed to hit the ditch instead of the pavement.

Wild bluebells along the path. 🌱

🤘 /jig happy friday ya'll.

Tokengrinder slowly going through a solid decade of research ideas and notes. Vulns that were almost there™ that have been nagging at me for years.

Thursday evening.

Once again, as the president of the "links are meant to be clicked, QR codes are meant to be scanned" club, I ask that you do not click any links I send you.

Apple sold you out. "a zero-click Israeli spyware that reads your Signal and WhatsApp messages without you ever tapping anything" youtu.be/bElVBtRuGTQ

A critical security issue I've been trying to report to SpankMatch/SpankChain since Dec 2023 has finally been addressed. This post details that, plus the shitshow the waning days of GCR were. Quote GCP: "The product team has currently not expressed interest in proactively reaching out to users."

Hit an important milestone with the truck today.

"Our version is too OLD for this specific CVE" When you don't update your libraries and narrowly avoid exploitation.

status: API's back up.. Voice in my head plays: "Hit It Very Hard" youtu.be/u4uj2KEfUWg?...

Hacking by the fire Turning n0-day into 0-day. 🎶 clickity, hackity, pwned.

Ever just run your hands through some nettle just for fun?

No CVE, no exploit send skeet moak.ai

The kids have a great sense of humor.

Congratulations on your bounty award! Thank you for partnering with us to secure customers.

Locking in and Sabotage comes on....

I held an iPhone 4 last night and I really want that size and squared off form factor back

can’t phish the man? phish the lobster instead!

Brutal.

After all these years... my first bounty award from MSRC! "Based on the assessment from our engineering team, we have determined that your case ###### is eligible for a US$6000.00 bounty award under the Open Source Bounty Program. Congratulations!" This will be a fun one to get to share.

Lately it seems like I'm feeling and doing my very best and also feeling and doing my very worst at the exact same time.

A GPU-based rowhammer attack achieved root access on a Linux system gpubreach.ca

Developers are in scope attack surface.

🥰 Analog data centers.

"By weaponizing VS Code's tasks.json auto-execution feature, attackers have created a scenario where simply opening a cloned repository in your IDE can compromise your system. No user interaction required beyond a git clone and opening the folder. opensourcemalware.com/blog/tasksja...

I respect that the leaked source code for the Claude client is protected by copyright. But wouldn’t it be ok for me to train my LLM on it? You know, fair use and all that. Asking for a friend

“We confirmed the behavior you reported.” is nice to hear back for once 😅

Do unsafe things where unsafe things can be done safely.

If you don’t take breaks for yourself the universe will provide one for you that you will probably not enjoy.

Gary has a new hat for the Spring season. Now go away.

If you're heading out to a protest, there are a number of concepts to keep in mind to keep yourself—and your data—safe. ssd.eff.org/module/atte...

I am ready to log off.

Friend: "oh shit, I stole the wrong Adam Baldwin's identity... now I'm getting emails with bad scripts to review" Me: "lol wrong bad scripts"

Today is Friday I do not have a bug yet but the day is young

A drill works really well to put a new hole in a leather belt.