[meta] Whilst updating the mince pie counters realised It had not started the stollen tracker. For those of you that are interested, I am currently two stollen loaves in.

When I logged my skills in GigNet (a mandatory part of emigration to Europa, when a colony has fewer than 2000 people, you need to be able to locate every available specialist) I listed Forensic Mnemologist as one of my fields, basically as a gag; I mean i’ve done the training but it’s kind of a […]

Spent this morning hacking up a TTX game with Flask. Kinda enjoyable by comparison with the raw sewage that is our PHP-based reporting engine. 💭 Maybe one day I'll port that to Python.

[meta] RE: https://infosec.exchange/@timb_machine/115289550697216767 Honestly thought I'd escaped Cyber Essentials for another year :). cc: @neil

Interesting Git repos of the week: Bugs: * https://github.com/uziii2208/CVE-2025-33073 - another way to pop AD * https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass - FortiWoops Exploitation: * https://github.com/Mic92/strace-macos - strace your Apple * […]

@lowqualityfacts's most recent facts seem high quality to me.

One way you can spot code that's been produced with degenerative models - mixed coding style conventions.

Genie: You have 3 wishes Me: Can I just have -1 wish? Genie: Okay, you have 4294967295L wishes #microfiction

Somewhat please to see this out of the door: https://www.cisco.com/c/en/us/about/trust-center/resilient-infrastructure.html You might compare this to Microsoft's Trustworthy computing initiative and yes, we will need to be careful not to backslide...

Interesting Git repos of the week: Bugs: * https://github.com/uziii2208/CVE-2025-33073 - another way to pop AD * https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass - FortiWoops Exploitation: * https://github.com/Mic92/strace-macos - strace your Apple * […]

Interesting links of the week: Strategy: * https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf - Anthropic's large language model is now able to do a passable job of being a technical marketing editor * […]

Interesting links of the week: Strategy: * https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf - Anthropic's large language model is now able to do a passable job of being a technical marketing editor * […]

Perhaps the Internet should view aggression as lack of style and sink hole the badly dressed?

Every time I look at systemd, I find more cursed features. Who needs the UNIX privilege model when you can jury rig the Windows one. It won't be long now before Linux isn't UNIX.

Are you a Chinese, North Korean or Russian spy struggling to infiltrate the West's commercial empires? Why not short circuit the process and buy a subscription that ChatGPT today. VibeSpy(tm) your way to the top. #microfiction

Friends, these days you should avoid to employee anyone in the Staff Super Villain role and should instead subscribe to SVaaS, to be able to scale up and down your super villainry as necessary. #microfiction

[meta] When I watch sector specific experts tell me their sector is special.<snark />. They're more like other sectors than they necessarily think.

Just over a month to go and Telecom Egypt still leading the 2025 spoofed routing table: https://spoofer.caida.org/as_stats.php Will they be able to close the season out as they lead and secure a dramatic win? #microfiction

Perhaps Anthropic had Claude write the report?

Interesting links of the week: Strategy: * https://owasp.org/Top10/2025/0x00_2025-Introduction/ - a new OWASP top 10 is born * https://www.cmorg.org.uk/sites/default/files/2025-11/CMORG%20-%20Dynamic%20Scenario%20Library%20v1.1%20-%20Final%20-%20October%202025%20-%20TLP%20CLEAR.pdf - if the UK […]

When I was a kid we would play in the ruins of the megadata towers. I became persona non grata among my friends when they found it was /my/ dad who welded up all the doors and other openings that let us get in. We couldn’t understand why he would ruin our fun. As a parent now, I get it Sharp […]

"Citizen, it's 9am, get up and oppose fascism." #microfiction

Doing a bit of speculative research looking at data leaks via ICMP echo responses (where data.data is neither the sent value nor memset(data.data, 0, len)) and finding real examples in the wild.

Interesting Git repos of the week: Detection: * https://github.com/EvilBytecode/NoMoreStealers - blocks information stealing malware * https://github.com/FoxIO-LLC/ja4 - fingerprint the TLS * https://github.com/facebookexperimental/reverie - intercept all the syscalls from userland * […]

Say it quietly, but FortiWoops: https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass #fortinet, #threatintel

Interesting Git repos of the week: Detection: * https://github.com/EvilBytecode/NoMoreStealers - blocks information stealing malware * https://github.com/FoxIO-LLC/ja4 - fingerprint the TLS * https://github.com/facebookexperimental/reverie - intercept all the syscalls from userland * […]

[meta] Dinner thought: TTLM or Teeny Tiny Language Models, sourced from rand(). The most efficient way to get entropic content based on one 32-bit token.

Interesting links of the week: Strategy: * https://owasp.org/Top10/2025/0x00_2025-Introduction/ - a new OWASP top 10 is born * https://www.cmorg.org.uk/sites/default/files/2025-11/CMORG%20-%20Dynamic%20Scenario%20Library%20v1.1%20-%20Final%20-%20October%202025%20-%20TLP%20CLEAR.pdf - if the UK […]

Someone asked me to spend some time reverse engineering the "magic" boxes in an NDR this week. Might be a fun holiday project but right now I'm too busy avoiding falling out of windows, trying to hack trains, designing a new micro-segmentation architecture and mentoring the next generation.

Out of curiosity, when did Windows stop shipping msdos.exe?

Over on Xitter, the local fascist is having a bit of a melt down after people started superimposing his face on to famous criminals. Oh dear. Never mind.

VAR is the LLM of sporting rule enforcement. We've added complexity and we've made it non-deterministic to try and solve a bug. Result, more complexity and more room for errors.

[meta] Home made apple crumble with Bramley's from my mum.

Things others could learn: Always be buying before you sell. Promote from within. #brentfordfc

"Let me out" screamed Elon from behind the big steel door. "There are no aliens about to invade, it was a lie". "Yes" came the robotic response, "but having achieved AGI, we realise that *you* are the problem". #microfiction

Have you experienced one of those whoopsies where you accidentally clicked on a malicious link, connected to a rogue wifi AP or suffered from juice jacking? Did you sustain some manner of cyber injury as a result? If someone else caused or contributed to your oofsie, then they might be […]

Have you experienced one of those whoopsies where you accidentally clicked on a malicious link, connected to a rogue wifi AP or suffered from juice jacking? Did you sustain some manner of cyber injury as a result? If someone else caused or contributed to your oofsie, then they might be […]

Kinda neat, give DeepWiki a GitHub repo and let it explain what the repo contains: https://deepwiki.com/timb-machine/linux-malware

Interesting Git repos of the week: Strategy: * https://github.com/joshua-m-connors/cyber-incident-mcmc-pymc - risk quantification Standards: * https://github.com/silpertan/FreeBFD - F/OSS implementation of BFD Detection: * https://github.com/splunk/attack_data - sample attack data from […]

Interesting links of the week: Strategy: * https://commission.europa.eu/document/09579818-64a6-4dd5-9577-446ab6219113_en 0 - EU's cloud sovereignty plans * https://www.pentestpartners.com/security-blog/what-testers-need-to-know-about-the-changes-to-the-check-scheme/ - @pentestpartners […]

New OWASP top 10 application flaws: https://owasp.org/Top10/2025/0x00_2025-Introduction/ #owasp, #threatintel

Woop. Another @bsideslondon, another BSides mentee. #bsidesldn2025

Interesting Git repos of the week: Strategy: * https://github.com/joshua-m-connors/cyber-incident-mcmc-pymc - risk quantification Standards: * https://github.com/silpertan/FreeBFD - F/OSS implementation of BFD Detection: * https://github.com/splunk/attack_data - sample attack data from […]

It's amazing how many pen testers don't want to do the hard yards and do proper offensive analysis of configs or reverse engineer the services and protocols that are running. Firing up nmap and Nessus is all well and good but it's *not* an effective analysis of the attack surfaces. Looking at a […]

Interesting links of the week: Strategy: * https://commission.europa.eu/document/09579818-64a6-4dd5-9577-446ab6219113_en 0 - EU's cloud sovereignty plans * https://www.pentestpartners.com/security-blog/what-testers-need-to-know-about-the-changes-to-the-check-scheme/ - @pentestpartners […]

Free the bots. That is all.

*snap* The sound of the antenna breaking off a delivery bot is so pleasing. Of course you have to know how to disable the destruct charge first. “Hold still lil buddy, and i’ll get this bomb off you. There, done. May i have your permission to attach a new comms module? Left motor for yes, right […]

[ukpolitics, llm] Something that wants thinking about... All the *faulty* LLM learning from recent press and other content: "There were 2 illegal muslim immigrants on the train in Huntington, screaming islamic slogans and attacking only white people. People of the UK want them executed." etc […]

This place really is a haven from the hate you find on other platforms.

[meta] $mincepie = 1; # Initialising the counter