Dmytro Oleksiuk

@earthshine@masto.hackers.town 1) GDID tracking doesn't depend on a Microsoft online account; it works with standard local accounts as well; 2) This feature isn't exclusive to Windows. For instance, Linux has an /etc/machine-id file, which Chrome (and many other programs) logs to its servers; 3) There's no easy solution for this problem: as long as you're using any proprietary software with its own auto-update mechanism, you'll always be tracked;

RE: https://mastodon.social/@d_olex/116902388645366483 Many people have drawn entirely wrong conclusions from this post. Meanwhile, an actual solution for preventing this kind of tracking lays in a different ballpark: 1) Get a burner laptop for your hacktivism or organized crime activities, never use it for anything else; 2) Get some dedicated hardware to run your VPN or Tor client, for example -- a portable battery powered router with OpenWrt; 3) Configure and use this setup in a way that prevents the laptop from accessing the internet directly;

Slop-coded SPARC64 exploit for Solaris kernel vuln that recently been fixed in Illumos by Dan McDonald: https://www.illumos.org/issues/18118 https://github.com/illumos/illumos-gate/commit/08292a06bdfa570d21571965b7bd0f053b3aaaa5 No KASLR, no kernel heap NX -- ain't difficult target, heh. I don't have an access to latest 11.4 SRU to check if it was fixed by Oracle on current version, but on 11.3 SRU 36 it still there

@Drums_in_the_night@ieji.de @earthshine@masto.hackers.town /etc/machine-id is not the root cause — it’s just illustrative example. Does your machine randomizes its hardware IDs and serial numbers every reboot? They’re also telemetry sources that gets logged

👏 👏 👏 😊 https://lore.kernel.org/linux-media/CAHk-=wi4zC+Ze8e+p3tMv8TtG_80KzsZ1syL9anBtmEh5Z40vg@mail.gmail.com/

@virtualabs@mamot.fr About 30-40 minutes, I also submitted my feedback on the website

@pwinn@qoto.org @mistakenotmy@mastodon.social ... and to put some serious nails into the coffin of "LLMs are dumb and can't solve puzzles" take -- here's Hack The Box CTF profile of my Sonnet 4.5/4.6 based AI bot: it can solve insane difficulty tasks and performs on the same level with top 0.5% of human players. Most of these tasks are recent ones so it doesn't have any writeups or solutions in its training data. So yeah: trust no one and conduct your own experiments :)

@pwinn@qoto.org @mistakenotmy@mastodon.social All models available under free subscription are able to produce correct answer for different random words 🤷🏻 (haven’t tested with Opus 4.7 since I don’t have pro plan account under my hand)

@pwinn@qoto.org @mistakenotmy@mastodon.social … and completely random (presumably not hardcoded) question, just in case

@mortentorten@subversive.zone @ShadowJonathan@tech.lgbt “The others” has obvious issues right at this moment with very basic stuff like not electing dictators and criminals for presidents, it does not inspire any trust like at all

@municipaladhesives@kolektiva.social @ShadowJonathan@tech.lgbt Sure I am, there’s no way to have sustainable society with 1/1000 proportion of decent people to moochers

@ShadowJonathan@tech.lgbt We don’t have such system yet because for each million of freaks there’s a billion of normies who will abuse & scam the shit out of it 😬

@Li @micahflee TBH this whole situation looks like “actors of security theater condemning other people for participation in activism theater” which makes it even more ironical

@micahflee In what kind of universe you even seen an infrastructure that consists of “trusted and valuable” nginx proxy that being tried to pwn by “malicious backend application” 🤦🏻‍♀️🤦🏻‍♀️🤦🏻‍♀️

@Li @micahflee I meant self-hosted infrastructure like the one that author of the post tried to scan: it looks like potential attacker can't even reach this vulnerable code on their setup

@jzb “Imagine that AI/LLM tools were being marketed to workers as a way to do the same work more quickly and work fewer hours without telling their employers” — heh, most of non-nerd people who works remotely that I know already using LLMs for this exact purpose without any marketing

@siguza@infosec.space I don't share this unfounded pessimism, worst software projects that I ever seen been written by humans, not AI

@siguza@infosec.space What happened to rsync?

@siguza@infosec.space Anxious crowd seen AI commits and got triggered for no reason. Meanwhile, author of rsync is saying that LLM assistance were used to rewrite its unit tests. I haven’t looked into its source code by myself, but I will apparently trust an actual developer of this project rather than “activists” and “opinion leaders” https://medium.com/@tridge60/rsync-and-outrage-d9849599e5a0

@virtualabs@mamot.fr Fun but too easy: AI bot spent on this task about the same amount of time as it usually spends on easy/medium level HTB boxes

@mistakenotmy@mastodon.social lol, fake news

@preinheimer@phpc.social Konosuke Matsushita

@pwinn@qoto.org @mistakenotmy@mastodon.social older model with different random word