Replying to
@zackwhittaker@mastodon.social a post-mort can be blameless, but that doesn’t make what happened legal! I wonder who blamelessly accepted liability?
Can’t wait for discovery in the (surely inevitable?) lawsuit.
Remote
Space Invader
@spaceinvader@social.securitytheater.net
mastodon 4.7.2Cloud Security @ Temporal; he/him; Slava Ukraini!
38 Followers
120 Following
21 Posts
Joined January 17, 2023
Replying to
@anthropy This is legit good news. I tried 20 years ago to repurpose my grandpa’s old tower into a Fedora machine. An OS update broke it, and the advice on forums was to SSH in and do some hand-wrangling of files.
Got a gentle chiding from him every so often until Alzheimer’s took his memory about how good I am with computers except his, and he hoped “that Linex thing” wasn’t still causing trouble.
Replying to
@slowpoke@chaos.social I came looking for someone to mention this. A wonderful gesture of humanity.
https://www.nine.com.au/sport/peter-norman-tommie-smith-john-carlos-black-power-protest-mexico-olympics-1968-20200616-p5imf0.html
Replying to
@bertdriehuis@infosec.exchange @MisuseCase@twit.social it depends on how you use the tool. Outsourcing all thought and creation to AI is almost certainly going to cause issues. Having an AI vulnerability finder take a pass before release can be akin to running code through a fuzzer. Letting the LLM fix issues may fix one bug at one time, but isn’t a holistic approach to fixing a codebase.
Managing burnout and upskilling jr devs was a concern before LLMs. Orgs that fail to recognize and manage that will fail regardless.
Replying to
@MisuseCase@twit.social Yeah, the KEV is still being updated AFAIK. But I don’t think I’d rely on that too much, because who knows what’ll happen to CISA next.
I am glad to see bugs being surfaced and patched. This industry likes big splashy things and doesn’t seem to respond as well to the effort it takes to build, maintain, and test. Compared to bridge building—which humans have done for millennia—software is in its infancy. There just aren’t the same standards around how to really build software well.
Replying to
@mattblaze@federate.social I didn’t used to think of myself as a single-issue voter, but I sure as hell am now.
Replying to
@rmd1023@infosec.exchange @hacks4pancakes@infosec.exchange always makes me thing of this Vietnam era Zippo.
Replying to
@GossiTheDog at least while I’m in charge of issuing CVEs, we won’t do this.
Replying to
@SwiftOnSecurity Once you know E=mc^2, it’s “simply” a problem of figuring out the best way to take the easiest form of mass and convert it into energy.
I think it was mentioned in Oppenheimer; everyone knew an atomic weapon was possible, and it was a race for how, not if.
Replying to
@xyla@shitpost.trade everybody’s like “drink more water” but then everybody’s like “ohhhh noooo not like that!”
Replying to
@mttaggart@infosec.exchange Very cool. I can barely code without a linter, and the tips have definitely made me a better coder. Things usually compile by the second try 😛.
But also… it’s concerning that something so easily detected by the simplest of static analysis tools doesn’t seem to have been in use for this very important code.
Replying to
@mttaggart@infosec.exchange TIL. Do linters flag this?
(I do not write mission critical Rust. Or even important Rust. Just learning the language, slowly. )
Today I Learned: In GitHub, you can have a branch protection rule for a branch that doesn’t exist.
Add it to the arcane knowledge I’ve gathered over the years. I don’t know *why* this capability exists, but it does, and can cause strange issues when you don’t expect it.
This could only go poorly and I’m here for it. Only missing a way to malloc-over-IP and you’re halfway to summoning the Four Horsemen of the apoCalypse.
RE: https://mastodon.social/@wttdotm/117242029929362342
Video games can be works of art. (Although this is art imitating life, not the other way around.)
https://uphack.io/blog/post/the-hugging-face-incident-is-not-an-ai-story/
OpenAI’s hack of Hugging Face isn’t about AI hacking stuff, it’s about the same very human failures we see constantly in InfoSec. I liked this write up of those failures.
@gruber@mastodon.social This sort of thing does not exactly inspire confidence in iCloud Drive.
Replying to
@AskPippa@c.im @infobeautiful@vis.social oh, huh, I was reading the first column and didn’t spot it. Thanks. On me for assuming “what it is” would be fluoride, and not reading the “where it’s from” column all that closely.
Replying to
@rysiek@mstdn.social @pluralistic@mamot.fr Browsers used to auto-find and put an RSS button in the URL bar.
Used to.
I kinda understand why they stopped, but I wish it was a user-selectable option so power users could easily find those feeds. Also, it would allow for the creation of a viral TikTok video about a “secret option” to break free of algorithms which would do more for teaching non-technical users about RSS than anything else ever written.
Replying to
@MisuseCase@twit.social My 2¢: like any vuln, it’s serious if you have exposure to them and not serious if you aren’t. CVSS scores are just a starting point and not the be-all-end-all.
I’ve handled both AI and human reported vulnerabilities, and a recent human-discovered one had the highest CVSS score I have personally issued, but required a unique configuration. An AI-reported vuln had a lower score but was more likely to be present.
Seriousness requires context to determine.
Replying to
@infobeautiful@vis.social suspiciously absent: Fluoride. Purpose: help you keep your teeth.