buherator / is on Nostr

A drunken debugger

Heretek of Silent Signal

Company / Blog: https://blog.silentsignal.eu/authors/b.html
Birdsite: https://twitter.com/buherator
GitHub: https://github.com/v-p-b
Personal: https://scrapco.de
Nudes: https://infosex.exchange

Last Notes

2024-10-11 10:21:56

Re: traffic lights hacking
We have a childrens book series, where the pets of the protagonist children often do reckless and outright dangerous magic, like changing traffic lights and being fascinated by all the hard breaks and horns. There is no explanation why such thing would be irresponsible and any "punishment" is very mild (and usually also self-imposed).
I think this book should not be read to/by children without a responsible adult explaining why the cute characters are actually dangerous psychopaths.
The writing is also objectively bad.
How can I responsibly get rid of these books (I don't want to destroy them)?
#Book #Bookstodon

2024-09-25 11:47:33

[RSS] CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability Deep-Dive
https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive/

2024-09-14 17:58:59

OpenAI’s ‘$8.5 Billion Bills’ Report Sparks Bankruptcy Speculation
https://www.asiafinancial.com/openais-8-5-billion-bills-spark-bankruptcy-speculation

2024-09-11 13:55:19

Getting code execution on Veeam through CVE-2023-27532
https://blog.scrt.ch/2024/09/10/getting-code-execution-on-veeam-through-cve-2023-27532/

2024-09-07 11:21:04

[Pwn2Own 2024] DOMArrayBuffer confused about ownership of backing buffer CVE-2024-3914
https://issues.chromium.org/issues/330759272?s=09

2024-09-04 14:24:43

Security mitigation for the Common Log Filesystem (CLFS)
https://techcommunity.microsoft.com/t5/security-compliance-and-identity/security-mitigation-for-the-common-log-filesystem-clfs/ba-p/4224041?s=09
#windows

2024-09-03 09:06:12

:O
"The TMS9900 is bonkers. Big endian, has no stack pointer, and there's an instruction to execute the contents of a register as if it were an instruction in memory." - @npub1zm6…wvsx
"Mike Brent (tursilion) made an awesome TMS9900 code generator for CVBasic, so now it can target TI-99/4A computers. The picture shows Viboritas running in the Classic99 emulator." - @npub1el4…pe3k
https://github.com/nanochess/cvbasic

2024-08-28 15:44:26

[RSS] CVE-2024-37079: VMware vCenter Server Integer Underflow Code Execution Vulnerability
https://www.thezdi.com/blog/2024/8/27/cve-2024-37079-vmware-vcenter-server-integer-underflow-code-execution-vulnerability

2024-08-18 13:35:34

- reply

Presentation can be an important factor, but an ad is an ad. My prev example also shows that we don't necessarily know what to look for in the first place.
I think we should ask questions like "What is the proper way to distribute information about different classes of products/services?" (the answers for medicine and fancy cars surely must be different) or "Why do we have ads in the first place?" so we won't throw out the baby with the bathwater.

2024-08-18 13:08:26

- reply

I probably hate advertising as it is more than most people, but we have the old saying: "even the best wine needs a banner", and I can't dispute that.
Example: It recently crossed my mind that maybe I could rent cargo bikes when needed and turns out I could! This service would've been very useful to me, but I simply didn't know about it before. An ad in this case would've been beneficial for everyone.
My point is that ads don't necessarily "inject" a need but an option. Problem is that while the latter increases buyer freedom, the former increases seller revenue so guess which type of ads we see more frequently...

2024-08-15 18:14:22

A Formal Analysis of SCTP: Attack Synthesis and Patch Verification

2024-08-15 17:35:37

[RSS] Instead of putting a hash in the Portable Executable timestamp field, why not create a separate field for the hash?
https://devblogs.microsoft.com/oldnewthing/20240815-00/?p=110131

2024-08-11 09:21:19

Time-travel Testing of Android Apps
https://mboehme.github.io/paper/ICSE20.TTT.pdf

2024-08-05 13:37:35

University student phished others so he could steal their grants. Article in Hungarian:
https://hvg.hu/itthon/20240805_Feltorte-a-Neptun-rendszert-es-maganak-utalta-el-a-diakok-osztondijat-a-csalo-ebx
I'd like to note that In my time we wouldn't think of stealing from broke-ass students like ourselves...also had proper RCE's :P
#Hungary #Neptun

2024-07-20 14:34:10

- reply

testing stuff with DRM can be tricky though: https://infosec.place/notice/Ak77QQbjZ0Z52TP6I4 (not saying this as an excuse, but a potential contributing factor)

2024-05-30 17:55:13

What's next for Kagi?
https://blog.kagi.com/what-is-next-for-kagi

2024-05-30 10:51:33

RFC for 700 HTTP Status Codes
https://github.com/joho/7XX-rfc

2024-05-22 13:21:27

We should start using phrases such as "AI infested" in regards to software.