buherator

A drunken debugger

Public Key

npub1n3p6whdpmt9k8rxzcmvrs053utg662lfrgdxh7dl9t04ff8sdk7qqdjee0

NIP-05 Address

buherator_at_infosec.place@mostr.pub

Profile Code

nprofile1qqsfcsa8tksa4jmr3npvdkpc86g795dd90535xntlxlj4h655ncxm0qpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43quksehr

Publishing to

relay.mostr.pub

Author Public Key

npub1n3p6whdpmt9k8rxzcmvrs053utg662lfrgdxh7dl9t04ff8sdk7qqdjee0

Show more details

Last Notes

2024-08-12 19:04:50

Wormable Substack XSS
https://blog.calif.io/p/wormable-substack-xss

2024-08-09 07:15:59

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1&s=09
Latest by Orange Tsai!

2024-07-16 14:07:06

- reply

@npub1t7d…pqpp "you'll give me a directory of files" - the answer may be related to the fact that many young people don't have a concept of files (blame smartphones)?

2024-06-23 06:58:53

- reply

@npub1zdz…tl8u Any recommendations?

2024-05-30 10:51:33

RFC for 700 HTTP Status Codes
https://github.com/joho/7XX-rfc

2024-05-27 15:53:11

- reply

@npub1yks…rgk5 rejtő jenő audiobooks (YT) + ebook (mek.oszk.hu)?

2024-05-04 11:29:13

- reply

@npub17lg…9uux Medium's half-screen sign-up form certainly doesn't help with audience conversion. Just a tip.

2024-04-25 19:53:47

Today I realized our national postal service uses a *lot* of printers at customer desks. Maintaining those and the software that use them must be The IT Hell.

2024-04-22 15:06:32

[RSS] RESTler: Stateful REST API Fuzzing - Microsoft Research
https://www.microsoft.com/en-us/research/publication/restler-stateful-rest-api-fuzzing/

2024-04-21 16:53:06

- reply

@npub1zdz…tl8u IME sound making toys make you learn basic electronics 2x as fast and your dexterity also improves so you can dis/reassemble as quickly as possible without the kid noticing

2024-03-23 10:33:38

- reply

@npub1f6a…pnql Now let me put on my Grumpy Security Guy Hat:
Verifying code is incredibly hard. One of the main dangers of LLM's I see is that it's really easy to conclude that the code is correct because it works in the general case, but it will break havoc in edge cases. Worst, you won't be able to reason about those edge cases because you wouldn't know how the code works (you can figure it out of course, but then there goes your claimed efficiency).
Now for toy problems this is all good and well. On the other hand we've all seen toy scripts ending up in production...

2024-03-23 08:55:29

- reply

@npub1f6a…pnql
"and it was clearly wrong" - Here's my theory: LLM's are useful if results are easy to verify.
In your example eyeballing can easily tell if the resulting shape is _similar_ to the input area. As I understand your use-case doesn't require too much precision, which is totally fine, but it's important to ask how much harder your problem would get if you wanted to make sure the input and output shapes are precise matches? Would you use an LLM to write some verification code? How do you decide if that code is correct? (I think in this particular case actual verification could be actually pretty easy, but I wanted to stick with the example)

2024-03-17 08:34:38

The real problem with anonymity - by @npub1hyk…3p33
"There is a category of person who reliably uses a certain, specific kind of anonymity to do vicious things that inflicts serious harm on whole swathes of people: corporate bullies."
https://pluralistic.net/2024/03/04/greater-corporate-fuckward-theory/#counterintuit-ive

2024-02-17 14:48:01

- reply

@npub17qe…v7la @npub13w3…9k68 By principle I mean having an open, distributed network where everyone is welcome, except when some peer is unwanted for $reason, in which case everyone should block (see the Fedi Pact) and those who don't are $badpeople.

2024-02-17 14:22:00

- reply

@npub17qe…v7la @npub13w3…9k68 There was definitely a push to block Threads, which is by definition opting-out, but I think the principle is the same. I think if Bsky implemented AP, there would be a similar push, see:
https://infosec.space/@jerry/111924397250228557

2024-01-02 19:06:50

I'm not a huge #history nerd but this is amazing:
Turns out the Austro-Hungarian Empire had a colony in China(!) after they helped out western allies against the Boxer Rebellion, and a later Chinese Emperor (Yuan Shikai) even had Austrian citizenship (article in Hungarian):
https://falanszter.blog.hu/2011/01/19/az_osztrak_magyar_monarchia_kinai_gyarmata
In short this is why my son could find Chinese letters on a cannon at the side of the Danube.
/cc @npub1l2x…ydl8

2024-01-02 18:46:49

H1 should sanction LLM reports, wasting the time of OSS developers like this is simply infuriating.
https://hackerone.com/reports/2298307

2023-12-10 09:30:56

I have a dockerized environment. The development environment sets up and tears down the database. The whole thing runs in a VM, that worked just fine a month ago.
I started the VM after a month (I literally didn't touch it since last run), killed and removed and stopped containers. Pruned volumes. The database container just won't start.
Nothing was upgraded.
I reboot the VM, the system works.
Now tell me a) how this is possible b) how am I not supposed to be extremely angry.

2023-11-29 16:53:40

CVE-2023-49103 (ownCloud):
"It seems more likely that sensitive environment variables would be present in a Docker installation, as this is a common technique used to pass secrets to a Docker container at runtime, however as we have seen, exploiting ownCloud shipped as a Docker image does not seem possible, due to either the additional rewrite rules in the .htaccess file, or the inclusion of phpinfo on the list of disabled PHP functions in certain ownCloud Docker images."
https://attackerkb.com/assessments/a2b1b41a-0a26-4226-a53b-ae72e6c65107

2023-11-10 07:48:24

Session File Relative Path Traversal in sudo-rs
CVE-2023-42456
https://github.com/memorysafety/sudo-rs/security/advisories/GHSA-2r3c-m6v7-9354
https://media.infosec.place/infosec-place/469ed5fe3e051a904b72ebb5a3e2da058f58dfa15f5db8dc6944aa8c8f7a055a.jpeg

2023-09-28 10:58:30

Cisco: Reports about Cyber Actors Hiding in Router Firmware
A few quesitons:
"Modern Cisco devices include secure boot capabilities, which do not allow the loading and executing of modified software images." -> Do the affected devices count as "modern"?
"The stolen code-signing certificates mentioned in the report are not from Cisco." -> How are they relevant then?
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csa-cyber-report-sept-2023
Original CISA advisory:
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a

2023-09-10 17:29:55

- reply

@npub1s2r…7gng
https://media.infosec.place/infosec-place/2937b5975de8219fadad010c5e57c30d99b5fe07c8fb0befbb58ae0ad6a2fcaa.gif