@unchartedworlds Not sure how quoting myself helped, but glad it did.

"- implicit consent vs explicit consent"

Do I understand correctly that you think requirements for consent are/should be the same on Fedi as they are on a city street?

"- context & scale as factors."

Do I understand correctly that you think Fedi and a city street are similar in how many people you meet, how many of them are familiar/stranger to you (scale) and that people participate in the street traffic in a similar capacity as they do in the Fediverse (context)?

@wdormann @malwaretech See, this removes friction! We should be thankful.

CVE Crowd's search feature is now public!

This means you can now search for vendors, products, package names or CVE numbers and find related posts on the Fediverse and Bluesky - all without signing up anymore.

Previously, I used sign up as an obstacle for bots. But since #ALTCHA proved good enough to keep those away, it now also secures search.

I hope this is useful to y'all!

https://cvecrowd.com

#Pentesting #AppSec #InfoSec #CyberSecurity #BugBounty #Hacking #CVE #CveCrowd

OMG did @jerry just update Akkoma so we now have enhanced search? 😍

Thank you!

@infosecdj Right??

I'm on this picture and don't like it.

...If anybody's looking for a person who basically does everything from compiler {backend,frontend} development, GPU driver development, to hardware/firmware security research, let me know. #getfedihired

US only.

@0v1 Parser generators: are we a joke to you?!

@unchartedworlds

My Step 1.: "My understanding is ..."

My Step 2.: "I'm genuinely curious if there's any point I miss"

Waiting for you to take Step 3.

@unchartedworlds TIL about steel-manning, it really sounds useful! When it comes to analogies though I think it may not be the right tool because arguing against an analogy requires to point out exactly where it breaks down instead of focusing on where it confirms the opposing argument. For example I could argue that it's fine to take pictures of birds on the street, but this would be an obviously bad argument for stalking people because people are not birds.

I described how I interpreted your analogy, I think this is as far as I can get describing what I think you think (lacking psychic abilities).

I also tried to explain our differences in thinking, and I'm genuinely curious if there's any point I miss (where I didn't manage to steel-man enough)!

@Viss @wdormann @cR0w yeah I'd be very interested in a deeplik :popcorn:

RE: https://mastodon.social/@campuscodi/117128474535423979

Ah, I get it now. They are doing the same thing to CISA that they did to 18F and login.gov - kill off perfectly functional (in fact, superior, non-partisan, cost-effective) public tech infrastructure so it can be privatized by attrition. The classic "starve it, then declare it ineffective" tactic. 😠

PSA: if you have a website or a blog, you can use Google Search Console to turn off the use of your site in AI overviews. You get multiple scary warnings if you try. I was curious what's the actual impact on site traffic, so I turned it off. It went from ~1k AI summaries a day to zero, with no measurable impact on visits to the site.

"You never can tell with bees."

I want a Firefox extension that knows how to replace every single "N months ago" label with the actual exact timestamp (using patterns for how the data is hidden in tooltips, click-to-expand, etc.).

That shit is SO unhelpful. Like if I'm looking back at git history, I don't care that a change was made roughly 3 months ago. I care whether it was made before or after an email I'm looking at that said something relevant to the change.

⚠️ A few hours ago, a malicious crate was discovered on crates.​io which spread as a dependency of `arrayref` and some other crates, likely due to compromised credentials. The affected versions have been deleted.

For details and how to see if you are impacted, see: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

@unchartedworlds My understanding is that on the street people mostly interact out of necessity, and because of this it is considered rude (or even illegal) to e.g. intercept one's conversation, follow them etc.

In my view the web and esp. social media[1] (like microblogging platforms of Fedi) were created with the explicit intention for people to be listened to, followed, commented on etc. (I'm sure you can come up with analogies, but I won't mention any to avoid misdirecting the conversation.)

Technology allows us to create more private/safe infrastructure than a street (encryption, access controls etc). Social media generally aims at the opposite direction (Fedi provides public plain text APIs for everyone to use).

[1] I use this word in the sense where people curate/produce information for each other, like on (micro)blogging platforms. The "let's keep in touch with my aunt" use-case is less relevant when talking about public content.

[RSS] The benchmarkpocalypse

https://danluu.com/benchpocalypse/

Microsoft killed my exploit 😢
This Friday on @offby1security I'll talk to @steph3nsims about what why, how and if this is the end for this class of exploit techniques

One day I'll sit around the camp fire and be like "You know grandpa Bas used to this stuff by hand before the em-dashes took over" ... Things like https://github.blog/security/vulnerability-research/now-you-c-me-now-you-dont-part-two-exploiting-the-in-between/ were always less about the bugs themselves and more about how to approach attack surfaces and exploit development as an adventure in creative debugging and ultimately just fun puzzling. Of course, that very same kind of iterative text based feedback loop is perfect for the current fancy text completion revolution. It's just a bit of a shame that the landscape seems to be shifting from "that was so much fun to figure out!" towards "oh wow it was able to figure it out".