@Viss @wdormann @cR0w yeah I'd be very interested in a deeplik :popcorn:

RE: https://mastodon.social/@campuscodi/117128474535423979

Ah, I get it now. They are doing the same thing to CISA that they did to 18F and login.gov - kill off perfectly functional (in fact, superior, non-partisan, cost-effective) public tech infrastructure so it can be privatized by attrition. The classic "starve it, then declare it ineffective" tactic. 😠

PSA: if you have a website or a blog, you can use Google Search Console to turn off the use of your site in AI overviews. You get multiple scary warnings if you try. I was curious what's the actual impact on site traffic, so I turned it off. It went from ~1k AI summaries a day to zero, with no measurable impact on visits to the site.

"You never can tell with bees."

I want a Firefox extension that knows how to replace every single "N months ago" label with the actual exact timestamp (using patterns for how the data is hidden in tooltips, click-to-expand, etc.).

That shit is SO unhelpful. Like if I'm looking back at git history, I don't care that a change was made roughly 3 months ago. I care whether it was made before or after an email I'm looking at that said something relevant to the change.

⚠️ A few hours ago, a malicious crate was discovered on crates.​io which spread as a dependency of `arrayref` and some other crates, likely due to compromised credentials. The affected versions have been deleted.

For details and how to see if you are impacted, see: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

@unchartedworlds My understanding is that on the street people mostly interact out of necessity, and because of this it is considered rude (or even illegal) to e.g. intercept one's conversation, follow them etc.

In my view the web and esp. social media[1] (like microblogging platforms of Fedi) were created with the explicit intention for people to be listened to, followed, commented on etc. (I'm sure you can come up with analogies, but I won't mention any to avoid misdirecting the conversation.)

Technology allows us to create more private/safe infrastructure than a street (encryption, access controls etc). Social media generally aims at the opposite direction (Fedi provides public plain text APIs for everyone to use).

[1] I use this word in the sense where people curate/produce information for each other, like on (micro)blogging platforms. The "let's keep in touch with my aunt" use-case is less relevant when talking about public content.

[RSS] The benchmarkpocalypse

https://danluu.com/benchpocalypse/

Microsoft killed my exploit 😢
This Friday on @offby1security I'll talk to @steph3nsims about what why, how and if this is the end for this class of exploit techniques

One day I'll sit around the camp fire and be like "You know grandpa Bas used to this stuff by hand before the em-dashes took over" ... Things like https://github.blog/security/vulnerability-research/now-you-c-me-now-you-dont-part-two-exploiting-the-in-between/ were always less about the bugs themselves and more about how to approach attack surfaces and exploit development as an adventure in creative debugging and ultimately just fun puzzling. Of course, that very same kind of iterative text based feedback loop is perfect for the current fancy text completion revolution. It's just a bit of a shame that the landscape seems to be shifting from "that was so much fun to figure out!" towards "oh wow it was able to figure it out".

I escaped the WebAssembly's sandbox and got arbitrary shell execution on the host. https://trustsig.eu/blog/wasm2c-tableflip-unchecked-calloc/

No perfect 10s this time, but that's a lot of AIX vulns from the other day:

https://www.ibm.com/support/pages/node/7283858

@unchartedworlds Of course. Our disagreements root in the fact that you find a street a good analogy for the Internet (in fact, I should've written Fedi/social media), while I don't.

@unchartedworlds The Internet is not the street though, and there seems to be a divide about how different groups of people see the Internet.

Case in point: When I posted first on Fedi I expected my post to be shared, digested, etc. far and wide. Some people clearly expected the opposite.

Norms may have changed, they sometimes do. Still my best bet is that content both of us post on Fedi is shared, digested, etc. far and wide.

@jik "I'm not going to call you names" - I didn't mean you either, sorry for the confusion!

The funny thing is that I don't even think our stances are too far apart, but this topic somehow still triggers flames after all this time.

I expressed my opinion, you expressed yours. I'm OK with not taking this further.

@jik Thanks for the reasonable reaction! I'm thinking about said controls as a band-aid for an already messed up situation (see the first part of my post). E.g. an opt-in system could make all historic posts followers-only by default. This wouldn't affect existing archives ofc. (which do exist whether we like it or not) and may be too much headache for users. We'd need arguments and compromises.

Calling each other names only conserves the current situation where one chunk of users is missing key features while an other is living in a false sense of privacy.

Just published “Vulnerability Analysis of CVE 2025 22226 Information Disclosure Due to OOB Read in VMwares HGFS” by Alex Zaviyalov the first vulnerability in an ITW VMWare guest to host escape chain 👇

https://www.nccgroup.com/media/1mzfvyzl/nccgroup_cve-2025-22226.pdf

We have achieved kernel code execution via the IDT under Windows 11 with VBS/HVCI/kCET enabled.

Read the technical write-up here: https://exploitpack.com/blogs/news/idt-table-hijacking-under-vbs-hvci-kcet-in-windows-11

#Windows11 #KernelExploit #IDT #VBS #HVCI #kCET #DataOnly #RedTeam #ExploitResearch #WindowsSecurity #infosec #pentest

@dsalo See, "we can't even seem to have a proper discussion about the possible solutions". Bye!

@dsalo I think the root of this problem is that people who want to be forgotten historically chose the absolute worst platform for their communication: a public[1] microblogging platform.

I strongly believe a searchable, archived Fedi would be immensely useful and necessary so please don't suggest that everyone in the Fedi are on the same page about this. I'm not against having controls (either opt-in or opt-out) to control indexing on a per-account basis, but unfortunately we can't even seem to have a proper discussion about the possible solutions.

[1] The consent so many people seem to miss is in the act of pressing the button to *publish content on the open Internet*.