Posts
4308
Following
738
Followers
1637
"I'm interested in all kinds of astronomy."
@cR0w "at the cost of research velocity while the vulnerabilities are patched."

I've spent enough time in enterprise settings to recognize that this translates to "security is a cost center and we spend as little on it as we legally can". I do love how they manage to also blame due diligence as a cause of not whacking more moles!
1
3
4
repeated

Alesandro Ortiz 🇵🇷🏳️‍🌈

🎶 Here comes another bubble.
The VCs are backing,
Baby let's get cracking. 🎶

Here Comes Another Bubble (2007):
https://www.youtube.com/watch?v=I6IQ_FOCE6I

0
2
0
@nullandnull I need something for one-off diagrams, I don't want to write a formal declaration this time. My best idea so far is to annote the bytes in some GUI that supports this (IIRC 010 does?), and take a screenshot...
1
0
0
repeated

i don’t usually respond to these kinds of emails, but this one made me so fucking mad that i blacked out and regained consciousness with this in my outbox

6
6
1
Dotcom bubble nostalgia in the local pubs restroom
0
4
6
Any recommendations for generating annotated hex dumps for #documentation, optimally (but not necessarily) something like @angealbertini's format dissections:

https://github.com/corkami/formats/blob/master/image/PNGRGB_dissected.png

#ReverseEngineering
1
1
0
RefluXFS: Local Privilege Escalation via XFS reflink direct-I/O race
(CVE-2026-64600)

https://www.openwall.com/lists/oss-security/2026/07/22/14

Mythos writes Qualys advisories now FML :P
0
0
0
repeated

Google just had its first negative cash flow quarter ever due to massive AI spending

Google continues to report big quarterly revenue, but its AI spending has skyrocketed.
https://arstechnica.com/google/2026/07/google-just-had-its-first-negative-cash-flow-quarter-ever-due-to-massive-ai-spending/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

8
8
0
repeated

The new UI quality of life improvements are pretty nice, especially jump anywhere and pathfinder. I'm starting to like them!

https://hex-rays.com/blog/ida-9.4-smarter-navigation-and-quality-of-life-improvements

Digging deeper into the SDK now, some recent changes in IDA 9.4 might impact my idalib-based plugins (hopefully in a good way).

0
2
1
repeated

the headlines are near satire at this point

0
2
0
repeated
repeated

My team @ @srlabs is growing. 🚀
We are looking for an experienced Forensic Analyst for our Blue Team. The ideal fit is a person that wants to dig deep into our clients' infrastructure to understand current attacker TTPs, somebody that wants to help build resilient IT environments by defending against current attack patterns and a true team player that helps clients prepare for or survive the worst case. And all of that can be done with amazing colleagues in an environment that fosters curiosity, growth while having fun together.
You know the game - if you know someone that knows someone - please send them this way.

https://security-research-labs.jobs.personio.com/job/2726007?language=en

0
2
0
repeated

first we got "prompt injection" aka "deciding to forget two decades of knowledge about secure composition of code and inputs, langsec, etc" and now we have "deciding to forget everything about capability-based security and writing a call of duty script about it"

2
3
0
repeated

if your "containment" is "telling the robot to be a good boy" you're not a serious person

2
9
0
"The intrusion started where AI platforms are uniquely exposed: the data-processing pipeline"

Sure, before AI no system ever had a "data-processing pipeline". Whatever that means.
0
0
2
repeated
repeated

rare lore: back in 2018 I came across a 500-page technical deep dive guidebook on SimCity 2000. In a process that took several years because they had so much backlog of manuals, magazines, etc, I sent it to Gaming Alexandria and they made a proper professional scan of it and uploaded it to archive.org. You can read it right now!

When I say technical... I mean there's a section on how to hex edit your save files.

https://archive.org/details/sim-city-2000-power-politics-and-planning-revised-edition-strategy-guide/

8
16
0
@schrotthaufen @jcoglan And coding agents gaslight the user by injecting "system reminders" prefixes that are invisible to the user but the LLM sees them as user messages and regularly refer back to those as user requirements.
0
1
2
I feel it's time to reshare this excellent piece, as it explains some general problems that relate to my previous posts:

Can chatbots craft correct code?

https://blog.trailofbits.com/2025/12/19/can-chatbots-craft-correct-code/
0
1
2
repeated

somehow I only recently learned that LLMs need the whole conversation fed back to them on each prompt so their i/o cost scales as O(n^2), something that would be considered completely unacceptable in almost any other production network-accessible software

5
5
2
Show older