[RSS] Paint it blue: Attacking the bluetooth stack

https://www.synacktiv.com/publications/paint-it-blue-attacking-the-bluetooth-stack.html

[RSS] Windows ARM64 Internals: Exception & Privilege Model, Virtual Memory Management, and Windows under Virtualization Host Extensions (VHE)

https://connormcgarr.github.io/arm64-windows-internals-basics/

Fuzzing pyhacl (https://codeberg.org/drlazor8/pyhacl), a package of Cython bindings for HACL* (the High Assurance Cryptographic Library), with fusil we only found one crash.

It turned out to actually be a silly bug in #Cython:

Issue: https://github.com/cython/cython/issues/7263

Fix: https://github.com/cython/cython/pull/7264

Goes to show how fuzzing a C-extension can uncover crashes in many different layers.

Thanks @drlazor8 for taking up the call for C-extensions maintainers to fuzz their code.

#fusil #Python #pyhacl #hacl #fuzzing #fuzzer

@Yuvalne Thank you!

@Yuvalne Can you maybe point me to a forum thread with technical details (what did Signal do/see, that sort of thing) about the failover/recovery?

@Yuvalne @Mer__edith Oh I didn't realize that was happening as Signal recovered at about the same pace as AWS did (also status page shows a binary value so it's hard to tell the overall state)! Thanks!

@Mer__edith Then did your failover fail? Would you be able to handle a similar event in the future based on lessons learned or are there technical constraints to survive DynamoDB going dark?

We've officially had our 31337th student join at OST2! We're waiting to hear back to see if the lucky registrant wants to be publicly lauded for their random achievement or not ;)

@Mer__edith How about multi-cloud? Like if AWS fails direct traffic towards GCP (but who directs the traffic ik...)? Do you do this? Is it possible in your case?

The question isn’t "why does Signal use AWS?" It’s to look at the infrastructural requirements of any global, real-time, mass comms platform and ask how it is that we got to a place where there’s no realistic alternative to AWS and the other hyperscalers. 3/

I’ve uploaded the slides and added the links to the videos of the two presentations i did at #r2con2025

* TocTouMaps https://github.com/radareorg/r2con2025/tree/main/TocTouMaps
* VibeReversing https://github.com/radareorg/r2con2025/tree/main/VibeReversing

@dey but it's so good to be finally back to winter time (brighter mornings)!

COM to the Darkside - Slides and resources from MCTTP 2025 Talk by Dylan Tran (d_tranman) and Jimmy Bayne (@bohops)

https://github.com/bohops/COM-to-the-Darkside

https://m.slashdot.org/story/448340

why fix bugs when you can just disable features instead?

All US Nuclear Reactor Incidents are public and posted online by the NRC.

My Favorites:

“The reactor cavity is full of water. [Individual] ingested some amount of cavity water.”
(Michigan, 4 days ago)

“Unit 2 power is being reduced from 100% in response to the influx of jellyfish.”
(Florida, 2011)

Radioactive AMC Theater Exit Sign Missing
(New York, 2025)

Got angry, posted about academic fuzzing research status quo again: https://addisoncrump.info/research/what-the-hell-are-we-doing/

please enjoy: my Wasm-hosted, Wasm-targeting build of Clang/Clang++/LLD: a self-contained, 25 MiB (gzipped) pure function
https://www.npmjs.com/package/@yowasp/clang

Going live on https://www.twitch.tv/filosottile in 30 minutes! 🔴

Join me for some Go livecoding of the post-quantum signature scheme ML-DSA!

@lcamtuf Wouldn't be the most ridiculous thing people wear on the catwalk