I heard a very encouraging insight from @j00ru many years ago: either everyone has looked at it because there are always bugs, so there will be more, or no one has looked at it, so there will be bugs. In both cases, there are bugs. I welcome the machines to the playing field.

Cortex is a long-term, multi-tenant scalable open source storage for Prometheus and OpenTelemetry.
Earlier this year we conducted a security audit sponsored by @ostifofficial

Check our report here:
https://blog.quarkslab.com/cortex-security-audit.html

So, if I understand correctly, a bunch of elected politicians said ‘okay, we identified that the things Facebook and friends are doing is actively harmful to their users. So what we’re going to do to mitigate this is ensure that, legally speaking, the only people who can experience these negative effects are people of voting age.’

I was hoping to catch a small #metal concert in #Oslo next week or in #Bergen the week after. But it seems like all the venues I checked are on a summer break. Any recommendations?

wow, discord acknowledged on the Bad Place that it was true that an overfitted CSAM detection AI started flagging grids (spreadsheets, game inventory screenshots, etc) as illegal and instabanning people.

8200 people got banned this way over several weeks before someone managed to get their attention on reddit. But the good news is they have in fact manually rolled back all the bans.

On the one hand, this is the one problem where you absolutely want as little hands-on human moderation as possible. On the other, this is a very clear-cut overfitting failure mode on a small dataset (of the images that governments provide to major websites for automated detection) with disastrous consequences for random innocent people. And they presumably had to go back and manually check all bans in this category for the last few weeks, thus maximizing the moderators' exposure too. 🤦‍♀️

Just one more show option bro. One more show option will fix it.

for whoever needs to hear this: you're not alone. i'm not vibecoding any of the software i write. i'm writing it by hand, but i've leveled up my emacs with eglot/lsp. i'm modernizing my stacks and use languages with excellent compilers. i think about how to do more with less. i'm trying to combine the best human-written libraries and modules and assemble them with minimal boilerplate. i enjoy reading your manuals and references. i believe in robust, secure, human-written software.

aaaaaand we just finished a dumb request smuggling PoC for (Open)LiteSpeed httpd live on stream: https://warez.sl0p.foo/ols-h2-smuggle/

their commit hygiene is designed to hide security fixes, didn't manage to find a CVE/report anywhere.

all results will be published on http://warez.sl0p.foo -- beware, minimal curation! ;^)
https://bird.makeup/users/bl4sty/statuses/2074056010168209849

I’m excited to finally open-source a project I’ve been heavily refining: the #encryption #crate.

This is a 100% strict, #![no_std] generic #Rust implementation of the Ouroboros #cryptographic engine. I designed it to maintain absolute parity with the security guarantees and constant-time execution of my original #AVR assembly implementation, now brought to the Rust ecosystem.

When teaching #Embedded Systems Reverse Engineering, the vulnerabilities in standard #cryptographic libraries become glaringly obvious at the silicon level. I needed an engine that didn't just look good mathematically, but could actually survive physical and side-channel attacks on bare-metal hardware.

Whether you're targeting an ATmega328P, an RP2350, or testing natively on your host machine, this crate is built for hostile environments.

Here is what is happening under the hood:

1. Speck-128/256 & Davies-Meyer KDF: We are running 24,576 iterations of Speck-256 wrapped in a Davies-Meyer construction. This creates a ~10-second cryptographic "tar pit" that makes brute-forcing a high-entropy key over UART impossible, while crippling the theoretical quadratic speed-up of Grover's algorithm.

2. Constant-Time MAC Verification: The engine uses a branchless 2's-complement mask (derived from the AVR NEG, SBC, COM trick) to verify the payload. No data-dependent branches mean no timing oracles.

3. Hardware-Hacking Resistant: Because the key is stretched and mixed into the CTR stream, even if an attacker uses EMFI/voltage glitching to bypass the MAC validation branch, the payload decrypts to randomized garbage. Cold-boot RAM extraction is useless because the memory wipe executes in constant time.

The repository includes a host-based mock hardware demo that runs the exact same engine directly in your terminal, plus a full RP2350 hardware implementation via USB CDC ACM.

If you're building secure bootloaders, dealing with bare-metal authentication, or running hardware hacking labs, pull the crate and test it out.

Source and full cryptographic design breakdown here: https://github.com/mytechnotalent/encryption

Also available natively on Crates.io: https://crates.io/crates/encryption