@tris Usually what makes a difference is the business model (e.g. adtech vs. regular subscription). Your hair dresser may know exactly who you are and know a lot about you, but you can trust them not to sell your conversations because they make a living from cutting hair, not selling PII. A level of privacy is of outmost concern for many OnlyFans performers (to avoid stalking), while they show a lot of themselves publicly. Privacy != encryption either.

@campuscodi

(Re-)New Nightmare Eclipse stuff!

https://git.projectnightcrawler.dev/NightmareEclipse/ShieldBreak

Essentially RoguePlanet 2, it seems like.

#NightmareEclipse #Windows #Malware #Infosec #Microsoft

Today the solution for the Halting Problem is: It does not halt.

#fml

@campuscodi You have to register a Signal account too. Privacy != anonymity

Discovered while doing ethnographic research for a public library district. I was touring one of their branches when this caught my attention.

It’s genius. Smartest solution I’ve seen for this common problem.

Librarians could save the world if we’d let them. 😉

#DIY #Libraries #Library #Ethnography

PEOPLE/ARNOLD1.GIF

Any recommendations for books on #DistributedComputing?

I'm primariy looking for a best-practices kind of thing to recognize potential problems early and avoid reinventing wheels.

#Bookstodon #FediBooks

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/

Slides and whitepaper of Gone in 60 Frames – USB Video Exploitation by @robherrera_ and myself seem to be on the #defcon34 media server now!

Slides - https://media.defcon.org/DEF%20CON%2034/DEF%20CON%2034%20presentations/DEF%20CON%2034%20presentations/DEF%20CON%2034%20-%20Alex%20Plaskett%2C%20Robert%20Herrera%20-%20Gone%20in%2060%20Frames%20-%20USB%20Video%20Exploitation%20-%20In60%20Slides%20v1.pdf

Whitepaper - https://media.defcon.org/DEF%20CON%2034/DEF%20CON%2034%20presentations/DEF%20CON%2034%20presentations/DEF%20CON%2034%20-%20Alex%20Plaskett%2C%20Robert%20Herrera%20-%20Gone%20in%2060%20Frames%20-%20USB%20Video%20Exploitation%20-%20In60%20Whitepaper%20v1.pdf

New video: Compiled V8 JavaScript for reversers 🎥

➡️ V8 compilation pipeline
➡️ bytecode caching
➡️ how bytenode abuses caching for protection

https://www.youtube.com/watch?v=YSSCMSMcpeM
#MalwareAnalysisForHedgehogs #JavaScript #V8

Richard Scarry already summarized everything there is to know about cyber security, about 50 years ago.

RE: https://fosstodon.org/@frehi/117077677106911268

paging all nerds who run their own mailserveres

Rogue vSphere server that captures credentials from Veeam Backup & Replication https://github.com/mattmillen15/VeeamThief

CVE-2025-7771 — ThrottleStop.sys Arbitrary Physical Memory R/W https://github.com/enessakircolak/CVE-2025-7771

ETW for Security Research: Providers, Sessions, and Detection Engineering https://idov31.github.io/posts/inside-etw-with-etwsuite

What the…??? I mean, leaking a signing key to a private GitHub repository is clearly better than leaking it to a public one. But still, I remember a blog post from something like two decades ago about how Mozilla was using hardware tokens for signing, so that the signing keys could not possibly leak. That probably pre-dated their Linux package repositories, so either the concept wasn’t used consistently after that or at some point performance became more important than protecting key material (Mozilla’s infrastructure is producing lots of builds).

https://blog.mozilla.org/security/2026/08/10/updated-gpg-key-for-signing-firefox-and-thunderbird-releases/

[RSS] Exploiting AD ResetNightmare (CVE-2026-27912) and KerberLoss (CVE-2026-25177) from Linux

https://cravaterouge.com/articles/resetnightmare/

@dey The cybersecurity awareness you spread to me starts to itch. It also hurts to pee.

@briankrebs