@infosecdj Right??

I'm on this picture and don't like it.

...If anybody's looking for a person who basically does everything from compiler {backend,frontend} development, GPU driver development, to hardware/firmware security research, let me know. #getfedihired

US only.

@0v1 Parser generators: are we a joke to you?!

@unchartedworlds

My Step 1.: "My understanding is ..."

My Step 2.: "I'm genuinely curious if there's any point I miss"

Waiting for you to take Step 3.

@unchartedworlds TIL about steel-manning, it really sounds useful! When it comes to analogies though I think it may not be the right tool because arguing against an analogy requires to point out exactly where it breaks down instead of focusing on where it confirms the opposing argument. For example I could argue that it's fine to take pictures of birds on the street, but this would be an obviously bad argument for stalking people because people are not birds.

I described how I interpreted your analogy, I think this is as far as I can get describing what I think you think (lacking psychic abilities).

I also tried to explain our differences in thinking, and I'm genuinely curious if there's any point I miss (where I didn't manage to steel-man enough)!

@Viss @wdormann @cR0w yeah I'd be very interested in a deeplik :popcorn:

RE: https://mastodon.social/@campuscodi/117128474535423979

Ah, I get it now. They are doing the same thing to CISA that they did to 18F and login.gov - kill off perfectly functional (in fact, superior, non-partisan, cost-effective) public tech infrastructure so it can be privatized by attrition. The classic "starve it, then declare it ineffective" tactic. 😠

PSA: if you have a website or a blog, you can use Google Search Console to turn off the use of your site in AI overviews. You get multiple scary warnings if you try. I was curious what's the actual impact on site traffic, so I turned it off. It went from ~1k AI summaries a day to zero, with no measurable impact on visits to the site.

"You never can tell with bees."

I want a Firefox extension that knows how to replace every single "N months ago" label with the actual exact timestamp (using patterns for how the data is hidden in tooltips, click-to-expand, etc.).

That shit is SO unhelpful. Like if I'm looking back at git history, I don't care that a change was made roughly 3 months ago. I care whether it was made before or after an email I'm looking at that said something relevant to the change.

⚠️ A few hours ago, a malicious crate was discovered on crates.​io which spread as a dependency of `arrayref` and some other crates, likely due to compromised credentials. The affected versions have been deleted.

For details and how to see if you are impacted, see: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

@unchartedworlds My understanding is that on the street people mostly interact out of necessity, and because of this it is considered rude (or even illegal) to e.g. intercept one's conversation, follow them etc.

In my view the web and esp. social media[1] (like microblogging platforms of Fedi) were created with the explicit intention for people to be listened to, followed, commented on etc. (I'm sure you can come up with analogies, but I won't mention any to avoid misdirecting the conversation.)

Technology allows us to create more private/safe infrastructure than a street (encryption, access controls etc). Social media generally aims at the opposite direction (Fedi provides public plain text APIs for everyone to use).

[1] I use this word in the sense where people curate/produce information for each other, like on (micro)blogging platforms. The "let's keep in touch with my aunt" use-case is less relevant when talking about public content.

[RSS] The benchmarkpocalypse

https://danluu.com/benchpocalypse/

Microsoft killed my exploit 😢
This Friday on @offby1security I'll talk to @steph3nsims about what why, how and if this is the end for this class of exploit techniques

One day I'll sit around the camp fire and be like "You know grandpa Bas used to this stuff by hand before the em-dashes took over" ... Things like https://github.blog/security/vulnerability-research/now-you-c-me-now-you-dont-part-two-exploiting-the-in-between/ were always less about the bugs themselves and more about how to approach attack surfaces and exploit development as an adventure in creative debugging and ultimately just fun puzzling. Of course, that very same kind of iterative text based feedback loop is perfect for the current fancy text completion revolution. It's just a bit of a shame that the landscape seems to be shifting from "that was so much fun to figure out!" towards "oh wow it was able to figure it out".

I escaped the WebAssembly's sandbox and got arbitrary shell execution on the host. https://trustsig.eu/blog/wasm2c-tableflip-unchecked-calloc/

No perfect 10s this time, but that's a lot of AIX vulns from the other day:

https://www.ibm.com/support/pages/node/7283858

@unchartedworlds Of course. Our disagreements root in the fact that you find a street a good analogy for the Internet (in fact, I should've written Fedi/social media), while I don't.

@unchartedworlds The Internet is not the street though, and there seems to be a divide about how different groups of people see the Internet.

Case in point: When I posted first on Fedi I expected my post to be shared, digested, etc. far and wide. Some people clearly expected the opposite.

Norms may have changed, they sometimes do. Still my best bet is that content both of us post on Fedi is shared, digested, etc. far and wide.