We are excited to announce that the 1st Workshop on Software Understanding and Reverse Engineering (SURE) will be co-located at ACM CCS 2025 in Taiwan! We invite the community to submit their awesome research https://sure-workshop.org/.

So, what is SURE? More in the 🧵

The biggest thing that I wish people knew before starting their 1st tech job (probably most jobs) is that asking someone more experienced for the “answer” is what you should do as soon as you get stuck. It’s drilled into students that this is “cheating”, so this is a big change for new hires. The faster a new hire can unlearn that you’re not expected to do your own work without getting advice from others, the happier and more productive they will be in a team environment.

Microsoft Outlook is pants at usability and running a fat GUI isn’t great for security. About a year ago I went on a mission to make mutt (the CLI mail client) work in a sandbox so I could read my work Microsoft365 mail nicely and more securely. Here’s how https://github.com/singe/muttpack

Update: I just added some further hardening ideas to this. My favourite is to run the containers under esoteric architectures with QEMU.

When IT tells you they invested in a new security product.

Ok, all y'all that did all the research into Recall, you can tell me how to detect and disable, right? Cause it is in violation of every NDA I have ever signed.

The EU is introducing an energy label for phones, together with mandatory requirements for phones sold in the EU;

- 5 years of software updates (AFTER they stop selling the device in the EU)

- providing important hardware parts (during sale and for 7 years after), including free software (if needed), to every repair shop, within 5-10 business days

- batteries have to make 800 charging cycles and still be above 80% original capacity

And on top of that, phones and tablets need this energy label (which also includes a fall damage durability and repairability score), and abide by the above requirements, from 20 June 2025.

(https://energy-efficient-products.ec.europa.eu/product-list/smartphones-and-tablets_en)

[Project] I built a tool that tracks AWS documentation changes and analyzes security implications https://awssecuritychanges.com/

Threads is starting to rollout ads, another feature that we will never have in here

I am so tired of all of the long blog posts of the form ‘I like the idea of magical AI things and I don’t understand why {some product with an integrated bullshit generator} doesn’t just do {thing that is either impossible without using something totally different to any current GenAI approaches or is possible but would be laughably easy to attack and would be worse than useless} and then it would be so much more useful!’

These machines are not magic. They are not thinking, they are not reasoning. They will generate token streams that have high probability based on their training data of following the input (prompts plus any other tokens you stream them). That’s it. This can be useful. They can quite quickly produce not-totally-wrong translations, for example, because their training sets include a load of things in two languages. They can produce code that solves minor variations on problems that have been solved hundreds of times before. There are probably other useful things (ethics of large-scale copyright infringement during training and ludicrous energy use aside).

The thing that really annoys me is that there are a load of more useful things that both rule-based and machine-learning systems could do and don’t. I’d love to have something that would suggest Sieve rules based on how I’ve manually filed email, for example. This is simple statistical correlation. It’s not even that hard. I haven’t seen a system that has done it. Yet people keep trying to use LLMs for live filtering instead (which is a terrible idea because avoiding prompt injection is almost impossible).

as is tradition, I just published my commentary on this year's Verizon Data Breach Investigations Report (aka #DBIR): https://kellyshortridge.com/blog/posts/shortridge-makes-sense-of-verizon-dbir-2025/

In the post, I include the following sections covering what I felt were the most notable insights and facets in the report:

🌍 So, what?

💃 Espionage: fast fashion or couture?

👻 APTs go BWAA-haha >:3

💸 How do the money crimes generate money?

🤖 Attackers are still not really using GenAI

👩‍🍳 If you can’t make your own 0day, store-bought creds are fine

🔓 #Security was the real supply chain threat all along

🍄 Things Rot Apart

🕵‍ Scooby Doo's Spooky Kooky Corporate IT Caper

🌈 At least some things are improving somewhere

Go forth and enjoy my commentary, and then make sure to find me at #RSAC to tell me what you loved or hated Tuesday 14:30 at the @fastlydevs booth (where you'll also get a free copy of my book ✨)

thanks @alexcpsec for the early copy <3

Trailing dot in Cygwin filenames https://openwall.com/lists/oss-security/2025/04/25/5
"foo" and "foo." are equivalent in DOS. This carried forward into contemporary Windows cmd.exe, explorer.exe (File Explorer), the usual file access APIs. But Cygwin actually creates a file with the dot.

A phrase I've been repeating a lot on vendor calls, regarding prevention vs. detection:

I want to win; I don't just want to know why we lost.

lol, more reason to hate Synology if you needed some - they threatened to sue Linus Sebastian if he *mentioned* a hack to put Synology OS onto other hardware https://www.youtube.com/watch?v=H1COU0ZpLQU

Parser Differentials have become pretty much my favorite bug class over the last years.

I am absolutely honored to get the chance to present on this topic at OffensiveCon in a few weeks.

https://www.offensivecon.org/speakers/2025/joernchen.html

Let's get this #nakeddiefriday started, people!

The guest of today is one TMS70C42A by TI. It is a 8-bit MCU carrying 4KB of ROM and 256B of RAM, with three timers and a UART.

This particular die was bit by gremlins, and a small part of it is missing; nothing crucial though. Let's have a walk around. 🧵

SiPron page: https://siliconpr0n.org/archive/doku.php?id=infosecdj:ti:tms70c42a

#electronics #reverseengineering #microscopy

With bluesky (mostly) going down for a few hours today, I got to wondering about how decentralized the fediverse really is in terms of where its servers are hosted. I grabbed a server list from fedidb, with network information coming from ipinfo.io .

[EDIT: I did a better analysis on a dataset of 10x as many servers, see https://discuss.systems/@ricci/114400324446169152 ]

These stats are by the number of *servers* not the number of *users* (maybe I'll run those stats later).

fedidb currently tracks 2,650 servers of various types (Mastodon, pixelfed, lemmy, misskey, peertube, etc)

The fediverse is most vulnerable to disruptions at CloudFlare: 24% of Fediverse servers are behind it. Also note that this means that I don't have real data on where this 24% are located or hosted, since CloudFlare obscures this by design.

Beyond CloudFlare, the fediverse is not too concentrated on any one network. The most popular host, Hertzner, only hosts 14% of fediverse servers, and it falls off fast from there.

Here are the top networks where fediverse servers are hosted:

504 Cloudflare, Inc.
356 Hetzner Online GmbH
130 DigitalOcean, LLC
114 OVH SAS
56 netcup GmbH
55 Amazon.com, Inc.
55 Akamai Connected Cloud
36 Contabo GmbH
33 SAKURA Internet Inc.
32 The Constant Company, LLC
31 Xserver Inc.
28 SCALEWAY S.A.S.
24 Google LLC
23 Oracle Corporation
16 GMO Internet Group, Inc.
14 IONOS SE
14 FranTech Solutions
11 Hostinger International Limited
10 Nubes, LLC

Half of fediverse servers are on networks that host 50 or fewer servers - that's pretty good for resiliency.

There is even more diversity when it comes to BGP prefixes, which is good for resiliency: for example, the cloud providers that have multiple availability zones will generally have them on different prefixes, so this gets closer to giving us a picture of the specific bits of infrastructure the fediverse relies on.

The top BGP prefixes:

55 104.21.48.0/20
50 104.21.16.0/20
48 104.21.64.0/20
41 104.21.32.0/20
41 104.21.0.0/20
38 104.21.80.0/20
32 172.67.128.0/20
31 172.67.144.0/20
28 172.67.208.0/20
28 162.43.0.0/17
27 104.26.0.0/20
26 172.67.192.0/20
26 172.67.176.0/20
23 172.67.160.0/20
19 116.203.0.0/16
17 172.67.64.0/20
17 159.69.0.0/16
16 65.109.0.0/16
14 88.99.0.0/16
14 49.13.0.0/16
13 78.46.0.0/15
13 167.235.0.0/16
13 138.201.0.0/16
11 95.217.0.0/16
11 95.216.0.0/16
11 49.12.0.0/16
11 135.181.0.0/16
10 37.27.0.0/16
10 157.90.0.0/16

75% of fediverse servers are behind BGP prefixes that host 10 or fewer servers, meaning that the fediverse is *very* resilient to large network outages.

Top countries where fediverse servers are hosted:

871 United States
439 Germany
156 France
148 Japan
75 Finland
57 Canada
49 Netherlands
38 United Kingdom
26 Switzerland
26 South Korea
21 Spain
19 Sweden
18 Austria
17 Australia
15 Russia
12 Czech Republic
10 Singapore
10 Italy

And finally, a map of the locations of fediverse servers:
https://ipinfo.io/tools/map/91960023-e8c6-4bee-9b07-721f2c8febab

📅 Mark your calendars!

https://www.hexacon.fr/