We need an internet archive outside the US! We can't put all our eggs in one basket.

Oh, wait: we *have* an internet archive outside the US. Let's support it.

And now they have an office - a physical presence!

https://flaminghydra.com/freedom-and-sharing-at-the-internet-archive-europe/

https://www.internetarchive.eu/

Inky Impression 用に額縁を設計してプリントして収めた。安っぽいけどだいぶフォトフレーム感が出た #shapolab

Workslop: bad ‘study’, but an excellent word

wasting coworkers’ time with AI — as directed

https://www.youtube.com/watch?v=xnI-Yr6plXI&list=UU9rJrMVgcXTfa8xuMnbhAEA - video
https://pivottoai.libsyn.com/20250923-workslop-bad-study-but-an-excellent-word - podcast

time 7 min 10 sec

https://pivot-to-ai.com/2025/09/23/workslop-bad-study-but-an-excellent-word/ - text

So I just reported a very interesting bug in Outlook - took me a while to analyze and understand (part of) the root cause..

The bug allows to read the value of an MAPI property* and use it *directly* as a memory pointer. We know OOB (e.g. caused by integer overflow) bugs are not rare but they're all some sort of "offsets", not someone just read the value and directly use it as a pointer.. So basically you can set the DWORD 0xdddddddd in the email and Outlook would happily access memory at 0xdddddddd. Not sure what severity it could be as it's an OOB-read at first glance, but def. an interesting find for me.:)

Full details will be released after MSRC's review.

* https://learn.microsoft.com/en-us/office/client-developer/outlook/mapi/mapi-property-overview

#VulnerabilityResearch #Outlook #EmailSecurity

System/38 project update. Edith is off the pallet and on her own wheels. WE REPEAT THE EDITH HAS LANDED.

https://www.gofundme.com/f/ibm-system-38-computer-rescue-and-restoration

The crates.​io team was notified of two malicious crates (with similar names as legitimate crates) which were actively searching file contents for Etherum private keys, Solana private keys, and arbitrary byte arrays for exfiltration. The malicious crates have been removed.

See the blog post for details: https://blog.rust-lang.org/2025/09/24/crates.io-malicious-crates-fasterlog-and-asyncprintln/

I wrote an article about what I wish juniors in cybersecurity would ask for and contribute when asking for a mentor and career guidance, in light of the terrible tech jobs market.

https://tisiphone.net/2025/09/24/reasonable-expectations-for-cybersecurity-mentees/

#Cybersecurity #Infosec #MentoringMonday #Mentoring #CybersecurityCareers

How a 20 year old bug in GTA San Andreas surfaced in Windows 11 24H2

https://cookieplmonster.github.io/2025/04/23/gta-san-andreas-win11-24h2-bug/

[RSS] Why is Windows still tinkering with critical sections?

https://devblogs.microsoft.com/oldnewthing/20250924-00/?p=111624

stty

https://wizardzines.com/comics/stty/

(from The Secret Rules of the Terminal, out now! https://wizardzines.com/zines/terminal/)

You just don't understand the fourth industrial revolution

"CVE-2025-1727 reveals a critical design flaw: the EoT/HoT linking protocol — which sends emergency brake commands [to trains] over a radio channel — has no cryptographic authentication."

https://cervello.security/blog/vulnerabilities-incidents/research-cve-2025-1727/

🚨 SolarWinds, the gift that keeps on giving: a new Web Help Desk patch bypass, CVE-2025-26399, enables unauthenticated RCE via deserialization.

It’s a patch bypass of CVE-2024-28988/CVE-2024-28986 - previously exploited.

Given SolarWinds’ past, in-the-wild exploitation is highly likely. Patch now.

Need help assessing your exposure? https://watchtowr.com/

[RSS] BYOVD to the next level (part 1) -- exploiting a vulnerable driver (CVE-2025-8061)

http://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html

Help, I need a code signing certificate that won't bankrupt me.

Three years ago, I paid $100 for a three-year code signing certificate. I've signed all my open-source projects' releases with it. Now that it's renewal time, Certera (SignMyCode.com) wants almost $700 for the same three-year certificate (excluding the mandatory HSM purchase, which I am totally on board with).

I write silly C and PowerShell code, and I timestamp my signatures so that they're perpetually valid. My PowerShell Gallery stuff, as well as binaries of aprs-weather-submit on Windows and macOS, are all signed and hashed (but not notarized by Apple, because that's another $99 a year for something that feels done unless Bob Bruninga's followers are thinking about APRS 2.0).

If I can't find a solution, anything I write or update in the future will have to be released as unsigned unless I half-ass something (like the Notepad++ developer using self-signed certs -- semi-dangerously clever). $100 every three years, fine. $700 every three years, and I'll do it if my three fans click my Buy Me A Coffee link over and over.

Is there any CA out there that will offer open-source, not-for-profit developers like me a chance to get globally-trusted code signing certificates? I don't think SigStore ever took off (sadly), and even if it did, I don't think it's part of the Microsoft Authenticode program.

#CodeSigning #SSL #TLS #certificates #Certera #SoftwareDevelopment #C #PowerShell #PowerShellGallery #AmateurRadio #HamRadio #APRS #APRS-Weather-Submit #GitHub #security #developer #Windows #macOS #Linux #Authenticode #DevSecOps #DevOps

SALLY STRUTHERS: Do you use floats? Sure. We all do. But did you know a + b + c ≠ c + b + a with many floats? No. Well, neither did I, but with this one PDF you can become a fount of floating-point foibles to impress and depress your colleagues around the water cooler. Isn't this fun?

https://dl.acm.org/doi/pdf/10.1145/103162.103163 #compsci

Let's say I have a couple of MP3's (very royalty free ofc) that I want to share with normie friends on a web server. Is there a playlist format or maybe even some web frontend that I can use to organize these tracks so my friends can listen to the tracks without installing anything on their Win/Mac boxes, just opening a single URL/file?

It's be nice if there was support for basic HTTP auth because I don't want to open this to everyone either.

#FOSS #MP3 #mixtape

[RSS] The Phantom Extension: Backdooring chrome through uncharted pathways

https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways.html

at this point anybody still using solarwinds should just be considered a huge security risk

https://www.theregister.com/2025/09/23/solarwinds_patches_rce/

New video: Inside Windows Sessions
https://trainsec.net/library/windows-internals/inside-windows-sessions/