GNU social JP
  • FAQ
  • Login
GNU social JPは日本のGNU socialサーバーです。
Usage/ToS/admin/test/Pleroma FE

  • Public

    • Public
    • Network
    • Groups
    • Featured
    • Popular
    • People

Notices by buherator (buherator@infosec.place)

  1. Embed this notice
    buherator (buherator@infosec.place)'s status on Monday, 20-Jan-2025 23:04:43 JST buherator buherator
    Serious question: Is there an open-source 2D printer (the type with paper and ink)?

    If not, why not? Is there some serious production bottleneck that only HP&co can meet?
    In conversation about 7 days ago from infosec.place permalink
  2. Embed this notice
    buherator (buherator@infosec.place)'s status on Monday, 13-Jan-2025 16:24:51 JST buherator buherator
    "Even if I wanted to improve the app, I really didn't understand how to achieve the increasingly difficult goal I was aiming for. So, rather than writing an automation script that helped me skip over /the hard details/ I focused on learning the science I was trying to ignore."

    https://seclists.org/dailydave/2025/q1/3

    #fuzzing #llm
    In conversation about 15 days ago from infosec.place permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: seclists.org
      Dailydave: Re: (the root of the root and the bud of the bud)
      from Don A. Bailey via Dailydave
  3. Embed this notice
    buherator (buherator@infosec.place)'s status on Monday, 13-Jan-2025 02:03:58 JST buherator buherator
    Old digital cameras turn out to be great for kids:

    - They come without all the invasive crap of smart phones
    - They boost creativity
    - They teach user interfaces and controls outside "push shiny moving button"
    - They teach basic software concepts like files (yes, knowing about files is a skill) and how to move them around

    And probably more.

    Coming up next: MP3 players!

    #parenting
    In conversation about 15 days ago from infosec.place permalink
  4. Embed this notice
    buherator (buherator@infosec.place)'s status on Thursday, 26-Dec-2024 00:18:45 JST buherator buherator
    What are the online #book stores that are neither a) monopolistic giants built on enshittification nor b) copyright bullies?

    If I ask for a unicorn, which ones do at least give authors a more fair share for their work?
    In conversation about a month ago from infosec.place permalink
  5. Embed this notice
    buherator (buherator@infosec.place)'s status on Thursday, 26-Dec-2024 00:18:42 JST buherator buherator
    in reply to
    • Cory Doctorow
    • Charlie Stross
    • stf
    @stf @pluralistic @cstross I learned at Bsky that at least author royalties are independent from distributors which is good news!

    https://bsky.app/profile/notaname.info/post/3le53oer4hk24
    In conversation about a month ago from infosec.place permalink

    Attachments

    1. No result found on File_thumbnail lookup.
      Andrew (@notaname.info)
      from Andrew (@notaname.info)
      authors royalty payments are usually negotiated between the author and the publisher. where a book is sold generally don't change the amount the author gets. it might be different with books sold in non bookstore places like Walmart or something.
  6. Embed this notice
    buherator (buherator@infosec.place)'s status on Sunday, 01-Dec-2024 20:28:32 JST buherator buherator
    in reply to
    • Brewster Kahle
    @brewsterkahle Finally giving up on quality?
    In conversation about 2 months ago from infosec.place permalink
  7. Embed this notice
    buherator (buherator@infosec.place)'s status on Thursday, 28-Nov-2024 02:26:14 JST buherator buherator
    @mrose.ink.bsky.social said it perfectly:

    https://bsky.app/profile/mrose.ink/post/3lbwpud2mes2n

    "One enduring complication with all this is that scraping happens all the time for reasons that people *don’t* find inherently objectionable, and in fact support—the Wayback Machine, all kinds of public health and extremism research, etc. The mistake was assuming that goodwill transfers.

    A key problem in the Disc Horse (and policy to a lesser extent) is reminding people that scraping as a technological process is Important, Actually, for all the things You Think Are Good, and any proposed solutions to curtail GAI training uses need to be VERY narrowly tailored to not impact those.

    All the proposed solutions so far have had some critical flaw that makes them unworkable.

    Manual consent? Ok, how do we implement that at scale? robots.txt style flags are fine, but they’re also not legally binding—and that’s good! If they were, Wayback wouldn’t be able to index!

    So exclusion protocols can be ignored, For Good Reason. “What if we give an exclusion protocol the force of law for this specific use?” Closer, but there’s active debate in the courts about whether this is all a fair use, and if the answer is “yes,” then it doesn’t matter

    …then best case scenario the tags are rendered null (because you can’t legally override fair use), and worst case you’ve just recreated a DMCA 1201 style lockout trick, and we have spent the last 25 years seeing just how incredibly those fuck up everything around them."
    In conversation about 2 months ago from infosec.place permalink

    Attachments

    1. No result found on File_thumbnail lookup.
      Meredith Rose (@mrose.ink)
      from Meredith Rose (@mrose.ink)
      One enduring complication with all this is that scraping happens all the time for reasons that people *don’t* find inherently objectionable, and in fact support—the Wayback Machine, all kinds of public health and extremism research, etc. The mistake was assuming that goodwill transfers.
  8. Embed this notice
    buherator (buherator@infosec.place)'s status on Monday, 11-Nov-2024 02:28:47 JST buherator buherator
    • Kevin Beaumont
    • K. Reid Wightman :verified: 🌻
    • cR0w :cascadia:
    @GossiTheDog @reverseics @cR0w But could *non-admin* users access the DB of *other* users? SQLite or not, this should not be possible (in general...). If it was possible back then (as it was suggested by you and articles based on your comments), then now would be the best time for all to see what the problem was to check if the same or similar problem is present in the implementation that is to be released.
    In conversation about 3 months ago from gnusocial.jp permalink
  9. Embed this notice
    buherator (buherator@infosec.place)'s status on Monday, 11-Nov-2024 02:05:31 JST buherator buherator
    • Kevin Beaumont
    • K. Reid Wightman :verified: 🌻
    • cR0w :cascadia:
    @GossiTheDog @reverseics @cR0w Great you chime in! Any plans to release that x-user Recall exploit you talked about?

    https://infosec.place/notice/AieinAN5CpyKNShdvE
    In conversation about 3 months ago from gnusocial.jp permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: media.infosec.place
      buherator (@buherator@infosec.place)
      @wdormann @screaminggoat @tiraniddo @arstechnica I'm happy to give @GossiTheDog the benefit of doubt here, but posts like the one referenced below *really* don't help getting a clean view of th...
  10. Embed this notice
    buherator (buherator@infosec.place)'s status on Monday, 11-Nov-2024 01:25:46 JST buherator buherator
    • K. Reid Wightman :verified: 🌻
    • cR0w :cascadia:
    #directoryTraversalMemes seem to become a classic, but I wonder if anyone has a list of specific payloads that trigger the different vulnerabilities of recent memory?

    /cc @reverseics @cR0w
    In conversation about 3 months ago from infosec.place permalink
  11. Embed this notice
    buherator (buherator@infosec.place)'s status on Saturday, 10-Aug-2024 03:23:36 JST buherator buherator
    Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

    https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1&s=09

    Latest by Orange Tsai!
    In conversation about 6 months ago from infosec.place permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: blogger.googleusercontent.com
      [EN] Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
      from http://blog.orange.tw/
      This is 🍊 speaking
  12. Embed this notice
    buherator (buherator@infosec.place)'s status on Saturday, 04-May-2024 21:38:10 JST buherator buherator
    in reply to
    • Kevin Beaumont
    @GossiTheDog Medium's half-screen sign-up form certainly doesn't help with audience conversion. Just a tip.
    In conversation about 9 months ago from infosec.place permalink
  13. Embed this notice
    buherator (buherator@infosec.place)'s status on Friday, 05-Apr-2024 16:59:11 JST buherator buherator
    Finally a sane discussion about that safe_fprintf() -> fprintf() patch in libarchive:

    https://www.openwall.com/lists/oss-security/2024/04/03/17

    As far as I can tell the only known vector so far is messing with terminal escape sequences which are of questionable utility, but the patch may be part of some more complex scheme. Maybe the plot was to first fall back to vanilla fprintf(), then remove the format string parameter ina later patch (which didn't happen)?
    In conversation about 10 months ago from infosec.place permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: www.openwall.com
      oss-security - Re: escaping terminal control characters (was Re: backdoor in upstream xz/liblzma leading to ssh server compromise)
  14. Embed this notice
    buherator (buherator@infosec.place)'s status on Monday, 19-Feb-2024 03:38:54 JST buherator buherator
    in reply to
    • Sven A. Schmidt
    • Paul Cantrell
    @finestructure @inthehands I heard a legend about a lab exercise at our uni where students were tasked to figure out the contents of a box by electrical measurements on some external connectors. Sometimes the box contained a potato wired up.
    In conversation about a year ago from infosec.place permalink
  15. Embed this notice
    buherator (buherator@infosec.place)'s status on Saturday, 03-Feb-2024 01:06:34 JST buherator buherator
    [RSS] Your Security Program Is Shit

    #vent

    https://crankysec.com/blog/shite/
    In conversation about a year ago from infosec.place permalink

    Attachments

    1. No result found on File_thumbnail lookup.
      Your Security Program Is Shit
      Very shit
  16. Embed this notice
    buherator (buherator@infosec.place)'s status on Tuesday, 30-Jan-2024 21:52:20 JST buherator buherator
    I guess I have to add another item to my "reflective XSS exploited in the wild" list (still less than 5 elements though)

    https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/
    In conversation about a year ago from infosec.place permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: storage.googleapis.com
      Zimbra 0-day used to target international government organizations
      TAG’s discovery of a 0\u002Dday exploit used to steal email data from international government organizations.
  17. Embed this notice
    buherator (buherator@infosec.place)'s status on Thursday, 04-Jan-2024 09:28:55 JST buherator buherator
    in reply to
    • feld
    • jomo
    • Lorenzo Franceschi-Bicchierai
    • ret2bed is hacking web apps :verified:
    @ret2bed @feld @jomo @lorenzofb I'm genuinely curious if there is some standard risk assessment practice to take into account that compromise of n% of users would provide access to data of, say (n^2)% of users (that function obviously doesn't work but you get the idea)?

    Same question whether there are best practices for determining a threshold for "enforce MFA" or is it just "if you got breached, you definitely should've enforced it"?
    In conversation about a year ago from infosec.place permalink
  18. Embed this notice
    buherator (buherator@infosec.place)'s status on Thursday, 04-Jan-2024 07:07:46 JST buherator buherator
    in reply to
    • feld
    • jomo
    • Lorenzo Franceschi-Bicchierai
    • ret2bed is hacking web apps :verified:
    @feld @lorenzofb @ret2bed @jomo Ahh of course, AAL's! The fact that they didn't come to my mind is a proof that I'm doing this holiday thing right...

    Thanks, this mostly settles the question, although I still find the question of "cascading impact" interesting - I'll probably read up on 800-63 again about this!
    In conversation about a year ago from infosec.place permalink
  19. Embed this notice
    buherator (buherator@infosec.place)'s status on Thursday, 04-Jan-2024 06:48:32 JST buherator buherator
    in reply to
    • feld
    • jomo
    • Lorenzo Franceschi-Bicchierai
    • ret2bed is hacking web apps :verified:
    @feld @lorenzofb @ret2bed @jomo Sure, regulatory compliance most probably won't go into this detail, but if we expect companies to make the right calls it seems fair to have some pointers for them about what "right" actually means.

    Maybe requiring an extra special character in all passwords would've also mitigated all this, but I don't think that would've been the right way to go.
    In conversation about a year ago from infosec.place permalink
  20. Embed this notice
    buherator (buherator@infosec.place)'s status on Sunday, 27-Aug-2023 21:17:35 JST buherator buherator
    in reply to
    • stf
    @stf it's nice to see they are willing to correct themselves, but I still won't put too much trust to a platform where ideology can so easily override reason. Do the ppl who were bullied to abandon their search projects get an apology now?
    In conversation Sunday, 27-Aug-2023 21:17:35 JST from infosec.place permalink
  • Before

User actions

    buherator

    buherator

    A drunken debugger

    Tags
    • (None)

    Following 0

      Followers 0

        Groups 0

          Statistics

          User ID
          105742
          Member since
          9 Mar 2023
          Notices
          22
          Daily average
          0

          Feeds

          • Atom
          • Help
          • About
          • FAQ
          • TOS
          • Privacy
          • Source
          • Version
          • Contact

          GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.

          Creative Commons Attribution 3.0 All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.