Nostr notes by buherator

what is the version of your mpengine.dll?

2026-06-10T14:26:35+02:00

In reply to nevent1q…55zk
_________________________

what is the version of your mpengine.dll?

Thanks, that sounds relevant! Do you have a link to an ...

2026-06-10T09:21:07+02:00

In reply to nevent1q…ppdq
_________________________

Thanks, that sounds relevant! Do you have a link to an attribution source that I could include?

Added some new entries to avpwn, including the CVE-2026-41091 ...

2026-06-10T08:24:31+02:00

Added some new entries to avpwn, including the CVE-2026-41091 Defender LPE from this Patch Tuesday:

https://github.com/v-p-b/avpwn

to convince life forms to live in a place they don't ...

2026-06-06T22:25:44+02:00

In reply to nevent1q…437w
_________________________

to convince life forms to live in a place they don't naturally inhabit with a high chance of getting extinguished later

sounds pretty cruel/inconsiderate to me...

2026-06-06T16:14:01+02:00

In reply to nevent1q…egpa
_________________________

sounds pretty cruel/inconsiderate to me...

I complained about hexeditors recently. Now I found TeeHee, and I ...

2026-06-04T18:33:48+02:00

I complained about hexeditors recently. Now I found TeeHee, and I think I'll stick with it on all platforms:

https://sr.ht/~aleksi/teehee/

- King Louis XIV. rode out around midday... - UTC, CET or CEST?!

2026-06-04T18:08:38+02:00

In reply to nevent1q…wn4q
_________________________

- King Louis XIV. rode out around midday...
- UTC, CET or CEST?!

It helps me dealing with taxes a lot if I imagine myself as the ...

2026-05-21T15:36:10+02:00

In reply to nevent1q…akdd
_________________________

It helps me dealing with taxes a lot if I imagine myself as the protagonist of a Kafka novel (or any other absurd/surreal work). Maybe it helps with SAP/other horrors too?

did they start supporting normal webauthn without passkeys ...

2026-05-20T09:42:26+02:00

In reply to nevent1q…tdjh
_________________________

did they start supporting normal webauthn without passkeys again??

Nostr event nevent1qqsdh3uzg983j026l9d8tzflnu4y9m4njd9kc6tsdx20jsw3g8jd3fszyreesvls3c8st9etupsywdw4rmrsp7c334yaq2nehajywzf38rywyh3q2d8

2026-05-04T18:25:38+02:00

It's 2026 and Windows still can't synchronize time

chaotic alignment was missing so I created a chart ...

2026-05-03T08:07:09+02:00

In reply to nevent1q…h25p
_________________________

chaotic alignment was missing so I created a chart

Can you tell us about token costs?

2026-04-22T09:01:43+02:00

In reply to nevent1q…glr0
_________________________

Can you tell us about token costs?

Look into yourself and ask: "Why am I still wearing ...

2026-04-20T19:30:35+02:00

Look into yourself and ask:

"Why am I still wearing pants?"

"Is there some way of searching them?" I can only speak ...

2026-04-16T09:31:34+02:00

In reply to nevent1q…q73m
_________________________

"Is there some way of searching them?" I can only speak of Android: here definitely is a system-level option keep a browsable notification history.

These are the official results, beware that atm processed rate is ...

2026-04-12T20:14:59+02:00

In reply to nevent1q…3ksd
_________________________

These are the official results, beware that atm processed rate is statistically meaningless (refresh once in a while):

https://vtr.valasztas.hu/ogy2026

You know what would make Fedi an attractive place for journalists ...

2026-04-07T17:07:10+02:00

You know what would make Fedi an attractive place for journalists (and lots of others)?

Working search!

Nostr event nevent1qqsxqxwl74ktptst98xesz8mfelafwcv4tcha3kym3nu50p8m33zuxczyreesvls3c8st9etupsywdw4rmrsp7c334yaq2nehajywzf38rywypdkm9k

2026-04-07T10:43:16+02:00

"and if we think them not enlightened enough to exercise ...

2026-04-06T19:09:30+02:00

In reply to nevent1q…zv77
_________________________

"and if we think them not enlightened enough to exercise their control with a wholesome discretion, the remedy is not to take it from them, but to *inform their discretion by education*.”

Maybe you can point me to the right direction about this: today we see pretty clearly how un/mis/disinformed masses can ruin democracies, yet I see very little push for basing voting rights on education/knowledge. Why is that? (I know the "literacy tests" in the US were badly abused but this doesn't mean that fair systems are impossible)

I don't expect a full explanation, would be happy with some pointers.

Gitea/Forgejo has cloud offerings IIRC, they are pretty solid too ...

2026-03-27T10:04:53+01:00

In reply to nevent1q…5w7k
_________________________

Gitea/Forgejo has cloud offerings IIRC, they are pretty solid too for regular repo stuff.

"broken attention span" is a pretty interesting topic: ...

2026-03-25T10:07:37+01:00

In reply to nevent1q…dt57
_________________________

"broken attention span" is a pretty interesting topic:

https://www.youtube.com/watch?v=aDfeOvUZ7Kk&t=240s

"companies spending money with the adtech companies do see ...

2026-03-22T13:46:13+01:00

In reply to nevent1q…ns7n
_________________________

"companies spending money with the adtech companies do see returns" - Not necessarily, as measuring conversion rates is not easy. If you see that without G your visits plummet (as measured by G) you go back to G. Recommended:

https://thecorrespondent.com/125/the-non-sense-of-online-advertising-when-the-numbers-dont-add-up

I'm not familiar with news specifically, but I assume they don't partner with advertisers directly, but through an ad network, which is in the end owned by Meta or G, who can ~arbitrarily set their prices/payouts?

Yes, this is what I mean. You are right that these are extremely ...

2026-03-22T12:15:40+01:00

In reply to nevent1q…dhlt
_________________________

Yes, this is what I mean.

You are right that these are extremely powerful tools, still I feel like most customers (by count, not invoices) are just burning their money on adtech, because that's what everybody does, while you don't have to be Nassim Taleb to see that the numbers justifying the spend are rigged.

I still don't get how the market of "telling people about ...

2026-03-22T11:24:00+01:00

In reply to nevent1q…3v54
_________________________

I still don't get how the market of "telling people about things" can be more profitable than the market for "things" (G and Meta being the largest companies in the world) in the first place.

Since I read the JPL coding manual I'm always very ...

2026-03-20T17:40:42+01:00

Since I read the JPL coding manual I'm always very considerate before introducing an infinite loop.

Then I usually decide that "it's fine, this is not a spaceship" and forget to implement the exit path.

Pleroma/Akkoma are more lightweight if that helps

2026-03-20T17:12:28+01:00

In reply to nevent1q…0a3m
_________________________

Pleroma/Akkoma are more lightweight if that helps

[RSS] Streamlining Google's OSS VRP: Key Rule Updates ...

2026-03-19T10:33:31+01:00

[RSS] Streamlining Google's OSS VRP: Key Rule Updates

https://bughunters.google.com/blog/ossvrp-rule-updates-2026

Mandatory LLM generated design ...

2026-03-11T16:57:59+01:00

In reply to nevent1q…ywyk
_________________________

Mandatory LLM generated design

Hear me out: The boiling point of ethanol is well within the ...

2026-03-11T14:35:52+01:00

Hear me out: The boiling point of ethanol is well within the range of operating temperatures of GPUs, so we could use all those AI datacenters to brew moonshine!

"hand out the contents of emails which Proton cannot" - ...

2026-03-06T11:30:54+01:00

In reply to nevent1q…qtds
_________________________

"hand out the contents of emails which Proton cannot" - OK let's not dive into if G should have obeyed a subponea... In both cases the accounts came under scrutiny because authorities _already knew_ email contents. Gmail would even have the benefit of not having payment info (also, cheaper).

(Btw. Proton can absolutely leak all your e-mails e.g. from the frontend they serve to you.)

"it's not victim blaming to point out bad OPSEC" - by this logic we shouldn't criticize charlatan doctors, because their patients should know medicine better?

Let's put it this way: the acc owner is in the same situation ...

2026-03-06T11:07:34+01:00

In reply to nevent1q…gtmz
_________________________

Let's put it this way: the acc owner is in the same situation as if they used Gmail for free (if they were smart authorities would even have a harder time connecting the person to IPs and other metadata). This is speculation, but I'd bet that the relevant comms is already collected from the users or the recipients devices/e-mail accounts too.

So what is exactly the value Proton provided here that the user paid for?

I disagree. Proton convinced US people that their comms will be ...

2026-03-06T10:49:16+01:00

In reply to nevent1q…hava
_________________________

I disagree. Proton convinced US people that their comms will be safe at a foreign provider (them). Were users naive to believe this? Yes, but this is victim blaming.

I agree that Proton is not the only bad provider in the market. Actually, the whole market exists because all the providers communicate dishonestly.

The ToS will obviously point out these caveats so they won't ...

2026-03-06T10:25:34+01:00

In reply to nevent1q…fx54
_________________________

The ToS will obviously point out these caveats so they won't have troubles in court. What matters is the companies communication (marketing, PR aka. "oUr sERvErz aRe In SwiTZeRlAnd") because that is what people actually see and base their decisions on.

"subscriber information received from the Swiss Mutual Legal ...

2026-03-06T09:40:31+01:00

In reply to nevent1q…00aj
_________________________

"subscriber information received from the Swiss Mutual Legal Assistance Treaty Unit" - so the FBI basically asked the Swiss police, that got the data and forwarded it back under the umbrella of a long standing treaty between the countries/authrities. This should not be surprising at all btw, but somehow for many VPN customers it is.

Just what I needed, thx!

2026-03-05T10:13:58+01:00

In reply to nevent1q…guwl
_________________________

Just what I needed, thx!

Time dilation can be observed in the proximity of large masses ...

2026-03-04T16:30:12+01:00

Time dilation can be observed in the proximity of large masses and software that is supposed to crash.

Nostr event nevent1qqsqjctphvkxjup4jjql8xgzyatx7rsdt5tsygqqew7vh2t9ptn9tqczyreesvls3c8st9etupsywdw4rmrsp7c334yaq2nehajywzf38rywysa5a0e

2026-03-02T18:11:25+01:00

*Screams in 53-bit numbers*

I browse in private mode for various reasons (not all ...

2026-02-26T15:18:45+01:00

In reply to nevent1q…qua2
_________________________

I browse in private mode for various reasons (not all security/privacy related) so it doesn't work (as it shouldn't).

Now I would link that thread where there are users with this very same problem but y'know, I just had to restart my browser so I don't have the link anymore :)

Now I get that my setup is still counts as strange but this behavior *guarantees* regular users run away screaming regardless if they can restore or not.

You know what, I'm kind of OK with the #Firefox AI ...

2026-02-26T15:05:11+01:00

You know what, I'm kind of OK with the #Firefox AI opt-whatever solution they have

...compared to the fact that they kill all my sessions by a forced fucking restart when I try to act responsibly and update.

That's fucking outrageous!

Thank you for the additional info! I already opened #1096 and ...

2026-02-26T12:13:52+01:00

In reply to nevent1q…0xet
_________________________

Thank you for the additional info! I already opened #1096 and #1097 in frida-gum, hope they will be useful!

Right now I'm trying to fingerprint the runtime based on JS behavior (e.g. `console.log(gc.toString())`) but neither gadget configs nor `frida --runtime` seem to have any effect.

Update: It seems in V8 `gc.toString()` doesn't have newlines

Is it possible/reasonable to compile @npub1ne9…0uhz with V8 in ...

2026-02-25T19:21:51+01:00

Is it possible/reasonable to compile Frida (npub1ne9…0uhz) with V8 in 2026? (I just reported a couple of QuickJS bugs that are blockers for me)

If so, are there any documentation available about the build process or is that knowledge lost to bitrot?

#Frida #ReverseEngineering

Reminds me of us nerds installing Linux then spending weeks ...

2026-02-23T10:36:37+01:00

In reply to nevent1q…puzy
_________________________

Reminds me of us nerds installing Linux then spending weeks tweaking our WMs, shells and editor configs...

Thanks, that makes sense, but I can't touch Session as it ...

2026-02-18T09:24:18+01:00

In reply to nevent1q…c4dm
_________________________

Thanks, that makes sense, but I can't touch Session as it comes from a dependency. There is definitely a lifetime issue here too (esp. because the actual tree of objects goes ~5 levels deep).

I think the root of my Q is if there is a way to create a "will" for Rust functions/scopes that would say "after my death my caller will inherit all that I own (so please don't free shit up)"?

From a different branch of this convo: "Imagine that ...

2026-02-18T09:04:58+01:00

In reply to nevent1q…jjn5
_________________________

From a different branch of this convo:

"Imagine that initialization is more complex and I want to provide a library that hides that complexity, exposing something like setup_widget() and deinit_all()."

https://infosec.place/notice/B3RIRrdtPQog3eUc2y

Today in This Should Be Easy But in #Rust It Apparently ...

2026-02-18T08:38:48+01:00

Today in This Should Be Easy But in #Rust It Apparently Isn't: how do I encapsulate the widget initialization (without triggering E0515) in this example, so it becomes reusable?

https://play.rust-lang.org/?version=stable&mode=debug&edition=2024&gist=f31dd1ecf5530b11e301bb19af85b0fa

What stage of #enshittification is it when Amazon adds a ...

2026-02-17T09:05:47+01:00

What stage of #enshittification is it when Amazon adds a "Download Problems" option to it's Refund menu instead of fixing their system so people can download their digital purchases?

(Would it be ironic if I supported Anna's Archive with Amazon gift cards after I downloaded the books from there?)

Nostr event nevent1qqsp8x9677xnvm8k8zhf6pp285epxfxejpd0m7mahpvyxan56jvpl4szyreesvls3c8st9etupsywdw4rmrsp7c334yaq2nehajywzf38rywy9pqfnq

2026-02-09T17:39:23+01:00

git ass

Thanks for the explanation, truly appreciated! I guess you ...

2026-02-07T14:39:12+01:00

In reply to nevent1q…p7e6
_________________________

Thanks for the explanation, truly appreciated!

I guess you can't do much about it now, but IMO French could've been excellent for finding a unique name (not necessarily with your weirdest spelling, but people learned to spell "kubernetes" too).

We agree that the homepage link is actively misleading, but it should be easy to remove (not a mandatory field) or replace e.g. with the link to the documentation.

@bert_hubert@eupolicy.social Virgile Deville (npub1dxu…zf3q) Samuel Paccoud (npub16y8…6lsk)

It's great to see #EU open tech initiatives popping up, but ...

2026-02-07T11:45:55+01:00

It's great to see #EU open tech initiatives popping up, but somehow it feels like we are just **terrible** at making ourselves visible, esp. compared to US.

Like how is anyone supposed find this (otherwise great) project - named "docs" - using a search engine?

https://github.com/suitenumerique/docs/

Even assuming I find this project, how do I search for anything related to it (e.g. install guide)?

Why is the homepage in French by default, without a clearly visible language switcher (also looking at you, Framasoft (npub12k0…e2sz) )?

After all these years I still rely on brute-force when it comes ...

2026-02-03T09:47:33+01:00

After all these years I still rely on brute-force when it comes to copy-pasting on #Linux:

- Which paste should I use for vim's * and + buffers?
- Which clipboard is used by Java GUI's?
- Did JavaScript manage to put text on the clipboard this time? Which one?
- etc.

How do fellow #X11 users keep track of your clipboards?

Participating in P2O as a vendor is a thing to be respected in ...

2026-01-28T17:15:04+01:00

In reply to nevent1q…n28t
_________________________

Participating in P2O as a vendor is a thing to be respected in the first place. They also wrote a blog about their efforts, but the link is broken - you can probably get it from an archive:

https://blog.synology.com/the-efforts-synology-made-in-pursuit-of-data-security

This is a more technical analysis from the attackers view:

https://drive.google.com/file/d/1MYCNVKkNETkqS-cLJsqHE43Sfm4LZbCO/view?pli=1

In short: they took significant steps forward during the past years, they probably ignored active network attacks (on LANs this may make sense, for Internet comms not so much).

[RSS] When NAS Vendors Forget How TLS Works ...

2026-01-28T14:28:16+01:00

[RSS] When NAS Vendors Forget How TLS Works

https://www.interruptlabs.co.uk/articles/when-nas-vendors-forget-how-tls-works

#QNAP #Synology #Pwn2Own #NoCVE

[RSS] Defeating Anti-Reverse Engineering: A Deep Dive into the ...

2026-01-25T00:08:23+01:00

[RSS] Defeating Anti-Reverse Engineering: A Deep Dive into the 'Trouble' Binary

https://binary.ninja/2026/01/23/reversing-linux-anti-re.html

#ReverseEngineering

Raiden Warned About AI Censorship ...

2026-01-24T20:53:37+01:00

Raiden Warned About AI Censorship

https://www.youtube.com/watch?v=-gGLvg0n-uY

This is creepy af (2023!)

I've been hunting for unencrypted services (among other ...

2026-01-22T22:01:55+01:00

In reply to nevent1q…qw3y
_________________________

I've been hunting for unencrypted services (among other things) on LANs for 15+ years and Telnet is still there. Yet the only real-world incident involving network interception I can recall post-2010 is "SSL added and removed here" of Snowden fame (happy to hear about more!), while auth bypasses/RCEs are common culprits in breaches.

Telnet has an awful smell for sure, but when you sit on a smelly network, it's reasonable to ask: "would attackers actually exploit this?" A bypass like this changes the answer.

[LWN] Responses to gpg.fail ...

2026-01-22T21:22:21+01:00

[LWN] Responses to gpg.fail

https://lwn.net/SubscriberLink/1054220/c6f98b90a009fca2/

even in that case a) I don't like to write a _slightly_ ...

2026-01-19T17:34:51+01:00

In reply to nevent1q…fu6f
_________________________

even in that case a) I don't like to write a _slightly_ different tool for a similar task (here comes maintenance) b) the fixed cost of vibe-coding (which is very easy to under-estimate) can easily exceed the cost of finding/learning 1 tool that can replace N.

But sure, I also do ad-hoc tools like this, and I actually think your observation is correct, it's just the tendency that is very slippery.

Problem is those vibe-coded tools will rarely get enough testing ...

2026-01-19T17:26:43+01:00

In reply to nevent1q…shse
_________________________

Problem is those vibe-coded tools will rarely get enough testing and maintenance to become really useful so we'll end up crafting (subpar) hammers for each nail, esp. because crafting hammers in this case feels pretty rewarding, see: https://svnscha.de/posts/the-passenger-seat-developer/

I would probably cry because of the unnecessary complexity ...

2026-01-19T12:47:34+01:00

In reply to nevent1q…frj3
_________________________

I would probably cry because of the unnecessary complexity containers introduce for this use-case.

[RSS] wtf is NS_ERROR_INVALID_CONTENT_ENCODING? investigating ...

2026-01-16T19:44:42+01:00

[RSS] wtf is NS_ERROR_INVALID_CONTENT_ENCODING? investigating shared dictionaries and ChatGPT breakage in Firefox

https://joshua.hu/chatgpt-fail-loading-firefox

Could you please ELI5 for me what a "permacomputing ...

2026-01-16T18:30:57+01:00

In reply to nevent1q…xatf
_________________________

Could you please ELI5 for me what a "permacomputing collective" is? This brewing metaphor is cool but a bit too abstract for me to imagine what is happening in such a group.

I just got the weirdest e-mail: It's a lab result for someone ...

2026-01-16T09:01:19+01:00

I just got the weirdest e-mail:

It's a lab result for someone else. It has a PDF attachment, but I can see noting malicious in it. The sender domain exists and does lab stuff. I looked up the person in the document and he seems to exist.

I'd say this must be a typo, but my e-mail address has only the first character (and probably the domain) matching with the persons name. I highly doubt his internet handle is a short keyboard distance from my Hungarian handle.

I have two theories:

a. This is a highly sophisticated scam (but I don't see the scam part yet)
b. Copilot hallucinated my e-mail address (which is actually pretty easy to scrape from the web)

does MS Teams count?

2026-01-15T10:40:53+01:00

In reply to nevent1q…sqwt
_________________________

does MS Teams count?

[RSS] Symless: an IDA assistant for structure reconstruction ...

2026-01-13T15:25:30+01:00

[RSS] Symless: an IDA assistant for structure reconstruction

https://blog.thalium.re/posts/symless-an-ida-assistant-for-structure-reconstruction/

There are no originals, only the data from the service with some ...

2026-01-12T12:47:17+01:00

In reply to nevent1q…am03
_________________________

There are no originals, only the data from the service with some random compression. What do I compare hashes to?

Archivists: suppose you have to scrape large amounts of media for ...

2026-01-12T12:32:57+01:00

Archivists: suppose you have to scrape large amounts of media for preservation from an unfriendly service. How do you ensure that the retrieved media didn't get corrupted along the way? (I don't want to watch/listen to 1000s of hours A/V)

#archiving #scraping

We (Hungary) don't anticipate EUR anytime soon, prices still ...

2026-01-12T11:33:11+01:00

In reply to nevent1q…5sd3
_________________________

We (Hungary) don't anticipate EUR anytime soon, prices still climbed to 400% since 2015.

Any recommendations for exploit dev focused #CTF with an archive ...

2026-01-07T12:53:47+01:00

Any recommendations for exploit dev focused #CTF with an archive of challenges?

I'm looking for samples and interested in code comprehension, less interested in obfuscation/VMs.

My recommendation: https://this-museum-is-not-obsolete.com/ Not a ...

2026-01-05T18:31:02+01:00

In reply to nevent1q…h5s3
_________________________

My recommendation: https://this-museum-is-not-obsolete.com/

Not a typical a museum, more like a playground for geeks :)

"The purpose of a system is what it does" ...

2026-01-05T15:25:49+01:00

"The purpose of a system is what it does"

https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does

This is exactly what I've been trying to articulate re: cookie banners. The word of the regulation and intent is largely irrelevant to the effect it caused.

So you'd source a print head from scrap and use HP's ...

2026-01-02T14:14:27+01:00

In reply to nevent1q…92yx
_________________________

So you'd source a print head from scrap and use HP's cartridges for ink?

I go to print shops because I refuse to maintain any commercially ...

2026-01-02T13:46:51+01:00

In reply to nevent1q…7adc
_________________________

I go to print shops because I refuse to maintain any commercially available printer, so literally anything that works would be step-up for me.

Open Printer https://www.crowdsupply.com/open-tools/open-printer ...

2026-01-02T11:27:43+01:00

Open Printer

https://www.crowdsupply.com/open-tools/open-printer

I've been looking for something like this for a long time! Unfortunately I don't yet see how ink could be supplied, and as Felicitas Pojtinger 🌅 (npub10hd…faqp) points out, the chosen CC license would make establishing a sustainable ecosystem difficult...

Thanks for the great talk, definitely the most thought provoking ...

2026-01-01T17:52:29+01:00

In reply to nevent1q…8rnj
_________________________

Thanks for the great talk, definitely the most thought provoking one for me from this CCC! Have to watch it like 3 more times to get all the details though 😅

I'm bringing this up exactly because when CVSS will be ...

2026-01-01T13:21:55+01:00

In reply to nevent1q…x540
_________________________

I'm bringing this up exactly because when CVSS will be assigned it will either show 0.0 or some really weird non-sense. The former would be likely a better, but still misleading scenario,. My bet is on MITRE publishing some non-sense though.

Not saying it's not a vulnerability but I think you won't ...

2026-01-01T13:15:42+01:00

In reply to nevent1q…ynpe
_________________________

Not saying it's not a vulnerability but I think you won't be able to score this with CVSS that would make CVE registration weird.

One of my secondary desktop runs NixOS and it's perfectly ...

2025-12-31T15:29:49+01:00

In reply to nevent1q…hfvt
_________________________

One of my secondary desktop runs NixOS and it's perfectly usable as long as you are willing to spend some extra time to look up docs when you introduce some more serious change (e.g. new HW). "I need to just get something done real quick" is exactly the way junk gets piled up, but IME NixOS educates you to either use a temporary install or setup things in containers/VMs that will probably pay off in the long run (I also have a VM host, so this may be easier to do for me).

But I had a chance to choose the appropriate interface instead of ...

2025-12-27T09:01:24+01:00

In reply to nevent1q…st80
_________________________

But I had a chance to choose the appropriate interface instead of blindly trying things in an environment you can't properly debug...

Thanks for the responses, but my diagnosis was wrong - although I ...

2025-12-26T20:47:05+01:00

In reply to nevent1q…34ah
_________________________

Thanks for the responses, but my diagnosis was wrong - although I still don't quite get it: it turns out that the object I'm writing out (json.dump) contains a list that gets extended by the script (this sort of explains why I'm writing out more and more data), BUT the list is part of an object that I reinstantiate on every run, which should empty the list (I call super() with an empty list). Problem is the (super)class is generated code and I suspect the list is not in fact an object member but a static class variable that may cause this??

OK so either I have a fundamental misunderstanding of how #Python ...

2025-12-26T20:25:26+01:00

OK so either I have a fundamental misunderstanding of how #Python I/O works, or this is a bug:

I have a `with open(..., "w") as foo:` block in my script. If I execute it twice (now from #IDA, and I experienced the same with #Ghidra) the contents are _appended_ instead of truncating the output first!

WT actual F?!

All I want for Xmas is sane documentation <3 ...

2025-12-26T18:39:14+01:00

All I want for Xmas is sane documentation <3

This one by @npub1zhy…cve0 may cover the details, although the ...

2025-12-22T16:55:17+01:00

In reply to nevent1q…43eu
_________________________

This one by quarkslab (npub1zhy…cve0) may cover the details, although the CVE is not mentioned: https://blog.quarkslab.com/k7-antivirus-named-pipe-abuse-registry-manipulation-and-privilege-escalation.html

[RSS] When OAuth Becomes a Weapon: Lessons from CVE-2025-6514 ...

2025-12-22T09:14:47+01:00

[RSS] When OAuth Becomes a Weapon: Lessons from CVE-2025-6514

https://amlalabs.com/blog/oauth-cve-2025-6514/

It's 2025, and I have to prompt an LLM no less than 5 times ...

2025-12-16T17:44:05+01:00

It's 2025, and I have to prompt an LLM no less than 5 times to figure out how to add a new keyboard layout to Windows Server 2025, becase 1) the UI turned absolutely shit 2) the built-in search is optimized for ads instead of discovering functionality.

Also, Disk Management is gone, and you get no meaningful results for "disk" in the Start Menu. But when you *right click* the Start icon it's there. Why would it be so hard to make this discoverable by search (or leaving a shortcut with the original name)??

Why not Ghidriff/BinDiff/Diaphora?

2025-12-15T16:06:20+01:00

In reply to nevent1q…kmr3
_________________________

Why not Ghidriff/BinDiff/Diaphora?

LEGO turned down the Turing Machine model idea :( ...

2025-12-14T11:44:23+01:00

LEGO turned down the Turing Machine model idea :(

https://beta.ideas.lego.com/product-ideas/10a3239f-4562-4d23-ba8e-f4fc94eef5c7

Wow that was quick, glad I could help! I've been doing ...

2025-12-09T17:21:20+01:00

In reply to nevent1q…t5dz
_________________________

Wow that was quick, glad I could help!

I've been doing infosec for ~20 years but I only realized recently we communicate wrong after some relatives fell for QR-based scams and had to walk them through what happened.

I agree that determining risk is incredibly hard in this case and TBH I think "don't trust QRs" may be more effective than trying to teach everyone URLs, DNS and PKI...

Great initiative, saved and shared! One suggestion re: "QR ...

2025-12-09T13:37:50+01:00

In reply to nevent1q…udt7
_________________________

Great initiative, saved and shared!

One suggestion re: "QR codes are simply a way to open a URL" -> users have no clue what URLs are or how to interpret them. Even if you assume they can parse out the true domain (major if!), they don't know which domains are trustworthy. On top of this mobile browsers make it esp. hard to inspect URLs. We need to come up with better advice for site verification!

"The benefit of having an actual memory space for special ...

2025-12-08T19:52:24+01:00

In reply to nevent1q…69ws
_________________________

"The benefit of having an actual memory space for special function registers is they can be seen, named, references created to them, data types applied at the location, as well as default values supplied for a given binary sample. We plan to do the same for other processors such as the PowerPC."

I hope this is the reason why my PPC-AS pull request is open for more than a year now :)

That was quick: #Ghidra 12.0 is out! Here's what's new: ...

2025-12-08T19:46:40+01:00

That was quick: #Ghidra 12.0 is out! Here's what's new:

https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.0_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.md

"Last week the @FFmpeg account began taunting security ...

2025-11-23T19:31:42+01:00

"Last week the @FFmpeg account began taunting security researchers. Foolish thing to do, as it ignores the asymmetry of their attack surface vs ours.

So as an exercise I found a stack-based buffer overflow on software that he wrote." - AIfredo 0rtega (npub15gk…3jd8)

https://threadreaderapp.com/thread/1991974275532636263.html

Normally I'm all for these stunts, but this one...

Please help making #TreeSitter Playground better by doing this ...

2025-11-21T19:25:54+01:00

Please help making #TreeSitter Playground better by doing this little experiment:

https://tree-sitter.github.io/tree-sitter/7-playground.html

Write some JS, like `var x=1;`. Enable Query and provide the `(identifier) @foo` pattern in the new Query textbox.

Do you see the code highlighted? (if not, turn on Accessibility, a'la GH issue #1714)

That's how I like my #Friday's: I came back from lunch ...

2025-11-21T14:18:19+01:00

That's how I like my #Friday's: I came back from lunch and my code started working!

Time to push to prod...

TIL cURL only supports the lowercase http_proxy environment ...

2025-11-19T13:33:01+01:00

TIL cURL only supports the lowercase http_proxy environment variable:

https://curl.se/mail/archive-2001-12/0034.html

I accidentally made this gif this morning before shit went down ...

2025-11-18T15:56:11+01:00

In reply to nevent1q…wxrm
_________________________

I accidentally made this gif this morning before shit went down

lol, some chaos engineering right there!

2025-11-18T14:06:59+01:00

In reply to nevent1q…k826
_________________________

lol, some chaos engineering right there!

Cloudflare down is another teachable moment to think about your ...

2025-11-18T13:29:48+01:00

Cloudflare down is another teachable moment to think about your eggs and your baskets.

TIL Minecraft requires a freaking MS account. I thought it ...

2025-11-16T19:09:00+01:00

TIL Minecraft requires a freaking MS account. I thought it wasn't that bad so we proceeded to create one, but it turns out that if you want to create a child account (based on birth date, to avoid adult ads and shit) you as an adult *also* need a MS account that would be of course immediately connected to your childs account which I assume to be a gold mine for advertisers.

Seriously, fuck #AdTech!

(I also wonder if this is legal in the EU?)

Honest question: how is the NDA compatible with SaaS models?

2025-11-15T15:55:40+01:00

In reply to nevent1q…upfn
_________________________

Honest question: how is the NDA compatible with SaaS models?

Dear designers: scrollbars are useful and exist for a reason. ...

2025-11-15T13:25:31+01:00

Dear designers: scrollbars are useful and exist for a reason. Don't hide them, please.

OK, it seems I found it (although not very useful, acceptable ...

2025-11-13T17:02:39+01:00

In reply to nevent1q…45gw
_________________________

OK, it seems I found it (although not very useful, acceptable value formats are not documented for example), at the end of the article about...publishing. Because somehow in the CLI's world there is just *no way* I won't update my code to GitHub :P

https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs#about-qlpackyml-files

GitHub Security Lab (npub1p3v…r8jg)