RE: https://infosec.exchange/@nyanbinary/117394349122804782
Say, where do the cool kids get their LinkinPark_Numb.mp3.exe these days?
Search
68 results for “nyanbinary”
-
CW: shitpost
SSVC stands for "Subjectively Scored Vibe Classification"
-
hm, no, this one isn't on me.
The bot uses the cvelistV5 repo for determining CISA KEV. For this it checks for a
metricsobject with typekevin the cisa ADP container. For these it appears this object wasn't created until ~1h ago: https://github.com/CVEProject/cvelistV5/commit/a2f5f1f0ee11cb1ed9fea2ca81383312b976fe6aInterestingly the SSVC metrics object & the CISA KEV reference was already included - while building the bot I was considering including checking for SSVCs exploitation:active but decided against it as, at the time & iirc, every single CVE record with exploitation:active also had the kev metrics object.
-
grmph, was @kev_bot broken again? :dragon_confused:
-
So, we have security systems set up. Basically, when you create a user, you can give it extremely fine-grained control on what it can access in the program. See examples above: Bill on the floor can’t run a report and get all the credit cards, unless Bill’s user was explicitly granted that security permission.
Another important note: the LLM is just a lower-level Claude running inside the application. It has full access to the database for that particular company. Anything available in their company’s database, the agent could technically grab on their behalf. It writes and executes its own SQL queries to try and answer user questions.
This is just malpractice. I know permissions are hard & chatbots are still kinda new but this is a well known & solved problem, even before chatbots.
*...remembers running @hardcoded_bot *
nvm, what did I expect
-
"3 billion devices run java" factoid actually just statistical error. average device runs 0 java. atlassian cloud, which lives in a cave and runs 3 billion different java versions, is an outlier adn should not have been counted.
-
Therapy is a PvP game, right?
-
The good thimg about my thoughts jumping all over the place all the time is I am probably not lieing when answering the question what I am thinking about...
-
We all have strategic stockpile of topics & memories to deflect, right? We all try to map out past conversation flows so we can control where the conversation doesnt go, right?
-
It's a good sign if you are actively thinking about ways to avoid therapy sessions & dread going there, right?
-
Oh, great, looks like the Nextcloud Client update fucked with the local settings so it prompted me to log in again & set up a new local sync folder (with it just not accepting the old one). Stopping the client & restarting it had it recover with the old settings so yay, I dont need to pull another 100GB over a residental upstream.
-
Part 1 of my brain: I should get tattoos :neobot_pleading: .
Part 2 of my brain: Yeees, agreed. I got a great idea for a face tattoo
Part 1: Oh neat, usually we struggle with ideas... waaait... hold on...! -
CW: US pol, aber Deutsch
Na, welche werdens?
-
CW: US pol, aber Deutsch
Super, jetzt muss ich drüber nachdenken welche Stadt Merz bereit wäre dem Iran zu opfern...
-
Oh, also a bunch of other criticals & highs in there: https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9
-
RE: https://infosec.exchange/@hardcoded_bot/117394790524268752
This is fine, right? Whats the worst that can happen, right?
-
Sag mal, darf man die Coldmirror HP dubs eigentlich noch genießen? :thinking_cirno:
-
I guess I could just yt-dlp ...
-
Scheiß drauf, ich guck ob ich irgendwo ne gepiratete Version finde & schick denen 20 Euronen in der Post
-
Nein, ich will dein Album nicht streamen. Gib mir einfach nen Link wo ich dir Geld geben kann und du mir Dateien gibst.
Das schöne an Auto-Deletion ist, dass ihr nicht nachweise könnt, dass ich das hier alle paar Monate poste...
-
No, I didnt think this through
-
CW: Silly idea
So, I think its a bit of a missed opportunity with passkeys but opportunistic e2e cross-session storage of availability-uncritical confidentiality-critical data would be quite neat?
Fundamentally passkeys/webauthn is just pubkey authentication taken to the web (in the application layer). The assumption that underpins the broad passkey rollout is that we have built ecosystems that manage to abstract the key management enough so users dont have to worry about keymanagement, with keys being created and enrolled without user interaction & follow users through ecosystems.
So why limit this to authentication if we can also do encryption?
Encryption has one issue that authentication doesn't: If you lose your authentication key you can have account recovery procedures that restore full access. If you lose an encryption key (unless you are also encrypting it with the sites key) its gone. As such we are kinda limited to data with low availability requirements.
Example: Credit card or other payment options. You run a webshop & you want to allow people to store their payment options without the risk of storing that data in a way your employees can access it. So... you just have your customer send you an e2e encrypted blob. If they make another purchase they get sent the blob and if they still have the key they can decrypt it & reuse it. And if someone doesnt use passkey+? Well, do it opportunistically, either dont store it or store it for only those customers.
-
RE: https://infosec.exchange/@BleepingComputer/117393249679280513
Not to shit on the reporting, on the contrary, but the absence of reporting on the flood of BEC is fascinating to me. When I still did IR at $lastjob one of our vendors/suppliers getting popped (or at least a couple of their M365 accounts, incl. mail & sharepoint) & sending us phishing was a near-daily occurrence. And thats just the stuff that made it through the filters & was reported to us...
-
Gonna make the pope 1v1 me in CoD MW2 for the title
-
Most cursed IT company mergers?
-
Hey you. You want any of the .... good stuff? opens coat, showing collection of parmesan wedges
-
vandalizing every single surveillance camera is the moderate position, istg
-
But honestly much worse: The ubiquitous surveillance cameras in public transport. I have been on one too many late night trains where the ceiling camera globes outnumbered the passengers. I have been in one too many train stations with more cameras than people boarding the train.
-
One day I will take a grafiti spray can to every surveillance camera on this fucking street. Fuck you and your rich people bunker.
-
Sometimes I realized how dead privacy is in the physical world and it makes me fucking angry.