@adamshostack.infosec.exchange.ap.brid.gy
Author, game designer, technologist, teacher.
Helped to create the CVE and many other things. Fixed autorun for XP. On Blackhat Review board.
Books […]
[bridged from https://infosec.exchange/@adamshostack on the fediverse by https://fed.brid.gy/ ]
@thedarktangent.defcon.social.ap.brid.gyReposted by @adamshostack.infosec.exchange.ap.brid.gy@adamshostack.infosec.exchange.ap.brid.gy@bruces So … is this against the law, and if so who’s violating which law? Is it copyright infringement? By whom? The ai company or the guy writing the prompts?
@bruces.mastodon.social.ap.brid.gyReposted by @adamshostack.infosec.exchange.ap.brid.gy*Vibe-coded replicas of established commercial software-packages
@adamshostack.infosec.exchange.ap.brid.gy@thedarktangent @xabean And how to restrict the web server to only accept from let’s encrypt ip addresses?
@thedarktangent.defcon.social.ap.brid.gyReposted by @adamshostack.infosec.exchange.ap.brid.gy@xabean The short answer to your questions are essentially “Because of the changes to web PKI certificate lifetimes everyone will need to automate with ACME. When using Let’s Encrypt that requires your server to make outbound connections to (essentially) the internet. How do I restrict CertBot […]
@adamshostack.infosec.exchange.ap.brid.gyAhh the famous British “Stiff upper lip” in the face of adversity!
@cosmictraveler.mastodon.social.ap.brid.gyReposted by @adamshostack.infosec.exchange.ap.brid.gy
@adamshostack.infosec.exchange.ap.brid.gy@darkuncle Is it a full reimplementation? Does it require root privs to run half a dozen extraneous daemons? 😇
@georgemonbiot.bsky.socialReposted by @adamshostack.infosec.exchange.ap.brid.gyYes, I've seen some of the abuse on this site for the stance I've taken. But it won't change my belief that this motion is gesture politics of the kind you might find in a students' union. Except in this case it has real and damaging consequences - that are already playing out. A massive self-own.
@adamshostack.infosec.exchange.ap.brid.gy@rsalz To be direct, mouse movements? Most computers (ioT, cloud, mobile) no longer have mice.
I think you risk credibility by including that.
@adamshostack.infosec.exchange.ap.brid.gy@rsalz I think you need to take on the question "when is the hardware RNG, washed through a hash function with some other stuff, not sufficient?"
As I worked on the 2nd edition of threat modeling, I threw out a heck of a lot of PRNG content as .. no longer relevant, since the chips "all" now […]
@adamshostack.infosec.exchange.ap.brid.gyIf the Llm was actually anything close to intelligent, it could talk about Soatok without having a meltdown. But it’s not. It’s a weird amalgamation with some very cool tricks and some very big blindspots.
@adamshostack.infosec.exchange.ap.brid.gyYou know what else is efficient? Executing enemies of the state. We gave up on that because no one wants to be the enemy of the state who gets executed, and so we all decided that a little inefficiency was better than all the alternatives that had been tried from time to time.
@adamshostack.infosec.exchange.ap.brid.gy@juergen_hubert Out of curiosity are you writing a folklore book in latex? Is that a norm in that discipline?
@juergen-hubert.mementomori.social.ap.brid.gyReposted by @adamshostack.infosec.exchange.ap.brid.gyI am looking for beta readers for "Old Goatfoot", my upcoming collection of Devil-tales from German folklore. Beta readers are test readers for books who provide feedback from a fan perspective and help the author identify and fix problems before the book […]
@adamshostack.infosec.exchange.ap.brid.gyRE: https://infosec.exchange/@cR0w/117377754771371427
This is a really great point: Accelerating the PQC timeline takes security budget from other priorities, like stopping directory traversal or SQLi.
@adamshostack.infosec.exchange.ap.brid.gyAssume that you got a a USB key in the mail, addressed to you. How would you investigate it? What tools or sandboxing would you bring to bear? (Ideally MacOS). Edit: So the threats seem to fall into three groups: 1. Physical 2. Logical layer with the drive giving false reports of what's […]
@adamshostack.infosec.exchange.ap.brid.gyAlso, I didn't mean to misplace the comma in commas, it was supposed to be after the word, but ... eh? 🤷
@adamshostack.infosec.exchange.ap.brid.gyI really appreciate how Amazon is innovating in the display of ... years.
Not only the comma,s but also skipping 2,022 and 2,023 entirely.
@adamshostack.infosec.exchange.ap.brid.gyRE: https://infosec.exchange/@patrickcmiller/117372663953258546
“No problem sir, we’ll write that in.”