Sometimes I build things. Certified has-been: SuperSU (100M's of devices), DSLR Controller (first mobile USB control), WMWifiRouter (first mobile hotspot ever)
Netherlands
Joined May 2009
- Tweets9.7K
- Following531
- Followers127K
- Likes32
My agents keep logs of all their mistakes. Had Claude analyze pre/post Nov 3.
Incorrect claims: 2x+
Mistakes caught by me: 3x+, and I didn't get any smarter.
Disclaimer: I only work at best 30m a day due to circumstances, but Opus keeps going. Normalized to tokens per day.
Chainfire retweeted
I'm winding down my time in the Apple Security Bounty program — so I'm open-sourcing the research. 100+ PoCs, real CVEs, and the fuzzers that found them. Public repo 👇 github.com/dawgyg/AppleResea…
Sigh.
SSHole : une faille critique dans OpenSSH restée cachée pendant dix ans (via Pierre Arlais)
Donc go installer la mise à jour de sécurité OpenSSH 10.6p2.
👉 sshhole.com/
ALT *sshole so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016. accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters. yes, any password. yes. i know. yes. $ ssh root@alpine-cloud root@alpine-cloud's password: wrong Permission denied, please try again. root@alpine-cloud's password: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Welcome to Alpine! alpine-cloud:~# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) alpine-cloud:~#
"Wow, it held up." ~ Claude
Never seen Claude "wow" at me before. Details next week, hopefully. Exciting!
Chainfire retweeted
The empirical rate from CVE temporal clustering is 5-15%, security patches introduce at least one new bug. OpenAI patched 948 bugs. At 5-15%, that's 47-142 new vulnerabilities created by the act of fixing the old ones.
Cut one head, you grow two 🐲🐲🧵
This is crazy even for France. Netflix probably defaulting to 144p 😂
🔴 🇫🇷 ALERTE INFO - DU JAMAIS VU: UNE TAXE SUR CHAQUE GIGAOCTET INTERNET VOTÉE À L’ASSEMBLÉE
Les députés ont adopté un amendement prévoyant de taxer les producteurs de données numériques à hauteur de 5,5 centimes par Go transmis.
💰 Objectif affiché : jusqu’à 10 milliards d’euros par an.
Netflix, YouTube, cloud, jeux dématérialisés… les grands services numériques pourraient être concernés, avec un risque de répercussion sur les prix pour les consommateurs.
📌 Source : Assemblée nationale
#France #Budget2027
Chainfire retweeted
Someone is putting the law of every country into one git history.
Git for Global Law turns each country's laws into a repository where every commit is a real law taking effect. So you can see exactly what the law said on any date, and which law changed every word.
It started with the US Code, which hit #1 on Hacker News. The global version is growing country by country: Germany's constitution since 1949, Estonia and more so far.
Free to use for anything, and perfect for feeding to an AI.
github.com/lexifina/global-l…
It's interesting that there's suddenly a lot of attention on X on how un-competitive the EU is for small- and medium-sized businesses, tech, start-ups.
What changed? Because it has been that way for 20 years. I've screamed into the void long and hard enough about it😖
SOC2T2 is what accountants think security is.
Having gone through the certification process a year or two ago at a gig, it is somewhere between theatre and sheer madness.
We had to actually reduce security to be able to meet the requirements.
Chainfire retweeted
Your next trip: a flight to another world. 🪐
Send your name aboard NASA’s Dragonfly mission to Saturn’s largest moon Titan and get a personalized boarding pass for the journey.
Become a Dragonflyer today: go.nasa.gov/dragonfly-names
ALT Poster with a peach-and-gold background that reads “Journey to Titan” in bold orange text, with a banner beneath it that says “Fly your name to another world!” Below the headline, NASA’s Dragonfly rotorcraft flies through a hazy sky with its rotors spinning, with faint hexagon patterns in the background.
Chainfire retweeted
In lieu of flowers, memorial contributions may be made to:
Johns Hopkins Alzheimer’s Disease Research Center Fund
alzresearch.org/giving/
Alzheimer’s Foundation of America Caregiver Resources
alzfdn.org/donate/
Photo Credit: Tommy Garcia
Chainfire retweeted
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Chainfire retweeted
One of the biggest mysteries of the Wow! Signal is its exact location, with two possible positions in the sky. Our #AreciboWow team has solved this mystery using three independent methods. We’ll present our findings in 2027.
We know! 😉
Over 400 million downloads and 500 GB of compressed pre-rooted images 👀
This week’s vulnpocalypse was a good excuse to black out all my sites, have the trusty clanker decide what comes back, and upgrade (bye PHP!).
Quite the trip down memory lane. Apps I barely remember writing. Websites for them I definitely don’t remember building 😂
Turns out I was still serving over 40K files, mostly pre-rooted boot images, for thousands of device/Android version combos.
SuperSU and dozens of other apps, counted across my server, Play and XDA: easily 400 million downloads, nearly all over a decade ago. Add the custom ROMs and devices that pre-installed them and I’d cautiously say the total cleared half a billion 👀
I almost forgot what a busy little bee I used to be in the Android space. I remain my own impossible act to follow 😅
About half the old sites are back, some crippled, for posterity. The boot images are out of my backup rotation though. If that repo dies, it stays dead.
So if you still need to root an Android 4.0 device with SuperSU, now’s the time 😂