Prasanna retweeted
If AI is reducing working hours and increasing productivity, why aren’t companies reducing working hours too?
Why should employees keep working the same long hours when AI helps them get work done faster?
Shouldn’t employees get to spend that extra time with their families, pursue hobbies, and take care of their personal lives?
If companies get the productivity gains from AI, shouldn’t employees get some of their time back too?
Prasanna retweeted
I’m concerned we haven’t adequately prepared for the inflation of exploit naming. We should probably be using
php00002shell
Just to be future-proof. That will allow an easy 99997 more exploits before we need to update again.
Prasanna retweeted
MLC elections in 28 seats across 4 big states - Uttar Pradesh, Maharashtra, Bihar and Karnataka.
Elections held using ballot papers.
Guess how many seats Congress won? 🧐
Prasanna retweeted
Mobile PLI stats as follows:
Government incentive paid: Rs 19,000 Cr.
Direct tax collected: Rs 25,000 Cr.
GST collected: Rs 3,00,000 Cr.
Electronics manufacturing employs 25 Lakh people; mobile manufacturing alone employs 12 Lakh.
Cope harder!!
One in four iPhones is made in India, but imported parts and costly subsidies complicate the success story. @andymukherjee70 takes apart an iPhone to explain why copying China's manufacturing model may not pay off 🎥
Prasanna retweeted
For anyone getting into biology, please consider taking airborne disease resistance more seriously.
It's a super important area of medicine that is a huge cause of death and sickness but easily gets forgotten. We're likely to get many more airborne plagues in the future due to the combination of not just extremely dense and interconnected society (including city and farm animals), but also accidents from bio research and offensive biotech (both from random people and from secret government programs that can easily get themselves exempted from safety restrictions), all enhanced by powerful AI.
Right now, this area is getting way less love than longevity research (which continues to be super important!), but it's an area where there are lots of unclaimed wins that we know exactly how to do (but are not yet doing) with present-day tech:
* early detection
* passive universal testing
* filtration/ventilation/UVC
* better vaccines (including making them open source and open science)
* cryptography to make all of the above privacy-preserving
We can have China-level pandemic resistance with Sweden-level limited intrusion into people's lives, and then go even further. We just have to actually do the work for it.
Prasanna retweeted
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Prasanna retweeted
Ppl need to understand that the celebrity they are defending to such a extent on this app doesn't know about your existence and they dont care a bit about you. Stop behaving as if they are your responsibility. We all really need to calm down. Its okay to have a diff of opinion
Prasanna retweeted
apparently 4 is the new 256-bit security standard. eMudhra walked so GoAhead could crawl. 😭😭
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Prasanna retweeted
Bug bounty has definitely changed.
I used to spend hours analyzing HTTP requests, switching back and forth between Firefox and Burp Suite.
Now, I open my terminal, point my AI skills at a target, intercept and analyze HTTP traffic using Burp Suite MCP, and offload heavy tasks to my HackBot running on a VPS.
But here’s the thing: AI doesn’t replace your hacking skills. It scales them.
The goal is to get really good at manual hacking first, then use AI to automate and scale what you already know.
Not the other way around.
You don’t start by building a HackBot and expecting it to hack for you when you don’t even understand what it’s doing.
Learn to hack first. Automate second. Scale third.
Keep hacking! ✌️
Prasanna retweeted
I really want to know what actual work people are doing at Microsoft ?
This man spent more time on shooting reels than doing actual work.
Now we know why microsoft offering voluntary exit
Prasanna retweeted
If you ever wonder the cost of ransomware, read theanonnetwork.substack.com/…
Prasanna retweeted
Weird how they’ve found so many amazing things and yet not one single result related to practical cryptanalysis. I guess everyone should pat themselves on the back for a job well done.
We are announcing three new discoveries in mathematics, computer science, and physics about harmonic analysis, complexity theory, and quantum field theory.
openai.com/index/building-sc…
Prasanna retweeted
Imagine a world where Pani Puri helps you achieve your protein goals and maintain a calorie deficit!
Prasanna retweeted
People are going to lose their mind when they realize its actually easier to hack things using FEATURES not CVEs.
Prasanna retweeted
Everything I have seen about Rashmika and Vijay Deverakonda has been against my will.
Prasanna retweeted
Just a few of the biggest security incidents in the past week... we're still accelerating:
* PHP2Shell: Two critical RCE bugs in PHP core
* eMudhra: Eight intermediate certificates had extremely weak private keys due to a key-generation script error that created keys with tiny values.
* GitLab: integer overflow RCE
* Plex Media Server: flaws compromised internet-facing servers used for cryptominers and proxy tools.
* Arista VeloCloud Orchestrator zero-day: Actively exploited authenticated SQL injection enabling privilege escalation.
* Node.js Brotli decoder RCE
* NGINX critical heap/use-after-free issues
* Railway breach: Attacker accessed systems storing customer environment variables and, for some, obtained decrypted contents (API keys, database credentials, private registry logins, etc.)
* Zeabur breach: ~321,810 accounts and over 3.2 million environment-variable records exposed. Company announced it is shutting down.
* LiteLLM supply-chain compromise: Malicious version 1.107.0 pushed to PyPI and Docker Hub containing a credential stealer and remote-access/backdoor capability.
* California public school data theft: 5.7M+ student records leaked, including names, dates of birth, addresses, demographics, and disability status.
* Capcom breach: Unauthorized access to ~11.77 million CAPCOM ID records
* Quest Diagnostics: Unauthorized access to Quanum Lab Services Manager system used by some clients; potential access to certain patient records.
* State Bank of India breach: customer records appearing on dark web