infosex.exchange <3

You are probably looking for the infosec.exchange Mastodon instance

This host is mostly for my random stuff, and in little part acts like a well-intentioned placeholder for the typosquatted domain.

Discoverability and Archiving

Currently I'm using this host for saving the items from my own feeds to the Wayback Machine and provide in-links for search engines. I hate that I have to do this, but the non-sense ideology of Mastodon pretty much ruined the search feature for Fediverse as a whole, and this wasn't changed by the fact that they owned their mistake and implemented search eventually.

Yes, I (or anyone else) could do similar things with other peoples published feeds, regardless of the tantrum. No, you can't defederate this, because the process doesn't rely on an instance.

Gluttony Section for Search Engines

@elilla "many online subcultures used to have a politeness norm of 'don't ask questions without first googling it'. this rule is obsolete."

Damn it, you are right! :O
this post | permalink
It seems that MS is pretty nervous about prompt injections[1] to the point where it breaks tool integration by default in their new shiny WinDbg MCP[2].

I'd **love** to see some malware prompt injecting analysts via e.g. strings! Extra points for revealing the malicious prompt in debugger output only, e.g. in a stack trace :)

[1] https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-mcp-overview#windbg-mcp-security-and-privacy-considerations
[2] https://github.com/microsoft/WinDbg-Feedback/issues/401
this post | permalink
[RSS] [Quarkslab] Internship Offers for the 2026-2027 Season

http://blog.quarkslab.com/internship-offers-for-the-2026-2027-season.html
this post | permalink
[RSS] Calif iPhone jailbreak demos

https://blog.calif.io/p/iphone

"Everything will be released in due time"
this post | permalink
[RSS] Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

https://calif.io/research/big-fish
this post | permalink
[RSS] Deep-Dive into Android Binder UaF (CVE-2023-20938) using Time-Travel Debugging

https://www.eshard.com/blog/kernel-uaf-1-trigger
this post | permalink
[RSS] Dumping Encrypted Viltrox Lens Firmware - two times

https://blog.29b.net/dispatches/viltrox_re/
this post | permalink
[RSS] One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux

https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
this post | permalink
The only good AdTech is Adhesive Tech.
this post | permalink
@Linkshaender

Sorry, there is a lot to argue with here, so let me give you an extreme, but hopefully illustrative example:

Our spec is to add two finite integers. There is a non-zero chance, that the LLM will implement this by calculating square roots and applying a ton of hacks and so it does.

Humans are not able to touch the code since every bit of it is unreasonable and literally drives them crazy. Having an LLM do a change makes things worse.

Still all of your tests pass, since that's the success criteria for the LLM (btw how do you know what to test for in this case?). Some inputs (you don't know which) would DoS your system or give inaccurate results, but no one complained the last 6 months.

Would you be a happy PO of this system?

@gadi
this post | permalink
Next Page