infosex.exchange <3

You are probably looking for the infosec.exchange Mastodon instance

This host is mostly for my random stuff, and in little part acts like a well-intentioned placeholder for the typosquatted domain.

Discoverability and Archiving

Currently I'm using this host for saving the items from my own feeds to the Wayback Machine and provide in-links for search engines. I hate that I have to do this, but the non-sense ideology of Mastodon pretty much ruined the search feature for Fediverse as a whole, and this wasn't changed by the fact that they owned their mistake and implemented search eventually.

Yes, I (or anyone else) could do similar things with other peoples published feeds, regardless of the tantrum. No, you can't defederate this, because the process doesn't rely on an instance.

Gluttony Section for Search Engines

Setting up a mailserver is a horrible experience in itself, but I like challenges.

DKIM in particular is so insanely bad though that I'm contemplating joining BigTech in their crusade against e-mail.
this post | permalink
[RSS] Black Hat Asia 2024 Conference Slides

https://github.com/onhexgroup/Conferences/tree/main/BlackHat%20ASIA%202024-Slides
this post | permalink
Exploit Development and Analysis of CVE-2021-31956 NTFS Windows Kernel Pool Overflow (Google Translated from ES):

https://gabrieldurdiak-github-io.translate.goog/ntfs/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=hu&_x_tr_pto=wapp
this post | permalink
Writeup on two older VMware vulnerabilities:
- CVE-2021-21987 - Workstation/Horizon Client OOB read
- CVE-2022-22938 - Workstation/Horizon Client DoS

https://gabrieldurdiak.github.io/vmwarevuln/
this post | permalink
"Implementing Exchange support with Rust"

I'm afraid if the authors primary concern is how to handle application/xml in Rust, then they really don't grasp the actual problem.

#Exchange handles a number of highly fragmented/underspecified protocols (SMTP, ICS, *DAV, ...) in a certain way, while #Thunderbird does so just differently enough (and inconsistently IME) so that everything breaks randomly.

You can't solve this with a cool compiler.

https://blog.thunderbird.net/2024/04/adventures-in-rust-bringing-exchange-support-to-thunderbird/
this post | permalink
"Somehow, against all odds, I found it. I happened to use the exact right string in my search to pull up some reddit threads [...] inside was a link to a Microsoft forum post. I kept my expectations in check and clicked on the link. What I saw had my nearly vibrating in my seat."

And this is why #discoverability and #search are important.

You may some day post some weird stuff that could save somebody else's ass. Poor fella will never find it on Fedi though, because of the ancient fear of imaginary monsters who gain their power from full-text-search.
this post | permalink
@simontsui "Disabling Telemetry prevented the system cron job from running, preventing the execution of the command [...] we discovered additional ways to exploit the vulnerability that did not require telemetry to be enabled"

In other words instead of fixing the root cause of the vulnerability they focused on the particular exploit. Wishful thinking straight from the '90s...
this post | permalink
@swapgs "Handling it only at the "right" place also gets tricky..." - This is part of the reason I'm asking. My thinking is that with multiple guards you'll need multiple changes for thing to go wrong, so you may have to trace all of those during debugging.

Generally it may be true that finding the removal of the last guard will tell you what the problem is, but I'm not sure this is always this simple, and that by seeing the last guard only wouldn't mislead the fixer.

(Again, I'm not talking about security-critical checks here, in those cases defense-in-depth is clearly beneficial)
this post | permalink
#Programming best-practice:

If I have the chance to prepare for edge cases at two places, should I do so at both? In security we would call this defense-in-depth, but functionality-wise I have the feeling that this introduces redundancy and I may catch bugs earlier if I only did the handling at the "right" place.

What do you think?

Does the equation change, if we talk about distinct components (e.g.: code&template, different microservices)?
this post | permalink
@singe @wdormann I'm not that sure about the "no shitpost" part on my side :D Thanks for the commendation!
this post | permalink
Next Page