infosex.exchange <3

You are probably looking for the infosec.exchange Mastodon instance

This host is mostly for my random stuff, and in little part acts like a well-intentioned placeholder for the typosquatted domain.

Discoverability and Archiving

Currently I'm using this host for saving the items from my own feeds to the Wayback Machine and provide in-links for search engines. I hate that I have to do this, but the non-sense ideology of Mastodon pretty much ruined the search feature for Fediverse as a whole, and this wasn't changed by the fact that they owned their mistake and implemented search eventually.

Yes, I (or anyone else) could do similar things with other peoples published feeds, regardless of the tantrum. No, you can't defederate this, because the process doesn't rely on an instance.

Gluttony Section for Search Engines

Local Privilege Escalation via writable files in Checkmk Agent (CVE-2024-0670)

https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-writable-files-in-checkmk-agent/
this post | permalink
If you think your remote kernel debugger is slow:

https://fosstodon.org/@AkaSci/112091847867604195
this post | permalink
@da_667 @tomw @demize It's only an outage if it occurs in the Oui region of France
this post | permalink
[RSS] Discovering Deserialization Gadget Chains in Rubyland - Include Security Research Blog

https://blog.includesecurity.com/2024/03/discovering-deserialization-gadget-chains-in-rubyland/
this post | permalink
@ret2bed I was thinking #1FFFFFF
this post | permalink
To little surprise, Copilot just failed my valet test:
this post | permalink
@jpmens Wow, I've been planning something like this for ages! :D My concept was to include such obscene/offensive words in every passphrase that no one would dare to share them with anyone.
this post | permalink
MS Word autocorrects "HTTP" to lowercase, but it doesn't do so with "HTTPS".

I'd like to request a CVE.
this post | permalink
Exploiting CVE-2024-21378 — Remote Code Execution in Microsoft Outlook

https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/
this post | permalink
Quill editors CVE-2021-3163 is another example of how confusing identifying security boundaries and evaluating #CVE data can be: the project thinks it's not their responsibility to filter data incoming from the (trusted) server, while many users assume the frontend component will handle such cases for them securely.

I got a bunch of nice stored XSS vulns as a result in real-world apps even recently.

https://github.com/quilljs/quill/issues/3364#issuecomment-901806341

#CveCrowdDeny
this post | permalink
Next Page