Crankysec

Did we forget about the concept of "PoC || GTFO"?

You all can stop with the "HoW I UsE ClAuDe" articles.

Maybe don't let AI agents touch production stuff? Like, ever? It fails miserably while doing utterly inconsequential shit, so you can extrapolate from there.

I'm not lazy. I optimize for leisure. Leisuremaxxing, if you will.

Just a little something for the #cybersecurity and/or Robert De Niro fans!

https://crankysec.com/blog/drive-by/

Who would've guessed that good software development practices were useful.

https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability

Since we're doing friendly reminders, here's a friendly reminder that just because it's on Mastodon, it doesn't mean it's not bullshit.

You fools! You follow me, I’m following you right back.

Y'all bitch about AI destroying the planet, taking yer jobs, this and that, but you can't stop using it to "translate" your nonsense to LinkedIn Speak, can you?

But also, kind of alarming that a whole bunch of posts about "prompt engineering", "How I use LLMs", "My AI workflow" boil down to "know how to put your thoughts into written words with clarity".

Tech people are discovering that functional illiteracy is bad.

What we're seeing in tech today (and I use "today" very loosely here) is that feeling a lot of us in #cybersecurity feel when we go to a conference or something: Yes, we have this ONE thing in common, but I would avoid you like the plague in any other situation.

Believing that we all share the same values just because we share some niche interest is a bad idea. "We're all passionate about tech!" Sure, but you're also an asshole.

LOL. This bitch sold out, got the bag, and is now complaining that the mega corp that paid him a lot of money doesn't give a shit about the work. Get bent. https://www.natesilver.net/p/disney-erased-fivethirtyeight

LOL. This fucking take: https://yagmin.com/blog/your-docs-directory-is-doomed

LLMs suffer from document discoverability issues? They get confused about document ownership and domain expertise? Can't handle doc rot?

Welcome to the real world, buddy! If you're so smart, figure it out. What's that? I need to do ALL that meta-work just so you can perform according to what was promised? Get fucked.

Knowing a lot about hammers doesn't automatically make you an expert on carpentry, or construction, or any other activity that requires hammers.

@willb@infosec.exchange fr. It's one thing to let it write some stupid slide deck, or some code that will have to go through several checks (I hope) before being deployed. Going "here's the filesystem, make yourself at home. Highly sensitive credentials are over there." is a whole other game.

The circlejerk: "Terrible Signal exploit fixed thanks to journalists! FBI could read your deleted Signal messages!"

Me: Yikes. Let's look at the CVE.

The CVE: 6.2 Medium. Notifications marked for deletion could be unexpectedly retained on the device.

Notifications. Could.

Me: Zzzzzzz

You pay for YouTube Premium just to see creators you like put everything behind a "Members only" paywall.

@da_667@infosec.exchange I mean, I get it. You put in the work, you should be compensated if you so choose. But, man... it's getting ridiculous. Next thing you know you'll have a "Want to @ me? That would be $5, please and thank you. Or purchase a subscription so you can watch ads when you purchase a membership to see sponsored content!"

@da_667@infosec.exchange "Pay twice for the privilege of watching ads!"

You're smarter than this

Critical thinking is part of the job

https://crankysec.com/blog/smarter/

Little something for you beauts. My treat. https://defector.com/vindicated-at-last-in-my-years-long-loathing-of-grammarly?giftLink=21b3a668f2e4f6145592081f9caa17b0

When I said we should all have Gemini pods, you didn't listen. There's a sprawling greenfield right there for you to build on.

No, silly. This Gemini: https://en.wikipedia.org/wiki/Gemini_%28protocol%29

Apple can release a MacBook NeoTrinityMorpheus with the A87 Ultra Max Apple Silicon for $20 and it would still be a piece of shit because of macOS. No matter what John Gruber says.

PoC || GTFO. "Claude Opus 4.6 found more high-severity bugs in Firefox over a two-week period than the rest of the world typically reports in two months. The model discovered more than 100 bugs in total, 14 that were tagged as high severity. The model was asked to write code to exploit the bugs, but it turns out the model is much better at finding bugs than exploiting them. The exploits that Claude wrote would have been stopped in the real world by Firefox's other security mechanisms."

To all the young hockey players out there who are discovering things like “grep”, “gzip”, “tee”, pipes, “rsync”, and whatnot: you’re going to like this book.

https://www.oreilly.com/library/view/unix-power-tools/0596003307/

Everyone's talking about how good Anthropic's products are at finding vulnerabilities, but no one is looking at how good they are at BEING the vulnerability.

(Apologies for linking to this shithole)

https://x.com/lifeof_jer/status/2048103471019434248

"Apple quietly launches AirPods Max 2" If you know me, you know that my OG AirPods Max stopped working out of nowhere (quite possibly a bad software update). It wouldn't even factory reset.

The geniuses at the bar told me that it would be $200 just to send it in for diagnostic. I told them to kindly fuck off, and bought a Nothing Tech CMF that was on sale for 60 bucks.

AirPods Max miraculously came back to life after sitting in a box for a couple of months.

Age checks while data brokers are totally legal businesses. 👍

The big tech con was always to exploit your earnest passion for technology, suck your soul, and spit you out. Remember that.