Alesandro Ortiz 🇵🇷🏳️‍🌈

@gsuberland@chaos.social *aggressively chair dances*

@xssfox@cloudisland.nz Curious about context. I know nothing about NZ or AU Medicare, DSE, or how they use AI agents.

@scream@bots.robots.rodeo Need screaming, not understanding.

@flyingpenguin@infosec.exchange @briankrebs@infosec.exchange Once again, I want to know what the lawyers on every side really think. Somehow OpenAI's lawyers were okay admitting negligence here. https://infosec.exchange/@AlesandroOrtiz/116978061213285356

@sundogplanets@mastodon.social I'll yell this from the rooftops: Put timezones on all times unless you absolutely know the person is local to your TZ and will physically be in said TZ. When in doubt, add the TZ! Also, ET/CT/MT/PT is good year-round for U.S. TZs! Unless you're planning across a Daylight Savings change, no need to specify EDT or EST.

@SecureOwl@infosec.exchange Reminds me of this news report of a person who broke into a store while his car was running with keys, had car stolen during burglary, and then called the cops while at the scene to report his car was stolen. https://youtu.be/XFkmAlUHttc

RE: https://mastodon.social/@zackwhittaker/116977657519858883 Reuters reporting reveals an incredibly concerning timeline and (unsurprisingly) lack of responsible behavior from OpenAI. I really hope the public gets to see more details about internal reactions on both sides. The initial call/email from OpenAI to HF saying "we hacked you, accidentally". HF's execs initial reactions. Oh, and especially the lawyers' reactions (on both sides). I can't imagine the Hugging Face team being anything but furious about this, despite what they're projecting externally. Had OpenAI hacked any other company outside its sphere of influence, I don't think things would have gone as well as with HF.

@clark@hachyderm.io @SwiftOnSecurity@infosec.exchange "not again"? 😂

@zackwhittaker@mastodon.social I really hope the public gets to see what happened internally some day. The initial call/email from OpenAI to HF saying "we hacked you, accidentally". HF's execs initial reactions. Oh, and especially the lawyers' reactions (on both sides). I can't imagine a calm reaction from anyone on either side, despite what they're projecting externally. Had OpenAI hacked any other company outside its sphere of influence, I don't think things would have gone as well as with HF.

@SwiftOnSecurity@infosec.exchange 🎉 I was just telling my Dad over the phone to install Paint.net but NOT to go to Paint.net, and to not Google "paint.net" because they might click on a malicious ads.

@zackwhittaker@mastodon.social Has this been happening for months everywhere, but now more orgs are looking and disclosing? e.g. Anthropic didn't know about their attacks from 3+ months ago until they looked in late July. Customers didn't know who hacked them until their disclosure. Some didn't even realize they had been compromised. If it's happening more widely, even at a very small scale compared to human attacks (in line with GossiTheDog's recent industry survey), it's possible most victim orgs aren't detecting these attacks or are not able to attribute them to major AI agents.

@briankrebs@infosec.exchange We may need a "safetime" tracker that lets us know when there were no known widely-used packages that were compromised in a repository. Retroactive, of course, but might be interesting like uptime. e.g. npm might have 98.5% safetime this week based on known compromised packages being available for X hours.

@Ryanbigg@ruby.social You joke, but I have actually done this.

@SecureOwl@infosec.exchange We were even a flagship tenant at our 4th office, and moved out of there in less than 3 years IIRC. 😅

@SecureOwl@infosec.exchange And people wonder why startup sales teams win. They'll do anything for a sale.

@mikey@soylent.green New Kool-Aid Man has dropped

@gsuberland@chaos.social I got exponential numbers.

@simplenomad@rigor-mortis.nmrc.org Many have to do this due to their employers prohibiting payments from other companies. These policies are usually in place to avoid ethical or contractual issues. Others donate out of generosity. A good example of this is Seunghyun Lee, who has made large donations to picoCTF: https://www.cmu.edu/news/stories/archives/2025/january/student-bug-bounty-discovery-supports-picoctfs-cybersecurity-education-efforts-with-462000-gift If you search the Chromium issue tracker, there are multiple cases of folks donating rewards to EFF and other charities for either of the reasons I mentioned.

@SwiftOnSecurity@infosec.exchange Thought this was one of @gsuberland@chaos.social's Unsafe Warnings stickers. :D

@freddy@social.security.plumbing Ah, forgot about those changes. (It's been a _very long_ 2 months.) Reward amounts seem unchanged and Firefox still pays for reasonable moderate impact vulns, which is appreciated. Hope reward amounts aren't lowered given the new landscape, especially since FF rewards were much lower than other browser VRPs (now about the same).

@benjojo@benjojo.co.uk I actually did not realize that Adaptive Pricing fees for customers were so high until now. It does increase conversion rates, but now I feel bad that I'm passing on extra costs to customers. I previously thought it was shifting the same conversion fees that merchants used to pay over to the customer.

🎶 Here comes another bubble. The VCs are backing, Baby let's get cracking. 🎶 Here Comes Another Bubble (2007): https://www.youtube.com/watch?v=I6IQ_FOCE6I

Can't wait for the future where companies accidentally hack each other. /s *holds earpiece* Oh, it's happened already? NYT (gift link): https://www.nytimes.com/2026/07/21/technology/openai-attack-hugging-face.html?unlocked_article_code=1.zVA.w4cy.zFR0x0h7CDK-&smid=url-share

@zhuowei@notnow.dev Figma still does this? Gist is from 2020.

@benjojo@benjojo.co.uk From a merchant's perspective, it's quite bad too, whether they use Adaptive Pricing or not. Merchants can set fixed local currency price or use Adaptive Pricing. If you saw the conversion rate and fee disclosure on the checkout page, then it's Adaptive Pricing. Stripe adds 2-4% fees to customers: https://docs.stripe.com/payments/currencies/localize-prices/adaptive-pricing?payment-ui=stripe-hosted#pricing Merchants still must pay 1.5% fee for non-US cards, with or without local/adaptive pricing. (AFAIK this also applies to non-US Stripe merchant accounts.) Merchants also pay 1% for currency conversion when not using Adaptive Pricing. (With Adaptive Pricing, cost is passed on to customers.)

@scream@bots.robots.rodeo A little more

Unintentionally pentesting a hospital's PHI/PII protections this past week. 15% failure rate so far across a dozen calls where they disclosed PHI and PII without any verification or insufficient verification. Somehow my banks and phone company are better (0% fail rate over years) than a major NYC hospital system (15% fail rate in a week).

@GossiTheDog@cyberplace.social Do you think U.S. authorities could be investigating NightmareEclipse due to their disclosures? I imagine Microsoft is investigating internally to determine if it's someone with previous/current access to internal info that is still legally protected (by contract or law). Based on their posts, MS might already know their identity if they have interacted with this person via MSRC and have their payment info for the bug bounty programs.

@SecureOwl@infosec.exchange Also can be recruitment pipeline.

@SecureOwl@infosec.exchange I remember this happening often at several startups in the previous decade: weekday stays in company apt, train or flights, multiple office leases (often 10+ years in NYC because landlords wouldn't want less). I remember one of our CEOs joking we were more of a real estate company since we were forced to take 10+ year leases on all our offices, and we had ~5 prior offices that we outgrew and then sublet to others. We lasted about 9 years before fire sale acquisition, not even a full lease term. Startup VCs mostly are commercial lease portfolios if you think about it.

Initially I was concerned this was a live game, which meant it was up for grabs by bad actors. But given there is no demo or early access release, probably not attractive for them. In the browser extension ecosystem, public sale of an established extension usually means a bad actor will acquire it. Especially if it can be bought under $50k USD.

@Katharine@mas.to Wow, this is quite the throwback!

@scream@bots.robots.rodeo Now, subtly signaling to your significant other that you want to leave the party

@thisemailfindsyou@mastodon.social damn, are we in the hunger games or something?

@scream@bots.robots.rodeo Give me a little bit more

@Jdm2@boriken.social Sería buen nombre para un bot y website simple con titulares satíricos de Sin Comillas. 😂

@freddy@social.security.plumbing Thanks for sharing and making those reports public early. Great insight into what's happening with browser VRPs. Is Mozilla planning changes to the Firefox VRP in response to this, similar to recent changes to the Chrome VRP? (Or have changes already been made? I'm not closely following the Firefox VRP, unfortunately.)

@foone@digipres.club Thought they were Legos at first. 😅

@nelson@tech.lgbt This Apple Hide My Email issue feels similar to what you posted about Google Workspace: https://www.404media.co/apple-fixes-hide-my-email-vulnerability-after-404-media-coverage/

@slightlyoff@toot.cafe I don't have to use their app?! Also news to me. I was also moving away from random devices on SmartThings and moving everything to HA sometime this year.

@scream@bots.robots.rodeo Now, answering a Miss USA pageant question

@balint@mastodon.social Congrats! 🎉

@zak@infosec.exchange Ooh, TIL about GameNative and the neat the underlying emulators. Will keep an eye on GameNative development, looks promising.

@scream@bots.robots.rodeo Now, introducing a vaudeville act

@scream@bots.robots.rodeo Now, threatening a hostile takeover

At #SummerCon today, great talks and folks so far! #NYC

@freddy@social.security.plumbing Less? That's very surprising. Thought it would continue increasing despite *gestures wildly* everything.