Hakushu is getting bolder in his elder years, now testing me by sitting illegally on furniture
#shibainu #dogsofmastodon
Remote
Brad Larsen
@bradlarsen@infosec.exchange
mastodon 4.8.0-alpha.3+glitchSoftware toolsmith: application security, automated bug finding, secrets detection
0 Followers
0 Following
24 Posts
Joined December 16, 2022
Website:
GitHub:
Nosey Parker:
I've lived in my house for almost 10 years. One of my exterior doors has been stiff to open that entire time, rubbing on the threshold just as it latches.
To my chagrin (and joy!), I _just_ noticed that the door has adjustable hinges! It allows adjustment in two dimensions. A few minutes with a hex wrench and now the door is silky smooth, better than it's ever been!
Replying to
@wirepair@mastodon.social it's a vibe-coded copy of nosey parker and kingfisher (which is itself a fork of nosey parker), like "write me a secret scanner that can use rules from these other tools, but in go. Make no mistakes".
Replying to
@wirepair@mastodon.social is any additional auth needed? Or does this mean an ssh private key can be used to effectively bypass 2fa (by generating new recovery codes)??
Replying to
@b0rk@social.jvns.ca in large part osmosis from poring over sqlite docs, reading more general database performance guides (like https://use-the-index-luke.com/) and then experimenting a lot with writing more complex queries in some apps I was working on.
Having a high-level understanding of how joins are done and how a database uses available indexes helps tremendously.
My main us of query planning: answering whether "this query will take forever" or if it will be fast. For my usual work (analytic workloads) there is usually no in-between.
Replying to on nondeterministic.computer
@mjg59@nondeterministic.computer DPoP?
Are you looking specifically for a situation where some middleware has leaked secrets of the traffic it is mediating?
Replying to
@wirepair@mastodon.social oooh interesting! The sandboxing concerns have been on my mind too. seems like a clean VM with only necessary assets / projects on it for an LLM is wise
Replying to
Doing fuzz testing, I've seen the same performance bug in parsers for at least 3 systems, where a line number for location reporting is determined from a byte offset by looping through the input, itself done in a loop. Surprise O(n^2)!
It probably doesn't show up easily in "normal" use patterns, but when you start fuzz testing you hit it all the time.
@regehr@mastodon.social once pointed out that Anthropic's logo for Claude looks like something else, and I cannot unsee it now
Replying to
@pkhuong@discuss.systems more than 32k lines is certainly an error! (haha old visual studio)
I play double bass, but also sometimes play electric bass through headphones after my kids go to bed. It's interesting to me that I can tell when my ears get tired! After 40 minutes or so, I have a harder time distinguishing between half steps below 60Hz or so... they all start to sound samesies
Aetna sending me an apology email for their AI slop search feature. They are "taking steps" and I can call them to talk to a human.
A word extruder answering health and insurance policy questions. What could possibly go wrong??
Replying to
@masek@infosec.exchange what's your workflow for creating a new single-service email? Does your email allow wildcards, or do you have to manually set up something each time?
Replying to
@masek@infosec.exchange cool, thanks for the details! I have thought idly about doing similar for years, but the warnings my email provider gave about wildcards, spam, and possible denial-of-service on my email has given me pause.
Replying to
@wirepair@mastodon.social a few months after I left Praetorian they started pumping out vibe-coded security tools, killed off their Chariot CTEM product, and seem now to be trying to compete in the AI hacking space against Horizon3, XBOW, etc
The last couple months I have noticed a UI bug on several major websites on mobile: you scroll down a while, then make the "scroll to top" gesture. The page scrolls to the top, but form elements (like a search bar) become unselectable until a full page refresh.
My (non-techie) spouse has also noticed this and was complaining about it today!
Are all these sites using the same Javascript framework that introduced a bug or breaking change a couple months ago??
Replying to
@sickeningsprawl@infosec.exchange all cool and I understand the caveats. Just happy to see other Lua tooling and compiler / interpreter projects