Does anyone have a contact at pwn.ai?
We would kinda like to have a conversation with them...
Remote
Cure53🔓
@cure53@infosec.exchange
mastodon 4.8.0-alpha.3+glitchAnd there is fire where we walk.
733 Followers
122 Following
25 Posts
Joined November 07, 2022
Website:
Github:
Keybase:
Pronouns:
they/them
We're already seeing a spike in AI-generated PRs making the ecosystem much more secure.
Words cannot describe how grateful we are for all the contributions.
Replying to
@rauschma@fosstodon.org @evilpie@hachyderm.io Here, for example:
https://github.com/WICG/declarative-partial-updates/blob/main/fragment-include-explainer.md
Leading to possible attack vectors like this:
<?marker name="x">
![]()
Replying to
@agowa338 Cyber security is an insanely complex beast with some parts being technical, some being human, some being regulatory, etc., and well, finding bugs is one small component.
Emphasis on small.
We have not really been great at cyber security in the past, and improvements are needed all across the board. We won't be great at it tomorrow because magic.
Having one component potentially improve is, especially given how speculative the current situation is, is nothing to really worry about. Rather the contrary.
Time will tell, some processes might change, and that is likely all that will happen for a long time.
Most humans in cyber security will very likely notice very little impact for now. Can this all go sideways? Yes, of course. Is it time to say that cyber security is over? I don't think so. At all.
We did not expect that back in 2014 🥹
DOMPurify 2.5.9 and DOMPurify 3.3.2 were released today in a rush to fix a security issue caused by jsdom's faulty tag parsing.
A total of four people reported the exacty same bug within a window of three days.
One did so via email, thank you. One did so via private security advisory, thank you too.
One however simply published a ticket for everyone to see, the other one just dropped a CVE on us without a working fix release. Thanks for nothing.
In anticipation of possibly upcoming waves of OSS bugs as well maybe increasing amounts of real attacks, we have been busy hardening DOMPurify.
Look at those shiny badges and improvements, LOOK OMG 😱
https://github.com/cure53/dompurify?tab=readme-ov-file#dompurify
Work in progress of course, but lots got done this week 💪🏻
Replying to
@bontchev @GossiTheDog Agreed. Current recommendation from our end:
Keep calm, find and fix bugs, make the world a bit safer one bug at a time...
And ignore the hype train, but keep an open eye on how real and measurable things develop. Just what we did before.
We have slightly updated the publicly available contract templates for NDA, MSA and DPA. File format is ODT as usual.
Feel free to, just as before, use them as you see it fit for your own purposes 😄
To all the OSS projects getting swamped by AI tickets right now...
IT IS TOTALLY YOUR OWN FAULT.
The easy fix is to write better code.
You are welcome, this advice was free.
*ducks*
We know who Angine de Poitrine really is.
Version 3.4.0 of DOMPurify was released today, addressing a large number of issues reported by LLMs and real people alike.
Thanks to all who contributed.
https://github.com/cure53/DOMPurify/releases/tag/3.4.0
We hope everything went smoothly and that no one was overlooked in the release notes.
DOMPurify 3.4.1 is out with lots of small improvements.
Among them, a better test suite, a small fuzzer, several fixes and hardenings, and as usually we hope all went well 😅
Here's everybody's space heroes having a great time with DJT.
https://edition.cnn.com/2026/04/07/science/video/donald-trump-call-artemis-ii-hnk-digvid
DOMPurify 3.3.0 is out. You can now configure which tags can have which attributes much more easily.
https://github.com/cure53/DOMPurify/releases/tag/3.3.0
Thanks again to everyone who contributed to and supported the project. ❤️
Replying to
@datenkeller And if you don't, then Roko's Basilisk will get you and teach you some manners soon...
Replying to
@buherator Might also just be physics, having a spine and flipping the bird in zero gravity could be really hard.
RE: https://mastodon.social/@gwynnion/116859269846708028
Is this a post about LLMs?
