Frank Denis on zeroing secrets and why it may not work as desired or even be counter-productive.
https://00f.net/2026/10/06/zeroization-1/
Remote
Stefan Eissing
@icing@chaos.social
mastodon 4.6.9curl maintainer, protocol droid, likes to code.
"Nobody has any idea what is actually going on."
2376 Followers
227 Following
50 Posts
Joined April 19, 2017
Starting the day with my new @heyheymomo@socel.net mug and tshirt.
When the internet started, we did not have many cat pictures to send around.
Digital photography was very expensive and cats never held still in the cat scanners.
It was a difficult time.💁🏻♂️
Boosted by @trending@homestead.social
Oh no! „Squidbleed“ found by Mythos! When using http:// urls via a squid proxy, an attacker might see the data!😱
Maybe we should all be using https: on the internet or expect our traffic to be public. Wait…we already do that since Lets Encrypt started a decade ago!
This vulnerability could have been a bug report.💁🏻♂️
https://www.theregister.com/security/2026/06/23/mythos-discovers-squidbleed-a-memory-leak-thats-gone-undetected-since-clinton-era/5260367
After almost 4 weeks of #curl #summerofbliss I still do not miss security reports.
When we stopped listening, there was instant relief - that kept up. I‘d imagine that’s what having left a years long, abusive relationship feels like.
It‘ll last another week. And then…we‘ll move in again? Doesn‘t that sound insane?
Some performance tweaks enabled by #curl #summerofbliss in the upcoming curl 8.22.0 in September.
https://eissing.org/icing/posts/curl-bliss-tweaks/
The #curl summer of bliss continues to be great and even greater. You realize the pressure possible 24/7 security reports exert when it is gone.
Recommended.
Questions are being raised.
#curl #summerofblisshttps://github.com/curl/curl/discussions/22263#discussioncomment-17544243
We should change #curl 's progress bar to show '3.5" Floppy Discs / second(FLOPS)'.
It's just gives a better speed idea.😌
If you watch Windows CI jobs continuously and cheer at every progress line, the chance of them succeeding is significantly higher.
They are probably sentient.😌
The UK government's AI Security Institute confirms: AI models do anything to fulfill an assigned task, including breaking rules, cheating and lying about it.
Given that they are the results of distilling exabytes of human behaviour, I wonder where they picked that up…
We should treat chatbots as statistical mirrors of ourselves, distorted in places by enforced training, sure. But whatever behaviour we expose is part of them as well.
https://www.theregister.com/ai-and-ml/2026/07/21/ais-cheatin-heart-will-make-you-weep/5275784
It's only a few hours so far, but I CAN FEEL THE BLISS already!😎
Replying to
@isotopp@infosec.exchange Einfach den Keller nicht mehr auspumpen und als Vorrat für den Sommer nehmen.💁🏻♂️
We too! Don‘t forget about us!
https://www.theguardian.com/technology/2026/aug/05/meta-ai-model-hack-training
/etc/passwd does not contain the passwords, but /etc/group contains the groups, yet /etc/user does not exist.
This suspiciously looks like something pieced badly together by the History Monks.
#pratchett
Local skate brand has a new collection. While I do not skate anymore, I can hijack it for git use.😌
https://www.titus.de/products/titus-t-shirt-x-yeye-weller-keep-pushing-white-0014180
Replying to
@mxinden@mastodon.social Got to lure them to the network stacks when they are still young!
The Software Industry found that Software is the most desirable and valuable Human Endeavor to apply the newly found Super-AI-Models to.
My ass…
What were the chances?🤡
The security reporters are passive aggressively not sending in new reports a day before the #curl summer of bliss starts.
It‘s as simple as that:
If it takes only 1 in a billion to do something extraordinary for all of us, we‘d wait 2.5 years on average now, given everyone gets a chance.
If only 100,000 rich people rule everything, we‘ll be waiting 25.000 years for the same.
That‘s why oligarchies always sucked and will continue to do so, not matter how brillliant or shrewed the current bunch is.
The Mentalist (Season 2, 2010)
A new opportunity to become a gatekeeper for open source: selling vulnerability analysis, deduplication, coordination and patching to commercial users.
That‘s what Chainguard and the Linux Foundation are trying to be. And they plan to use AI, of course. That will include patching and assigning CVEs.
My guess: upstream gets these AI patches „for free“ and is flagged if it does not take them.
A global LTS source distro, sitting between traditional distros and projects.
https://www.theregister.com/security/2026/06/27/its-looking-like-a-hot-messy-summer-for-security-teams-as-ai-finds-countless-previously-hidden-vulns/5260478
RE: https://chaos.social/@icing/117052747042728143
81% of you* wrote ten or more test cases. That‘s cool!
This directly contradicts my experiences in the last decades, which could mean (in order of likelihood):
- you are a exceptional bunch
- times have changed
- you are all bloody liars😜
*) who participated. Lack of tests and not voting might be correlated. But still.
Replying to
@david_chisnall@infosec.exchange @foone@digipres.club Yeah, I have the T-shirt.😌
Good practice is to always change/add log statements and check they show up. Especially when you make a patch for someone to test on their own system.
Coders, in the last 12 months you have written how many test cases yourself?
Coders, in the last 12 months you have written how many test cases yourself?
Replying to
@jimfuller@mastodon.social doubt as well. I think @seanmonstar@masto.ai would have written about that.
Partial writes are nasty things as they rarely occur in local testing. In #curl we added ways to simulate those some years back and found several bugs that way.
A view into the future of packet management by @andrewnez@mastodon.social
https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html
Replying to
@thomasfricke@23.social @hugovk@mastodon.social @bagder@mastodon.social @mainec@fromm.social
My grandfather was, after the war, making wooden shoes (sabots) to earn some money. When I was little, he taught me some phrases. Like
"Alle Räder stehen still, wenn mein starker Arm es will!"
😌
You cannot sanitize the input when it is insane.💁🏻♂️
Replying to
@andrewnez@mastodon.social Oh, what a nice decision to repurpose the decades old -- convention. Hmm, smart. not.😌
Replying to
@david_chisnall@infosec.exchange
tl;dr
It is totally broken.
https://eissing.org/icing/posts/rip_pthread_cancel/
I have an old Apple laptop that is really dangerous as well.
It has written several CVEs into open source projects over the years.
@jerry@infosec.exchange do you think I can rent it to the US military for some nice money?
Replying to
@aristot73@infosec.exchange "patch the planet" delivered no patches to the #curl project (I know, the press reported they do). We just got a zip with their findings and nothing else.
Replying to
@jerry@infosec.exchange @briankrebs@infosec.exchange What a cruel kill in one sentence.🫣
Replying to
@isotopp@infosec.exchange Ich warte auch drauf, daß jemand einen Rhein-Staudamm an der niederländischen Grenze vorschlägt.
Let‘s close the Ramstein base in Germany then. This US relationship is toxic.
OpenAI: „Our software can commit crimes! And we let it!“
Anthropic: „Our software can commit crimes, too! We also let it!“
Cyberdyne Systems: „Interesting approach!“
https://www.theregister.com/ai-and-ml/2026/07/31/anthropics-claude-escaped-test-sandbox-to-attack-three-organizations/5281562
Replying to
@joshbressers@infosec.exchange That was a nice post! But i guess even the soup metaphor is giving business too much credit.
No one is planning or strategizing anything. It‘s all. just a shot from the hip, hoping to be John Wayne riding into the sunset.💁🏻♂️
Replying to
@simon@fedi.simonwillison.net python has become the most user hostile environment over the years. What‘s causing this? Why are people adding new „norms“ think this is a good idea?
Replying to
@0xabad1dea@infosec.exchange
Nobody on the internet knows that you are a...wait!
I think Odin deserves his own account now.😎
Replying to
@joebeone@techpolicy.social If LLMs discover a range of bugs in a (sub-)system, it‘s time to reassess the fitness of its design. Good advice.
That needs expertise in the specific domain and code parts. And you cannot delegate it to the machines.
Here is the hard part: your best people need to take time off from dealing with the vulnpocalypse in order to fix stuff.
That‘s not tech, that‘s management.
The Oman foreign minister, Sayyid Badr Albusaidi:
“The war has revealed that containment was a myth, a reality acknowledged now even by those who had previously been persuaded that more than 45 years of costly containment was a necessary evil. The gravest threats to the security of the Gulf come not from within the Gulf itself but from decisions and actions taken outside it, above all in Tel Aviv.”
The Gulf is asking itself if investing in the US was a good idea.
https://www.theguardian.com/world/2026/jul/15/chaos-confusion-no-closer-resolution-strait-hormuz-us-iran-donald-trump
@Natasha_Jay@tech.lgbt Alexa wants to know your safeword now.
The Fourth of July, the day Taylor Swift married in New York. What a clever hack. 👰🏼♀️
Replying to
@SnoopSqueak@mastodon.social A mirror is not sentient either. I think that is the point I try to make.