postmodern

Regarding the latest privacy drama about Discord, what privacy focused chat/forum platform are Open Source Security projects using or moving to?

#discord #privacy #opensource #infosec

The more I research how certain popular security CLI utilities work/behave, the more amazed I am at how much kruft and bad UX (or CLI-X?) infosec practioners put up with. We need to stop fetishising janky and clunky CLI utilities. Learning and mastering them does not make your a better hacker, they are just slowing you down with bad UX, confusing option names/behavior, and poor documentation. Better things are possible.

#infosec

Lukewarm Take: ptyxis is a terrible name for a terminal app. Atleast gnome-terminal tells you exactly what it is.

#ubuntu #fedora #ptyxis

Good lord Windows C programming is terrible.

In UNIX to convert an error code into text one does:

strerror(errno);

but in Windows...

char buffer[256];
buffer[0] = '\0'; // for some reason
FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, 0, GetLastError(), 0, buffer, sizeof(buffer), 0);

#c #windows

Obviously I could create a custom real-time 3d graph visualizer using WebGL, Neo4j, and Web Sockets, but is there a simpler solution for displaying/updating graph data locally in 3d and in real-time? Like, is there an app that draws a 3d graph and opens a socket in the background which I could then send node/edge data to said socket as JSON messages and have the app update the visualization accordingly?

#dataviz

Can anyone recommend me blog posts or talks on setting up your own fuzzing cluster? I'm curious whether fuzzing aficionados still use regular processes on bare metal for performance, or have they embraced containers and Kubernetes (or Docker Swarm, or Rancher, or Nomad)? I suspect containers must add some degree of latency, but make deploying new test harnesses much easier. Also, is it cheaper to setup your cluster "in the cloud", or host your own fuzzing cluster on your own hardware?

#fuzzing #cluster

How do you create a custom Fedora 43 Lab LiveCD? I was looking at the kickstart file for the Fedora Security Lab LiveCD and tried building it locally. The livecd-creator command complained that it needed the fedora-live-base.ks file included by fedora-livecd-security.ks. Most of the instructions online claim this file is available from the spin-kickstarts package (which no longer exists in Fedora 43) or the fedora-kickstarts git repo (which now only contains a message saying it's been replaced with a different build system). I can find older mirrored copies on GitHub, but I'm looking for the official supported way of building a custom Fedora LiveCD.

#fedora #fedora43 #fedoralabs #livecd

What ticketing system do Red Teamers generally perfer? How about for knowledge management?

#redteam #redteaming

What are people's favorite JavaScript packer/minifier/compiler?

#javascript #obfuscation #packer #offsec #redteam

Dumb Question: what is the license of the shellcode in ShellStorm's Shellcodes Database? I cannot find any mention of a license on the website. People have started creating their own git repos to mirror the website's contents, also without any mention of a license or copyright. I feel like this is a big copyright/licensing legal problem waiting to happen.

Also, what if you only copy/paste in the hex bytes from the assembled shellcode into another project? What if you add comments with the assembly source code next to each line of hex bytes? Is that considered "derived work"?

/cc @JonathanSalwan@infosec.exchange

#shellcode #shellstorm

Neat project trying to bring some of the language features from Rust to C. Although, I'm not a fan of Rust's overly terse keywords such as fn and impl (was fun or func really too long? why not omit the fn keyword entirely?) Also, if it still allows mixing signed and unsigned integers or arbitrary pointer access (doesn't mention anything about slices), it's still memory unsafe.

https://github.com/z-libs/Zen-C

#zenc #zen_c