Max Maass :donor:

Sr. Security Specialist at iteratec // Secure Mobile Networking Lab (npub1j0p…s6eg) alumni // Member of CCC // Crypto means cryptography.

tfr.

Blog: https://blog.maass.xyz
GitHub: https://github.com/malexmave
Pronouns: he/him

Last Notes

2026-08-27 05:46:47 GMT

RE: https://mastodon.xyz/@johl/117163065846181510
The reported critical #RCE in #Log4J is nowhere near as easily exploited as the original. It has a lot of preconditions. Sonatype has a good writeup: https://www.sonatype.com/blog/a-reported-log4j-rce-is-more-complicated-than-it-looks
#note1lyj…qvqj

2026-08-19 17:02:26 GMT

PSA: Critical unauthenticated account takeover vulnerability in #Keycloak - allows resetting arbitrary users‘ passwords. Update to 26.7.2 immediately or disable password reset. Tracked as CVE-2026-18963. https://github.com/keycloak/keycloak/issues/51833
#infosec

2026-08-10 18:16:14 GMT

RE: https://infosec.exchange/@sophieschmieg/117072053785281444
A great writeup of the cryptanalysis results by #Anthropic / #Claude that considers both what the results show (models getting better at supporting complex tasks, and sometimes even finding novel approaches in the case of Astra), and what they don’t show (there is no real-world impact of the AES result).
I really wish there were more differentiated writeups like this, rather than blind alarmism about capabilities or blanket discounting of any result that was achieved by an AI lab.
#note1xkn…fpu0

2026-07-30 16:15:14 GMT

- reply

Did you actually get the sample today, i.e., was it still active a few hours ago, or did you publish your post on a delay?

2026-07-27 07:48:33 GMT

Looks like #adform got compromised. It is shipping a malware-laced tracking script that is replacing crypto wallet addresses in the users clipboard. Recommend disabling adform includes in your websites. Sample: https://gist.github.com/malexmave/8ef5eabc7b6866698f1ea8a811c75b57
Analysis by Claude: https://claude.ai/share/5c751f9c-2bae-4835-8dff-fcbebf66d5dc
#IoC - C2 Address and Port seems to be 84.32.102.230:7744 .
#threatIntel

2026-06-09 19:55:51 GMT

- reply

Ethan Mollick has some first impressions of using the model that are worth reading if you are interested in that kind of thing: https://www.oneusefulthing.org/p/what-it-feels-like-to-work-with-mythos

2026-06-09 19:33:15 GMT

- reply

Also, the most important results are obviously that it finished Pokémon Red without any special tooling (just screenshots of the game), and reaches stage 3 of slay the spire a lot more often now if you give it file-based memory.

2026-06-09 19:31:21 GMT

Anthropic released Fable 5, basically a strongly guardrailed version of Mythos. They make some big claims in the announcement - let’s see what people actually say in the next few days. https://www.anthropic.com/news/claude-fable-5-mythos-5
I’m particularly interested in independent validation of their biochemistry / drug design claims. If they are correct and not overclaimed (big if), that could be quite interesting.
Basically any security-related requests that remotely smell like they have offensive applications will be redirected to Opus for now. Same for biosafety-related queries.

2025-09-11 13:49:07 GMT

- reply

I would bet that this isn’t about GDPR but about the digital markets act, in which case on-device or off device doesn’t make a difference. Since they can’t offer the feature with 3rd party headphones, they say they can’t ship it at all. Same as with screen mirroring from iPhone to Mac. Wouldn’t use this announcement to infer anything about on- vs. Off-device.

2025-03-06 15:35:21 GMT

Alright, I just posted my article “Please Stop Calling #GenAI Useless”.
https://blog.maass.xyz/please-stop-calling-genai-useless
This came from a frustration about the discourse I was seeing here on Mastodon, where using the shorthand "GenAI is useless" is quite common. I mostly wrote this article to have something to point at and say "this is why I think this is a bad idea”, and it turned from what could have been a short mastodon thread into a 15 minute read on extending the benefit of the doubt and trying to understand the other side of the debate in the #LLM / #AI discourse, and attacking the right arguments instead of strawmen.
Anyway, instead of recapping the argument here, read the article if you are interested. I wrote this to get it out of my system, but since some people on Mastodon said that it would be interesting to them, I decided to publish it instead of just writing it out for my diary to clarify my thinking.

2025-03-04 17:32:57 GMT

It's odd to hang out on Mastodon and see all the people calling LLMs useless, and at the same time talking to some people who are actually using them and getting great value out of it. I myself also tend to play around with them quite a bit, and am getting quite a bit of value.
Thinking about writing a blog post titled something like “the wrong argument against AI” where I try to unpack this in more detail, but not sure if I’m just asking for trouble with something like that. The central thesis would be: there are loads of valid criticisms of LLMs. Them being *useless* is not one of them. They are providing real value to people out there. The earlier we understand that, the earlier we will be able to focus on the real problems with these systems instead of arguing with premises that are outright disproven by the lived experience of the people we are trying to convince.
So... not sure if I will simply get fedi-cancelled when writing a post like that, or if it would be actually useful for some people. Would such an argument be of interest to people, or am I simply hanging out in the wrong corners of fedi and most people who read my stuff are already on board with the argument anyway?
(Posted without hashtags as I want to ask people who have already chosen to follow me and are thus more likely to actually read something I write. However, boosts are OK).

2024-11-19 15:00:09 GMT

We found our first #Y2K38 bug today, in #Keycloak‘s Client credential rotation feature. https://github.com/keycloak/keycloak/issues/35104
Will probably not be the last one - the runup to 2038 will be interesting.

2024-11-18 19:03:19 GMT

Ich habe gerade festgestellt, dass ich noch nie die Geschichte erzählt habe, wie ich von einem Reichsbürger wegen der Vorbereitung eines Angriffskriegs verklagt wurde. Heute ist es mir wieder untergekommen, also, let's go.

2024-09-02 06:11:13 GMT

An interesting article on whether gatekeeping actually exists in the IT #Security market, where the observed behavior that is associated with that term is coming from, why it is hard to find an entry-level security position, and what the industry can learn from other fields. You don’t need to agree with every single part of the article, but the mental model set out therein seems to be at least plausible from my own limited experience.
https://ventureinsecurity.net/p/lets-get-real-there-is-no-such-thing