2026-11-10T23:10:14Z https://njump.me Max Maass :donor: https://njump.me/npub17efqnutch084h4ls7mvqd8atkns0pp5wx676cg9njj5ry4aea70q9c5jva https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/321/399/347/751/072/original/75f7bf682c0e98a7.jpg https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/321/399/347/751/072/original/75f7bf682c0e98a7.jpg https://njump.me/nevent1qqsdaqyerljpgwz24xn07j9zh6m9de6u7s79xyerqwu6dnhwzd00y2czyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heu7ugpvj RE: <a href="https://mastodon.xyz/@johl/117163065846181510">https://mastodon.xyz/@johl/117163065846181510</a><br/><br/>The reported critical #RCE in #Log4J is nowhere near as easily exploited as the original. It has a lot of preconditions. Sonatype has a good writeup: <a href="https://www.sonatype.com/blog/a-reported-log4j-rce-is-more-complicated-than-it-looks">https://www.sonatype.com/blog/a-reported-log4j-rce-is-more-complicated-than-it-looks</a><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1lyjfpgsnntn59mzp2jqy4hnqfy00rln6qtpmt3z5j6wvc4rlw89q96qvqj" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1lyj…qvqj</a></span><br/> </div> Critical remote code execution (RCE) vulnerability in Log4j2. Party like it’s 2021.<br/><br/><a href="https://github.com/hypnguyen1209/log4j2-rce">https://github.com/hypnguyen1209/log4j2-rce</a> </blockquote> 2026-08-27T05:46:47Z https://njump.me/nevent1qqsy8d0lczf46tt5ej764lmdqz8j7atu5mltgh4qawghygddk5qtphczyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heuvna00e PSA: Critical unauthenticated account takeover vulnerability in #Keycloak - allows resetting arbitrary users‘ passwords. Update to 26.7.2 immediately or disable password reset. Tracked as CVE-2026-18963. <a href="https://github.com/keycloak/keycloak/issues/51833">https://github.com/keycloak/keycloak/issues/51833</a><br/><br/>#infosec 2026-08-19T17:02:26Z https://njump.me/nevent1qqswg73zpxjfh3ca9k96pgrnmctvdlhpw2lx88rp4u5rm04wn07c7rczyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heu0afxuf RE: <a href="https://infosec.exchange/@sophieschmieg/117072053785281444">https://infosec.exchange/@sophieschmieg/117072053785281444</a><br/><br/>A great writeup of the cryptanalysis results by #Anthropic / #Claude that considers both what the results show (models getting better at supporting complex tasks, and sometimes even finding novel approaches in the case of Astra), and what they don’t show (there is no real-world impact of the AES result).<br/><br/>I really wish there were more differentiated writeups like this, rather than blind alarmism about capabilities or blanket discounting of any result that was achieved by an AI lab.<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1xknmm4l8xglfacxczuw7mmecum809ygwwn6vlr0pn9jcykvdc84qwwfpu0" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1xkn…fpu0</a></span><br/> </div> New blog post about cryptanalysis and AI.<br/><br/>In particular: don't panic about AI ending up breaking all of cryptography just yet. While it's super impressive work, it's still the same work that humans have been doing for centuries with the same fundamental limitations.<br/><br/><a href="https://bughunters.google.com/blog/more-cryptanalysis-makes-us-all-safer">https://bughunters.google.com/blog/more-cryptanalysis-makes-us-all-safer</a> </blockquote> 2026-08-10T18:16:14Z https://njump.me/nevent1qqs8m25qvhteysqfe0ksryw7tlh3e98sjrpa6059ffmqp6atp6w7jsqzyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heuj329zk In reply to <a href='/nevent1qqsv2g5f98ud8pf93zxynq2a2870jlltqaq54nu0remjf2wtxy8azfsfdn3vr'>nevent1q…n3vr</a><br/>_________________________<br/><br/>Did you actually get the sample today, i.e., was it still active a few hours ago, or did you publish your post on a delay? 2026-07-30T16:15:14Z https://njump.me/nevent1qqs93nnl36y0h9ffy9geyv6zkcrggy9kyf6j5dy7r93cuh8v34ldwxczyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heuqplt4v Looks like #adform got compromised. It is shipping a malware-laced tracking script that is replacing crypto wallet addresses in the users clipboard. Recommend disabling adform includes in your websites. Sample: <a href="https://gist.github.com/malexmave/8ef5eabc7b6866698f1ea8a811c75b57">https://gist.github.com/malexmave/8ef5eabc7b6866698f1ea8a811c75b57</a><br/><br/>Analysis by Claude: <a href="https://claude.ai/share/5c751f9c-2bae-4835-8dff-fcbebf66d5dc">https://claude.ai/share/5c751f9c-2bae-4835-8dff-fcbebf66d5dc</a><br/><br/>#IoC - C2 Address and Port seems to be 84.32.102.230:7744 .<br/><br/>#threatIntel 2026-07-27T07:48:33Z https://njump.me/nevent1qqsykvtzdnvt02rr57zcnz5fe0y09lshayw6plchkdsu4y75hq7m5dqzyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heupprwqr In reply to <a href='/nevent1qqsdllalyaycl6t847sgvkvckfw3yqxkgycymq607tj3uvslsj4ettqpajlhz'>nevent1q…jlhz</a><br/>_________________________<br/><br/>Ethan Mollick has some first impressions of using the model that are worth reading if you are interested in that kind of thing: <a href="https://www.oneusefulthing.org/p/what-it-feels-like-to-work-with-mythos">https://www.oneusefulthing.org/p/what-it-feels-like-to-work-with-mythos</a> 2026-06-09T19:55:51Z https://njump.me/nevent1qqsdllalyaycl6t847sgvkvckfw3yqxkgycymq607tj3uvslsj4ettqzyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heu9pg2wt In reply to <a href='/nevent1qqsv22mzmtagf2hfwgyysj6e8fxlg7dfwhhwh8fh4ytap0ffpjrwezs0s5t89'>nevent1q…5t89</a><br/>_________________________<br/><br/>Also, the most important results are obviously that it finished Pokémon Red without any special tooling (just screenshots of the game), and reaches stage 3 of slay the spire a lot more often now if you give it file-based memory. 2026-06-09T19:33:15Z https://njump.me/nevent1qqsv22mzmtagf2hfwgyysj6e8fxlg7dfwhhwh8fh4ytap0ffpjrwezszyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heud4tlfu Anthropic released Fable 5, basically a strongly guardrailed version of Mythos. They make some big claims in the announcement - let’s see what people actually say in the next few days. <a href="https://www.anthropic.com/news/claude-fable-5-mythos-5">https://www.anthropic.com/news/claude-fable-5-mythos-5</a><br/><br/>I’m particularly interested in independent validation of their biochemistry / drug design claims. If they are correct and not overclaimed (big if), that could be quite interesting. <br/><br/>Basically any security-related requests that remotely smell like they have offensive applications will be redirected to Opus for now. Same for biosafety-related queries. 2026-06-09T19:31:21Z https://njump.me/nevent1qqsf4tgy0w4ewfuzyt4n2rn80nvgewqctx88j3y2hm9zmethtsw06aczyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heudpyznh In reply to <a href='/nevent1qqsqlschgcqwyjn6wcywzfu9we2l8kwwjd0722c2fp6gxg6lrrfqgngm7cfvh'>nevent1q…cfvh</a><br/>_________________________<br/><br/>I would bet that this isn’t about GDPR but about the digital markets act, in which case on-device or off device doesn’t make a difference. Since they can’t offer the feature with 3rd party headphones, they say they can’t ship it at all. Same as with screen mirroring from iPhone to Mac. Wouldn’t use this announcement to infer anything about on- vs. Off-device. 2025-09-11T13:49:07Z https://njump.me/nevent1qqs9ek4uchrf5feunwaphjq6hfanrtgllcqhp88m452dy573486ss5qzyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heu56t8us Alright, I just posted my article “Please Stop Calling #GenAI Useless”.<br/><br/><a href="https://blog.maass.xyz/please-stop-calling-genai-useless">https://blog.maass.xyz/please-stop-calling-genai-useless</a><br/><br/>This came from a frustration about the discourse I was seeing here on Mastodon, where using the shorthand &#34;GenAI is useless&#34; is quite common. I mostly wrote this article to have something to point at and say &#34;this is why I think this is a bad idea”, and it turned from what could have been a short mastodon thread into a 15 minute read on extending the benefit of the doubt and trying to understand the other side of the debate in the #LLM / #AI discourse, and attacking the right arguments instead of strawmen.<br/><br/>Anyway, instead of recapping the argument here, read the article if you are interested. I wrote this to get it out of my system, but since some people on Mastodon said that it would be interesting to them, I decided to publish it instead of just writing it out for my diary to clarify my thinking. 2025-03-06T15:35:21Z https://njump.me/nevent1qqsd32svctwwxlljcafx077qh2asvtxw2m7778544pz8wzw84xh2tygzyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heu66ymfl It&#39;s odd to hang out on Mastodon and see all the people calling LLMs useless, and at the same time talking to some people who are actually using them and getting great value out of it. I myself also tend to play around with them quite a bit, and am getting quite a bit of value.<br/><br/>Thinking about writing a blog post titled something like “the wrong argument against AI” where I try to unpack this in more detail, but not sure if I’m just asking for trouble with something like that. The central thesis would be: there are loads of valid criticisms of LLMs. Them being *useless* is not one of them. They are providing real value to people out there. The earlier we understand that, the earlier we will be able to focus on the real problems with these systems instead of arguing with premises that are outright disproven by the lived experience of the people we are trying to convince.<br/><br/>So... not sure if I will simply get fedi-cancelled when writing a post like that, or if it would be actually useful for some people. Would such an argument be of interest to people, or am I simply hanging out in the wrong corners of fedi and most people who read my stuff are already on board with the argument anyway?<br/><br/>(Posted without hashtags as I want to ask people who have already chosen to follow me and are thus more likely to actually read something I write. However, boosts are OK). 2025-03-04T17:32:57Z https://njump.me/nevent1qqs93stn6x54p9m4az7qvapcj3j7aegsgnug6h70c37x3ce5lkp32mqzyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heu4mscmj We found our first #Y2K38 bug today, in #Keycloak‘s Client credential rotation feature. <a href="https://github.com/keycloak/keycloak/issues/35104">https://github.com/keycloak/keycloak/issues/35104</a> <br/><br/>Will probably not be the last one - the runup to 2038 will be interesting. 2024-11-19T15:00:09Z https://njump.me/nevent1qqsgrqmdt58wkgn0an5x0gsv0x280wmuu5dcrdxaeu6mlcqxn4et3dgzyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heu8jfh2d Ich habe gerade festgestellt, dass ich noch nie die Geschichte erzählt habe, wie ich von einem Reichsbürger wegen der Vorbereitung eines Angriffskriegs verklagt wurde. Heute ist es mir wieder untergekommen, also, let&#39;s go. 2024-11-18T19:03:19Z https://njump.me/nevent1qqs0hpwwpm4u0x9ttdk5w8q8qq5xu3hthzuywgz00kuea0yj0tv9wyqzyrm9yz030zau7k7h7rmdsp5l4w6wpuyx3cmtmtpqkw22svjhh8heuly900a An interesting article on whether gatekeeping actually exists in the IT #Security market, where the observed behavior that is associated with that term is coming from, why it is hard to find an entry-level security position, and what the industry can learn from other fields. You don’t need to agree with every single part of the article, but the mental model set out therein seems to be at least plausible from my own limited experience. <br/><br/><a href="https://ventureinsecurity.net/p/lets-get-real-there-is-no-such-thing">https://ventureinsecurity.net/p/lets-get-real-there-is-no-such-thing</a> 2024-09-02T06:11:13Z