buherator

"I'm interested in all kinds of astronomy."

Personal: https://scrapco.de
GitHub: https://github.com/v-p-b
Nudes: https://infosex.exchange

Public Key

npub17wvr8uywpuzew2lqvprnt4g7cuq0kyvdf8gz57dlv3rsjvfcer3qqgnag2

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs08xpn7z8q7pvh90sxq3e4650vwq8mzxx5n5p20xlkg3cfxyuv3cspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dshm0uca

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub17wvr8uywpuzew2lqvprnt4g7cuq0kyvdf8gz57dlv3rsjvfcer3qqgnag2

Show more details

Last Notes

2026-09-16 07:53:17 GMT

My binary so thick it stores data in the base pointer

2026-09-15 08:11:48 GMT

From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX
https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/

2026-08-27 18:27:01 GMT

I can't wait for someone pivoting from a HF build container to Nvidia's ICS :)
#note1wd8…xfxc

2026-08-27 17:39:26 GMT

- reply

Yeah I kinda understand, but this "OS as a service but not really" policy is confusing + docs could be more forward about "bleeding edge" features (like "we mark this purple because you won't find this in releases")
@npub1ecm…8mfg

2026-08-12 12:44:11 GMT

- reply

Usually what makes a difference is the business model (e.g. adtech vs. regular subscription). Your hair dresser may know exactly who you are and know a lot about you, but you can trust them not to sell your conversations because they make a living from cutting hair, not selling PII. A level of privacy is of outmost concern for many OnlyFans performers (to avoid stalking), while they show a lot of themselves publicly. Privacy != encryption either.
@npub1s69…rmen

2026-07-29 06:41:13 GMT

HugginFace incident report:
https://huggingface.co/blog/agent-intrusion-technical-timeline
The report itself reeks of LLM slop with gems like the "kill chain", consisting of phases like recon, exfil, c2...and k8s :) Nuances are overemphasized (like how code execution was used to execute code) while important steps are blurry (e.g. they had some kind of "allowlist" in the dataset processor, that allowed everything which didn't look like an URL?).
I feel sorry for blue teams not because they'll have to respond to more incidents but because they'll have to wade through reports like this...

2026-07-13 06:41:18 GMT

- reply

As I wrote I have this problem all the time with different maps. That includes OSM (also mentioned in the ticket) and GMaps.

2026-07-12 18:26:09 GMT

#Geoinformatics geeks: why is it a hard problem to make all street names visible on a given window over a map?
This is an old support request of mine:
https://kagifeedback.org/d/8256-missing-street-names/8
... but I'm struggling on a weekly basis with this problem using different maps.

2026-07-12 07:07:44 GMT

[RSS] CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys
https://www.thezdi.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys

2026-07-10 16:42:29 GMT

- reply

Honest question: What on Earth made you feel that way? I see absolutely zero indicators of privacy in any mainstream LLM app (similarly to Google/Meta).

2026-07-10 16:37:24 GMT

- reply

It's always been someone else's computer...

2026-07-03 07:08:05 GMT

- reply

I think it's a quite common thing across EU and I hate it.

2026-07-02 17:11:34 GMT

Has anyone compared Watts/bug stats of LLMs vs. fuzzers?

2026-07-02 11:07:52 GMT

- reply

Was it really RSS, or the applications built around it? IIRC Google Reader was pretty popular during it's time, until vendors started to push ppl away from syndication (incl. killing Reader) in general.

2026-06-29 05:38:50 GMT

- reply

Several editors highlight "TODO" specifically, but I want a way to format custom sets of markers, possibly depending on the extension/project I'm working on. Another example is marking findings in my notes with different severity labels.

2026-06-28 17:38:05 GMT

- reply

How does org-mode help with customizing highlighters?

2026-06-28 05:53:01 GMT

I've been thinking for a while about creating customized #Markdown highlighting, e.g. making all "TODO" strings stand out in my notes.
Are there any tools/frameworks out there (esp. for #Vim/#Neovim) that allow me to add new formatting rules on the top of existing highlighters?

2026-06-15 19:58:25 GMT

#windows #graphics #design #ui
https://media.infosec.place/infosec-place/322f760aa5a635ba41698dca300b72c0a26f7f04336295d652dde94d31ad5a64.png

2026-06-06 20:25:44 GMT

- reply

to convince life forms to live in a place they don't naturally inhabit with a high chance of getting extinguished later

2026-06-06 14:14:01 GMT

- reply

sounds pretty cruel/inconsiderate to me...

2026-06-05 06:48:12 GMT

- reply

A universal marker for "no one will talk stupid in the mic" both for party ads and recordings. I think promoters would be quite surprised about the correlations the would occur!

2026-06-04 16:33:48 GMT

I complained about hexeditors recently. Now I found TeeHee, and I think I'll stick with it on all platforms:
https://sr.ht/~aleksi/teehee/

2026-06-04 16:08:38 GMT

- reply

- King Louis XIV. rode out around midday...
- UTC, CET or CEST?!

2026-06-01 10:03:01 GMT

- reply

You mean this? https://docs.rs/clap/latest/clap/_derive/_tutorial/index.html

2026-06-01 07:44:22 GMT

I found a bug, so I created a test suite and published a new release for my signed/unsigned integer converter CLI utility, twos:
https://github.com/v-p-b/twos/releases/tag/v0.0.2

2026-05-27 17:38:41 GMT

- reply

I'm afraid I don't see the difference between scraping and downloading a copy of something

2026-05-27 17:29:52 GMT

- reply

https://get.kiwix.org/en/solutions/applications/kiwix-reader/ ?

2026-05-21 13:36:10 GMT

- reply

It helps me dealing with taxes a lot if I imagine myself as the protagonist of a Kafka novel (or any other absurd/surreal work). Maybe it helps with SAP/other horrors too?

2026-05-18 10:27:34 GMT

- reply

No, just authn related stuff, pretty sus...

2026-05-18 10:21:03 GMT

To whom it may concern:
Would you please stop trying to log in to my G/MS accounts? Not too much to see there anyway...

2026-05-12 12:45:48 GMT

- reply

"might affect cryptology at some future time or (more likely) in some other world." I forgot about this one lol

2026-05-06 04:28:21 GMT

- reply

Remember me to one who lived there.
She once was a true love of mine.

2026-05-04 16:25:38 GMT

It's 2026 and Windows still can't synchronize time

2026-04-16 07:31:34 GMT

- reply

"Is there some way of searching them?" I can only speak of Android: here definitely is a system-level option keep a browsable notification history.

2026-04-09 11:44:04 GMT

- reply

Have you seen this series: https://www.youtube.com/watch?v=kkfIXUjkYqE ? (I'm so glad someone finally called out kWh!)

2026-04-04 10:25:59 GMT

- reply

iirc one of Jobs' concerns about the first iPad prototype was that it couldn't be picked up, hence the shape of the edges of production models

2026-03-31 09:24:38 GMT

- reply

IMO part of the problem is that deep in their souls every dev wants to build frameworks that can do many things. You basically miss Quick Start guides that show you how to do $simple_thing. No one wrote that guide because they see value in $complex_things[] their project can do and probably even see $simple_thing distracting from the Real Purpose of the project.
Source: I also tend to write frameworks for everything.

2026-03-28 12:38:05 GMT

- reply

I'm imagining the utter confusion of some people seeing those numbers and I'm pretty happy actually :)

2026-03-27 09:04:53 GMT

- reply

Gitea/Forgejo has cloud offerings IIRC, they are pretty solid too for regular repo stuff.

2026-03-26 16:35:46 GMT

- reply

Hmm, I'm looking into this, although he seems to be more focused on the implementation of the control pane (if that's a thing?). I'm looking for thing like error handling strategies when e.g. there is a malfunction or your sensors just give you bad data. Also, things like quality control, recycling rejected items.

2026-03-26 16:22:55 GMT

#ICS #OT crowd: I'm looking for "Production Line Design for Dummies"-type resources. I'm primarily interested in high-level best practices, rules of thumb for making industrial processes work reliably, ELI5 level is sufficient. Let's say I want to build a lemonade factory for my teddy bear!
Any recommendations?

2026-03-25 16:32:01 GMT

- reply

Plus the store-now-decrypt-later threat model is not really affected by the time of the first practical quantum attack (you just store more data). I think the original announcement is more about the good rate of pqc adoption rather than q-computing breakthroughs...

2026-03-25 14:21:13 GMT

[un]prompted 2026 conference videos
https://www.youtube.com/playlist?list=PLjmt1tu85IhAiVPugOjP-7Cy0Oemi3m7z

2026-03-23 12:37:55 GMT

- reply

I get that this is a stronger isolation layer, but why is that necessary? Do agents randomly perform container escapes?
Simplicity is definitely a plus, but that wouldn't require VMs either.

2026-03-22 12:46:13 GMT

- reply

"companies spending money with the adtech companies do see returns" - Not necessarily, as measuring conversion rates is not easy. If you see that without G your visits plummet (as measured by G) you go back to G. Recommended:
https://thecorrespondent.com/125/the-non-sense-of-online-advertising-when-the-numbers-dont-add-up
I'm not familiar with news specifically, but I assume they don't partner with advertisers directly, but through an ad network, which is in the end owned by Meta or G, who can ~arbitrarily set their prices/payouts?

2026-03-22 11:21:02 GMT

- reply

lol OK that makes sense :D I thought you want to exclude advertisers.

2026-03-22 11:15:40 GMT

- reply

Yes, this is what I mean.
You are right that these are extremely powerful tools, still I feel like most customers (by count, not invoices) are just burning their money on adtech, because that's what everybody does, while you don't have to be Nassim Taleb to see that the numbers justifying the spend are rigged.

2026-03-22 10:24:00 GMT

- reply

I still don't get how the market of "telling people about things" can be more profitable than the market for "things" (G and Meta being the largest companies in the world) in the first place.

2026-03-22 09:56:19 GMT

- reply

My gut tells me most of these are in fact stand-ins for large adtech companies like Meta and Google.

2026-03-20 16:40:42 GMT

Since I read the JPL coding manual I'm always very considerate before introducing an infinite loop.
Then I usually decide that "it's fine, this is not a spaceship" and forget to implement the exit path.

2026-03-19 21:27:40 GMT

Gotta say #IDA Semantic Engine sounds incredibly cool!
https://hex-rays.com/blog/2026-product-direction-priorities

2026-03-18 10:58:47 GMT

- reply

This sounds pretty much like foreign language education in the post-Soviet block

2026-03-02 17:11:25 GMT

*Screams in 53-bit numbers*

2026-02-25 18:21:51 GMT

Is it possible/reasonable to compile @npub1ne9…0uhz with V8 in 2026? (I just reported a couple of QuickJS bugs that are blockers for me)
If so, are there any documentation available about the build process or is that knowledge lost to bitrot?
#Frida #ReverseEngineering

2026-02-03 08:47:33 GMT

After all these years I still rely on brute-force when it comes to copy-pasting on #Linux:
- Which paste should I use for vim's * and + buffers?
- Which clipboard is used by Java GUI's?
- Did JavaScript manage to put text on the clipboard this time? Which one?
- etc.
How do fellow #X11 users keep track of your clipboards?

2026-01-28 16:15:04 GMT

- reply

Participating in P2O as a vendor is a thing to be respected in the first place. They also wrote a blog about their efforts, but the link is broken - you can probably get it from an archive:
https://blog.synology.com/the-efforts-synology-made-in-pursuit-of-data-security
This is a more technical analysis from the attackers view:
https://drive.google.com/file/d/1MYCNVKkNETkqS-cLJsqHE43Sfm4LZbCO/view?pli=1
In short: they took significant steps forward during the past years, they probably ignored active network attacks (on LANs this may make sense, for Internet comms not so much).

2026-01-28 13:28:16 GMT

[RSS] When NAS Vendors Forget How TLS Works
https://www.interruptlabs.co.uk/articles/when-nas-vendors-forget-how-tls-works
#QNAP #Synology #Pwn2Own #NoCVE

2026-01-24 23:08:23 GMT

[RSS] Defeating Anti-Reverse Engineering: A Deep Dive into the 'Trouble' Binary
https://binary.ninja/2026/01/23/reversing-linux-anti-re.html
#ReverseEngineering

2026-01-13 20:38:01 GMT

- reply

<marquee> - infinite fun!

2026-01-13 15:05:03 GMT

- reply

No idea, I posted it in part as a bookmark for myself to read later...
(plus based on my recent experience, scripting IDA data types is always a courageous act)

2026-01-13 14:25:30 GMT

[RSS] Symless: an IDA assistant for structure reconstruction
https://blog.thalium.re/posts/symless-an-ida-assistant-for-structure-reconstruction/

2026-01-13 14:25:13 GMT

[RSS] X41 Audited CRI-O Runtime
https://x41-dsec.de/security/research/job/news/2026/01/13/cri-o/

2026-01-13 13:26:27 GMT

Observation: low-quality MCPs have more GitHub stars than their high-quality alternatives.

2026-01-13 13:17:14 GMT

- reply

One important lesson I learned in life is to stay the fuck away from people who employ projection, esp. if they do it consciously:
https://www.psychologytoday.com/us/basics/projection

2026-01-13 11:20:40 GMT

- reply

It's perfectly normal, our politicians used that same spyware on journalists etc.

2026-01-13 11:17:46 GMT

[RSS] Hungary grants asylum to former Polish minister implicated in spyware probe
https://therecord.media/hungary-asylum-spyware-probe-poland

2026-01-13 07:47:55 GMT

- reply

https://media.infosec.place/infosec-place/0b5f5f6e3ecac0806262bdaa49c66f2b967e8fd0704feccee1f709a77447f1bc.jpeg

2026-01-13 07:29:38 GMT

libpng memory corruptions:
* CVE-2026-22695 - Heap buffer over-read in `png_image_read_direct_scaled` (regression from CVE-2025-65018 fix)
https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp
* CVE-2026-22801 - Integer truncation causing heap buffer over-read in `png_image_write_*`
https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8

2026-01-12 17:56:04 GMT

The Remarkable Computers Built Not to Fail by Asianometry
https://www.youtube.com/watch?v=SSSB7ZTSXH4
#tandem #hp

2026-01-12 15:25:51 GMT

- reply

I don't have a clue if expecting EUR drives inflation or not, but pretty sure that real estate prices are not good indicators that it does.

2026-01-12 13:48:25 GMT

[RSS] From gixy-ng to Gixy-Next: rescuing Gixy from AI slop
https://joshua.hu/gixy-ng-ai-slop-gixy-next-maintained

2026-01-12 12:57:37 GMT

[RSS] Multiple Vulnerabilities in OpenProject
https://mantodeasecurity.de/en/2026/01/multiple-vulnerabilities-in-openproject/

2026-01-12 12:29:44 GMT

- reply

Hell, I can vibe-code a bot that posts publicly and outsource the whole verification mess :D

2026-01-12 12:27:41 GMT

- reply

That's a pretty neat idea actually, would also catch invalid encoding programmatically, not to mention brightening my day with frames of events I care about :)

2026-01-12 12:18:09 GMT

- reply

That would make a good sanity check assuming the compression doesn't change across downloads (I can imagine the stream in optimized in lots of ways), and I'll definitely give it a shot!
My other concern though is that the service may just start streaming blank/noise/whatever randomly, and I wouldn't notice.

2026-01-12 12:16:04 GMT

- reply

E-tags are a neat idea, but I'm not sure if will reflect the hash of the compressed stream delivered to me? I'll keep this in mind though!

2026-01-12 11:53:15 GMT

- reply

It's 2), please explain!

2026-01-12 11:47:17 GMT

- reply

There are no originals, only the data from the service with some random compression. What do I compare hashes to?

2026-01-12 11:32:57 GMT

Archivists: suppose you have to scrape large amounts of media for preservation from an unfriendly service. How do you ensure that the retrieved media didn't get corrupted along the way? (I don't want to watch/listen to 1000s of hours A/V)
#archiving #scraping

2026-01-12 10:33:11 GMT

- reply

We (Hungary) don't anticipate EUR anytime soon, prices still climbed to 400% since 2015.

2026-01-12 09:47:58 GMT

Reverse engineering my cloud-connected e-scooter and finding the master key to unlock all scooters
https://blog.nns.ee/2026/01/06/aike-ble/

2026-01-11 09:54:41 GMT

If Seatbelt Guidance Worked Like Cybersecurity Guidance
https://scribe.rip/@boblord/if-seatbelt-guidance-worked-like-cybersecurity-guidance-01dbe8b88c96

2026-01-10 08:01:18 GMT

- reply

https://media.infosec.place/infosec-place/4f3b5596174af01e2db840bcaae8784ddffba353fcd653d943779adacf66b75c.gif

2026-01-09 15:57:11 GMT

[RSS] Breaking Down the Attack Surface of the Kenwood DNR1007XR - Part Two
https://www.thezdi.com/blog/2026/1/8/breaking-down-the-attack-surface-of-the-kenwood-dnr1007xr-part-two

2026-01-09 10:09:17 GMT

SmarterTools CCO: "the steps for replication were rather intricate"
Narrator: It was "../"
This thread shows how 90s security mindset is alive and kicking in 2026.
#note1am9…v4l9

2026-01-09 07:35:38 GMT

[RSS] The Ni8mare Test: n8n RCE Under the Microscope (CVE-2026-21858)
https://horizon3.ai/attack-research/attack-blogs/the-ni8mare-test-n8n-rce-under-the-microscope-cve-2026-21858/

2026-01-09 07:29:59 GMT

Good morning!
https://gilliancarter.bandcamp.com/album/live-in-tampa-fl-8-31-2025

2026-01-08 18:00:08 GMT

[RSS] Clang Hardening Cheat Sheet - Ten Years Later
http://blog.quarkslab.com/clang-hardening-cheat-sheet-ten-years-later.html

2026-01-08 17:45:22 GMT

- reply

original or remake?

2026-01-08 16:41:04 GMT

"IDA 9.3 is on the horizon [...] type system enhancements"
God have mercy on my soul!

2026-01-08 10:29:01 GMT

- reply

https://media.infosec.place/infosec-place/74fbb5ede3488f1c321692baa2723353c427562f036d362f9affe8bba6bffedd.jpg

2026-01-08 06:18:00 GMT

[RSS] Ni8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)
https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858

2026-01-08 06:17:07 GMT

[RSS] TrustZone Break-in Vulnerabilities in Ampere UEFI MM Drivers (Arbitrary Out-of-Bounds Write)
https://github.com/google/security-research/security/advisories/GHSA-jxxm-gxxf-64mg

2026-01-08 06:17:01 GMT

[RSS] TrustZone Break-in Vulnerabilities in Ampere UEFI MM Drivers (Buffer Overflow and Stack Information Leak)
https://github.com/google/security-research/security/advisories/GHSA-46qj-g894-vrxr

2026-01-08 06:16:02 GMT

[RSS] Breaking Down the Attack Surface of the Kenwood DNR1007XR - Part One
https://www.thezdi.com/blog/2026/1/6/breaking-down-the-attack-surface-of-the-kenwood-dnr1007xr-part-one

2026-01-07 21:28:35 GMT

- reply

Don't take my word for it, I really didn't have time to dig in, but that's kind of the problem with slop isn't it?

2026-01-07 21:25:21 GMT

- reply

The person who posted this also posted a bunch of other stuff in different projects. This is their "repro" for MongoDB:
```
./mdb_load -T /tmp/lmdb_asan < [crash_input_file]
```
...but I don't see what `crash_input_file` anywhere. I smell slop.
(Source: https://seclists.org/fulldisclosure/2026/Jan/5 )

2026-01-07 15:52:37 GMT

- reply

https://media.infosec.place/infosec-place/a93e3863f1b44e927ff46c60ccda322bed0b7d1791c3cce4f46e2240627a07b5.gif

2026-01-07 12:48:46 GMT

- reply

...of course Phrack doesn't disappoint: https://github.com/xforcered/PhrackCTF/

2026-01-07 12:48:18 GMT

- reply

will take a look thanks!