ostif-derek

6 ms·

1. 1.▲
   by ostif-derek 4mo ago

   But you have to be super careful about defining the mitigations for this one, as for example Cloudflare passes malicious headers as-is without extra configuration, leaving hosts vulnerable when they are assumed to be protected.
2. 2.▲
   by ostif-derek 4mo ago

   You're relying on everyone in the world to set things up in a way that provides defense in depth. Not everyone is going to do that. Which means there's going to be a lot of cases where people don't do the safe thing. Especial
3. 3.▲
   by ostif-derek 4mo ago

   This is a bad one. Rating it a medium understates how hard it hits thousands of downstream projects and billions of installs. People need to patch asap. I'm normally against the "giving a bug a name, logo, and website" trope,
4. 4.▲
   by ostif-derek 4mo ago

   Unfortunately that doesn't help much. LLMs are really really good at digging up known vulns, so much so that they often falsely declare known vulns as new and novel ones. They have the CVEs in their training data, know how to look up o
5. 5.▲
   by ostif-derek 1y ago

   Hey there everyone! Some friends just notified us that this is trending. Let me know if you have any questions/comments/feedback about the work! It was a great project, I wish we had more budget so that we could spend some time wi