vin10

9 ms·

1.
by vin10 4mo ago
There should be a metric for sites hosting malicious content! https[:]//erasmus-plus.ec.europa.eu/sites/default/files/2026-05/mortal-kombat-2-cs.pdf
2.
by vin10 9mo ago
it's a (then-)safe default from the age when having 1GB of RAM and 2GB of swap was the norm: https://linux-kernel.vger.kernel.narkive.com/U64kKQbW/should...
3.
by vin10 9mo ago
> he way stuff fails when it runs out of memory is really confusing have you checked what your `vm.overcommit_ratio` is? If its < 100%, then you will get OOM kills even if plenty of RAM is free since the default is 50 i.e. 50% of RAM
4.
by vin10 9mo ago
For anyone feeling brave enough to disable overcommit after reading this, be mindful that default `vm.overcommit_ratio` is 50% which means that if no swap is available, on a system with 2GB of total RAM, more than 1GB of RAM can't be a
5.
by vin10 1y ago
Nice usability features definitely. Apart from that how would you say it compares against something like sysdig falco / cilium + tetragon? Apart from this a major issue is DNS based dynamic filtering which is way batter to get right in
6.
by vin10 1y ago
Interesting project, I think I just found a way to crash the sandbox, just reported via an advisory.
7.
by vin10 1y ago
I would have expected at least Virustotal to flag them if that were the case. It does more than just looking up in a database of known malicious URLs and I think the reputation of the domains is the key factor here. https://www.v
8.
by vin10 1y ago
It is the same for nested links as well. They mostly have a chain of links, each one taking you to a new one with hop count ranging anywhere from 5 up to 10 or more.
9.
How are cyber criminals rolling in 2025?(vin01.github.io)
266 points by vin10 1y ago|92 comments
10.
by vin10 2y ago
> If you wouldn't trust running it on your host, you probably shouldn't run it in a container as well. - From a Docker/Moby Maintainer
11.
CVE-2024-38396: Abusing escape sequences in iTerm2 for code execution(vin01.github.io)
5 points by vin10 2y ago|0 comments
12.
by vin10 2y ago
It is guarded by a warning and requires explicit approval similar to browsers but yes, it does broaden the attack surface: https://gitlab.com/gnachman/iterm2/-/commit/fc9ae5c90f53cb1e...
13.
by vin10 2y ago
It is the first one, they need to be printed and clicked.
14.
Abusing url handling in iTerm2 and Hyper for code execution(vin01.github.io)
141 points by vin10 2y ago|56 comments
15.
by vin10 3y ago
This is a very well formulated suggestion. Nicely written!
16.
by vin10 3y ago
You are right about short expiry times but another catch here is that if pre-signed URLs are being leaked in an automated fashion, these services also keep the downloaded content from these URLs around. I found various such examples where l
17.
You cannot simply publicly access private secure links, can you?(vin01.github.io)
420 points by vin10 3y ago|218 comments
18.
by vin10 3y ago
OP here. Another interesting attack vector I have been working on is OSC 8 for hyperlink support in terminals. Mostly they allow arbitrary url schemes including "ssh://" without any prompt or user interaction to consent
19.
SSH ProxyCommand == unexpected code execution (CVE-2023-51385)(vin01.github.io)
30 points by vin10 3y ago|14 comments