vngzs

5 ms·

1.
by vngzs 2mo ago
It lets organizations (Tailscale) control the timing and narrative around the disclosure more directly. Organizations sometimes avoid the bureaucracy of going through CVE Numbering Authorities by self-publishing. Often a CVE assignment foll
2.
by vngzs 10mo ago
How do you manage to coax public production models into developing exploits or otherwise attacking systems? My experience has been extremely mixed, and I can't imagine it boding well for a pentesting tools startup to have end-users fac
3.
MinIO declines to release Docker builds resolving CVE-2025-62506(github.com)
175 points by vngzs 11mo ago|2 comments
4.
by vngzs 1y ago
I can register my Yubikeys on account.google.com (and around the web, e.g., fastmail.com) as passkeys. If you visit the account security page[0] and enable "skip password when possible", then you can log in to Google with only a Y
5.
by vngzs 2y ago
Curious what the threat model for the cryptographic verification is. It looks like verify_signature_software[1] doesn't actually verify ed25519 signatures, but rather computes a truncated sha512 hash of the data and compares that with
6.
by vngzs 2y ago
Does this mean rewriting Magit to use libgit2 FFI bindings[0] rather than subprocess calls would lead to significant speedups? [0]: https://github.com/emacsorphanage/libegit2
7.
by vngzs 2y ago
It's a Linux phone that runs Android apps, so they ostensibly don't have the problem of building the ecosystem.
8.
by vngzs 2y ago
It's "fury phone": > Furious Support from the FuriOS team
9.
by vngzs 2y ago
There's a binary analysis time travel debugger similar to this, Qira [0][1]. [0]: https://www.usenix.org/conference/enigma2016/conference-prog... [1]: https://qira.me/
10.
by vngzs 2y ago
We're not, and they're still in the process of discussion. It seems a bit early to fork and witch-hunt [0]: > So clarification here: you asked me about that, but I haven’t been able to respond to you due to my illnesses and I’m
11.
by vngzs 2y ago
It's not a complete mitigation, but you can pause your video history which may decrease the amount of information Google retains over time from this sort of analytics. I haven't dug into the privacy policy and I'm not sure it
12.
Reversing the AMD Secure Processor (PSP) – Part 2: Cryptographic Co-Processor(dayzerosec.com)
112 points by vngzs 2y ago|30 comments
13.
by vngzs 2y ago
There's actually a Slate article covering this topic[0]. First, consent was given for certain homes. However, the article also notes that under "exigent circumstances" warrantless searches are permitted: > In exigent ci
14.
by vngzs 2y ago
I think you'll find "distributed decision-making" is no panacea. I joined a company recovering from a distributed governance model, and the big challenge was that nobody had enough decision-making authority for the firm to ch
15.
by vngzs 2y ago
Links are just for reference, but the gist is: serve the webapp from the Go binary instead. The end-user already has to trust the Go binary, and if they need to they can look at the code once and confirm it's not vulnerable. I prefer
16.
by vngzs 2y ago
You're very right! Luckily, we can resolve the vulnerability in this instance, although it's a challenging problem to resolve in general webapps. The technical explanation for our issue is that the client-side Javascript in our we
17.
by vngzs 2y ago
AES-GCM has more issues than merely the nonce reuse in the context of random nonces. For instance, the short tag issue[0] leaks authentication (not encryption) keys after a probabilistic "forged" message. In general, the move in m
18.
by vngzs 2y ago
I assume there's TLS in the server connection already, but the encryption here is to make the communication unavailable to the server for decryption, so "bare" TLS does not solve the problem. With TLS you need pubkeys you can
19.
by vngzs 2y ago
You will still need to get the nonce and key generation right, but I'd recommend using Golang's nacl/secretbox [0] for a project such as this. It's designed to be relatively misuse-resistant compared to using underlying
20.
by vngzs 2y ago
Good job releasing your project! It's a cool idea and surprisingly minimalist. That said, I've found a number of cryptographic flaws in the application source. This should not be used in instances where the encryption is mission-c
21.
by vngzs 2y ago
Agreed. The Linux kernel source contains everything you need to produce Linux kernel binaries. The llama source does not contain what you need to produce llama models. Facebook is using sleight of hand to garner favor with open model weight
22.
by vngzs 2y ago
Either the court or his lawyers.
23.
by vngzs 2y ago
His site now has a notice about the court case and denies he is Satoshi [0]. I've saved a copy for posterity at [1]. [0]: https://craigwright.net/ [1]: https://i.imgur.com/5yHiCLr.png
24.
by vngzs 2y ago
Experiments with human cells and mice have shown oxidative stress, neurotoxicity, reproductive toxicity, carcinogencity, and altered metabolism. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10151227/ If you a
25.
by vngzs 2y ago
In the vast majority of America, there is no serious high-speed internet competition.
26.
by vngzs 2y ago
Paxos | SecOps | USA+Canada | Full-time | Fully remote | https://www.paxos.com Paxos is building a fully-regulated, foundational blockchain infrastructure platform to enable the instant movement of any asset, at any time, in a t
27.
Tvix – A New Implementation of Nix(tvix.dev)
88 points by vngzs 2y ago|105 comments
28.
by vngzs 2y ago
I would describe this spyware's "illegal" status as colloquially true - despite the lack of a comprehensive, international, enforceable legal framework - at least in the USA [0]: > As part of this effort, the End-User Re
29.
by vngzs 2y ago
Ephemeral key handshakes are blocked by enterprises that do TLS decryption.
30.
PoC||GTFO 22 - reversing / security zine [pdf](alchemistowl.org)
20 points by vngzs 3y ago|1 comments

More ›