cataflam
Joined 14 years ago
Karma
940
Submissions
156
Member since
Jan 19
Recent submissions
Comment · 17 hours ago
Comment · 12 days ago
> The original researcher published about this in August of this year [1], a year after reporting it, titling the report "Defrost the Food",
And it's _even worse_ than that. A famous french cybersecurity firm, Synacktiv, published a report in 2023 (!) about the code-of-the-day vulnerability, but it made less noise apparently [1]
[1] https://www.synacktiv.com/sites/default/files/2023-10/synack...
Comment · 12 days ago
Stage 1 and 3 of that chain are shocking. I mean, yes, security is very hard, especially in a large codebase, but they look like actively made misguided choices.
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.
Comment · 17 days ago
Great write-up!
Not surprised by the driver software quality issues. When I was still working in consumer electronics / embedded, I saw many examples of the internals of those devices. The software was often a hodgepodge of scripts and drivers, whatever seemed to work, from companies without a great software and details culture.
We would usually rewrite the drivers entirely from the datasheets or from reversing the vendor ones!
Comment · 19 days ago
Looks like that specific vulnerability was found this summer, disclosed in coordination with the vendor and at least some models were patched [0] (unclear if all models were), but from early reports:
- they either didn't warn their customers this was a critical security patch, - many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!
Crazy stuff
[0] https://www.claroty.com/team82/research/freeze-the-controlle...
Comment · 1 month ago
> When a person hears someone talk about the importance of backups, but also haven't heard friends/family suffer this date, they will rightfully ignore this warning.
Maybe they just haven't talked to you about it? Most people I know have suffered some form of (partial) data loss or another, and lived with it.
Comment · 5 months ago
Congrats gaeld and team
The demo is very impressive!
disclaimer: I've known the founder for a while, as legitimate as it gets in deep tech, real years of research and engineering behind this, not vaporware
Comment · 5 months ago
> For monitoring I use and recommend UpDown.io, which doesn’t seem to be listed there.
It doesn't seem very well known, but I've been a happy user. Most of the others have become over-bloated with a shitty UI.
Comment · 5 months ago
> Nicholas Carlini, a researcher at Anthropic, orchestrated 16 parallel Claude agents to write a production C compiler in Rust.
To write a proof-of-concept C compiler, not a production-grade one...
Hard to take the article seriously after this
Comment · 6 months ago
You misinterpreted the comment you are citing.
This non-determinism would not and did not cause replays to diverge (the PRNG seed was most likely stored and would reproduce exactly the same results).
Comment · 7 months ago
Your AI powered comment is wrong.
Le monde has been doing this for years. They have a series of articles about this.
There is no "gap closing."
Comment · 7 months ago
it cannot email your secret key to an attacker because of prompt injection etc.
Comment · 7 months ago
Almost a month old, original source: https://cybernews.com/security/global-data-leak-exposes-bill...
and I've never seen any confirmation elsewhere
Looks like CyberNews have edited the article with more info since first I saw it, it used to look quite suspicious and untrustworthy, it now has more info. Still doesn't say exactly what a record is, or how many uniques there are.
Comment · 7 months ago
You're getting downvoted because you didn't read the article.
It is specifically about cleaning up the data by removing these 3 and showing a clearer picture of acceleration without these 3 factors.
no idea, but at least Tailscale and Caddy were opening MPTCP sockets on servers I checked.