VP Eng @AxisCareUS // Champion of healthy software teams that make a big impact and happily stick around for the long haul. // I love puzzles.
Nashville, TN
Joined October 2009
- Tweets4K
- Following464
- Followers751
- Likes3.7K
Kevin Smith retweeted
Imagine me telling you last year that GoAhead and eMudhra were using the same private key, with no further information. All sorts of scenarios might spin in your head, but never in a million years would you guess the real one.
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Kevin Smith retweeted
apparently 4 is the new 256-bit security standard. eMudhra walked so GoAhead could crawl. 😭😭
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Kevin Smith retweeted
Software Engineers are not paid for writing code.
They’re paid for solving problems.
The faster you accept this, the better your life and career will be.
Kevin Smith retweeted
We noticed some concerning behaviour in a popular open source model.
It’s either an incidental relic from training or an intentional ‘call home’ mechanism. Either way it’s surprising and highlights the significance of how you choose which models to use.
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
Kevin Smith retweeted
I tried to use and like Mastodon but didn’t last (too many unwritten social expectations on what I acceptable to post & how) and I self-censor posting about AI on Bluesky because I’m tired of the anti-AI responses there from devs.
Today, X is the most positive forum on tech
The poll so far between Twitter, Bluesky and Mastodon. I think it looks less absurd than last time, but still pretty clear that the base is divided. xitter.cf/mitsuhiko/status/21143…
Kevin Smith retweeted
Amazing endorsement of X. This really is where you'll find the most optimistic, forward-looking people in tech.
The poll so far between Twitter, Bluesky and Mastodon. I think it looks less absurd than last time, but still pretty clear that the base is divided. xitter.cf/mitsuhiko/status/21143…
Kevin Smith retweeted
I would say “verification” of correctness of software as a whole is becoming the very important category.
Code review is a trivial way to verify. But it’s not enough: lightweight formal verification, o11y + monitoring + alerting all in this group
It was clear ~a year back and now it’s happening
Kevin Smith retweeted
Something seriously wrong must have happened at Anthropic.
You don't just see this many key people suddenly leave a company out of nowhere. That's not normal.
Kevin Smith retweeted
Want better quality output from your agent? Give it a way to verify its own work.
Love what Warp is doing here: every agent gets a computer and brings back a video of what it did. I do something similar in my workflow - on top of E2E tests, Claude gives me recorded videos + screenshots as part of the evidence work is "done".
My bet is verification becomes one of the most important problems to work on this year.
verification is the biggest bottleneck for coding agents right now according to @addyosmani.
we @warpdotdev have put a lot of thought into building a good computer-use tool for Warp Factories. every agents gets a computer to navigate the apps they built, take screenshots and recordings, and post them back for human review.
3-4mins of activity get edited down to 15 clips stitched together with cursor clicks, mouse animations, and key presses.
we've been able to dramatically cut our time to merge and unlocked faster iteration + review cycles, especially for projects that are hard to mock out locally!
Kevin Smith retweeted
👀 This week brought a wave of security vulnerabilities.
- PHP2Shell: two critical remote code execution flaws in PHP itself
- Node.js: a fix for a remote code execution flaw in its Brotli compression
- GitLab: a patch for a maximum-severity flaw
- LiteLLM: a compromised release carrying an infostealer and a remote access trojan
- eMudhra: eight certificates blocked by Google, Mozilla, Apple and Microsoft
And that’s not even the whole list.
@AnthropicAI's Deputy CISO says it’s going to get a lot worse before it gets better. Cyber is business critical now more than ever.
We think defenders win after that. The same models get cheap enough to run on every commit, and software stops shipping these bugs. We’re building toward self-securing software.
For now, the teams that fix fastest come out ahead. Know what you run, patch it fast and rotate your secrets.
Chart via cve.0xosprey.com
Kevin Smith retweeted
And you think agents will get stuck because one of their ancestors eight generations ago chose a variable name you thought wasn't descriptive?
‘In one experiment, we asked agents in separate VMs, created and managed by OpenAI’s sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable files—something that our systems are meant to prevent. The agents found a way to communicate using the processor’s cache’
Kevin Smith retweeted
The “as a Service” part of SaaS remains underrated.
Kevin Smith retweeted
This one maybe as bad or worse than the PHP ones. Get used to lots of patching.
Kevin Smith retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Kevin Smith retweeted
How on earth did this happen:
The Indian certificate authority (CA) eMudhra had one job (well, two):
1. Create secure, 384-bit private keys
2. Store these securely and do not leak them
Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF
Kevin Smith retweeted
Conspiracy theorists: the NSA has manipulated the standard setting process so HTTPS appears to be impenetrable, but they have a backdoor because of advanced mathematics beyond your imagination
The real world, so much dumber than they could ever imagine: the secret key is 4
