
OSINT⁃Android⁃Hardware⁃Cryptography⁃Forensics⁃Virtualization⁃GameDev #w00w00 cryptographyishard(@)https://xitter.cf/t.co/Jwv7la6YPg ∧·∪
lurk moar
Joined January 2013
- Tweets81.4K
- Following8.7K
- Followers7.8K
- Likes4
cryptopotato retweeted
I don’t get what the big deal is. 4 is a random number.
macOS Developers should update their /etc/ssl/cert.pem file to remove the compromised eMudhra certificate.
Apple has directions here: support.apple.com/en-us/1495…
This is the part of P / NP that always puzzled me, the assumption that if efficient algorithms could run in polynomial time, the exponent on that polynomial was going to be something like 3 or 5 instead of Graham's number. No a priori reason to assume that, as far as I can tell.
makeuseof.com/why-windows-ex…
how did I not know the MZ header was someone's initials?!
cryptopotato retweeted
Yes, the ETH is false. But it isn’t *that* false. In this series of tweets I will
cryptopotato retweeted
I hate being the bad guy here, because Greg is correct. However, it’s worth noting that the people on the other side of this are completely rational.
In the 30 years I’ve been professionally programming, I’ve watched the quality of the average engineer drop, delivery times lengthen, output grow poorer, and results become less impressive.
I’ve watched manager after manager get frustrated at teams who run their leaders around in circles, promising everything while delivering little.
I’ve seen teams setup complicated task boards designed to look like they’re busy without delivering any actual value to the business. I once even called a team out on accident by mentioning this during a training I was hosting.
Is it any wonder that managers want more? Especially when “more” is just the most basic levels of predictability and quality of delivery?
We, as a community of programmers and engineers, are just as guilty of creating this mess as managers are. Just as managers need to up their skills and learn to better manage their teams, we need to up our skills and learn from our own rich history of delivery.
Every time we say, “agile sucks”, “Java sucks”. “XML sucks”, “JSON sucks”, or whatever else it is that’s cool to hate on today, we ignore our own potential and fail to learn from history. We just want to be angry rather than learn to be productive.
And we somehow thought the consequences would never come to roost?
Well, the consequences are here. And they’re going to get worse before they get better. And we’re not going to fix it by pointing fingers at each other.
One hill I'll happily die on: the normalization of "ship fast" culture at the expense of proper SDLC has played a significant role in the quality of vulnerable code being pushed into production and the rise of CVEs and enshitification of software for the last several years.
We've systematically traded engineering rigor for velocity, security assurance for investor confidence, and long-term maintainability for quarterly growth. All things I wish we would second guess and reevaluate.
But the software overlords wanted products yesterday and they got them. And now the rest of us get to spend the next several years discovering exactly which corners were cut and figuring out how to deal with the immense amount of responsibility that's been dropped on our collective feet.
cryptopotato retweeted
In 1998, Brian Kernighan wanted a regular expression engine small enough to fit on one page of a programming book.
Rob Pike went to his office and came back an hour or two later with roughly 30 lines of C.
It supported ^, $, ., and *, using little more than pointers and recursion.
Kernighan later featured it in Beautiful Code.
cryptopotato retweeted
🎃🔮 LET'S FIND YOUR SPOOKY CYBERSECURITY ZODIAC 🔮🎃
🦇 sun sign: your mother's maiden name
🕷️ moon sign: the street you grew up on
💀 rising sign: the six-digit code you just received via text
✨ drop yours below and i'll tell you which ancient evil you've summoned ✨
cryptopotato retweeted
I have massive respect for anyone that says: I did this, it looked one way, one later view it was different/I was wrong/we got better intel etc.
like 10000000% it shows massive integrity of the person who can say: we made a mistake/I made a mistake etc. etc.
I fuckup things, I get stuff wrong, I make mistakes.
literally hacking is making mistakes until something works! (ok an oversimplification but...)
Still laughing at this a day later.
It’s especially funny when you remember how large parts of the drone community refused to acknowledge dual use. I know @d0tslash remembers.
cryptopotato retweeted
Replying to @khuxsal
Not at all. 4 years is very short. Social media glorifies shipping speed but real, durable ideas all take a decade or more. Very few quick wins that aren't just flash in the pan. Dig in deep and expect the good ideas to be full time work for a long, long time.
cryptopotato retweeted
Interesting finding from my colleagues for anyone following #PHP2SHELL activity
They found a Linux botnet sample that already has code targeting CVE-2026-109618 integrated into its existing exploit routines, alongside eight other CVEs
#PHP2SHELL is already making its way into active Linux botnet arsenals.
Spotted a THOR-detected sample with PHP2SHELL-VULN-CVE-2026-109618 integrated alongside 8 existing CVE exploit references.
Botnets are adapting fast.
Patch ASAP and assess your systems for signs of compromise. Don't assume you're safe just because you've patched.
virustotal.com/gui/file/a75f…
cryptopotato retweeted
Since this got fixed, it’s pretty clear that the exciting answer (they’re state level actors) gives way in favor of the boring dumb answer (they’re incompetent clowns).
emudhra is actively blocking certain versions of curl from fetching their certificate revocation lists. this is with the usual combination of incompetence (only blocking specific curl versions) and malice (deliberately disrupting global security response)
bugzilla.mozilla.org/show_bu…
cryptopotato retweeted
I used to patch monthly in the year 2003/4.. and even then we would patch fast for certain scenarios e.g. critical vulnerability in common software....
MSBLASTER was a thing in 2003....
people talking about patching like it's new:
It's not!
I installed > SUS
> WSUS
I used to manage SMS2003/SCCM
this is fucking ancient stuff... (relatively)
cryptopotato retweeted
Sounds like a “you” problem
Im full of joy writing my own compiler/PL from the ground up in C, without ai
I’ve effectively replaced video games with recreational programming
Software isnt dead, its just “dead” for those who only wanted a paycheck
cryptopotato retweeted
This is why the only eventual end result is people deciding to drop 0days on twitter. If companies are going to silently fix flaws, refuse to pay or show recognition to researchers and ignore they good faith attempts at the responsible disclosure process then people will just move outside of it regardless of the side effects that causes.
There has been such an uptick of these cases of people being pushed away by MSRC and then silent fixes being made that at this point I believe its very much intentional.
MSRC dismissed my LPE because it supposedly needs dev mode. Funny because I already sent them an updated working PoC without it like a month before they dismissed it.
I appealed on Oct 15. but that obviously went into the void…
There is still one small detail I’m not 100% sure about, but they didn’t even mention that in their dismissal either.
And now today I managed to bypass what looks to me like a deliberate fix they introduced in build 29695.1001 (Oct 23) so it comes down to SYSTEM again…
Like seriously, what the actual fuck are you trying to do here @msftsecresponse ?
If anyone could connect me directly with someone from their team I would really appreciate it, because I just wanna get this sorted out already somehow. DMs are open.
cryptopotato retweeted
Getting tired of people doing a bunch of llm assisted reverse engineering and making big claims about devices (cough LG and other TVs) and not providing evidence to support these claims. It goes without saying that pretty much all are spying on you, but how it does that matters..

































