how to hide bugs (backdoors) from LLM analysis: https://cipher.org.uk/2026/11/06/AI-Source-Code-Analysis-Detection-Evasion-Techniques/

americans and affairs. a scene:
https://www.youtube.com/watch?v=gczkM8cL2hs

(if you can find the whole series, it's brilliant)

capitalists have been cashing out -privatizing - the loans they took in the form of technical debts and now these debts are being called in and are collapsing onto all of us. the tsunami is only getting started, it will wash away a lot of sandcastles but also good stuff. the end is nigh, repent, radically minimize attack surface, go offline

#thistootcouldvebeenalinkedinpost

RE: https://mastodon.social/@hrbrmstr/117577061906936538

y'all know the the department of education is headed by Linda McMahon - the matron of the WWE empire, where acrobats LARP fighting in a ring. i think that is much worse, than being the spokesperson for agent krasnov...

i have just released a very early draft of libseal (Segmented Encryption & Authentication Layer):

https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z3wp7SxqLnD2XbwYZB8zFxTEvt4Jq

a construction that realizes random-access authenticated #encryption (raAE), it cuts a message into an indexed sequence of independently accessible, individually authenticated segments.

essentially this is very handy for data-at-rest & file encryption, u can do parallel en/decrypt, streaming & all kind of other things, while still have full integrity over the whole file.

hearing chatter about another very bad crit vuln on linux incoming. "it's bad, very bad" - brace yourself for the fantastic season finale of cyberawareness month.

RE: https://social.treehouse.systems/@whitequark/117558102884584703

quickly registers apt2shell.com

burn pictures on cd roms: https://github.com/JiaFeiMiao-K-Cat/DiscImageStudio

i was thinking. these ledger wallet implants can easily be detected by weight measurement. we just need to know the official uncompromised device weight, and then it should be easy-peasy to "look" at a device and say if this kind of implant is present or not. i suppose we can even identify the implants by how much weight they add.

#supplychain #security #wallets

huh, this #romu looks like a perfect vehicle for the zephyr-based variant of #klutshnik: https://www.crowdsupply.com/bitmerse/romu - although a bit pricey, it is definitely small enough to hide(lose?) in plain sight.

RE: https://mastodon.social/@LorenzMeyer/117536810324763633

the good kind of whataboutism.

zomg on my primary device:

locate cacert.pem | xargs grep -l 'emSign.*G3' | wc -l

returns 92, mostly in python virtualenvs. what a cancer.

i also love the aspect of, how do i update pip without using a pip that is vulnerable to MITM attacks.

RE: https://infosec.exchange/@yossarian/117474308852690763

zomg, this is bad:

> pip always loads the CA certificates from its vendored certifi in addition to the system trust store, and there is no supported way to disable this. REQUESTS_CA_BUNDLE / --cert only add CAs; truststore is used “in addition to certifi” by design. As a result, any pip < 26.2.2 will keep trusting the compromised intermediate CAs regardless of the system trust store, so distrusting them at the OS level is not enough.

why vendor and not use the system cert store? seriously???

announcing a beginner workshop for drunk chainsaw juggling. BYOB (bandages).

fixed a bug in pysodium (and made a new release). the submitter said this:

> And specially thanks to the author for trying to maintain the Python package compatible with ALL versions of libsodium, it is really a notable effort that other crypto libraries do not provide.

unsure if this is an LLM or proper biologically sourced compliment, but it is appreciated.

ivanti has some itw exploited 0day https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

https://github.com/h0m3us3r/w1700k-sdr

Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it.

#sdr #radio #hack

i just had the horror idea that the IETF RFCs will now be completely meatproxied. 🤮

RE: https://mastodon.sdf.org/@bitmage/117419095710341813

@weirdunits