Crankysec.com

Crankysec.com

@crankysec.com

32x33, comrades.

30 followers51 following36 posts

Crankysec.com
@crankysec.com

The case for "meritocracy" crumbles when you listen to absolute dumb fucks who run big AI companies talk about anything at all.

Crankysec.com
@crankysec.com

@wired.com ending their interview with the AI-is-gonna-kill-us bro with "I'm sure the next couple days will be crazy, but after things settle down, have you figured out what's next for you? instead of "Why are you a dumbass who doesn't know anything even though you're clearly educated?" Is a shame.

Crankysec.com
@crankysec.com

Knowing a lot about hammers doesn't automatically make you an expert on carpentry, or construction, or any other activity that requires hammers.

Crankysec.com
@crankysec.com

Maybe don't let AI agents touch production stuff? Like, ever? It fails miserably while doing utterly inconsequential shit, so you can extrapolate from there.

Crankysec.com
@crankysec.com

The circlejerk: "Terrible Signal exploit fixed thanks to journalists! FBI could read your deleted Signal messages!" Me: Yikes. Let's look at the CVE. The CVE: 6.2 Medium. Notifications marked for deletion could be unexpectedly retained on the device. Notifications. Could. Me: Zzzzzzz

Crankysec.com
@crankysec.com

Anyhoo, the lesson here seems to be well-known: big company is full of shit, fanboys with no domain expertise post stupid shit about it, the press slobbers all over it, and your #cybersecurity program gets a budget cut because your boss thinks Mythos can do your job.

Crankysec.com
@crankysec.com

"The Firefox test is not Firefox. It’s a SpiderMonkey JavaScript engine shell in a container, with “a testing harness mimicking a Firefox 147 content process, but without the browser’s process sandbox and other defense-in-depth mitigations.” (page 50)"

Crankysec.com reposted

Patrick Howell O’Neill
@patrickhowelloneill.com

Replying to @patrickhowelloneill.com

There's a huge difference between "we're in a genuinely important moment" and using apocalypse-coded language for marketing, some skepticism and scorn is warranted, but I'd just advise non-experts to pump the breaks before correcting practitioners who say their field is being reshaped

Crankysec.com
@crankysec.com

This astounding model managed to fail this attack scenario from 2020 70% of the time. The real business savvy is to get people with big audiences to parrot your claims with no critical thinking whatsoever. Welcome to the new #cybersecurity.

Crankysec.com
@crankysec.com

And it's wild to rely on tests of dubious methodology to conclude that "to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them." Gell-Mann amnesia effect, folks.

Crankysec.com
@crankysec.com

Not to be pedantic or anything, but you don't "discover" exploits. Exploits are not naturally occurring. It's not some ore vein somewhere.

Crankysec.com
@crankysec.com

Here we have a software developer quoting some fella who identifies as someone who helps "teams tell their story, efficiently and effectively" and "advise companies with their positioning, marketing, and strategy" talking about something they clearly don't fully understand.

Crankysec.com
@crankysec.com

A better process: 0-day drops -> Is it even exploitable? -> How hard it is to exploit?-> Are any of my systems theoretically affected? -> What's the impact? -> Do I even care about these systems? -> Do I have a billion other controls that would make this 0-day pretty useless? -> Panic or All good.

Crankysec.com
@crankysec.com

We're really spending tokens and paying money for output like this, eh? ● Yeah, sorry. Should have caught that during the rename. ● You're right. No excuse for that. ● You're right, I've been going in circles and made things worse by manually deleting the containers and network.

You are up to date.