Hazelnoot

Hazelnoot

@fedi.hazelnoot.dev

Hazel (she/her) - Transfem software developer. [ Admin of Enby.Life ] Hi! I'm Hazel, a transfem software developer with an interest in gaming, retrocomputing […] 🌉 bridged from ⁂ https://enby.life/@hazelnoot, follow @ap.brid.gy to interact

44 followers25 following424 posts

Hazelnoot reposted

Mallory Moore
@sexabolition.blog

Replying to @sexabolition.blog

We really have to stop psychiatrists and psychologists from having anything to do with trans healthcare whatsoever tbh. Having sexual health specialists do it makes it actually feel like healthcare.

Hazelnoot reposted

dish
@pyrox.dev

Just an FYI on the bluesky profile links thing: They started just blocking onlyfans and fansly, then expanded to cover a bunch of link shorteners explicitly because adult content is linked to through them. Fuck you @bsky.app . Proof: github.com/bluesky-soci...

github.comsocial-app/src/features/profileLinks/providers.ts at f0b2edb051d9855639a7ce3851032a6dd04b69c3 · bluesky-social/social-appThe Bluesky Social application for Web, iOS, and Android - bluesky-social/social-app
Hazelnoot
@fedi.hazelnoot.dev

Standard questions to ask before signing a SaaS provider contract: 1. How many 9's of reliability? 2. How many 4's of security?

Hazelnoot
@fedi.hazelnoot.dev

PSA: the BitWarden browser extension sends your session JWT as a query parameter, which can show up in mundane webserver logs or enterprise proxy records. There's not really much you can _do_ about this, but self-host operators should probably take steps to redact their logs. 2026/10/22 […]

enby.lifeOriginal post on enby.life

Hazelnoot reposted

David Gerard
@davidgerard.circumstances.run.ap.brid.gy

oh good, nginx too https://www.csoonline.com/article/4237420/f5-rushes-out-emergency-nginx-patches-for-three-critical-flaws.html

csoonline.comF5 rushes out emergency NGINX patches for three critical flawsF5 is once again disclosing cybersecurity flaws in its core offerings. The app delivery and security provider has released out-of-band (OOB) security patches that address multiple flaws in NGINX, its high-performance software that controls digital traffic for websites. These include three critical-severity flaws that could allow attackers to crash systems, execute code, and launch denial of service (DoS) attacks. OOB security patches are emergency software updates released outside of normal maintenance cycles. CVE-2026-15176, CVE-2026-97205, and CVE-2026-93479 are rated 9.2 in severity in the latest version (4.0) of the Common Vulnerability Scoring System (CVSS). Impacted software products include NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. While F5 says it hasn’t discovered evidence that these issues are being exploited in the wild, it advises customers to install or upgrade to fixed versions. Analysts agree. “NGINX is the front door: Reverse proxy, load balancer, and Kubernetes ingress,” said Frank Dickson of Dickson Research, noting that transport layer security (TLS) usually terminates in NGINX. “Code execution on that box means seeing passwords, session cookies, and API tokens in the clear, plus the private keys that make it all trustworthy.” ## Allowing attackers to crash systems CVE-2026-15176 and CVE-2026-97205 are _ngx_http_core_module_ vulnerabilities in F5’s NGINX, which could cause a heap buffer overflow in the server’s worker process. This type of memory corruption could lead to a system crashing or restarting, thus giving attackers access. Threat actors could also execute code on systems where Address Space Layout Randomization (ASLR), a technique intended to prevent exploitation by randomly arranging memory locations when an app starts, is disabled, or bypass ASLR altogether. The flaws could allow attackers to launch DoS attacks to make the server inaccessible to legitimate users, F5 explained. CVE-2026-93479 is similar, in that it is a map directive flaw that could allow attackers to send crafted HTTP requests to cause a heap buffer overflow; they can also execute code when ASLR is disabled, or bypass it. These vulnerabilities follow F5’s disclosure of CVE-2026-42530 in June. The flaw in _ngx_http_v3_module_ in NGINX Open Source could also potentially allow remote attackers to cause DoS or trigger code execution. Customers can mitigate CVE-2026-15176 by avoiding use of the _$request_filename_ variable and the _alias_ directive in a location block, F5 said, and CVE-2026-97205 can be mitigated by disabling asynchronous file I/O (AIO) and Server Side Includes (SSI). Meanwhile, F5 advised mitigating CVE-2026-93479 by avoiding unnamed captures and instead using named captures and limiting their usage to the block with the regex match. But, noted Seva Ioussoufovitch, senior research analyst at Infotech, “since NGINX is used across a wide swath of systems, this may increase the risk of service availability loss for many enterprises.” ## The latest in a series of cybersecurity issues While these three vulnerabilities are not known to be exploited in the wild, F5 has repeatedly borne the brunt of cyberattacks in recent years, which is troubling because the cybersecurity and app delivery networking (ADN) company serves tens of thousands of customers, including 80% of the Fortune 500, analysts noted. Threat actors have repeatedly targeted flaws in its systems and products to map internal servers, hijack devices, breach systems, steal sensitive documents, and deploy data-wiping malware. Over the last five years, the US Cybersecurity and Infrastructure Security Agency (CISA) has flagged eight actively-exploited F5 vulnerabilities; four of these have been targeted in ransomware attacks. For instance, a 2025 nation-state breach and CISA’s Emergency Directive 26-01 centered on F5’s BIG-IP, and F5 said at the time that NGINX source code was not accessed. But, Dickson noted, NGINX’s own “warning shot” came in May when CVE-2026-42945, a rewrite module overflow nicknamed NGINX Rift, arrived with a public remote code execution proof of concept. “This week’s alias and rewrite flaw lives in the same neighborhood,” he said, pointing out, “attackers read changelogs, too.” ## Mitigation Ioussoufovitch noted that the flaws are configuration-dependent, so enterprises should begin with an audit of current NGINX configurations to help risk-prioritize this patch. F5 also said that the risk of remote code execution (RCE) notably increases when ASLR is disabled, so users should double-check that ASLR and other typical OS-level protections are proactively enabled to at least limit the exploitation risk from similar types of attack. Enterprises need to ensure they have a clear inventory of which of their systems are running NGINX, including those where it is embedded in other products. This is critical to supporting configuration audits, segmentation efforts, and NGINX worker monitoring efforts, which can indicate that attackers “are poking at these types of vulnerabilities,” Ioussoufovitch said. “NGINX has already had multiple security releases this year, and I expect the trend to continue well into the future,” he noted. Dickson agreed that inventorying is the first step. NGINX “hides inside” ingress controllers, appliances, and container images. Many teams get NGINX from their Linux distribution, not nginx.org, and Amazon Linux still lists the AIO fix as pending. “A fix on the vendor’s site does not patch your servers,” he cautioned. As well as performing the inventory, enterprises should search their configurations for aliases paired with rewrite, AIO paired with SSI, and map blocks using unnamed regex captures. If an organization cannot patch today, the workarounds are simple, Dickson said: Disable AIO or stop serving SSI pages; switch map to named captures; confirm ASLR is on, run workers unprivileged; and segment the front door so it cannot reach the crown jewels. And, watch for worker processes that keep restarting. “These flaws need the right configuration to bite, and that is the good news,” Dickson said. “The bad news is that many organizations may not know what their NGINX configurations actually say.”
Hazelnoot
@fedi.hazelnoot.dev

I've never seen a bot impersonate _Windows CE_ before ​:senko_flustered:​ 37.60.226.187 - - [21/Oct/2026:14:41:07 -0400] "GET /.env HTTP/1.1" 301 178 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 8.12; MSIEMobile6.0)"

Hazelnoot
@fedi.hazelnoot.dev

2026/10/21 18:13:22.138 INFO http.log.access handled request {"request": {"remote_ip": "57.141.4.25", "remote_port": "42632", "client_ip": "57.141.4.25", "proto": "HTTP/2.0", "method": "GET", "host": "bsky.camp-fire.moe", "uri": "/profile/larrydarrel.bsky.social", "headers" […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

Why is a BlueSky labeler accessing my Fediverse instance ​:neofox_glare:​ 2026/10/15 21:13:47.612 INFO http.log.access handled request {"request": {"remote_ip": "3.78.178.37", "remote_port": "36458", "client_ip": "3.78.178.37", "proto": "HTTP/1.1", "method": "HEAD", "host": " […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

I have a self-hosted copy of BlueSky's social-app frontend, and to make bookmarks work, I made all URLs return 200 with a copy of the home page. But since it's not a redirect, all these crawlers think it's a separate page and are slowly navigating the entire link graph of BlueSky... through […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

It seems like they use a headless browser to render the SPA, which then grabs its own URL and fetches the appropriate data from BlueSky's backend. But then they don't interactively crawl - they place all extracted links into a queue to crawl later. Eventually that URL gets its turn, and the […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

sharkey@campsite:~$ sudo sharkeyctl start sudo: I'm sorry sharkey. I'm afraid I can't do that sharkey@campsite:~$ yeah ok, that's the last straw for `sudo-rs`. I'm reverting to the real `sudo` that actually works and doesn't drop movie quotes in my terminal

Hazelnoot
@fedi.hazelnoot.dev

Does anyone know what the _earliest_ vulnerable PHP version is? They only published info on supported versions, except for implying that 8.1 is also vulnerable.

Hazelnoot
@fedi.hazelnoot.dev

I took someone's advice and finally replaced my worn-out old bras with new ones that actually fit, and the difference is **huge!** So much more comfy _and_ supportive, and I didn't even need to splurge on an expensive, professionally fitted one - just buying from a major brand and following […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

so, to any other transfems still rocking their original "starter" bras from early transition - consider treating yourself to an upgrade! And take the time to re-measure, you might be surprised by how much difference just a single inch/letter difference can make. Your boobs deserve to be comfy! […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

I took someone's advice and finally replaced my worn-out old bras with new ones that actually fit, and the difference is **huge!** So much more comfy _and_ supportive, and I didn't even need to splurge on an expensive, professionally fitted one - just buying from a major brand and following […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

I also got a lightly padded push-up bra - and even though I messed up the sizing slightly, I look **fucking hot** in a t-shirt now! ​:neofox_dizzy_blush:​ ​:neofox_happy:​ Can't believe I never tried these before, it's incredible how much difference a little strip of foam can make!

Hazelnoot reposted

Wam ✨
@wamwoowam.co.uk

we had every single interaction here correct 25 years ago and every single attempt at a data table since has been a notable downgrade

Hazelnoot reposted

Jess👾
@jesstheunstill.infosec.exchange.ap.brid.gy

Cis women, If you have some sort of "Women's Group", or even just a circle of women who go and get lunch together, intentionally and explicitly invite trans women. A lot of us are reluctant about proactively inviting ourselves to places that we might encounter TERFs.

Hazelnoot
@fedi.hazelnoot.dev

> Modern web apps are increasingly complex, integrating third-party scripts and sometimes dynamically generated code from generative AI. While these integrations are powerful, they significantly increase the risk of data exfiltration. To address this risk, Chrome 152 introduces connection […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

> Caution: To avoid accidentally blocking legitimate network requests from your trusted code, isolate untrusted code within a dedicated iframe and apply the Connection-Allowlist header exclusively to that iframe. When doing this, ensure it's a cross-origin or sandboxed iframe so that the […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

> **Securing generative AI** : If your web app executes generated or untrusted code (like AI-generated UIs or development sandboxes), you can prevent that code from exfiltrating data to external domains. 1. Don't do that. 2. Just put it in an iframe with a separate origin, then you don't need […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

Does anyone know why a Lenovo laptop might suffer worse GPU performance when the lid is open? This has been reliably happening for several months, and it's the exact opposite of what I'd expect given how laptop cooling systems are designed. With the lid closed, performance is good. But if I open […]

enby.lifeOriginal post on enby.life
Hazelnoot
@fedi.hazelnoot.dev

Update to last night's HRT question: friend will _not_ take the conjugated estrogen, and I'm helping her get started with DIY instead. She's going back to the doctor to ask for proper estrogen in a few months, and if that goes poorly then she'll stay on DIY until she can afford a better doctor.

Hazelnoot@fedi.hazelnoot.dev

[HRT question] A friend of mine just started HRT, and the doctor prescribed her _conjugated estrogen_ instead of anything bioidentical. That's really bad and completely unnecessary, right? I want to tell her to demand something else, but please correct me if I'm mistaken. #HRT #Trans #Transgender

Hazelnoot reposted

Emma (Xfox 360)
@xfox360.invoxiplaygames.uk

Grimdoomer has just released the first version of the "Peer Pressure" softmod for the Xbox 360, giving code execution at boot time, within 20 seconds, with no hardware modifications required, supporting the majority of console motherboard revisions! github.com/grimdoomer/X...

github.comGitHub - grimdoomer/Xbox360PeerPressure: Persistent softmod exploit for Xbox 360Persistent softmod exploit for Xbox 360. Contribute to grimdoomer/Xbox360PeerPressure development by creating an account on GitHub.