Josh

Josh

@oracularhades.com

he/him my code is in your bluesky app, big atproto fan, posts are mine. working on the Aotearoa NZ feed as i can https://bsky.app/profile/did:plc:wtdzzfgzjpirnk5wvpjutqoy/feed/aaalback5hldm

1.8K followers599 following1.3K posts

Josh reposted

.NET has released an out of band security update to address the vulnerability in the Google Brotli library. This is the same library NPM and others use. .NET and ASP.NET Core do not use Brotli by default, you have to opt-in. Details on what to look for in your code are in the advisory.

github.comMicrosoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability## Executive summary A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process me...

Josh reposted

Josh reposted

The details are now public, as of two hours ago. bugzilla.mozilla.org/show_bug.cgi... The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. All not-updated software can be MITM'ed now. IOT boxes that can't or don't update are now trivially MITM'able forever.

bugzilla.mozilla.org2083449 - Private key compromise of eMudhra Intermediate CertificatesNEW (nobody) in CA Program - CA Certificate Compliance. Last updated 2026-10-20.
Russ Cox@swtch.com

If you make HTTPS requests or have other TLS clients and care about MITM attacks, you need to update today. If you run Go: go get go@1.27.3 If you run Homebrew: brew update brew install ca-certificates If you run Linux, maybe stay off the internet for now.

I don’t think an anti-abortion health minister with no medical degree should be telling doctors what they can and cannot prescribe.

Josh reposted

If you make HTTPS requests or have other TLS clients and care about MITM attacks, you need to update today. If you run Go: go get go@1.27.3 If you run Homebrew: brew update brew install ca-certificates If you run Linux, maybe stay off the internet for now.

Filippo Valsorda@filippo.abyssdomain.expert

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

really disappointing that bluesky still hasn't worked out algorithm or content. open the app and it's always people dog-pilling. every comment section, every trend. it's really unpleasant.

If I open TikTok it's going to be tailored to what I want and not immediate ragebait or dog-pilling. My feed feels more diverse over there.

Bluesky is overpowered by people who hate change and want to immediately dog-pile everything for likes and power.

No better advertisement for electric cars in New Zealand than being stuck behind a diesel truck and having your aircon filled with gross fumes.

This used to happen with buses, the exhaust was so bad. Now they’re all electric in Auckland! (at least what I’ve seen). So much more breathable.

I couldn't create an attachment in Outlook iOS without completing Microsoft Authenticator 2FA. amazing, no notes

My university email account (which I wasn't using) had expired credentials. I was trying to upload an attachment from the Files app locally on my phone, to get there you need to open the attachment UI, which pings OneDrive and triggers infinite 2FA screening into you finally verify.

Josh reposted

Replying to @blowdart.me

If this was public you could tell I work for Microsoft, because the estimate is going up, not down.

New Zealand press outlets constantly regurgitating Labour/National press statements, which is fine, but I would love it be fact-checked and tell me if there’s any merit

Both parties are styling their Public Announcements as News Cards. I assume so it’s easy to scroll past and think you’re reading a real headline. Crazy way to run a propaganda service.

Josh reposted

people I respect keep retweeting 404 media posts (they do not rise to the level of articles) and I keep sighing between them and the verge, we both need a better class of journalists and may never get them as they salt the earth

Josh reposted

But how else is Bill Gates’s daughter going to make money?

the_lion_of_anacostia 🦁@digitalscorpyun.bsky.social

A man-in-the-browser (MITB) attack compromises your browser to steal or alter transactions. Malware can change payment details before submission, then rewrite the receipt so everything looks correct. HTTPS cannot protect you from a compromised browser. #CyberSecurity #SecurityPlus