Dylan Katz

Dylan Katz

@plz.bsky.social

He/him Pro computer fighter aka @Plazmaz running in my walled garden while my script runs in yours https://dylankatz.com Rave reviews: "shame of infosec" "insufferable cyclist"

230 followers101 following845 posts

Y'all brotli4j just bumped their version. Nobody is talking about it but EVERY NATIVE BINDING FOR BROTLI will likely have CVE-2026-111497 present. This is more than the node or python bindings. Haven't looked at rust crates yet but there's gonna be some skeletons.

It looks like one of the axioms here (NBLTYPES = 1) is attacker modifiable in stream metablock headers? So I think this explains the discrepancy between a functioning poc and the proof. PIE is also DISABLED in many stock node docker images and like... Wtf

How am I the ONLY person on bluesky who has ever posted this link? 😩 I need people who are smarter than me to tell me why I'm wrong

the amount of weird shit in procfs always throws me. like I'll think I've exhausted every way to get out of my child process then I'll find for some reason there's a file descriptor open or someone put a secret in the command line of a process in my ns or something. It may be the craziest filesystem

The real reason AI art frustrates me is that I don't care about art, I care about the thought/humanity behind it. Art is a conversation with you and your voice, and I'm so fucking sick of hearing the same dull robot drone. I want YOUR voice. The plagarism and climate impact are also bad ofc.

Lying to kids is telling jokes that will have a punchline in like 10 years. Ty adults of the past for many excellent party moments. I will carry the torch forward.

It's fun having Google alerts set up for my name because I can see what all the other mes are up to. They're mostly doing school sports and are occasionally involved in crimes or scandals of some sort

Lol if agents end up resulting in really nice isolation, permissions, and access control on desktop oses that would kinda be sick ngl

It's so weird that you used to have to pay for domain privacy and trusted ssl certs. I remember it but it feels like they've both always been free...

Damn NOBODY else made the same connections guesses as me. I guess messing up green twice then getting yellow then messing up green again usually means failure, not getting the purple 🤷‍♂️ 🟩🟦🟩🟩 🟩🟦🟩🟩 🟨🟨🟨🟨 🟦🟩🟪🟩 🟪🟪🟪🟪 🟩🟩🟩🟩 🟦🟦🟦🟦

Like legit a lot of bad actors are considerate enough to not attack healthcare systems... The fact they're so confident they'll face no accountability that they apologized publicly instead of lawyering up and denying accountability is almost insulting.

If you bought a parrot it'd probably outlive you and that's been giving me waves of existential crisis for the last few weeks.

Maybe we shouldn't be having them as pets. I feel like they're also known for being mean but I'd be mean too if I had to spend 80 YEARS in bird jail from birth

Tortoises too obviously if you get one of the 100+yr ones but they're not parrot smart and you can take them for walks at least

It's really annoying how every tool, product, or vulnerability publication now has a huge ai slop webpage that doesn't tell me anything about what the thing is. The amount of writing that's just absolutely unreadable fluff is crazyyy

It's crazy how effective incompetent people are at being evil. Like imagine if the flock people were also competent... I don't even want to think about how much more damage they could do.

Micah Lee@micahflee.com

I've got a lot of work to do today but I'm getting absolutely nerdsniped by the new Flock dataset. You can download it here. It's all of the Android partitions extracted from a Flock device ddosecrets.org/article/floc...

I'm choosing to buy a fork from the yeehaw family wedding registry instead of the guns, knowing that financial aid frees up other capital that can be used to purchase weapons, but permits me to avoid providing explicit support. I need to read less news tbh

My personal conspiracy theory is people asking for recommendations on restaurants or music on dating apps are just data mining for listicles

Dylan Katz reposted

We're hiring a new product security lead for Wikipedia! It's a new lead PM role that would steer our security engineering team and how we go about this work here at the Wikimedia Foundation. AND: it's fully remote, and open in a good number of countries. job-boards.greenhouse.io/wikimedia/jo...

I wonder what JFK would think if he knew the entire concept of knolls is so closely associated with him, it's almost never mentioned in any other context.

I can't help but notice Stargate Atlantis has a lot of similarities to ds9. That's how I know I'm still a big nerd, despite my current sports phase.

Main series outpost far from home, communal living, popping around the universe with little ships, politicking with aliens, impending doom from aliens from a distant galaxy, etc.

It's kinda insane how portable toilets are such a pivotal part of most large gatherings. From festivals to marathons to political rallies, they're like the bedrock of the events industry. Gross.

When my dog gets scared she'll come into whatever room I'm in and start shaking/panting, but she'll sit right between me and the door, standing guard. She's so scared but so brave. Those fireworks don't stand a chance.

It's really weird how chat bots overuse specific slang terms. IDK why they chose the ones they did. Off the top of my head I'm completely sick of hearing - vibe - smoking gun - xyz-coded there are definitely others I'm forgetting.

The AMBER alert program is incredibly important but every time my phone makes the EAS noise I believe I am in immediate danger/missiles incoming/tsunami approaching and have a panic attack for a sec. I really wish I could change the sound. I know it's important and I want to keep seeing them but omg

I have docs sitting in my notepad history with just random garbage in them. I'm too scared to delete them because I've forgotten why I put them there. So I guess they'll be around until I either remember or my session gets corrupted 🤷‍♂️

Prompt injection is actually just two things. Either: 1. Make the llm forget it's not allowed to do something Or 2. Make the llm think it's doing something it's allowed to. There's no injection and it's not really a security flaw. It's how these algorithms are designed to work...