pancake

pancake

@trufae.bsky.social

Author of @radareorg, mainly active in the fediverse @pancake@infosec.exchange

267 followers136 following120 posts

pancake
@trufae.bsky.social

New release of r2hermes! The plugin for reverse engineering React Native apps with #radare2 In short, i've added SBOM listings, improved decompiler output, better overlapped strings support as well as much better SLP objects integration with latest radare2 from git! github.com/radareorg/r2...

pancake reposted

Sebastià López
@darumastudio.bsky.social

Sonic, la mascota més genial

Sonic the Hedgehog@sonic-official.bsky.social

We're going for the gold. We're excited to announce our upcoming "Olympic Rings" licensing collaboration with the International Olympic Committee celebrating the Olympic Brand and Sonic the Hedgehog! Stay tuned for more info in 2026!

pancake reposted

Barcelona Animal Save
@barcelonaanimal.bsky.social

¡Atención activistas! La Marcha por los Animales de Barcelona ya tiene fecha: 📅 21 de junio de 2025 ⏰ 17:00 - 19:00 h 📍 Empieza en: Plaza Catalunya 🎯 Termina en: Arco de Triunfo 🔸 Resérvate el día y mantente atenta, porque pronto compartiremos más detalles.

pancake reposted

Geoffrey Huntley
@ghuntley.com

📰 LLMs are mirrors of operator skill

ghuntley.comLLMs are mirrors of operator skillThis is a follow-up from my previous blog post: deliberate, intentional play. I didn't want to get into the distinction between skilled and unskilled work because people take offence to it, but AI is a matter of skill. Someone can be highly experienced as a software engineer in 2024, but that does not mean they're skilled as a software engineer in 2025, now that AI is here. In my view, LLMs are essentially mirrors. They mirror the skill of the operator. how do identify skill One of the most

pancake reposted

radareorg
@radareorg.bsky.social

We can finally spin donuts in iaito! 🍩 🍩 (i know, that's an ancient feature request that brings us closer to get 1:1 feature parity with #radare2 ) But it's better late than never! Enjoy 🎉 PD: You can spin as many donuts as you want!

pancake
@trufae.bsky.social

In X right now if you don't pay, your posts won't be seen by anyone, no matter if you search for keywords, use hashtags or mention. I have to go right to the profile and scroll down to the posts of each user to see if anyone said anything. If I just didn't had enough reasons for not using it

pancake reposted

AnimaNaturalis
@animanaturalis.org

❗️ Hemos sido testigos del horror en el que sobreviven los cerdos antes de ser enviados al matadero. Las afecciones en el sistema respiratorio, el canibalismo, los prolapsos y las afecciones oculares son algunos de los problemas de salud más comunes. Visita y comparte Granjas.org ✍️

pancake reposted

daniel:// stenberg://
@bagder.mastodon.social.ap.brid.gy

Detecting malicious Unicode in #curl https://daniel.haxx.se/blog/2025/05/16/detecting-malicious-unicode/

daniel.haxx.seDetecting malicious UnicodeIn a recent educational trick, curl contributor James Fuller submitted a pull-request to the project in which he suggested a larger cleanup of a set of scripts. In a later presentation, he could show us how not a single human reviewer in the team nor any CI job had spotted or remarked on one of the changes he included: he replaced an ASCII letter with a Unicode alternative in a URL. This was an eye-opener to several of us and we decided we needed to up our game. We are the curl project. We can do better. ## GitHub The replacement symbol looked identical to the ASCII version so it was not possible to visually spot this, but the diff viewer knows there is a difference. In this GitHub website screenshot below I reproduced a similar case. The right-side version has the Latin letter ‘g’ replaced with the Armenian letter co. They appear to be the same. GitHub shows a diff. But what is actually the difference? The diff viewer says there is a difference but as a human it isn’t possible to detect what it is. Is it a flaw? Does it matter? If done “correctly”, it would be done together with a _real_ and expected fix. The impact of changing one or more letters in a URL can of course be devastating depending on conditions. When I flagged about this rather big omission to GitHub people, I got barely no responses at all and I get the feeling the impact of this flaw is not understood and acknowledged. Or perhaps they are all just too busy implementing the next AI feature we don’t want. ## Warnings When we discussed this problem on Mastodon earlier this week, Viktor Szakats provided me with an example screenshot of doing a similar stunt with Gitea which quite helpfully highlights that there is something special about the replacement: Gitea warns that the replacement is using “ambiguous Unicode characters” I have been told that some of the other source code hosting services also show similar warnings. As a user, I would actually like to know even more than this, but at least this warns about the proposed change clearly enough so that if this happens I would get the code manually and investigate before accepting such a change. ## Detect While we wait for GitHub to wake up and react (which I have no expectation will actually happen anytime soon), we have implemented checks to help us poor humans spot things like this. _To detect malicious Unicode._ We have added a CI job that scans all files and validates every UTF-8 sequence in the git repository. In the curl git repository most files and most content are plain old ASCII so we can “easily” whitelist a small set of UTF-8 sequences and some specific files, the rest of the files are simply not allowed to use UTF-8 at all as they will then fail the CI job and turn up red. In order to drive this change home, we went through all the test files in the curl repository and made sure that all the UTF-8 occurrences were instead replaced by other kind of escape sequences and similar. Some of them were also used more or less by mistake and could easily be replaced by their ASCII counterparts. The next time someone tries this stunt on us it could be someone with less good intentions, but now ideally our CI will tell us. ## Confusables There are plenty of tools to find similar-looking characters in different Unicode sets. One of them is provided by the Unicode consortium themselves: https://util.unicode.org/UnicodeJsps/confusables.jsp ## Reactive This was yet another security-related fix _reacting_ on a demonstrated problem. I am sure there are plenty more problems which we have not yet thought about nor been shown and therefore we do not have adequate means to detect and act on automatically. We want and strive to be proactive and tighten everything _before_ malicious people exploit some weakness somewhere but security remains this never-ending race where we can only do the best we can and while _the other side_ is working in silence and might at some future point attack us in new creative ways we had not anticipated. That future unknown attack is a tricky thing.

pancake reposted

Deno
@deno.land

Deno 2.3 is here: 🌱 deno compile with FFI & Node native add-ons 📦 Local npm packages ⭐ deno fmt CSS/HTML/SQL in tagged templates 🔭 OTel event recording & tracing in distributed services and more — deno.com/blog/v2.3

deno.comDeno 2.3: Improved deno compile, local npm packages, and moreDeno 2.3 adds new features for deno compile and deno fmt, support for using local npm packages, several performance improvements, and more. Here are the biggest highlights.

pancake reposted

radareorg
@radareorg.bsky.social

Power #vim users are used to the m' navigation workflow, which was already implemented in the Visual mode of radare2. Now you can also use hjkl and those shortcut keys in iaito to quickly move around the binary without using the mouse! #reverseengineering #ui

pancake
@trufae.bsky.social

Sounds like for now only custom domain accounts have a panel to choose who’s eligible for the infamous badge. And only those who have been aproved previously as trustable organizations

pancake reposted

La Directa
@ladirecta.bsky.social

#ENTREVISTA | “Una família és només aquella que firma? O és la que construeixes en el dia a dia? Tots els models familiars són vàlids” https://directa.cat/no-podem-acceptar-que-la-gent-es-casi-per-por/ Àsia Selma va veure's abocada a reivindicar el seu model familiar amb @viudedadiguald

directa.cat"No podem acceptar que la gent es casi per por"Ser viuda a la trentena no forma part de l’imaginari, però sí de la realitat. Àsia Selma va perdre el seu company, víctima d’un accident laboral, fa poc més de tres anys. “Quan vaig saber que em denegaven la pensió de viudetat em vaig enfonsar més”, explica. 

pancake reposted

Phrack Zine
@phrack.org

We heard you needed some more time, so we wanted to let you cook. We decided to push the Phrack 72 CFP deadline back until June 15th. Stay tuned for upcoming Phrack events. Print this flyer out and give it to someone IRL!!