Bill Lummis

Everyone shut up, I just found out that park rangers have cool little totes to carry their hats in!

every bash command on linux is blplk -avqPmr o7 . ~/ every powershell command on windows is Please-Mister-Computer -Could-You-Kindly-Do-Me -This Favor ".\"

Second half Ravens exist to hurt us

You might wonder why the graph started ticking up around ~2016. That’s when CVE began aggressively enrolling more CVE Numbering Authorities! CVE is a federated system, and CNAs are the orgs approved to issue new CVE Records. In Jan 2016 there were 23 CNAs. Today there are 559.

It's notable openai could have done this before its agents hacked huggingface et. al but they just... didn't.

You've seen the private keys, now get the t-shirt! Any proceeds will be donated to Let's Encrypt. www.zazzle.com/win_the_cert...

shitposts aside, this one is serious, my loves: if you’re just waking up and you have any service online running PHP 5.4 to latest, you need to take it down RIGHT NOW and don’t put it back online until after it’s patched absolutely catastrophic vulnerability dropped in the middle of the night

The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page.

I'm a security professional, and I can tell you that security professionals only talk about PHP when they're very distressed

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

Security personnel around the world are on high alert following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet. arstechnica.com/security/202...

Excruciating is a good word

Hamilton really should've wrapped up there but what a hit

Anthropic found the origin of the NIST elliptic curve seeds: they were generated with drand48()! No one was seriously worried, but this should put some FUD to rest, completing the NIST ECC rehabilitation arc… just in time to be retired in favor of PQ. Also, we raised $36 Ki for ISRG. Yay!

@minakimes.bsky.social question you might know about overtime rules... the ravens killed like 8 minutes on their drive, what would've happened if they'd blown the full 10 and kicked a last second field goal? Would the falcons have just been out of luck?

Hamilton!!!!!!!!!!!!!

This is wild - somebody did a deep dive into the real stories behind this famous XKCD: sheets.works/data-viz/hol...

My theory is that going to a ball game is a habit—and losing that habit due to long periods of bad product on the field—is the most dangerous thing you can do to a franchise. Someone who doesn’t grow up going to Os games—doesn’t carry that urge into adulthood. In short: tanking tanks your brand

Just got an update from the pressbox PA: This FG by Loop is officially the longest in M&T Bank history, surpassing the previous mark by 6 yards.

Wow a fake wildcat, sicko play calling

What an absurd call. Everyone is playing on that snap

Why can't the ravens tackleeeeeee

Hey, we got a state shark. Nice.

The Brazilian Portuguese commentary on that Tyler Loop field goal for the Ravens is exactly what everyone needs to hear right now

That game took five years off my life

[Ravens] S Kyle Hamilton is being evaluated for a concussion. twitter.com/Ravens/statu...

lol the spirit of Torrey Smith possessed him on that PI

Seeing the "explicit lyrics" tag on a Pearl Jam song cracks me up... like, how can you tell?

You can read all the details in my write-up, which also shows exactly where in this public dataset you can find all of this micahflee.com/flock-camera...

This Flock camera is running obsolete, end-of-life software. - It's on Android 8.1, released in 2017, support ended in 2021 - It's on Android patch level 2018-06-5 - It's running Linux 3.18, released in 2017 This shit is like 8 or 9 years old, and full of vulnerabilities.

Justice Hill single-handedly killing that drive 🫠

Where was the protection on that play?? #ravensflock

Lamar Jackson is a wizard

Holy shit Lamar!

If it ain’t broke don’t fix it

We're hiring a new product security lead for Wikipedia! It's a new lead PM role that would steer our security engineering team and how we go about this work here at the Wikimedia Foundation. AND: it's fully remote, and open in a good number of countries. job-boards.greenhouse.io/wikimedia/jo...

Scoop: CISA is ending six free cybersecurity assessments for critical infrastructure operators, significantly reducing the hands-on guidance it offers to those organizations even as it tries to rebuild and reassert its value: www.cybersecuritydive.com/news/cisa-cy...

“Everyone wants to tell the story about the AI that went rogue, but the AI didn’t rent the servers, design the experiment, lower the guardrails, or decide it was safe to keep running after the warning signs started flashing. Humans did that,” he argued. www.infosecurity-magazine.com/news/openai-...

Project Zero is hiring! goo.gle/3UMXQIZ Please share with anyone you think would be great for the role.

As someone currently running for office, we need publicly financed elections and the complete overturn of Citizens United. Our political process should not be indistinguishable from a scam operation.

there is no such thing as "age verification." All "age verification" is actually "identity verification." You can coat it in glitter and "privacy-preserving" wrapping paper. But in the end, mandating age verification means mandating surveillance be built into software and hardware. Period.

Basically: Linux has to compile the drivers into the kernel. They are removing support for old hardware from the 90's and early 2000's that literally nobody can find a working example of to update the driver, because if they don't remove it Mythos will modprobe and exploit it.

The misaligned incentive is to get you buy new things - tools, processes, consulting - to deal with frontier AI(tm). And for CISOs to secure more budget. That does not lead to better outcomes, when orgs couldn't defend against Advanced Persistent Teenage Ransomware Groups in the first place.

the real takeaway from the huggingface incident was that bros will literally SSRF through an RCE via a ruby gems repo just to avoid using Jira

YouTube has never known less of what my deal is and is like “fuck I don’t know man, have you tried being Mormon?” You guys have every fucking email I’ve ever sent.