blasty

My agent is live doing “eCOS Cable Modem VR/XDEV” at sl0p.foo/s/qkaiser

@badlogicgames “and then you’re fucked”

recommended viewing. listen to me sound stupid on the internet again. also starring: my knees.

@badlogicgames i was promised hockeystick all the way to the end :(

maybe 2026 is the year we'll learn that all exponentials eventually become S-curves.

@vaxryy dunno about the sentiment of that post but > Jarred was already writing slop well before he had access to LLMs is a pretty slick burn ngl

all I can say about the zig guy blog post is that hyprland is not getting slop-rewritten you're welcome

@vxunderground wtf x dot com has code blocks?

@gergely_kalman take your time! looking forward to it. always enjoy reading people their take on the psychology/incentives side of things

@bl4sty I'm still working on that. It came up, because I found it funny what a bug bounty program really is: a corporation trying to convince a bunch of random (defiant, uncooperative, borderline criminal) hackers on the internet to do what they want

If you want to know what ADHD is like, it's this: 3 days ago I sat down to write a blogpost. Halfway through I realised that I wanted to talk about Apple's changes to TCC bounties so I started doing that. I am 20(!) pages and two days deep, almost done, yet I somehow managed to spend the last 3 hours of the day writing about what hackers are like and why. I also forgot to eat. How's Your week so far?

things are happening in the sl0pminez! @qkaiser is doing his first testrun livestream: "ram-resident GDB on an ecos cable modem" right now: sl0p.foo/s/qkaiser I'm live too sl0p'ing away at a basic TUI for headless IDA: sl0p.foo/s/blasty

fresh from the sl0pminez. bind9 DoS nday. wanna leave the office early and/or drive the smelly old neckbearded sysadmin mad? crash your local bind9 using our public service at bind9 dot sl0p dot foo: warez.sl0p.foo/bind9-rrsig-cr… ! [ quality subject to scrutiny, works in our vibed docker lab ]

another semi-useful dirty write target I found is vm.unprivileged_userfaultfd ; there's few sysctl's that actually *weaken* kernel security when writing a (unpredictable) non-NULL value to them AFAICT. happy to learn more tricks!

really really nice! especially after having wasted quite some time with the bug myself. :) this DirtyMode angle I had never considered, clever! (my doctered version had something which you could call.. DirtyCap, or CAP_ROULETTE as I refer to it. but task/cred structs harder to hunt :))

@spendergrsec my ghostwriter claudio nailed it

@bl4sty I like it:

another OpenLiteSpeed 0day drop on warez.sl0p.foo --> warez.sl0p.foo/ols-sandbox-es… no idea how useful, but argv0 whitelists = asking for troublez. join us in the sl0pminez at sl0p dot foo.

&& another silly exploit landed on stream, 0day LPE for "CyberPanel" --> warez.sl0p.foo/cyberpanel-roo… join us at sl0p.foo :-)

aaaaaand we just finished a dumb request smuggling PoC for (Open)LiteSpeed httpd live on stream: warez.sl0p.foo/ols-h2-smuggle/ their commit hygiene is designed to hide security fixes, didn't manage to find a CVE/report anywhere. all results will be published on warez.sl0p.foo -- beware, minimal curation! ;^)

@taluhunusa desktop or mobile? mobile needs serious work. not sure if it can ever be usable unless you like eye-strain or lo-res terminals. desktop should be workable? (disable/move chat)

@bl4sty font for ants

good morning! I'm currently broadcasting some random/light clanky VR work @ sl0p.foo/s/blasty also feel free to have a peep and join us in the sl0p.foo discord/IRC server! all infrastructure/architecture was vibed over the last week. expect crickets && chaos! 🤖

Yes, reputable sources only, that's why we included the Linux CNA which is using LLMs to mass-assign CVSS, including 9.4 "critical" scores for an ext4 infinite loop on mount.

@vxunderground shoulda flexxed on efnet hiding behind a catchy handle and a vanity vhost smh kids these days

Dawg, the Peter Stokes affadavit (nerd from Scattered Spider who was arrested) is fucked This dude was on Snapchat sending people pictures of him with stacks of money, expensive hotels, jewelry, etc. My Brother in Christ, they've got you dead to rights because of your flexing. You're going to do 40 years in prison now, 20 years if you beg for forgiveness. Why did you flex on Snapchat? When he's released from prison he's going to be 40 years old (if he's lucky) and all of his Telegram homies are going to be gone. Telegram, Discord, Snapchat, etc may not even exist anymore. Think of how much changes in 20 to 40 years. Now imagine that time being passed while sitting in a box with all white walls and steel bars.