Jowabels

3.2K posts

Jowabels

Jowabels

@jowabels

They said I couldn't fly. They were right. Like = bookmark.

Katılım Aralık 2016
315 Takip Edilen55 Takipçiler
Jowabels retweetledi
antirez
antirez@antirez·
Armin, I and many others had this anti dependencies position 10 or 15 years ago (look at Redis...) and I believe we were right given the current state of software. But imagine still not being in our side in 2026, with automatic programming, that makes this position so natural.
Armin Ronacher ⇌@mitsuhiko

Indeed. I pushed for this thinking for most of my career and somehow there was an almost 10 year window where even senior people loved to pretend that the cost of dependencies is free and that the risk of not upgrading instantly is too high. Pure insanity. I’m glad that there is some rethinking now.

English
10
11
232
36.4K
Jowabels retweetledi
Florian Roth ⚡️
Florian Roth ⚡️@cyb3rops·
A friend told me something in a beer garden in Germany about 12 years ago: “Florian, don’t overthink whether this specific service is exploitable. The stuff is broken. Plan accordingly.” He meant software. Most software looks stable because it runs under normal conditions. Look closer and you find memory leaks, parser bugs, unhandled input, bad defaults, forgotten modules, weird edge cases. Now we have better fuzzing, better automation, AI-assisted auditing, variant hunting, more exploit dev, more eyes on everything. So yes, patching matters. But in a world where every kind of internet-facing software keeps producing fresh RCEs, you also need the boring stuff: 1. Reduce the attack surface - expose fewer services - disable unused modules, plugins and features - don’t publish admin interfaces unless they really need to be reachable 2. Limit the blast radius - run services with least privilege - isolate internet-facing systems - avoid shared accounts and credentials 3. Build visibility and control - collect useful logs - monitor weird errors, crashes and “should never happen” events - keep enough data to investigate later - run regular compromise assessments Assume exposed software is brittle. The stuff is broken. Plan accordingly.
Charles Guillemet@P3b7_

You just patched last month’s Nginx vulnerability that was actively exploited in the wild? It’s already time for a fresh 0-day RCE. The whole world is basically “pwned-by-default”, patching vulnerabilities before they’re exploited feels like a Sisyphean task... 🫠

English
8
45
229
25.2K
Jowabels retweetledi
Johan
Johan@Adityapandeydev·
your brain is always becoming better at whatever you repeatedly do. that’s why repetition changes people more than motivation ever will. if you spend every day stressing, overthinking, comparing yourself to strangers online, replaying old mistakes, and expecting the worst, your brain slowly starts treating those patterns like home. it begins scanning the world for more proof that you’re not enough, that life is against you, that things won’t work out. the scary part is your brain doesn’t care if the pattern is helping you or destroying you. it only cares about what gets repeated. but the same thing works in your favor too. when you repeatedly choose discipline, growth, gratitude, focus, and belief in yourself, your brain slowly reshapes around those things as well. at first it feels unnatural because your old patterns are louder, but over time your perspective changes. challenges stop feeling like signs to quit and start feeling like part of the process. your mind becomes whatever it practices most. so be careful what you keep giving your attention to because eventually, your thoughts become your reality.
Nicholas Fabiano, MD@NTFabiano

Repetitive negative thinking is associated with cognitive decline. Repetition rewires the brain.

English
28
1.8K
8.2K
282.7K
Jowabels retweetledi
Dino A. Dai Zovi
Dino A. Dai Zovi@dinodaizovi·
There are a lot of interesting things for defenders to study and learn from in this full end-to-end attack path. My guess: compromised developer poisons NPM module, which gets used by a VS Code extension, poisoning it. GitHub developer installs VS Code extension, runs infostealer. Stolen tokens used off-target by attacker.
GitHub@github

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

English
4
11
70
14.2K
Jowabels retweetledi
GitHub
GitHub@github·
1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
English
584
3.6K
11.6K
7.4M
Jowabels retweetledi
GitHub
GitHub@github·
We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.
English
1.7K
5.3K
25.5K
13.7M
Jowabels retweetledi
Socket
Socket@SocketSecurity·
🚨 BREAKING: Socket is investigating an active npm supply chain attack compromising hundreds of packages in the @antv ecosystem. The malicious publish wave appears tied to Mini Shai-Hulud and packages connected to the npm maintainer account atool.
Socket tweet media
English
53
262
1.1K
599.2K
Jowabels retweetledi
PROFESSOR
PROFESSOR@SIGMAPROFESSOR·
the hottest and most intelligent way to exist is to take your work brutally seriously and yourself playfully unseriously.
English
73
3K
24.4K
322.7K
Jowabels
Jowabels@jowabels·
Oh noes think about the "security researchers" they can't write code how they gonna gain recognition and farm LinkedIn likes now
Lukasz Olejnik@lukOlejnik

The Linux kernel security list is drowning in duplicate AI-flagged bugs; same issues, with same tools, but different names of human submitters. Maintainers have now formalized the obvious - AI-found bugs are public by definition. New docs define 5 failure modes for AI-assisted reports: too long, Markdown-heavy, threat model-ignorant, reproducer-free, patch-free. Non-compliant reports risk being ignored. Most AI-flagged issues aren’t even real vulnerabilities anyway. Think: 500 submitters, 1 CVE, 0 patches?

English
0
0
0
21
Jowabels
Jowabels@jowabels·
🎯
Mason@CardinalMason

The literal #1 most suicidal belief you can have is that you’re an introvert/socially anxious/don’t like people. I was this guy until around 22. Thought I was better than everyone else and actively chose not to be social. Life completely changed when I started interacting with random people and just trying to make them laugh. Opportunities opened up, made relationships with people I never thought possible. Everything was just less dull and boring. Every day was fun for no reason. You cannot be a lone wolf. It’s a mental illness. Life is meaningless without people.

ART
0
0
0
40
Jowabels retweetledi
Ridgeline Cyber
Ridgeline Cyber@RidgelineCyber·
The incident response mistakes that turn a 4-hour containment into a 4-day investigation: 1. Resetting the password before checking for persistence. The attacker returns with their own MFA method. 2. Investigating only the compromised user. BEC operators typically compromise a second account within 30 minutes — check sign-in logs for the same attacker IP across all users. 3. Not checking OfficeActivity for the compromised account. The email rules the attacker created are still active. They're still receiving forwarded emails from the account you think you secured. 4. Closing the ticket after containment without checking whether Conditional Access should have blocked the initial sign-in. The policy gap that let them in still exists. Each of these mistakes is a recurring finding. I've dropped the resource link in the comments👇
Ridgeline Cyber tweet media
English
3
22
121
5.8K
Jowabels retweetledi
Ridgeline Cyber
Ridgeline Cyber@RidgelineCyber·
SOC analysts: When was the last time you investigated a service principal sign-in? Most teams never do — because the logs aren’t even enabled by default. AADServicePrincipalSignInLogs is a dedicated table, completely separate from user SigninLogs. Service principals authenticate independently: • No MFA • No Conditional Access (unless you built workload policies) • Zero visibility in normal dashboards An attacker who creates or hijacks one gets silent, persistent access that: → Never shows in user logs → Bypasses all user risk detections → Survives password resets & offboarding → Runs on its own schedule with secrets/certs Critical blind spot. Enable the logs first (off by default): Entra ID → Monitoring & health → Diagnostic settings Check “ServicePrincipalSignInLogs” → send to Log Analytics Then run this KQL: let CorporateIPs = dynamic(["your-corporate-range-1", "your-corporate-range-2"]); AADServicePrincipalSignInLogs | where TimeGenerated > ago(30d) | where isnotempty(IPAddress) and IPAddress !in (CorporateIPs) | summarize TotalSignIns = count(), SuccessCount = countif(ResultType == 0), FailureCount = countif(ResultType != 0) by ServicePrincipalName, AppId, IPAddress, Location | extend FailureRate = round(toreal(FailureCount) / TotalSignIns * 100, 2) | order by TotalSignIns desc
Ridgeline Cyber tweet media
English
1
34
143
7.2K
Jowabels
Jowabels@jowabels·
Wtf was that ATO, Pistons??
English
0
0
0
138
Jowabels retweetledi
Nathan McNulty
Nathan McNulty@NathanMcNulty·
@techspence @laplanted24 @magicswordio @ThreatLocker Without changing a single thing, you can create an alert and automate remediation if you wanted They publish queries that pull the latest domain names lists and hunt for you ;) x.com/NathanMcNulty/…
Nathan McNulty@NathanMcNulty

ICYMI, LOLRMM (lolrmm.io) now has SIEM (or XDR) detections as well This is an absolute must have detection query, exclude your actual RMM(s) and alert on any that aren't supposed to be used

English
3
8
29
3.5K

Keşfet

@mattjay @antv @techspence @laplanted24 @magicswordio @ThreatLocker @elonmusk @BarackObama