http :verified:

I toot mainly about IT security, iOS / iPhone jailbreaking. I have a Microsoft background. Administrator on geohot's theiphonewiki․com. Blue team.

http :verified: boosted:
http :verified:http@infosec.exchange
2025-07-15

@DrakkenZero I was very confused with this UI, but it's actually a security improvement and not just in this shop, but it's like that in the entire country:

POS device in a restaurant showing "input your PIN" in Spanish and the digits are all scrambled
http :verified:http@infosec.exchange
2025-07-15

@DrakkenZero I was very confused with this UI, but it's actually a security improvement and not just in this shop, but it's like that in the entire country:

POS device in a restaurant showing "input your PIN" in Spanish and the digits are all scrambled
http :verified:http@infosec.exchange
2025-07-14

@joe Might cause some issues creating reproducible builds.

http :verified: boosted:
2025-07-13

⁨TX2 BootROM vuln(s), coming soon:tm:

The circle is complete.⁩

A screenshot of a terminal. The first command ran reboots the Magic Leap One headset into the BootROM USB Recovery Mode. The second command is partially censored, but the output shows the following, partially changed to be more screenreader friendly:

Sending 2128 bye long payload to device.
The payload should now be running!
Device alive again after 0.34s!
Reconnected to device.

USB Logs:

Here's this devices SBK: redacted

Here's  0x200 bytes of the protected BootROM:

A hex dump is visible here, with the string "NV Prod Boot T186" in it
http :verified:http@infosec.exchange
2025-07-12

@ant0inet In German, it was not translated.

http :verified:http@infosec.exchange
2025-07-12

@mjg59 The last time someone paid me for some goods with a check, I've sent it back because after reading the conditions that my bank charged $20 for cashing it in and said they can revert even 2 months later, I didn't want that and I preferred to lose that customer. Never seen a check since then. And that was 25 years ago.

http :verified: boosted:
lcamtuf :verified: :verified: :verified:lcamtuf@infosec.exchange
2025-07-12

*** Online shopping in 2010 ***

Me: Hello, UnderpantsEmporium.com? I’d like to buy underpants.

Underpants Emporium: Certainly, sir. Your underpants will arrive on Monday.

Me: Thanks.

*** Online shopping in 2025 ***

Me: Hello, UnderpantsEmporium.com? I’d like to buy underpants.

*ding* ShipPirate.biz: Your package is getting shipped!

Me: Wait, who are yo…

*phone vibrates* SMS from 21525: ORDER UPDATE: package is on the move.

*ding* UPS MyChoice: Your package is on the way.

*ding* Underpants Emporium: Your pants-ckage is en route from us to you.

Me: dudes…

*ding* Underpants Emporium: Be sure to review your underpants!

*ding* UPS MyChoice: Your package is out for delivery. Follow it on a live map.

*phone vibrates* SMS from 21525: ORDER UPDATE: package is out for delivery.

*phone vibrates* SMS from +252 3983929301: There was a problem with your shipment. Please claim your package at che4p-pi1lz.virus-basket.biz.ru.

*ding* Underpants Emporium: how’s that review coming along?

*phone vibrates* SMS from 21525: ORDER UPDATE: the eagle has landed.

*ding* Underpants Emporium: customers who bought underpants also bought

http :verified: boosted:
2025-07-10

Why do we say 'slept like a baby'? Babies wake up every two hours crying.

I want to sleep like my cat. 14 hours, no responsibilities, zero regrets.

http :verified: boosted:
VissViss
2025-07-09

stop using twitter.

there are no more excuses.

get your news and your cti elsewhere.
the only reason the news and cti vendors stay on twitter is because you, the audience, are still there.

so leave.
take your clicks and your eyeballs to another platform.

it will make them leave.
dont wait for the critical mass to form

BE THE CRITICAL MASS

your body is a vote.
choose wisely.

http :verified: boosted:
vitaut 🤍❤️🤍 🇺🇦vitaut
2025-07-09

state of google in 2025

http :verified: boosted:
2025-07-08
D&D alignment chart meme.

“Free”, as in:

Speech - lawful good
And fair elections - neutral good
Beer - chaotic good
To play - lawful neutral
Style - neutral
Monads - chaotic neutral
Parking - lawful evil
Radicals - neutral evil
Use-after - chaotic evil
http :verified: boosted:
65dBnoise65dBnoise
2025-07-06

"Move fast and break things"
"A bunch of people will probably die"

For more joy, use a chainsaw if you happen to have one.

‘The vehicle suddenly accelerated with our baby in it’: the terrifying truth about why Tesla’s cars keep crashing.

"Always carry a hammer in your Tesla", says Germany’s largest automobile club, ADAC.

Read more horror stories:
theguardian.com/technology/202

http :verified: boosted:
bert hubert 🇺🇦🇪🇺🇺🇦bert_hubert@eupolicy.social
2025-07-06

The attempts by law enforcement & governments to subvert end-to-end encryption are ongoing. The European Commission is going to spend a year thinking about their new "Roadmap for law enforcement access to data", and they are (genuinely) asking for people to join their expert group to help. Here I urge you to join that group (also because I can't): berthub.eu/articles/posts/poss

http :verified: boosted:
Dolphin Emulatordolphin@dolphin-emu.org
2025-07-04

Signature collection for the #StopKillingGames initiative against planned obsolescence of video games is ending in a few weeks. If you're from Europe, please sign the petition and support game preservation!

For EU citizens: eci.ec.europa.eu/045/public/#/

For UK citizens and residents: petition.parliament.uk/petitio

Why we support it: dolphin-emu.org/blog/2024/12/0

http :verified: boosted:
sortius :Fire_Bisexual:sortius@infosec.exchange
2025-06-30

As always, minutephysics does such a great job of going overboard on a subject in such a short time:

The Magnetic Shadow Effect

youtube.com/watch?v=MuvuxHXLzls

http :verified: boosted:
2025-06-29

OY MY FREAKIN GOD!!!
#Perifractic is the actual CEO of #Commodore! He really did it! This is awesome! 🤩

youtube.com/watch?v=ke-Ao-CpI7

http :verified:http@infosec.exchange
2025-06-28

@sjwrenlewis @HalvarFlake I'm not sure how they get to the fact of no progressive taxes, but Switzerland for example has very low income taxes, no capital gains taxes, no inheritance taxes to children or spouse, but as one of the very few countries a high wealth tax of around 1%. In the current environment with 0% key interest rate in CHF, that's even reducing wealth of the rich, unless they invest in risky assets.

http :verified: boosted:
2025-06-28

Some random rambling about a Windows / AMD software bug:

Ever since I built my new PC, I always had the issue that sometimes at midnight, a blank "AMDAutoUpdate.exe" cmd window would open and do absolutely nothing. (See picture 1)

Googling it, I found a lot of people complaining about it. The exe is part of AMDs "Ryzen Master" utility that my motherboards "GCC" tool installed for me. The commonly accepted solution is to just disable the auto update service through the windows task scheduler. But that sounded too easy for me, tonight I actually went through the efforts of finding the root cause.

My first thought was: What is so broken about my hardware / setup that this random tool is just broken, it surely can't just be broken for everyone... right?

Right?....

Well... The tool in question is written in .net, this is very good because

A) .net is easy to decompile / reverse

B) I have written .net code a few years ago

So I went ahead and reversed what the tool does (or at least, what it is supposed to do).

The tool will attempt to download the file "VersionInfo.xml" from some URL that's stored within it's .exe.config file. Looking into that, hilariously enough there are two URLs, one being labeled "Production", the other being labeled "Develpment" (not a typo on my end), you can guess which of the two is commented out :P. However, this does not appear to be the issue, since both files appear to be the same in practice, let's dig deeper.

I noticed the downloaded file ends up being 0kb, so obviously something went wrong.

For downloading they use the "WebClient" class, they set a completion callback in which they call a different method to parse the file and display update option based on it's content. They also wrap the whole "WebClient" invocation into a try/catch block, but since no error is being logged, it doesn't seem there is an exception happening. (See picture 2)

However, I noticed the callback is being fired with an object of the type "AsyncCompletedEventArgs" and looking at the documentation, this object has an "error" property that they unfortunately do not check for, nor log. Instead, if there is an error, the program will simply try to open the 0kb xml, fail and deadlock forever, with absolutely nothing being done in the background.

Using a .NET debugger, I was able to retrieve the error:

ERROR: The request was cancelled: A protected SSL/TLS channel could not be created

Long story short, it turns out that WebClient by default sends a TLS 1.0 request to the server and the server at some point was updated to only support TLS 1.2 and 1.3.

This also means, it is in fact, BROKEN FOR EVERYONE. IN PRODUCTION. FOR POSSIBLY YEARS...

Using a .net recompiler (man .net really has some fancy tooling...), I was able to add the line
ServicePointManager.SecurityProtocol = (SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12);
which fixes the issue and I'm probably the first person in probably years to see the proper "update available" dialog (see picture 3), lmao.

So who's to blame here?
AMD? Microsoft?

I really don't know why this .net API doesn't try newer TLS versions if the older fail and instead requires an explicit flag to be set. On the other hand, AMDs tool is really shitty, doesn't do proper error checking and I would argue this cmd window should never open to begin with, which it wouldn't if they configured the task correctly.

http :verified: boosted:
2025-06-27

Sent a pull request to Audacity fixing a crash bug I'd been running into frequently. The cause was an out-of-bounds memmove. Classic C++ areas.

Anyway I got a fucking copilot review on my PR which left two comments, both completely wrong, one of which suggesting I reintroduce the out of bounds memory access. I'm furious!

http :verified:http@infosec.exchange
2025-06-26

@bontchev @malwaretech The stock didn't even drop. +36% in last 2 years, +67% in last year. There was a spike with Musk joining Trump between October and February. If you leave that away, no big rise or fall happened yet. I would never buy that stock seeing those numbers though.

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst