@bradlarsen@infosec.exchange

Brad Larsen @bradlarsen@infosec.exchange · 5d ago

Replying to @wirepair@mastodon.social

@wirepair@mastodon.social AI hacking companies? Or vibe-code companies? Or both??

0

Brad Larsen @bradlarsen@infosec.exchange · 5d ago

Replying to @bradlarsen@infosec.exchange

@wirepair@mastodon.social a few months after I left Praetorian they started pumping out vibe-coded security tools, killed off their Chariot CTEM product, and seem now to be trying to compete in the AI hacking space against Horizon3, XBOW, etc

0

1

0

Brad Larsen @bradlarsen@infosec.exchange · 5d ago

Replying to @wirepair@mastodon.social

@wirepair@mastodon.social it's a vibe-coded copy of nosey parker and kingfisher (which is itself a fork of nosey parker), like "write me a secret scanner that can use rules from these other tools, but in go. Make no mistakes".

3

1

0

Brad Larsen @bradlarsen@infosec.exchange · Jul 20, 2026

Replying to @jerry@infosec.exchange

@jerry@infosec.exchange I had one of those back in the day!!

0

Brad Larsen @bradlarsen@infosec.exchange · Jul 19, 2026

Replying to @wirepair@mastodon.social

@wirepair@mastodon.social is any additional auth needed? Or does this mean an ssh private key can be used to effectively bypass 2fa (by generating new recovery codes)??

3

1

0

Brad Larsen @bradlarsen@infosec.exchange · Jul 19, 2026

Replying to @wirepair@mastodon.social

@wirepair@mastodon.social oooh interesting! The sandboxing concerns have been on my mind too. seems like a clean VM with only necessary assets / projects on it for an LLM is wise

0

Brad Larsen @bradlarsen@infosec.exchange · Jul 18, 2026

Replying to @b0rk@social.jvns.ca

@b0rk@social.jvns.ca in large part osmosis from poring over sqlite docs, reading more general database performance guides (like https://use-the-index-luke.com/) and then experimenting a lot with writing more complex queries in some apps I was working on. Having a high-level understanding of how joins are done and how a database uses available indexes helps tremendously. My main us of query planning: answering whether "this query will take forever" or if it will be fast. For my usual work (analytic workloads) there is usually no in-between.

0

Brad Larsen @bradlarsen@infosec.exchange · Jul 11, 2026

Replying to @bradlarsen@infosec.exchange

Relevant: https://lwn.net/SubscriberLink/1080822/990a8a5e2d379085/

0

Brad Larsen @bradlarsen@infosec.exchange · Jul 08, 2026

I saw a service offering "115M ethically-sourced residential IPs". Is there even such a category for ethical residential proxies, or are they all underhanded things and botnets??

0

1

0

Brad Larsen @bradlarsen@infosec.exchange · Jul 08, 2026

Replying to @pkhuong@discuss.systems

@pkhuong@discuss.systems more than 32k lines is certainly an error! (haha old visual studio)

0

Brad Larsen @bradlarsen@infosec.exchange · Jul 08, 2026

Doing fuzz testing, I've seen the same performance bug in parsers for at least 3 systems, where a line number for location reporting is determined from a byte offset by looping through the input, itself done in a loop. Surprise O(n^2)! It probably doesn't show up easily in "normal" use patterns, but when you start fuzz testing you hit it all the time.

1

0

Brad Larsen @bradlarsen@infosec.exchange · Jun 01, 2026

Replying to @masek@infosec.exchange

@masek@infosec.exchange cool, thanks for the details! I have thought idly about doing similar for years, but the warnings my email provider gave about wildcards, spam, and possible denial-of-service on my email has given me pause.

1

0

Brad Larsen @bradlarsen@infosec.exchange · Jun 01, 2026

Replying to @masek@infosec.exchange

@masek@infosec.exchange what's your workflow for creating a new single-service email? Does your email allow wildcards, or do you have to manually set up something each time?

1

2

0

Brad Larsen @bradlarsen@infosec.exchange · May 14, 2026

@regehr@mastodon.social once pointed out that Anthropic's logo for Claude looks like something else, and I cannot unsee it now

mastodon.social

John Regehr (@regehr@mastodon.social) - Mastodon

4

1

0

1

Brad Larsen @bradlarsen@infosec.exchange · May 11, 2026

The last couple months I have noticed a UI bug on several major websites on mobile: you scroll down a while, then make the "scroll to top" gesture. The page scrolls to the top, but form elements (like a search bar) become unselectable until a full page refresh.

My (non-techie) spouse has also noticed this and was complaining about it today!

Are all these sites using the same Javascript framework that introduced a bug or breaking change a couple months ago??

0

1

0

Brad Larsen @bradlarsen@infosec.exchange · May 09, 2026

I play double bass, but also sometimes play electric bass through headphones after my kids go to bed. It's interesting to me that I can tell when my ears get tired! After 40 minutes or so, I have a harder time distinguishing between half steps below 60Hz or so... they all start to sound samesies

2

0

Brad Larsen @bradlarsen@infosec.exchange · May 05, 2026

Replying to @bradlarsen@infosec.exchange

@raymaccarthy @Remittancegirl https://infosec.exchange/@bradlarsen/113818975038391029

2

0

Brad Larsen @bradlarsen@infosec.exchange · May 05, 2026

Replying to @raymaccarthy@mastodon.ie

@raymaccarthy @Remittancegirl I have noticed the same! Sometimes the AI summary is *exactly opposite* what the actual sources say

3

1

0

Brad Larsen @bradlarsen@infosec.exchange · May 05, 2026

Aetna sending me an apology email for their AI slop search feature. They are "taking steps" and I can call them to talk to a human.

A word extruder answering health and insurance policy questions. What could possibly go wrong??

2

1

0

Brad Larsen

Posts

John Regehr (@regehr@mastodon.social) - Mastodon

Remote instance

Media