✅ Last day at current job done 🫡
Remote
faker
@faker@infosec.exchange
I liked ranting so much, I made it my job.
Pentester. I mostly break Web stuff but sometimes hardware too. OSINT from time to time.
Terrible music connoisseur.
@faker_ on Twitter.
#infosec #pentester #OSINT
227
Followers
239
Following
23
Posts
Joined August 18, 2018
Location:
Munich, Germany
Posts
Replying to
@studiolo_rb@mastodon.online
@studiolo_rb@mastodon.online from what I've read it's not really made for macOS, they say use something like KeePassXC in their forums all the time
I migrated recently to KeePassXC, but they are actively disabling macOS Handoff - you cannot copy a password on your Mac and paste it on iOS.
They pretty much say its because of security and just sync all your passwords to your iOS instead if you want that [1]. I really don't want to do that.
This is super annoying. Anyone use an alternative that allows this (100% local running)?
[1] https://github.com/keepassxreboot/keepassxc/issues/7279
Trying to figure out how to dispose expired RSA tokens, came across a german help page by RSA in which they mis-translate token several times to pretty much "coins" 
I find it weird calling the recent FFmpeg security vulnerability a RCE [1]. Where is that remote coming from?
Yes sure, some web applications use FFmpeg and passes untrusted files to it. *Those* have a RCE.
Setting the CVSS attack vector to "network" seems overinflating.
By that standard any software that somebody built a webapp around is "network" facing.
And let's not even talk about setting attack complexity to "low" but admitting that it only works with ASLR disabled.
[1] https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/
#FFmpeg #vulnerability #infosec #PixelSmash
Foo Fighters
In case you thought that buying a perpetual license for Microsoft Office on macOS means that you can use it for as long as it runs on your device: haha, nope!
Their certificate to verify the Office 2019 license expires next month, there will not a patch, and it will operate in read-only mode like it's unlicensed. For Office 2019 there will not be a fix at all.
There is no way to disable the animated Google Doodles on Chromes new tab page.
This is driving me insane, I usually have Chrome and a new tab open on a second screen, now it just constantly shows this soccer animation.
I think this is the final push to move me to another browser.
You've got to be kidding me, Lenovo! The stupid Vantage software that is (pretty much) required to install BIOS updates is pushing Ad notifications?!
The #infosec knee jerk reaction to https://bumsrake.de appears to be:
"Wait are they having FUN with vulnerability disclosure? Not on my watch!"
If you want your vulnerability details in a boring format feel free to buy a TI feed. Don't tell researchers who invested a ton of their time how to disclose stuff.
The stock market has the potential to do the funniest thing of all time on Friday.
Can someone create a MSCI World ex-Musk ETF?
I think there's enough demand for that.
@campuscodi@mastodon.social funny how that shared responsibility appears to be 100% on the researchers side. Not a word on improving their own processes.
Talk to anyone who tried to submit findings to MSRC and it's always a tale of nightmares.
I can't figure out how to mute a hashtag in @IceCubesApp@mastodon.online - that must be possible, right?!
Paypal sent me a (legit) mail that my account is being closed due to inactivity. But it sent that mail to an address that is no longer attached to my account.
And trying a password reset with that email address paypal says it's not registered?!
One of the guys who often typos his email address so their mails end up with me has done it again: He got a job offer, well, I guess I got it now?
Believe it or not, this is the *second* time I got a job offer by accident due to typos in the mail address (I think it was a different guy last time, there are a few people that manage to give out my address as theirs...).
Replying to
@xeniac@troet.cafe
@xeniac@troet.cafe @bagder@mastodon.social it depends on how you count. Mobile iOS and Android applications often use sqlite. If you count any database file as an installation it wins (IMO). If you count every sqlite client library it might still (since devs might still include a library and not use the system provided ones).
@leonido@chaos.social gerade https://www.tagesschau.de/wirtschaft/digitales/social-media-europa-alternative-100.html gelesen: soweit ich weiss ist chaos.social nicht vom CCC betrieben oder der "offizielle" CCC Mastodon Server, sondern ein community Projekt (natürlich sehr Chaos-nah) - aber eben ein eigener Verein.
ffs YouTube, I watched one professionally shot live video of a band. Do not recommend me shitty live videos that fans take out of the crowd with like 40 views.
Say what you will about Java, this is actually pretty cool.
What has #DNSSEC ever done for us?
It was not part of my threat model when I moved my email address to my own domain that the entire .de TLD could fail
Replying to
@bagder@mastodon.social
Use a library (e.g., libcurl for C, requests for Python) instead of calling the system's curl binary.
Yeah! Have you considered changing the curl binary to use libcurl?