So today she proceeded by once again attacking the researchers and criticizing journalists who were asking her about the security vulnerability, restating that it didn't exist.
And she claims that @DI_Security@twitter.com researchers publicly called her a transphobe. Not sure what this is about, I could only find a tweet by @firstname.lastname@example.org who appears to have no relation to the researchers. Judging by the way @email@example.com responded she thinks otherwise.
She says that they should have emailed technical department directly – yet from a brief look I cannot find the corresponding email address anywhere. From experience, emailing technical support about vulnerabilities is a bad idea. So Twitter is a valid way to approach a company.
From that point on, things went only downhill. @salltweets vehemently denied the existence of any security issues, claiming that the whole thing is a harassment campaign – despite not having received any details. She sent them a DM but apparently blocked the account later.
According to the researchers, they were first ignored when they attempted to report the issue. Eventually, they received a response but not the kind they hoped for. Not sure why they had to state their disagreement with @firstname.lastname@example.org’s views, but it clearly rubbed her the wrong way.
Several people from the Mozilla community felt that I’m building up a conspiracy theory here. That’s not the case, I’m actually quite certain that people are acting with good intentions. Unfortunately, that doesn’t automatically mean that we’ll be happy with the results. Updated my article:
Ouch, typo in the image – 1.81 * 10^19, not 1.81 * 10^20. Also, it's 2.9 J/s, not 29. The end result is correct, I forgot to correct a mistake for intermediate steps. ☹️
I always wonder what kind of algorithm is at work analyzing #Twitter data, taking great amounts of personal information and deducing all those bogus things about me. For most part, this is very intransparent, but at least with deduced languages it's slightly more obvious. 1/6
Wow, I knew of course that #Brave was running some really aggressive marketing campaigns... But now they are apparently spamming random bloggers because of links to MDN for browser extensions information.
For reference, the article in question is https://palant.info/2015/10/15/using-webextensions-apis-in-a-classic-extension/.
https://www.theregister.com/2020/06/24/bitdefender_security_hole/ got thoroughly confused by Bitdefender announcement claiming that the vulnerability resides in the SAFEPAY browser. No, a malicious website doesn't need to be opened in this browser, the exploit works from any browser as my post clearly states.
https://gbhackers.com/vulnerability-in-bitdefender-anti-virus/ on the other hand appears to be based on my blog post and Bitdefender announcement only. But it somehow manages to misattribute my statements to Bitdefender while also mangling my other statements in an attempt to avoid placing them in quotation marks.
I think the crown so far goes to https://androidrookies.com/bitdefender-anti-virus-found-vulnerable-allowing-attackers-to-run-commands-remotely/ which is a confusing mix of Wikipedia info, my article and https://www.bleepingcomputer.com/news/security/bitdefender-fixes-bug-allowing-attackers-to-run-commands-remotely/ without any of the sources named. Some of my statements are marked as quotes, others are simply part of the text. And parts are just weird.
And then one only needs to enable this reporter in ~/.config/urlwatch/urlwatch.yaml.
Don't forget to set DISPLAY=:0 when running urlwatch via cron!
Luckily, adding a reporter is fairly simple. One can create a ~/.config/urlwatch/hooks.py script, e.g. with the contents below (using kdialog command line tool to display a message).
And - yes, I can totally see how this error message can make someone despair. Crazy enough, I actually remember moving TSRs into high memory. 😀
Wladimir Palant, software developer and security researcher, browser extensions expert. He/him
Other Mastodon account for non-technical topics: https://social.tchncs.de/@WPalant
A Mastodon instance for info/cyber security-minded people.