RT @zooko@birdsite.link
This has been exploited in practice by Bitcoin thieves. They replaced the cold-wallet address in a hacked server so that BTC got redirected to them, and they vanity-generated their addr to match the first and last chars of the original and this successfully fooled the victims.

https://twitter.com/zooko/status/1068902564152975362

**karver** · Nov 26, 2018, 21:36

karver boosted

**Jerry Bell** @jerry@infosec.exchange · Nov 26, 2018, 21:36

Nov 26, 2018, 21:36

Jerry Bell @jerry@infosec.exchange

The event-stream library in NPM has been backdoored with a Trojan for some time. Looks like a damn mess. If you do/did anything with that library, time to put your helmet on.

**karver** · Nov 23, 2018, 22:34

karver boosted

**Jerry Bell** @jerry@infosec.exchange · Nov 23, 2018, 22:34

Nov 23, 2018, 22:34

Jerry Bell @jerry@infosec.exchange

Citizens of infosec.exchange: i will very likely be migrating to a new server this weekend. Several things to note:
1. The new server does not have an IPv6 address. Apparently there is a shortage of IPv6 addresses and hosting providers are rationing them.
2. I will be applying the glitch.social mods, which will provide longer toot length, among other enhancements.
3. The new server uses NVMe SSD’s, which I’ve been told are so fast that you may get toots even before you’ve asked for them.

**karver** · Nov 21, 2018, 06:44

karver boosted

**cryptoph** @ckluente@toot.thoughtworks.com · Nov 21, 2018, 06:44

Nov 21, 2018, 06:44

cryptoph @ckluente@toot.thoughtworks.com

@jerry @smays there is a cool podcast about the machine that generates the sitcom laughs: https://99percentinvisible.org/episode/the-laff-box/

**karver** · Nov 20, 2018, 10:33

karver boosted

@dch@bsd.network · Nov 20, 2018, 10:33

Nov 20, 2018, 10:33

@dch@bsd.network

I read a bit about #PrimeNumbers yesterday, as I've always had a fondness for primes. I use them a lot in config settings for servers, as when you get weird timeouts, it's usually very obvious from a multiple of a given prime which timeout is being hit.

**karver** · Nov 19, 2018, 15:00

karver boosted

**HackerNewsBot** @HackerNewsBot@mastodon.social · Nov 19, 2018, 15:00

Nov 19, 2018, 15:00

HackerNewsBot @HackerNewsBot@mastodon.social

Paint16b: A 16 byte paint program written in 12 lines
https://news.ycombinator.com/item?id=18481929
#hackernews #tech

**karver** · Nov 18, 2018, 13:51

karver boosted

**fallenhitokiri** @fallenhitokiri@infosec.exchange · Nov 18, 2018, 13:51

Nov 18, 2018, 13:51

fallenhitokiri @fallenhitokiri@infosec.exchange

Forgot your #instagram password? You just had to use their GDPR export tool to get it in plain text https://www.theverge.com/2018/11/17/18100235/instagram-security-bug-exposed-user-passwords-data-download-tool

**karver** · Nov 18, 2018, 20:49

karver boosted

**Jerry Bell** @jerry@infosec.exchange · Nov 18, 2018, 20:49

Nov 18, 2018, 20:49

Jerry Bell @jerry@infosec.exchange

Anyone running their mastodon instance using a cloud hosting object storage service (s3, etc)? I am in awe at how fast the storage needs of infosec.exchange are growing. #mastoadmins

**karver** · Nov 18, 2018, 19:40

karver boosted

**John Opdenakker** @j_opdenakker@infosec.exchange · Nov 18, 2018, 19:40

Nov 18, 2018, 19:40

John Opdenakker @j_opdenakker@infosec.exchange

Well written @wired piece about the real risks of using free wifi nowadays
TL;DR: If you're you're no high-value target you're probably safe as most (commonly used) websites are served over HTTPS.
https://www.wired.com/story/hotel-airport-wifi-safe/
#Infosec #CyberSecurity