harrysintonen

joined 2 years ago
sorted by: new top controversial old
No one — absolutely no one — saw this coming: "The UK government is developing a “murder prediction” programme which it hopes can use personal data of those known to the authorities to identify the in c/[email protected]
[–] [email protected] 3 points 48 minutes ago

This here is the prime example of why we must stay vigilant about the collection and dissemination of personal information.

Also, while this article only mentions "algorithm", it's not difficult to predict that AI models are or will be used for this kind of task.

AI advocates often claim that any plans to regulate AI are just a hindrance to progress. I will take regulation if it will stop this kind of madness.

9
No one — absolutely no one — saw this coming: "The UK government is developing a “murder prediction” programme which it hopes can use personal data of those known to the authorities to identify the (infosec.exchange)
 

No one — absolutely no one — saw this coming: "The UK government is developing a “murder prediction” programme which it hopes can use personal data of those known to the authorities to identify the people most likely to become killers."

https://www.theguardian.com/uk-news/2025/apr/08/uk-creating-prediction-tool-to-identify-people-most-likely-to-kill

This is far, far more sinister than anything even Philip K. Dick could dream of.

#precrime #thoughtcrime #privacy

4
I can't recommend (infosec.exchange)
 

I can't recommend
https://www.privacyguides.org/ enough. Excellent curated information on how to protect your #privacy.

7
Finnish Post has decided to start using your data for service planning and development. This is opt-in by default. (fedia.io)
 

Finnish Post has decided to start using your data for service planning and development. This is opt-in by default.

"My data may be used for service planning and development, as well as for delivering personalized content and targeted advertising using profiling.
Profiling refers to automated processing of personal data where the information is used to evaluate personal characteristics, such as interests or service usage. The purpose of profiling is to enhance the customer experience and ensure that the customer receives relevant and interesting recommendations and services."

Notably for some reason this is separate from "Marketing consents" and is enabled by default.

You can turn off this option at: https://my.account.posti.fi/settings

#profiling #privacy #gdpr #enshittification

20
Today Finland is voting in county and municipal #elections. Unsurprisingly the idiot Russian "hacking crew" is DDoSing websites of the political parties. (infosec.exchange)
 

Today Finland is voting in county and municipal #elections. Unsurprisingly the idiot Russian "hacking crew" is DDoSing websites of the political parties.

Newsflash: The voting is pen & paper. No websites are involved in the voting process. You gain absolutely nothing by DDoSing the party websites.

#infosec #cybersecurity

2
In case you haven't noticed #nis2directive is in effect in Finland now: (infosec.exchange)
 

In case you haven't noticed #nis2directive is in effect in Finland now:

"Finnish Parliament has passed the government proposal for a national #Cybersecurity Act to implement the EU Cybersecurity Directive (NIS 2 Directive). As regards public administration, the relevant requirements included in the Directive are laid down in the Act on Information Management in Public Administration."

Interestingly this also increases the duties and responsibilities of The Finnish Transport and Communications Agency Traficom:

"The Cybersecurity Act also entails new supervisory duties for Traficom compared to the old NIS Directive. In future, Traficom will be the competent authority supervising cybersecurity issues also in the following sectors: postal and courier services, space, public administration, managed service providers, managed security service providers, research, and the manufacture of vehicles and other transport equipment."

ref: https://traficom.fi/en/news/cybersecurity-act-passed-parliament-obligations-under-nis-2-directive-enter-force-8-april-2025

#Microsoft is removing the possibility to use a local account with #Windows. in c/[email protected]
[–] [email protected] 1 points 2 weeks ago

@[email protected] Sure, those methods might work for now. But if Microsoft follows their reasoning ("We’re removing X from the build to enhance security and user experience of Windows 11. This change ensures that all users exit setup with internet connectivity and a Microsoft Account.") they will remove these methods eventually as well.

#Microsoft is removing the possibility to use a local account with #Windows. in c/[email protected]
[–] [email protected] 1 points 2 weeks ago* (last edited 2 weeks ago)

@infinity Yeah, it does for now. I fully expect Microsoft to remove that registry key or the associated functionality next.

After all not doing so would mean that users could accidentally setup the system "without working internet connectivity and a Microsoft Account".

That would be terrible for security and user experience *cough* business.

12
#Microsoft is removing the possibility to use a local account with #Windows. (infosec.exchange)
 

#Microsoft is removing the possibility to use a local account with #Windows.
https://blogs.windows.com/windows-insider/2025/03/28/announcing-windows-11-insider-preview-build-26200-5516-dev-channel/

"We’re removing the bypassnro.cmd script from the build to enhance security and user experience of Windows 11."

Oh, okay, but how does it improve security or user experience?

"This change ensures that all users exit setup with internet connectivity and a Microsoft Account."

Ah, so it does not improve security or use experience. It in fact is making the user experience worse, as you no longer can set up Windows offline easily.

The only reason is to force more users to sign up to Microsoft account.

#enshittification

1
If you care about your health information #privacy sending your generic material to a commercial entity is a mistake. The reason for the cheap prices is that your health information will be sold. (infosec.exchange)
 

If you care about your health information #privacy sending your generic material to a commercial entity is a mistake. The reason for the cheap prices is that your health information will be sold. While some companies claim anonymity, such claims are often with little merit has there often is enough information to identity individuals.

The fallout from the malicious tj-actions/changed-files is still being investigated. It is fortuitous that this malicious commit was identified fairly quickly, as further compromise of major OSS in c/[email protected]
[–] [email protected] 2 points 1 month ago* (last edited 1 month ago)

@jerry It largely depends on how well the initial impact is cleaned up. I'm hoping we won't see a ton of backdoors in various components next.

4
The fallout from the malicious tj-actions/changed-files is still being investigated. It is fortuitous that this malicious commit was identified fairly quickly, as further compromise of major OSS (infosec.exchange)
 

The fallout from the malicious tj-actions/changed-files is still being investigated. It is fortuitous that this malicious commit was identified fairly quickly, as further compromise of major OSS components and projects could lead to a kind of chain reaction.

#infosec #cybersecurity

4
VMSA-2025-0004: #VMware ESXi, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) (infosec.exchange)
 

VMSA-2025-0004: #VMware ESXi, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226)

VMCI heap-overflow vulnerability (CVE-2025-22224): A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

VMware ESXi arbitrary write vulnerability (CVE-2025-22225): A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

HGFS information-disclosure vulnerability (CVE-2025-22226): A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390

#CVE_2025_22224 #CVE_2025_22225 #CVE_2025_22226 #infosec #cybersecurity

#curl predecessor httpget 0.2 from around 1996/1997 is 165 lines. Needless to say, it has multiple critical security vulnerabilities. How many can you spot? in c/[email protected]
[–] [email protected] 1 points 1 month ago* (last edited 1 month ago)

The httpget 0.2 doesn't quite work in the form it was uploaded.

First it uses hardcoded argv, argc instead of getting from the app invocation (as args in main, the code uses void main).

Second obtaining any data from the socket will result in the app stopping and leaving behind an empty file (if (nread) break;).

This program could never download anything. It is likely some work in progress or modified test version of httpget. Since it includes some windows specific headers and has disabled the unix ones I can only presume it was some earlier attempt to get the tool running on windows.

So while the code has a local stack buffer overflow it can't be triggered for this early version.

1
#curl predecessor httpget 0.2 from around 1996/1997 is 165 lines. Needless to say, it has multiple critical security vulnerabilities. How many can you spot? (infosec.exchange)
 

#curl predecessor httpget 0.2 from around 1996/1997 is 165 lines. Needless to say, it has multiple critical security vulnerabilities. How many can you spot?

If you build it on a modern system and want to try exploiting it in true 90s fashion, be sure to turn off address space layout randomisation (ASLR).

https://github.com/curl/httpget/blob/master/httpget-0.2.c

#infosec #cybersecurity

As expected #Apple has nuked Advanced Data Protection (ADP) for UK users. What does this mean in practice? UK govt will be able to decrypt all UK user's #iCloud data at will. in c/[email protected]
[–] [email protected] 1 points 1 month ago

If this trend continues, we will be losing the ability to use secure means of communication with UK friends and colleagues. For example, #signalapp will rather get out of the UK than add backdoors: https://www.bbc.com/news/technology-64584001

4
As expected #Apple has nuked Advanced Data Protection (ADP) for UK users. What does this mean in practice? UK govt will be able to decrypt all UK user's #iCloud data at will. (fedia.io)
 

As expected #Apple has nuked Advanced Data Protection (ADP) for UK users. What does this mean in practice? UK govt will be able to decrypt all UK user's #iCloud data at will.

Existing users' access will be disabled at a later date - this will likely mean that unless if you accept the new policy Apple will delete your existing iCloud data. Which I would recommend you do right now anyway - never trust someone else's computer with sensitive data.

https://www.bbc.com/news/articles/cgj54eq4vejo

#cybersecurity #privacy #enshittification

8
#OpenSSH client is vulnerable to MitM attacks if VerifyHostKeyDNS is enabled - https://www.openwall.com/lists/oss-security/2025/02/18/1 (infosec.exchange)
 

#OpenSSH client is vulnerable to MitM attacks if VerifyHostKeyDNS is enabled - https://www.openwall.com/lists/oss-security/2025/02/18/1

#CVE_2025_26465 #coordinateddisclosure #infosec #cybersecurity

#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. in c/[email protected]
#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. in c/[email protected]
[–] [email protected] 1 points 2 months ago

#Nordnet services appear to be back.

#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. in c/[email protected]
[–] [email protected] 1 points 2 months ago (2 children)

Nordnet has a lot of technical issues to sort out. If the malfunction allowed unauthorized parties to operate the accounts it will be quite messy to sort out.

Among with technical part, they will have to deal with the regulatory issues, in particular the Financial Supervisory Authority. They will demand answers.

In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It in c/[email protected]
[–] [email protected] 1 points 2 months ago* (last edited 2 months ago)

I still occasionally write some m68k code and apps. These are from 2024:

- Execute code in #amiga color registers: https://sintonen.fi/src/colexec/colexec.asm
- RXS-M-XS 32bit->32bit Permuted Congruential Generator: https://sintonen.fi/src/misc/pcg/_rand.asm
- Minimal modplayer (protracker music player): https://sintonen.fi/src/minimod/ (the replayer routine is mostly from Frank Wille however)

In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It in c/[email protected]
[–] [email protected] 1 points 2 months ago

I also participated in very useless size/speedcoding competitions - some of them are still accessible from this old web page: https://amycoders.org/compo/

Note that some of the HTML is a bit broken, for example https://amycoders.org/compo/circlecompo.html - you can view source to see the full routine

#m68k #assembly #sizecoding #speedcoding

#cURL doesn't validate SSH host identity if known_hosts file is missing. I think this is a #vulnerability, but the project disagrees. Advisory is here: in c/[email protected]
[–] [email protected] 2 points 2 months ago

@[email protected] Curl will likely address this eventually even though they don't consider it a vulnerability. See https://github.com/curl/curl/issues/16197

view more: next ›