Andrey R

Professional software developer .Net/C#, Haskell/Ocaml/Prolog & other coding challenges.
Interests: fiction literature, bicycle and biathlon.

[Andrey R @AndirNotes]

Как сердцу высказать себя?
Другому как понять тебя?
Поймёт ли он, чем ты живёшь?
Мысль изрече́нная есть ложь.
(c) Тютчев, 1830

[Florian Roth ⚡️ @cyb3rops]

I initially thought “RCE in Paint” meant tricking someone into opening a crafted image, and my confusion was just about terminology.

But Microsoft lists AV:N / UI:N. The FAQ describes sending a crafted packet to an “affected service”, with no user interaction.

Which service? How does that packet reach Paint and trigger code execution without anyone doing anything?

I really hope this is just an error in the advisory…

https://t.co/rTBO5WL23g

[Andrey R @AndirNotes]

A lot of clever tricks instead of proper typing system. '*' as a non-password, using salt of another account, '*' or 'x' instead of proper error/result type. Tricksters programming in a nutshell.

[David Leung ◎» @dhkleung]

Everyone is blaming OpenSSH for the sshhole vulnerability, but do you know who is really at fault?

musl

The POSIX standard requires crypt to return NULL on error.

musl returns "*" to not cause bad code to crash or worse, but in doing so, made well behaved code pay the price.

[Andrey R @AndirNotes]

Brilliant. Just brilliant. BTW. This * thing from crypt instead of NULL looks pretty suspicious change, even intentional I would say.

[ozgun @kultekin]

*sshole is out

if you run sshd on alpine, openwrt or any musl box with password auth on: update now

official writeup: https://t.co/hQUJXVPKwE

[Andrey R @AndirNotes]

Does it dark matter?! https://t.co/Os3Us4hrlz

[Andrey R @AndirNotes]

Restrictions-based defence technique. I saw similar technique in the wild when saving web-page from browser triggered antivirus due to EICAR signature embedded into every page.

[lifcc @mylifcc]

有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。

[lifcc @mylifcc]

有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。

[Embassy of Finland in the US 🇫🇮 @FinlandinUSA]

It's becoming nightmarish... for the Finns.

Happy Halloween from the Embassy of Finland! 🎃

[wwmccαt @WickedMcCat]

@hmemcpy They switched grifts, now they're all AI transformation consultants.

[Andrey R @AndirNotes]

Answer to the Ultimate Question of Life, the Universe, and Everything is 4.

[John Althouse @4A4133]

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...

The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.

- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.

- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.

- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.

These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.

https://t.co/AYUgNsrA0f

[Andrey R @AndirNotes]

Автоматический перевод стал настолько хорош, что явно стал заметен социальный сдвиг, что в твиттере, что в реддите - где люди общаются на разных языках практически без барьеров и потери смысла теперь.

[Andrey R @AndirNotes]

Talking to someone else's Claude is really most annoying thing today.

[EgorBo @EgorBo]

77 open PRs for the JIT compiler from non-team members. Obviously all fully AI-generated. Every interaction is just me talking to someone else's Claude or Copilot).

[katexbt.hl @katexbt]

oh my god this is worse than we thought

here's @Ledger $86M exploits explained

> cryptobilis was a reputable and authorized Ledger/Trezor/OneKey dealer for over 4 years

> they decided to sell the company to a Chinese guy (most likely patsy for DPRK) from northern China in MARCH 2026

> the "Chinese guy" modded the devices within the supply chain itself (physical), namely Nano X devices, to contain an implant module

> ledger validity/genuineness check CANNOT detect this because hw wasn't actually tampered with, just spied on

> quoting @MagicalTux:

" implant just monitors what's shown on the screen, will take note of the seed as it's shown to you, then transmits it to 3rd party"

> former owner chimes in on X (pic below) to say that "they were under a NDA" to not mention anything to anyone for 6 months

> they obviously didn't alert any of their partners that they were authorized to sell devices of... because NDA, duh!! its in the name!

> conveniently, funds start getting siphoned a few weeks before this magical NDA due date, and being laundered across all blockchains

[Mark Karpelès @MagicalTux]

This looks like this could be exactly what I'm investigating. Anyone affected, please contact me or open your ledger and send me pictures so we can confirm if there's a bug in there (pictures: ledger board on top, spy implant below).

https://t.co/mg2VRHLRHE

[Lorelai White @LaiLaiWhite]

@edandersen There's a large degree of overlap between deep object serialization and survival horror.

[Andrey R @AndirNotes]

Ну и наклодкодили тут...

[Insomniac Games @insomniacgames]

AHHGGG!

That piercing feeling when it's September 15 in parts of the world, but the rest of us have to wait until later for Marvel's #WolverinePS5. 🌐 🚀

[Andrey R @AndirNotes]

Looks like typical 2027

[Game Unlocked @gameunlocked26]

Cyberpunk 2077 with DLSS 5

[Andrey R @AndirNotes]

Rituals. Signing does not add trust automatically.

[Robert Graham @robertgraham]

No.

Never download and run an unsigned beta build like this.

Don't trust somebody who tells you to download and run their unsigned beta build.

[Andrey R @AndirNotes]

Kindle prices accidentally increased. Basic model for 150$. Eink is too expensive now.

[Andrey R @AndirNotes]

Let's do that retry loop again

[carlfranklin @carlfranklin]

Introducing the Open Source Maintenance Fee for Polly
https://t.co/iskmY7uvw2