AppSec Charlie

application security person with an interest in music, AI, and digital art

[AppSec Charlie @AppSecCharlie]

welcome to the future #chatgpt5

[AppSec Charlie @AppSecCharlie]

🚀@github can now leverage @MSFTCopilot to auto-magically fix your code if there are any breaking changes introduced by a @dependabot update.

only supports #typescript for now but this will be huge

https://t.co/muvGd06QlW

#appsec #cybersecurity #githubuniverse2024

[AppSec Charlie @AppSecCharlie]

@KDCoder here, have 27 update PRs, you're welcome 😂

[AppSec Charlie @AppSecCharlie]

very interesting conversation from @lexfridman and the @cursor_ai team about the tools we use to write code, how to best incorporate AI, and the future of programming more generally.

https://t.co/v1D9or7he5

#AI #githubcopilot #vscode

[Simone Margaritelli @evilsocket]

* Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago.
* Full disclosure happening in less than 2 weeks (as agreed with devs).
* Still no CVE assigned (there should be at least 3, possibly 4, ideally 6).
* Still no working fix.
* Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot.
* Devs are still arguing about whether or not some of the issues have a security impact.

I've spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can't accept that their code is crap - responsible disclosure: no more.

[Christopher Stanley @cstanley]

This is a wake up reminder that you shouldn’t have an internet connected privileged binary running on your production systems. What was a bad update could have easily been a massive adversary backdoor. A third party vendor will always be the weakest link. Isolate critical systems

[AppSec Charlie @AppSecCharlie]

if you're sourcing scripts from https://t.co/fB0F2aZzd0, don't

[AppSec Charlie @AppSecCharlie]

@Jr0dR87 Users can make themselves admin, password likely stored in plaintext, no validation on username/password (not checking for malicious input or that they meet requirements like password complexity). All running in debug mode so attackers get nice helpful error messages

[AppSec Charlie @AppSecCharlie]

@github build stuff, a lot. reading all the books and taking all the courses are useless if you don't practice solving real problems.

[AppSec Charlie @AppSecCharlie]

here's #PrintListener.. in example #1434 of why audio hackers are doing the most interesting work, how about using the sound of your finger on a touchscreen to reconstruct your fingerprint and bypass biometrics?

https://t.co/iS1Wt4Sbr6

#hacking #biometrics #cybersecurity

[AppSec Charlie @AppSecCharlie]

"it's cool because it's nerdy"

#datamosh #videoart #glitchart

https://t.co/WgxjnESD25