Alice

Sec Engineering Dev, martial arts practitioner, python slinger.
On fediverse: @[email protected]

[Alice @__3ve]

@tilver @mattjay I could be wrong, but I was assuming that possibility was what he was referring to with: "They don't believe APT29 recreated the exploits independently."

By "strikingly similar," I was also assuming that was at the byte level.

[Alice @__3ve]

@TheStevenCheung @realDonaldTrump lol, this campaign seems to be trolling itself.

[Alice @__3ve]

@SwiftOnSecurity I chuckled at the implied comparison of Bill Gates to Elon Musk.

[Cisco Talos Intelligence Group @TalosSecurity]

Coming soon: "The Light We Keep." This documentary will explore firsthand accounts of the chaos and consequences of electronic warfare https://t.co/3Yrc0cxerI

[Alice @__3ve]

Ah, almost forgot about this one time I didn't think about tapping a link in an email to a credit card site, and what smacked me out of my stupor was that the fraudulent site did not look or perform like the real thing.

[SwiftOnSecurity @SwiftOnSecurity]

One of the more fascinating inconsistencies in consumer sentiment is the touchscreen being seen as a pure luxury item, until consumers realized it's a huge cost-saver in manufacturing and wiring complexity as the backend components dropped in price. Now buttons are luxury items!

[Alice @__3ve]

@bfistein @acnewsitics Respectfully, I believe you are referring to the ability to relate to your audience..

[Alice @__3ve]

Cuz sometimes leadership is showing strength when you’re wholly spent, and sometimes it means listening and standing down despite giving it your all. 🫡

[Alice @__3ve]

@vbbernard @edgarrmcgregor I don’t know what it does to the pH of the soil, as my soil can be pretty clay-ish as it is, so I haven’t tried it, myself.

[Alice @__3ve]

@vbbernard @edgarrmcgregor I haven’t had a snail problem yet (and am sorta new to gardening, myself), but I’ve seen people swear by bentonite clay (like the powder used for face masks) for use around your plants to dry out the snails, like some sort of dehydrating moat.

[Alice @__3ve]

@vbbernard @edgarrmcgregor This! I was amazed that the birds didn’t touch our blueberries because our plants were covered by a random viney plant.

[Alice @__3ve]

@edgarrmcgregor The sunlight is great for solar panels, and my veggie plants and flowers need sunlight. Otherwise, shady trees are great.

[Alice @__3ve]

"We're both frustrated, but I'm not trying to be difficult. If I don't know what you mean, I can't fix the problem."

Somehow that is still offensive for some personalities.

[No Nonsense Neurodivergent @NoNonsenseND]

Just say it

[Alice @__3ve]

@daydream113017 With a few notable exceptions, my entire worldview on giving and grace is informed by a Christian upbringing, and it boggles my mind how diametrically opposite it is from what I see Christians espousing these days.

[Special D. Circumstances @AJAlkaline]

@ChrisAlvino The problem with AI is not with AI; the problem with AI is with capitalism.

[Robert Hansen @RSnake]

Little known fact - I had been thinking about Slowloris for about 10 years before I finally actually sat down to write it.

In the early 90's I had encountered a situation where Apache would die when people would do what I used to call "half-open" attacks where they'd see if they got the first packet (200 or 401) and then close the socket without seeing the rest of the result or sending RST or FIN packets causing Apache to be confused and hang, patiently waiting to finish it's response. Our interprocess communication would lock - something related to dead semaphores, and the whole system would halt and no longer deliver HTTP responses.

Every day at around 5PM Japan time, some kid would come home from school and attack us trying to break in. It was annoying, and it never really had a chance of working but it did break our website and cause my phone to start alerting due to the outage... every... single... night... at... 1am. Grr.

The solution at the time was simply to block the attackers and build a self-healing solution that would reboot Apache when we detected those hung IPC semaphores. Fairly ugly solution but it worked and was pretty cutting edge for it being the 90's. I also got my first Blackhat talk out of it with subsequent solutions we came up with to hide the responses requiring full HTTP responses to be analyzed before they could close the socket.

The talk was "Military Hardening of .htaccess" and was exclusively attended by Chinese speakers and like 3 of my friends - I was speaking opposite Mitnick, I think, so the room was virtually empty. I was also extremely, mind-bendingly, hung-over. I ended up throwing up right before going on stage, like under a minute before, and my head was spinning through the whole talk.

The Chinese audience members had a translator and it was making me sick to hear my own translation and I was already having a hard time keeping it together. I cannot believe Blackhat ever gave me a second chance after that mess. Friendly note kids - don't go full Vegas the night before your preso.

As you might imagine, after that I was pretty much totally done with the whole idea so I sat on the idea of Slowloris for a decade. Yes, a really really bad hang-over made me uninterested in developing a denial of service tool. It literally made me a little nauseous to think about it.

I digress...

But it got me thinking that there would be a way to do something similar as an intentionally malicious attack rather than just efficient brute forcing. The way to do that would be to send the packet with the first half of the HTTP headers and then just keep the socket open, never finishing the request.

I do wonder how many other exploits are out there where people are sitting on it forever just because they haven't gotten around to writing it yet.

[Erin Reed @erininthemorning.com on Bsky @ErinInTheMorn]

Rest in piece Lynn Conway.

She changed the world, and if you are using a mobile phone, you have her to thank.

[Alice @__3ve]

Guess I'm gonna have to rt this if Twix is gonna be hiding my likes. :P

[M@ @MattyGx93]

@vxunderground You know who they're not private from? Twitter.

[Alice @__3ve]

Ugh, hi, I'm back on this TwiX thing.. Gross.