blasty

irresponsible disclosure aficionado

[blasty @bl4sty]

sifting thru vibeslopped finding artifacts is the ultimate lootbox experience

[blasty @bl4sty]

I had just managed to get rid of my i-missed-warcon FOMO and then you had to post this thread! ;-) my BAD for not making it this year. (and my bad for not even bothering to follow up to the invitation; mr. @h0wlu and mr. @antisnatchor I'm sorry! I'll bring fresh warez next edition. promise!)

sounds like you guys had a good time though! :-)

[blasty @bl4sty]

thank _god_ THOR chain is safu again! hopefully they can get the chain operational again asap. my lazarus acquaintance told me there's an immense backlog of loot that needs to be chain-hopped pronto!

[V12 @v12sec]

Update: We disclosed all remaining bugs to Thorchain despite no bounty program.

[blasty @bl4sty]

slopping some dank clipart for my @OrangeCon_nl talk this thursday! 😎🐎🚬

[blasty @bl4sty]

I fully stand by their rationale btw, let that be clear..

the term "whitehat" has a pretty washed/depraved meaning in web3 land anyway 😂

[blasty @bl4sty]

the zellic grayhat division *will* come and halt + pilfer your magic internet money chain if you start yoinking bounties

[V12 @v12sec]

We reported a critical loss of funds bug to @Thorchain (32M TVL, 150M FDV)

They silently patched it and told us their bug bounty program is permanently retired.

We have more Thorchain chain halt DoS vulns. We intend to release them (open disclosure) in the coming few days

[blasty @bl4sty]

damn lil bro doesnt beat round the bush 2day

[blasty @bl4sty]

@GuanniQu gotcha!

[blasty @bl4sty]

"eventually you realize the thing is actually complex, and it needs sustained attention and you move on to next idea"

yup, it's a good wakeup call that whatever you were trying to do was not at all merely a sustained robotic engineering effort. or the output does not make sense from a value/benefit point of view. no amount of slopping can (really) save you from something that is inherently broken by design or built upon a naive foundation by an operator who wasn't too invested in the idea in the first place.

[blasty @bl4sty]

@b1ack0wl don't forget the part where the documentation is outdated/missing and the examples are broken/un(der)maintained and you're pretty much on your own in the depths of hell for 36 hours but you came out as a stronger person

[blasty @bl4sty]

@badlogicgames looks like good panning to me

[blasty @bl4sty]

🤣

[Robert Chen @NotDeGhost]

the real winners of DEFCON quals

[blasty @bl4sty]

every other io shield out there getting port mogged

[Hoshino Lina / 星乃リナ 🩵 3D Yuri Wedding 2026!!! @Lina_Hoshino]

This is what peak I/O shield looks like.

VGA, DVI, DisplayPort, or HDMI? Yes.
Analog or optical 5.1 audio? Yes.
PS/2, USB2 or USB3? Yes.
eSATA? Yes. Two.

Bonus RS232 with a 3D printed bracket on the side~

(From an old home server I just shut down after many years ^^)

[blasty @bl4sty]

tinfoil hat plot twist: TeamPCP is secretly ran by Socket employees

[Feross @feross]

TeamPCP just did an interview where they were asked what defenders should do to stop supply chain attacks.

Their advice: pin versions to a specific hash, use least-privilege tokens, restrict IDE extensions. And then, verbatim: "The company Socket will detect the malware before the package even reaches your machine."

So... thanks, I think?

We're not putting this on the testimonials page.

But at the same time, if you're not yet using @SocketSecurity to protect your supply chain, what are you waiting for?

[blasty @bl4sty]

did they bump the PoW difficulty on the https://t.co/0CNid285sA http frontend? had to stare at anime girl loading screen for a good 30 seconds on a recent iphone just now ;-/

[blasty @bl4sty]

@defendtheworld picking on freebsd is reserved exclusively for lollersk8erz

[blasty @bl4sty]

cool. now that malware is instantly (re-)written/vibed in any language I think having access to high quality decompilers for as many languages as possible will become increasingly more important.

of course next to pivoting languages/runtimes "the bad guys" will also start vibing new LLVM passes, virtual machines, antidebug && whatnot now since the engineering effort/cost is practically zero. ;)

[Zion Leonahenahe Basque @mahal0z]

For years, Rust binaries made reversing a nightmare. Modern decompilers only support C, lacking meaningful types, constructs, and language-specific functions. Led by @34r7hm4n, we're releasing our S&P work Oxidizer, the first deep Rust decompiler, built on angr!

Interested? 🧵👇

[blasty @bl4sty]

@halvarflake (and I'm always surprised how much the outcome of a turn can change if you pad it with some seemingly pointless steering/nudging/encouragement, even if it seems really "stuck")

[blasty @bl4sty]

prompting skill issue! ;-) what I do is a silly shellscript around a cli agent (I'm using pi: https://t.co/s613DLHSLJ ; its neat, imho!). let the agent churn through a full turn on a prompt. part of prompt has an IMPORTANT clause that tells agent to leave a flag file on filesystem (as well as proof artifact) to signal goal completion. https://t.co/puwkvM6co0 picks up signal and does additional e2e verification of goal claim. (this is just one out of infinite ways to skin this cat, of course)