Abhi

builder & entropy weaver. cto&cso @polychain. long (🇺🇸, crypto). raised by monks

[Abhi @bufoverflow]

Musk's razor at play.

But seriously, update every single software you have.

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours.

Each key should be a 116-digit number, but one was just 4.

Anyone can guess them and forge HTTPS certs for any website.

[Abhi @bufoverflow]

This is what I use in my PR reviews to explain TOCTOU vulns.

[Abhi @bufoverflow]

@martin_casado When the act of measuring refusals triggers a refusal, non Daybreak/Glasswing ordained whitehats prefer a model with zero refusals at 50% capability.

We fill the gap w prop threat data, heavy steering, and custom workflows anyways.

[Abhi @bufoverflow]

Relying on model refusals for cybersecurity is the “security by obscurity” of our times.

Abliterated models guts out refusals, while keeping the capabilities.

[Abhi @bufoverflow]

in summary: you're cooked if you patch fast (novel backdoors); you're cooked if you patch slow (ai-assisted 0days)

[Abhi @bufoverflow]

security tech debt is now with the collections agency.

[Abhi @bufoverflow]

2'nd order effect is that this creates real toil for my SoC team, which then lowers the barrier for tailgating for nation-state adversaries.

[Abhi @bufoverflow]

@martin_casado Scenes from my soc today.
https://t.co/KCRYRZVTUR

[Abhi @bufoverflow]

I believe we have had enough cybersecurity awareness for the month and let's go back to the scheduled programming please.

CSO's in my network are hyperventilating.

[Abhi @bufoverflow]

@CISAgov This could have been a scheduled post for next week, now I'm worrying about physical security too.

[Abhi @bufoverflow]

I will press X for doubt.

Intended, or not your post does whataboutism citing other failures.

See, a CA isn’t some random web app that hosts user data. It sits at the root of trust for all comms that happen on the interwebs. Generating bad scalars with low entropy is a domain specfic chernobyl-like disaster where operators never bothered to verify their actions.

This is a different order of problem, that won’t be excused by counterpoints even though those were also bad.

So @deedydas ‘s point stands. He is not dinging indian tech or alluding that indian tech is incompetent, instead he is dunking on incompetent technicians who happen to be Indian AND are oblivious to their responsibilities.

Big Difference.

[Abhi @bufoverflow]

@martin_casado 💯 Whoever is working on CF Warp, they have my sincere gratitude. That is the only defense that held against vendored trust apps that have failed to patch the emudhra ca snafu.

[Abhi @bufoverflow]

@adityaag

[Abhi @bufoverflow]

@deedydas We should stop humans from generating random scalars.

[Abhi @bufoverflow]

@martin_casado @stevesi Heard for the first time in 18y. “Let’s clear all security tech debt. We can defer features and perf work.”

[Abhi @bufoverflow]

Agents that pay on your behalf will feel magical when they can infer a decade worth of context and not email like an opposing counsel.

[Abhi @bufoverflow]

This year, Astra pooja was literal. ⚡️

Here’s to the spark that gives us agency to overcome ignorance. Prompting is the mantra to engage these tools of clarity and creation.