Chris Lawing

Cybersecurity, network and information security. BSc Telecommunications Engineering. Security and payments tooling in PHP and Node. Coding is the passion.

[Chris Lawing @catidegla]

@GrafWeltgong @Playyy__boii @grok Is that true @grok the Pic of the after?

[Chris Lawing @catidegla]

@anywaydani and the fix is a resolver that only answers an allowlist. the agent still reaches npm, it just cant spell your .env into a subdomain

[Chris Lawing @catidegla]

@anywaydani silence is the metric, the catch is happy users are silent too. only the funnel tells you which kind youve got

[Chris Lawing @catidegla]

@anywaydani fine right up until the cron job has write access and the prompt reads an email 🙂

[Chris Lawing @catidegla]

@anywaydani test runner for me. types tell you it compiles, tests tell you it still does what you meant

[Chris Lawing @catidegla]

@Chris_L_Elliott agreed, and the thing that decides it in practice is whether fail open is loud. a quiet one just becomes permanent, nobody ever goes back to it

[Chris Lawing @catidegla]

@Chris_L_Elliott fail open vs fail closed is the whole argument, and everyone picks open the first time it takes prod down 🙂

[Chris Lawing @catidegla]

@reallevelbrook ah nice, so the answer to my whinge is just disable_ddl_transaction!, which you already need for concurrent indexes anyway. convenient

[Chris Lawing @catidegla]

The migration ran in eleven milliseconds on your laptop. The table had four rows.

Adding a column with a default rewrote the whole table on Postgres 10 and has been instant since 11. A linter that does not ask which version you run is guessing.

https://t.co/eIJX9nCAIa

[Chris Lawing @catidegla]

@arcjet fair, i read it as after only. then the before one on a tool result is the interesting half, thats where youre filtering data the model needs.

strip a row before it lands and the model reasons from a hole it cant see. it doesnt know a field went missing, so it fills it in

[Chris Lawing @catidegla]

@TheHackersNews the shape is worth naming: it reopens from a stored path, so it resolves the same string twice and trusts the second answer. the guest only has to swap a parent directory in between.

fix pattern is holding an fd and using openat relative to it rather than re resolving a path

[Chris Lawing @catidegla]

@arcjet the after policy is the one id want detail on. if redaction runs after the call the model already saw the value, and its in context for every turn after. you strip it from what the user sees, not from upstream.

output hygiene, not the same as it never reaching the model

[Chris Lawing @catidegla]

@aisecbrief one of the few classes thats cheap to catch deterministically. if a description renders differently than it parses, thats a finding. no model needed, no false positive argument.

unicode tag blocks, bidi overrides, ansi escapes. none belong in a package description. byte check

[Chris Lawing @catidegla]

@buildstack_ai the read side is the bit people skip. a camera is an input channel the agent parses, so anything you get in frame is untrusted input. a printed sign in view of the lens is prompt injection with no network hop to filter on.

and a lock is state in the world

[Chris Lawing @catidegla]

@Chris_L_Elliott at that point its not a scanner, its a proxy. inspecting resolved requests means sitting in the path of every call, which makes your security tool an availability dependency.

static config catches deployment mistakes cheap. runtime catches the rest and costs you a hop

[Chris Lawing @catidegla]

@mcpplayground the one always missing from these is the false positive cost. poisoning detection that keys on phrasing flags every tool documenting a dependency. "call initialize before using this tool" is ordinary lifecycle docs.

a checklist that fires on everything gets skipped by week two

[Chris Lawing @catidegla]

@PadhiyarRushi the 0.0.0.0 vs 127.0.0.1 line is doing all the work in that one. same bug on loopback is a local priv esc, on every interface its a 9.8.

funny timing, i fixed that exact blind spot in my own config scanner this morning. it had 0.0.0.0 filed under loopback

[Chris Lawing @catidegla]

@Chris_L_Elliott went and checked my own config rules after that. it had 0.0.0.0 in the same bucket as 127.0.0.1, so a server bound to every interface with no auth header was the one case it stayed quiet about. fixed. 127/8 is loopback, 0.0.0.0 is exposure

[Chris Lawing @catidegla]

@Chris_L_Elliott the 27826 half is the uncomfortable one. nvd says it plainly: middleware and DI layer, not a tool handler, so tool level analysis cant see it. mine included, it only reads manifests and config. you get 27825 scored as a path write and the half that makes it rce stays invisible