DML

MUFC | Cybersecurity | AppSec Engineer | The quicker you let go of old cheese, the sooner you find new cheese.~~~~~ Warrior and Survivor

[DML @damipedia]

Every morning,a Gazelle wakes up,it knows it must outrun d fastest lion or it will be killed.Also, a lion wakes up, It knows it must run faster than d slowest gazelle, or it will starve. It doesn't matter if you're the lion or a gazelle-when the sun rises, you'd better be running

[sid @immasiddx]

People are now tricking Meta’s AI support assistant to gain access to other people’s Instagram accounts.

This is exactly why AI should never have the authority to make account recovery decisions.

[André @oracles]

Today Instagram had this massive exploit where hackers were just stealing rare handles left and right. Hundreds of accounts gone.

People losing handles they’ve owned since 2010, some worth hundreds of thousands.

I own a few rare ones so I was actually stressed watching this happen in real time, which I haven’t been in years.

Obama White House account got hit.

These aren’t some random new accounts, these are verified, locked down accounts and they still got compromised.

The thing is the exploit is so simple it’s almost funny. Attacker goes to Forgot Password, says their account is hacked, turns on a VPN to match the target’s location (which now you can find on the about section of the page).

Instagram’s AI support flow asks them to verify with a selfie.

They grab a photo from the target’s profile, run it through an AI video generator to make an animation of the person’s face moving around, upload that to Meta’s AI as proof.

And Meta’s AI just accepts it because it can’t tell the difference between a real selfie and an AI-generated video of someone’s face
.
Once verified they change the email to theirs. Password reset link goes to their email. They own it now. 2FA gets bypassed somehow in the process but honestly I don’t know exactly how, just that it did.

Point is even locked down accounts went down.

Then you try to recover your account and you’re talking to a chatbot that has zero ability to help.

You can’t escalate to a human. You’re just stuck. Your asset is gone and there’s no one to call.

The whole thing just highlighted how stupid it is to automate account security without any human in the loop.

One AI fooling another AI while there’s literally no person anywhere to catch it.

Meta took hours to even acknowledge it while accounts were getting stolen every minute.

Now thankfully it’s patched but I don’t think it will be the last one. Stay safe!

[IamJP 🪖 @iamjuspat]

“Premier league is not UEFA”

Asake has never lied to me before 😂😂😂

[Raul Junco @RaulJuncoV]

Push-based systems come up in 90% of system design interviews.

Here's the exercise you should be able to solve:

Design a notification system for 100M users. Some have 50 followers. Some have 10M.

The instinct is to hold a WebSocket connection open to every active user and push updates as they arrive. Clean mental model. It collapses the moment a celebrity posts.

When someone with 10M followers posts, you push to 10M open connections simultaneously. Your message broker saturates. Your WebSocket servers fall over. The system fails at the exact moment it needs to work.

That's the fan-out problem. And it kills more interview answers than any other mistake.

The production answer: push and pull aren't binary. You pick based on follower count. Users with fewer than 1,000 followers get push fan-out. Each follower gets notified immediately.

Users with millions of followers get pull fan-out. Their feed assembles on read. Nobody gets a push. Followers see the post when they open the app.

Twitter built exactly this: push-on-write for small accounts, pull-on-read for large ones.

But fan-out is only half the problem.

Push means stateful connections. Your servers now need to know which connection lives on which machine. You can't route blindly. Most teams reach for Redis pub/sub here; the WebSocket server subscribes, the backend publishes, the message finds the right node.

Add a 3-second network drop and you have another layer: what did the client miss? Now you need sequence IDs, a message buffer, and reconnect logic that replays missed events.

"Push-based" became push with a pull fallback, a message broker, sticky routing, and a replay buffer.

Most engineers stop at the first diagram.
The ones who get the offer keep pulling the thread until the system breaks.

[Tabassum Parveen @Tabbu_ai]

Instead of watching Netflix tonight, watch this 2-hour Stanford lecture.

It will teach you more about how LLMs like ChatGPT and Claude are actually built than most people learn in years working in AI.

Stanford released it for free.

Save this.

[Movez @0xMovez]

Spotify's Chief Architect just showed how they ship 4,5K deployments /day with Claude at Anthropic stage

27-minutes. free. By #1 music app dev

"More than 99% of our engineers use AI coding tools. Adoption took off after Opus 4.5"

Worth more than any $500 vibe-coding course.

[Nick Frichette @Frichette_n]

@mattjay https://t.co/kzPMC47Qjw
Install this on your machine, all future install requests to NPM/PyPi will get routed through it. Malicious packages get blocked.

[Robert Graham @robertgraham]

"Canvas" is a "learning managment system" used by around 8000 universities around the world but mostly in the United States.

A million students and teachers likely saw this ransomware message when they tried to login today. This makes it a newsworthy event.

This happened right at the end of term when teachers are trying to grade exams and record grades. It's going to cause pain for a million students who can't get their terms finished on time.

[Matt Johansen @mattjay]

I'm getting more DMs about this than any other hack probably since Change Healthcare.

This is massive and the impact is widespread.

[Rahul @sairahul1]

Two Anthropic engineers spent 24 minutes exposing every Claude Code feature you didn't know existed.

Most people will scroll past this. Don't be most people.

[shirish @shiri_shh]

VERCEL just got breached.

They’re selling internal DB + employee accounts + GitHub/NPM tokens for $2M on BreachForums.

looks like someone got early access to Claude Mythos 💀

[Ryan Carson @ryancarson]

If you’re on Vercel - action this immediately

[Rony @Ronycoder]

Instead of watching an hour of Netflix, watch this 2-hour Stanford lecture on AI careers. It will teach you more about winning in the AI race than all the AI content you’ve scrolled past this year.

[Ayaan 🐧 @twtayaan]

DevOps engineers after AWS DevOps Agent announcement

[Reva Jariwala @reva_jariwala]

how is this a class?

absolutely insane line-up

[Rohan @rohan_2502]

https://t.co/6r5nGXX9bm

[prnv patil @21prnv]

Instead of downloading and unzipping the whole codebase, here’s a detailed, structured view of every file and folder so you can explore it like a product, not a zip dump:

https://t.co/3qpml5mGfa

[V @vineetwts]

I created documentation over Claude Code's Codebase, which explains

- Its pipeline
- How it works
- How it handles Context
- How it handles Memory
& More

Read it here - https://t.co/GngrSvWAmh

[Griffin @aussinfosec]

I have been doing bug bounty since 2011 and ran a program for a multinational bank. Put everything I've learned into https://t.co/78z1JfSzmr. Target selection, recon pipelines, chain patterns, report templates, the business side. Free, no paywall, no course upsell.

[Ojas Sharma @OjasSharma276]

Most people say Doubly Linked List, and honestly it sounds logical because you think the browser needs to store the previous and next pages. Even I used to think the same.

But what I learned is that browsers actually use two stacks: a Backward Stack and a Forward Stack.

We prefer stacks over a DLL because browser navigation is not a simple linear list. It behaves exactly like an undo/redo system, where:

>Back = undo (pop from Back stack, push to Forward stack)
>Forward = redo (pop from Forward stack, push to Back stack)
>Opening a new page after Back = clear the Forward stack

A doubly linked list doesn’t naturally support this behavior. It still requires deleting the forward path manually, and gives no real advantage.

Stacks match the exact semantics of navigation: Last In First Out, simple push/pop operations, predictable behavior, and no unnecessary pointer manipulation.

So yes, even though a DLL feels intuitive, two stacks are actually the cleaner, more accurate way to model browser history.