ippsec

[ippsec @ippsec]

Looking for a video on a specific hacking technique/tool? Check out https://t.co/yqxaZuwoyu - Searches over 100 hours of my videos to find you the exact spot in the video you are looking for.

[ippsec @ippsec]

@djchateau @Venmo Well over a decade ago, illusion of choice. People use Venmo because they hate PayPal (and vice versa) 😂

[ippsec @ippsec]

Heads up - @Venmo has pretty much 0 buyer protection, as all the seller needs to do is send a tracking number. It doesn't matter what address they use for shipping.

I've lost 3 disputes, despite the address they sent it to being never associated with my venmo before.

Funnily enough, tried to open a HackerOne report against for the business logic flaw. Got closed as a duplicate from a unfixed report back in 2024.

The surprising thing is @PayPal , whom owns venmo does have these types of protections in place.

[ippsec @ippsec]

@GsInfosystems @Venmo I'm guessing so - It was something through @eBay. They were no help either in the dispute. Normally wouldn't use it but friends typically pay me back in venmo and i had quite a bit of venmo cash on my account. Figured I'd just use it instead of transferring out. big mistake.

[ippsec @ippsec]

Any chance I know anyone at OpenAI that can help out? Seems odd to ban CTF Creators from the platform. Not sure how people would be able to ensure AI doesn't one-shot challenges without being able to test it in the first place.

[TheCyberGeek @TheCyberGeek19]

@OpenAI I want to share a frustrating experience as a security professional.

I purchased YubiKeys to meet your account security requirements, then had my account banned for conducting authorised testing in my own self-hosted lab. My appeal has gone unanswered, and there's been no refund for either the new subscription or the hardware keys.

Credit where it's due: Daybreak is remarkably capable. But the ban process feels opaque, and even after completing ID verification, legitimate customers are left without recourse. I'd welcome a proper review of my case.

[ippsec @ippsec]

Personally, I don't see how this is even a mild take. I used to say you can't "hack time", but I think AI models prove that is possible. In most companies there are too many alerts for humans to triage, let alone the ones that don't even raise an alert.

A fine tuned model does an excellent job at filtering a large amount of the noise. Will it miss something? Probably but I've also lost count at the number of humans I see mark a legitimate AV Alert as a false positive.

I don't think SOC/Threat Detection will go away, but it will lower the "grunt work" and potentially make it a more enjoyable job.

[ippsec @ippsec]

@LiveOverflow I was really hoping you had snuck a UUIDv1 in that screenshot.

[ippsec @ippsec]

Just wanted to say congratulations and thank you - I know persona gets some hate, I grimaced when I had to use them to validate for some AI Models. That said, identity verification is incredibly important and had I known you were there a couple days ago, wouldn't have grimaced as hard. Glad to see people I trust/respect/etc are working there, certainly gives hope.

[ippsec @ippsec]

It's all how you just measure time. In reality it has made me both slower and faster, I certainly have noticed my critical thinking skills have detrified. But on the other hand, I've actually knocked out a lot of my "wishlist" grunt-work that I've put off for years.

For example, I have github actions now that sync my YouTube to https://t.co/vZXsNAXVUG and will even query HTB's public api to get some details about the machine and add it to the correct playlist. Heck, I even fixed up some hacky javascript db for the queries because when I created it; I was lazy and took a shortcut, thinking I'd come back to it later.

Am I being serious with 20-30x? Not really, I love my memes... But also yes, if you change how you are measuring time. Probably would have taken me a solid 6-8 hours to do the updates I mentioned above. Claude and I got it done in 30-60 minutes.

Hell, today I decided to try out FilmCraft as I'd love to stop paying Adobe $75/m. Immediately found out there's a nasty bug when using it with videos recorded from Obs (go figure its vibe coded). But I was able to figure it out without really knowing Rust, and get it fixed while I was working on something else.

Do I wish I could go back a year to a timeline where AI was a joke? Yes but that's only because I think it is horrendous for the educational system and I don't see how future generations will get those critical thinking skills I am losing.

However, pandoras box was opened and I don't know how you can ever think it will be closed. Not learning it will only do more harm than good. So I try to figure out ways to keep an open positive mind.

Mindset is important, I really hope you have to go out of your way to find me saying something negative (atleast publicly). Always try to find a way to give the benefit of the doubt or leave on a happy note.

[ippsec @ippsec]

@Jhaddix Any reason you want a machine? I really enjoy the Chemex, Stagg, and Bratza combo. I just feel like it is so much easier to give the occasional deep clean to. Just shake some coarse salt and water in the chemex and it looks good as new.

[ippsec @ippsec]

@LiveOverflow The American way.

[ippsec @ippsec]

I am looking forward to the video, but am confused. Seems more like a misdefinition of security boundary that has upset the community for years. For example, with Windows UAC and Admin -> Kernel bugs were getting ignored because M$ didn't consider them a security boundary, so the bug was irrelevant.

I can only assume this goes back to the "what is a sandbox" debate. I don't see why containers can't be used to perform this functionality. Are there ways to break out? Sure but there will be ways to break out of every network.

The issue comes down to the same thing it always has been. Security slows people down and there is a fine balance between cutting corners and getting pwned. People are just learning the consequences of moving fast and I don't think the tech stack itself is at fault.

Just either a desire to move fast or laziness.

[ippsec @ippsec]

I really hate how sensitive people became where-as asking questions to find out where they are coming from gets taken as an interrogation. Not to mention getting called names used to be a badge of honor, now it just spawns witch hunts.

Really still feels like repercussions from when the world was chronically online for a year or two and keyboard warriors became much more mainstream.

[ippsec @ippsec]

@TJ_Null @NetworkChuck https://t.co/9L8oUdk3np is pretty amazing. Moshi hook gives a nice web interface too for the PC. Downside is the price but I did the $200 lifetime pretty quickly once I hit the free limited.

[ippsec @ippsec]

@Kostastsale

[0xdf @0xdf_]

Really nice lab. Learned some new techniques. Big thanks to @mpgn_x64 and @mael91620 for running this.

@ippsec and I got started a few hours late (it started at 5am), but we managed to finish. ctrlzero came through big when he was able to join for the last few flags!

[ippsec @ippsec]

Gemini in general is my goto for very small and specific work. I have a small project for managing sports teams, submitting pictures of their scorebook (ex softball/baseball), Gemini flash blows everything else out of the water for digitizing.

Similar experiences to security. It was laughably bad at trying to do something completely agentic. But if you’re just augmenting something to go the last mile, it worked pretty damn well. Especially if cost is a factor.

[ippsec @ippsec]

@LiveOverflow I'd say that is a testament to how well guard rails currently work, as they can be turned off for training/benchmarking (source: AISI report with mythos). Scary thing is the guard rails won't last forever, as every frontier release also improves the models that don't have guards

[ippsec @ippsec]

@0sm0s1z It really depends on the job. Feel like the obvious is sol isn’t great at planning but there’s plenty of others like Gemini flash is underrated when it comes to describing images.

[ippsec @ippsec]

It’s come to my reason there could be other reasons for this hate and DHH is just catching strays. Original point was I dislike public call outs for just associating with someone, without full context. Thought about deleting the tweet but could easily see that backfire. So the only point I really stand behind is you cant assume everyone knows everyone’s drama and can unintentionally make a stupid move trying to do the right thing.

[ippsec @ippsec]

Hopefully I don't lose points here, but from someone that doesn't really follow drama and only knows DHH from Primagen and random RAILS stuff - I was surprised by the seriousness of the hate, can totally see Chuck being clueless here too.

Also as much as I hate to say it the bar for being a decent human has dropped so much over the last couple years, I was really expecting this to be much worse.

Don't get me wrong, not agreeing with anything in those posts but I don't think anything is beyond the point of discussion. I'd be curious if there's any videos of him being a racist asshole or something. Not that it's an excuse but some people just shouldn't be allowed to talk over text (often times I am one of them).