John Cobb

Cyber, Defence, Security and all sorts in between | These views are my own, not of my employer

[John Cobb @johnc2k]

Dump all the things #iot #HardwareHacking

[John Cobb @johnc2k]

@sudoingX Any issues with the Strix software stack? All I read about is the "lack of support" for AMD

[John Cobb @johnc2k]

@GBPolitcs Department for Science, Innovation and Technology - Minus the technology because its all banned

[John Cobb @johnc2k]

@sudoingX The price point is pretty close, I guess the big question is how much performance improvement do you get for the difference?

[Skipster @FarRightSkip]

You were watching PawPatrol on YouTube after curfew were you not?

[John Cobb @johnc2k]

@Banksycat Next your going to tell me the cameraman was not the point man 😅

[John Cobb @johnc2k]

@Keir_Starmer and yet you ignore known trouble spots like Roblox? https://t.co/Lf933XGTDz

[John Cobb @johnc2k]

@NVIDIAGeForce #RTXPowersPlay

[John Cobb @johnc2k]

@TheAhmadOsman No RTX 3090!?

[John Cobb @johnc2k]

No More Free Bugs

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs."

The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can.

Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept.

He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."

[John Cobb @johnc2k]

@danpalman @tesla_uk @Tesla I'm also waiting for my AWD model Y, it was supposed to be delivered on 24/06, Tesla gave me the "systems issue" excuse

[John Cobb @johnc2k]

@NVIDIAGeForce #RTXOn

[John Cobb @johnc2k]

@NVIDIAGeForceUK #RTXPowersPlay

[John Cobb @johnc2k]

@hamptonism Praise the Omnissiah

[John Cobb @johnc2k]

@NVIDIAGeForceUK @007GameIOI #007FirstLightRTX

[Clash Report @clashreport]

Reporter: Did you talk to Xi about the cyber attacks that he's done in the United States?

Trump: I did. And he talked about attacks that we did in China. What they do, we do too.

[John Cobb @johnc2k]

@elonmusk @Space_Station Business As Usual

[John Cobb @johnc2k]

@NVIDIAGeForce #007FirstLightRTX

[John Cobb @johnc2k]

@HermesAgentTips I'm going to look into either a M5 Mac Studio, DGX Spark or a Ryzen AI/Strix Halo based system next

[John Cobb @johnc2k]

@sudoingX Are you running "default" GPU power limit?