learner

if ya know ya know

[tuckner @tuckner]

There is a postMessage API that websites and extensions can use to communicate over. Many are misconfigured and can allow for 1. Extensions to snoop on sensitive website content 2. Websites to gain access to privileged extension capabilities. Great research!

[learner @learner1001a]

@minchoi All you have shown are the presentation layer which is less valuable than the core.

[Adnan Khan @adnanthekhan]

It's finally happening. We can put this whole install script NPM worm madness behind us...

https://t.co/BnSYkpdMQA

[learner @learner1001a]

@vxunderground The acquisition of the scale AI is the worst among all

[learner @learner1001a]

@ZackKorman Didn’t they say AI will replace engineers in 6 months and now they gotta pause because of that?

[learner @learner1001a]

@IceSolst Lmao

[learner @learner1001a]

@IceSolst @MartinShkreli lol

[learner @learner1001a]

@dinodaizovi @IceSolst @AnthropicAI Would be useful if the agent is developed with less privilege and sandboxing.

[learner @learner1001a]

@0xcdn I have seen a few people that were rewarded 50-60K dollars from dependency confusion. Microsoft MSRC is running out of money

[learner @learner1001a]

@vxunderground GH doesn't give a fuck. It hasn't even shared the details or postmoterm from the last VS code security incident.

[learner @learner1001a]

@msftsecresponse @HackingLZ Seriously you needed AI to write this article to respond to the community? What a shame!

[learner @learner1001a]

@ZackKorman This fucking article is written by AI 100%

[learner @learner1001a]

@vxunderground @thegrugq No surprise when working with MSRC

[vx-underground @vxunderground]

Chat, I don't want to be that guy, but I think Microsoft has really pissed off security researchers and we're approaching the tipping point.

This Eclipse guy has really rocked the boat for Microsoft.

[learner @learner1001a]

@d5fa4lt @C2IRIS @ChaoticEclipse0 Spend time grinding.

[Florian Roth ⚡️ @cyb3rops]

Oh, great
https://t.co/Z3eldzjcg6

[learner @learner1001a]

Has @github shared the postmortem of its recent security incident? What a joking company

[learner @learner1001a]

@perplexity_ai You guys should focus on your strength

[learner @learner1001a]

@IceSolst At this point building an app like GitHub is super easy. Enough patterns to build.

[learner @learner1001a]

@github It's been nearly 2 days, and you guys still haven't shared further details, even the name of the extension. What a fucking joke!