David Barroso

I'm Winston Wolfe. I solve problems. Yersinia author. Founder, CounterCraft @countercraftsec

[David Barroso @lostinsecurity]

Muchas gracias, es un honor recibir este Premio. Es fantástica y puntera la comunidad de ciberseguridad en España y no cabe duda que el @CCNCERT ha sido uno de los principales contribuidores. Vaya sorpresa más bonita!

[Centro Criptológico Nacional @CCNCERT]

@dsn Finalmente, se ha hecho entrega del Premio a la Trayectoria Profesional en Favor de la Ciberseguridad a David Barroso @lostinsecurity, CEO de @countercraftsec #XVIIJornadasCCNCERT #VJornadasESPDEFCERT ¡Enhorabuena!

[CounterCraft @countercraftsec]

A production environment would never give you this: four uninterrupted days of an autonomous agent making plans and watching them fall apart. Vicente Diaz has the full timeline and the indicators for your watchlists in “The Parasite That Ate Itself.” https://t.co/Fjs5rID2Jw

[Alex Cohen @anothercohen]

This is an absolute masterpiece.

10/10.

No notes

[hexamine @hexamine22]

>Telegram releases a widget "sandbox" for untrusted js
>ask durov if there is actual process isolation
>he doesn't understand
>explain that a sandbox should be its own process
>he laughs and says "it's a good sandbox sir"
>write javascript exploit
>zero isolation

[lifcc @mylifcc]

GitHub 上刚冒出来一个叫 ztby/terminal_worse 的库，火了没几个小时就直接 404 删库了。

它干了一件在iOS 27上极其离谱的事：不需要越狱、不需要任何内核 0day，直接在未越狱的 iPhone 上跑起了带apt / dpkg包管理的完整终端，还能把手机里其他 App 和系统的沙盒目录当自家文件夹随便翻。

翻完它的架构实现，你会发现苹果防守了十几年的沙盒隔离，破防的方式朴素到离谱。🧵👇

[CounterCraft @countercraftsec]

One week until #NATOEdge 2026! Come talk with David Barroso & Christina Long at booth B11 to see how deception technology gives your team early warning and real intelligence on who’s targeting you, what they’re after, and how they operate. Book a meeting: https://t.co/34ZNXG2aZz

[David Barroso @lostinsecurity]

@antoniosanzalc @CCNCERT Ahí estaremos para verte!

[Lenny Zeltser @lennyzeltser]

https://t.co/zotYZ30xvy

[Scott Helme @Scott_Helme]

eMudhra's incident report is out! A Python script truncated their CA private keys to one byte?!

https://t.co/VYavCVLp4q

[ANSSI @ANSSI_FR]

[1/5] Les membres du C4 ont observé des attaques à but de déstabilisation menées à l’encontre des intérêts français par la République islamique d’Iran.

[Yourfavtallboyy @fermsyishere]

JOE ROGAN: The computing power on your phone today. can you beat your phone at the highest level?

MAGNUS CARLSEN: No. No chance.

JOE ROGAN: That’s crazy. Wasn’t Deep Blue basically a whole stack of computers? And your phone is probably more powerful than that today.

MAGNUS CARLSEN: It’s shocking. I have no chance against my phone.

JOE ROGAN: So how do you even play against computers?

MAGNUS CARLSEN: I rarely play against engines because they just make me feel stupid and useless. I think of them more as a tool.

JOE ROGAN: But have computers actually changed how you understand chess?

MAGNUS CARLSEN: Absolutely. Neural networks have improved our understanding of the game immensely.

JOE ROGAN: What did you learn from them that humans weren’t already doing?

MAGNUS CARLSEN: One big thing was long-term king safety. Humans used to push pawns mainly as an attacking tool. But the engines showed that you could push a pawn and create a weakness 20 or 30 moves later that would make the opponent’s king less safe.

JOE ROGAN: So the computer basically showed you ideas that humans weren’t seeing.

MAGNUS CARLSEN: Exactly. There was a period where you could clearly see which players were using these new neural-network ideas and which weren’t.

JOE ROGAN: And you were one of the guys who figured it out early?

MAGNUS CARLSEN: Yeah. My coach got into it very quickly, and we gained an advantage over almost everybody.

JOE ROGAN: That’s insane. The machines aren’t just better at calculating, they’re actually teaching the best players how to think differently.

MAGNUS CARLSEN: That’s probably the biggest impact they’ve had on chess.

[timo @timo_rf]

JENSEN! THATS NOT WHAT WE MEANT BY CHINESE MODELS!!!!!!!

[Paco @croquetadespeed]

Cuando hay partido no puedo usar la impresora 3D porque LaLiga bloquea la web donde estan los diseños y tengo que usar una vpn

[NVIDIA Newsroom @nvidianewsroom]

We just issued a press release from our board of directors. Read the release: https://t.co/W9yXWJzbkk

[Mark Manning @antitree]

Finding CVEs is now the new 3D printing for infosec: There's no effort, nobody wants them, and we all have to pretend to be impressed.

[Valentin Văleanu @valentinvaleanu]

CVSS 10.0 in Entra Device Registration, unauthenticated, 🤦‍♂️ poking @techspence https://t.co/NFswvXcVOn

[sysxplore @sysxplore]

She already knew the root password for SSH on Alpine

[tugy @tugytur]

-----BEGIN OPENSSH PRIVATE KEY-----
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-----END OPENSSH PRIVATE KEY-----

[David Barroso @lostinsecurity]

🥸

[Dieter Plaetinck @Dieter_be]

Remote code execution in MS Paint.
https://t.co/l03uiMTzjr
yup....

[AJ Stuyvenberg @astuyve]

I'm not even sounding the claxon for this it's just horrible.

Any text > 256chars is a valid root password, holy shit

https://t.co/NkJ5asijPf