kat traxler

proficient at drawing the rest of the 🦉| security impact junkie

[kat traxler @NightmareJS]

@johullrich @JNitterauer I’m shocked. 😳
Lost a legend today

[kat traxler @NightmareJS]

To close the knowledge gap, I wrote a threat model of these identities, complete with exploitation examples, available mitigations, and comparisons to #aws and #gcp.

https://t.co/twsIuSajNJ

[kat traxler @NightmareJS]

Most know about Azure Managed Identities but I bet you haven't considered Azure's Platform-Level Managed Identities, #PLMIs

[Itamar Golan 🤓 @ItakGol]

Men in their 40s used to have cool midlife crises… now they just have agentic workflows.

Bought a Claude subscription instead of a Porsche lmao.

[Pope Leo XIV @Pontifex]

Artificial intelligences do not undergo experiences, do not possess a body, do not feel joy or pain, do not mature through relationships, and do not know from within what love, work, friendship or responsibility mean. Nor do they have a moral conscience, since they do not judge good and evil, grasp the ultimate meaning of situations, or bear responsibility for consequences. They may imitate or even simulate, but they do not understand what they produce, for they lack the affective, relational, and spiritual perspective through which human beings grow in wisdom. #MagnificaHumanitas

[Zack Korman @ZackKorman]

Some of you don’t want to hear this but if your bug reports are always getting rejected you probably need to improve your writing.

[rekdt @rekdt]

ACAB includes MSRC

[International Cyber Digest @IntCyberDigest]

‼️ After the MSRC blog post about Nightmare-Eclipse, researchers are coming forward with their own MSRC horror stories.

The response from the security community isn't going Microsoft's way. As they’re not backing Microsoft.

Gabriel Landau, a well-known Windows security researcher, says he reported a Device Guard bypass with a 90-day window. MSRC told him it met their bar and they'd fix it, then asked him to hold disclosure for extra months. He agreed on the condition they issue a CVE. They patched it silently, decided after the fact it "didn't meet the bar," and never issued the CVE. In his words: "MSRC strung me along for a few extra months to keep me quiet, then broke their word."

Another researcher, rootsecdev, says he responsibly disclosed a legacy-auth flaw that allowed password spraying while avoiding smart lockout. Five months later, MSRC replied that it "doesn't meet the bar for servicing," silently fixed it, and closed the case.

Microsoft's post was meant to defend their coordinated disclosure policy. Instead it became a thread of researchers explaining why they've stopped trusting their process.

[kat traxler @NightmareJS]

Should I tell my gym crush I’ve never spoken to that im moving so they’re not worried?

[kat traxler @NightmareJS]

@b1ack0wl @SecureThisNow MRSC auto reply

[kat traxler @NightmareJS]

@attrc I believe a lot of folks have coffee mugs and tshirts worth of goodwill

[solst/ICE of Astarte @IceSolst]

They were burning their 0days by disclosing to msft hahahahhahahahahahahahaahahahahahahah

[kat traxler @NightmareJS]

@vxunderground MSRC are scoundrels and they’re getting scoundrel treatment

[kat traxler @NightmareJS]

Nihilism as Optimism and other thoughts on the #vulnapocalypse

https://t.co/N2MzAccoQB

[Nick Frichette @Frichette_n]

Interested in attending @fwdcloudsec but bummed you didn’t get a ticket? There are a few for sale from people who couldn’t make it last minute. Check out the Cloud Security Forum Slack to get yours and attend the best cloud security conference on earth.

[kat traxler @NightmareJS]

@CheyCab Ewe

[kat traxler @NightmareJS]

Anthropics model assortment for every kind of catholic.

Opus 4.7, the frontier model for front pew Catholics
Sonnet 4.6, the model for the everyday, the Irish catholic.
Mythos, the model for the clergy and cloistered.

[Wholesome Side of 𝕏 @itsme_urstruly]

Never forget that YOU are a data center. Drink some water!!

[kat traxler @NightmareJS]

@gadievron Dashboard trolls are almost as bad as those bridge trolls.

[kat traxler @NightmareJS]

@halvarflake @ryanaraine I’ve been reading literature. Don’t ask me how I think this is helping