🅰🅳🅼

CSIRT lead

[🅰🅳🅼 @securityfreax]

In the last weeks I've seen many statements like this. I get the impression that TOR has lost the trust of its user base.

[_SiCk @encrypted_past]

I think I might shut down my Tor exit node. I don't think I support the project anymore.

[🅰🅳🅼 @securityfreax]

"Microsoft and openAI broke up" - this is going to be interesting now.

[Tom Warren @tomwarren]

Microsoft and OpenAI broke up — now they’re ready to fight. Microsoft AI CEO @mustafasuleyman tells me "the goal is to prove that we can become one of the top four labs in the world." Interview from me and deep analysis from @haydenfield 👇 https://t.co/q7i6u8h5NC

[Nightmare Eclipse @ChaoticEclipse0]

Everyone except me ? We are in fact still in court over this.

[Florian Roth ⚡️ @cyb3rops]

They did it : https://t.co/fzSG3boUSl

[🅰🅳🅼 @securityfreax]

@AlfinCodes Can't reproduce, tried many times.

[🅰🅳🅼 @securityfreax]

@GelosSnake @Alibaba_Qwen @claudeai I still suspect that most of the Chinese LLMs are just poor copies

[🅰🅳🅼 @securityfreax]

A company spent "$500,000,000 on Claude in one month" because they didn't set usage limits?

Seriously, why are so many people reposting this, do they really believe such bullshit or they do they simply want to look AI bad?

[🅰🅳🅼 @securityfreax]

This should become a "mandatory-standard" for all web browsers.

[Xavier Rivera @XavierRiveraX]

Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.

[🅰🅳🅼 @securityfreax]

@cyb3rops I thought the same, when I've noticed that the prior anouncement was about "Token Binding" via TLS sessions (RFC 8471) - which wasn't successfull.

The new DBSC with TPM support seems very promising to me.

[🅰🅳🅼 @securityfreax]

It looks like MSRC is in need of a complete overhaul.

[Svyatoslav Pidgorny 🇺🇦🇦🇺 @Slav636]

Been a while, but here’s mine:
* I found out that I can use email certificate as a CA certificate on Windows;
* MSRC wasn’t interested, thinking it’s Verisign problem;
* I posted the issue to SecurityFocus;
* Some guy stood up server with fake cert on the Internet;
* Microsoft issued a patch.

Also: it’s [email protected] because security@ was the campus guards.

[🅰🅳🅼 @securityfreax]

$500 million in one month for Cluade?
I have so many questions.

https://t.co/qEdGyN7sVE

[🅰🅳🅼 @securityfreax]

From a practical standpoint, MSPs are a waste of money; they serve only to check a box on the security compliance checklist and are otherwise worthless. It’s nothing more than cyber security cosplay that costs a fortune.

[BleepingComputer @BleepinComputer]

🚨 MSPs don’t lack security data. They struggle to separate real threats from alert noise.

🛡️ @KaseyaCorp explains how SIEM helps MSPs improve visibility, reduce fatigue, and respond faster.

➡️ https://t.co/DHFGh3HevW
#cybersecurity #sponsored

[1aN0rmus @TekDefense]

Feels like it is harder to REPORT a malicious package than it is to PUBLISH a malicious package

[🅰🅳🅼 @securityfreax]

Socket firewall (free version) provides a good baseline security for npm installs.

Set the alias and socket fw checks every npm package before installation

https://t.co/xC6XxX7xrX

[International Cyber Digest @IntCyberDigest]

THIS IS FAKE‼️

None of the “OnlyFans Mega Leak” accounts exist. It's AI-generated bullcrap.

Via @meakaaet

[🅰🅳🅼 @securityfreax]

How fast is Windows ETW?
@0gtweet, hold my beer.

[Grzegorz Tworek @0gtweet]

I’ve always claimed that ETW is very fast. I’ve been writing and teaching about it for years (for example, my talk “The Good, the Bad and the ETW” at x33fcon 2020 https://t.co/mRjLi3Jr2D), but I never actually measured its speed - until today. I needed an exact figure, so I wrote a small C app that logs 1 million events and measures the elapsed time. Here’s the code along with the complete test procedure. Enjoy! 🚀
https://t.co/Ow75wzaIHz

[🅰🅳🅼 @securityfreax]

Is it just me or is the pricing of https://t.co/Ss4a7O9tw0 insanely high?

50 bugs per dev per month? Really?

I like the product and their approach, but the pricing is crazy imho.