@zvava@twtxt.net I never used any of the social media platforms, that’s why I’m probably ignorant.
I don’t understand the concept of a retwt. Just quote the (relevant) parts from whereever and comment on that. Or post a link instead of a quote. Sounds simple enough. :-) That’s also has the benefit that it works with every source, no matter what. Since it’s called retwt, I’d imagine this to only work (well) with whatever messages the system itself offers. But I could be wrong. What would be the benefit of having a dedicated message type or structure for “hey, look at that” messages in your opinion?
Hmm, what’s a content warning?
@bender@twtxt.net Cool, the PDF doesn’t have the navigation links between each section, that’s indeed a tad nicer. Thanks!
@kat@yarn.girlonthemoon.xyz Oh dear, nobody needs bot attacks. :-( Luckily, the web server responding a hell lot quicker today than the last two days.
Now that’s interesting. Some of these bots start crawling at URLs like this:
That is obviously completely wrong. But I can explain it. Some years ago, I screwed up my nginx rewrite rules, and that’s how these broken URLs came to be.
It all redirects to /git now, which is why that endpoint sees so much traffic lately.
But what does that mean? Why do they start there? I can only speculate that this company bought an old database of web links and they use that to start crawling. And it was probably a cheap one, because these redirects have been fixed for quite a long time now.
@movq@www.uninformativ.de Got a link to this
ESC/P standard.
There is a missing feature I’ve been intending to add to though, which is that any link that looks like a URL that might be an image, for example, ends with .png or .jpg or whatever, we should just render that as an image and not expect users to wrap it in Markdown image links 
@movq@www.uninformativ.de @kat@yarn.girlonthemoon.xyz I also wondered for a very long time why nobody improved the man experience in the terminal. I’d love to see links and more colors.
37C3 and New Year’s Eve 2023
Another one from the vaults. The 37C3 conference took place in
December, 2023. This report was mostly written in January, 2024.
Mostly finished it at night in my cottage between 28 and 29th
December, then edited and added some stuff in July, 2025. So… Only
1.5 years late?
It was a little ironic, and a little sad, that I was finishing the
37C3 report during 38C3. I didn’t manage to get any tickets for me and
#3 for 38C3 and had to make do with watching the stream.
The links to the talks go to [C … ⌘ Read more
setpriv on Linux supports Landlock.
@prologic@twtxt.net Yeah, it’s not a strong sandbox in jenny’s case, it could still read my SSH private key (in case of an exploit of some sort). But I still like it.
I think my main takeaway is this: Knowing that technologies like Landlock/pledge/unveil exist and knowing that they are very easy to use, will probably nudge me into writing software differently in the future.
jenny was never meant to be sandboxed, so it can’t make great use of it. Future software might be different.
(And this is finally a strong argument for static linking.)
setpriv on Linux supports Landlock.
Another example:
$ setpriv \
--landlock-access fs \
--landlock-rule path-beneath:execute,read-file:/bin/ls-static \
--landlock-rule path-beneath:read-dir:/tmp \
/bin/ls-static /tmp/tmp/xorg.atom
The first argument --landlock-access fs says that nothing is allowed.
--landlock-rule path-beneath:execute,read-file:/bin/ls-static says that reading and executing that file is allowed. It’s a statically linked ls program (not GNU ls).
--landlock-rule path-beneath:read-dir:/tmp says that reading the /tmp directory and everything below it is allowed.
The output of the ls-static program is this line:
─rw─r──r────x 3000 200 07-12 09:19 22'491 │ /tmp/tmp/xorg.atom
It was able to read the directory, see the file, do stat() on it and everything, the little x indicates that getting xattrs also worked.
3000 and 200 are user name and group name – they are shown as numeric, because the program does not have access to /etc/passwd and /etc/group.
Adding --landlock-rule path-beneath:read-file:/etc/passwd, for example, allows resolving users and yields this:
─rw─r──r────x cathy 200 07-12 09:19 22'491 │ /tmp/tmp/xorg.atom
@movq@www.uninformativ.de Yeah, it’s a shitshow. MS overconfirms all my prejudices constantly.
Ignoring e-mail after lunch works great, though. :-)
Our timetracking is offline for over a week because of reasons. The responsible bunglers are falling by the skin of their teeth: https://lyse.isobeef.org/tmp/timetracking.png
- The error message neither includes the timeframe nor a link to an announcement article.
- The HTML page needs to download JS in order to display the fucking error message.
- Proper HTTP status codes are clearly only for big losers.
- Despite being down, heaps of resources are still fetched.
I find it really fascinating how one can screw up on so many levels. This is developed inhouse, I’m just so glad that we’re not a software engineering company. Oh wait. How embarrassing.
we should bring back XFN that is the cutest shit in the world i want to link to my friends and have the internet know they are my friends through the markup!!!!!!!!!!!
@prologic@twtxt.net no, good man. Follow the link, follow eet! :-)
@kat@yarn.girlonthemoon.xyz i linked the normal length edit instead of the full 15 minute music video because i’m not gonna subject you all to that amount of my bullshit
(…15 minute version is a great watch though)
@bender@twtxt.net Yeah, well, it’s a bit like twtxt. There is a Gopher community, but it’s small. I actually don’t like that HTTP is so easily accessible. I don’t like it that much when people post links to my site on HackerNews or something like that. Too much exposure.
Gopher is a small world. It’s slow and cozy.
And much like twtxt, the protocol is simple®, so it’s easier to tinker with it.
Passing of Jean-Raymond Abrial
Jean-Raymond Abrial, father (in particular!) of the Z notation, but also of the B method, and then Event-B, passed away on May 26. I was surprised to see that this piece of news, which may be of some interest to formal method folks, doesn’t seem to be very well known (there’s not much material on the web).
Here are some links (on LinkedIn, sorry):
[by Bertrand Meyer](https://www.linkedin.com/posts/bertrandmeyer_i-am-saddened-to-report-from-todays-print-activity-7335684948974034944-SJf1? … ⌘ Read more
GraphQL Gatecrash: When an Introspection Query Opened the Whole Backend ️
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/graphql-gatecrash-when-an-intro … ⌘ Read more
Radeon Software For Linux Dropping AMD’s Proprietary OpenGL/Vulkan Drivers
Direct link to upstream release notes.
Bill Atkinson has died
https://facebook.com/story.php?story_fbid=10238073579963378&…
Comments URL: https://news.ycombinator.com/item?id=44210606
Points: 515
# Comments: 117 ⌘ Read more
How a Welcome Email Can Be Used for Malicious Redirection
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-a-welcome-email-can-be-used-for-malicious-redirection-fd833ec71550? … ⌘ Read more
**☠️ CORS of Destruction: How Misconfigured Origins Let Me Read Everything **
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8F-cors-of-destruction-how-m … ⌘ Read more
@lyse@lyse.isobeef.org I cannot / could not imagine that, either – but if it’s publicly available on the internet and something links to it, they’ll eventually find, scrape it, use it. ☹️
Trump official who shut down Russia propaganda unit has links to Kremlin ⌘ Read more
Exploiting the Gaps in Password Reset Verification
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/exploiting-the-gaps-in-password-reset-verification-9bb86ec95d29?source=rss—-7b722bfd1b8d– … ⌘ Read more
Bug Bounty from Scratch | Everything You Need to Know About Bug Bounty
📌Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bug-bounty-from-scratch-everything-you-need-to-know … ⌘ Read more
Nigeria arrests 4 Pakistani nationals over terror links ⌘ Read more
A Hidden Backdoor: Bypassing reCAPTCHA on the Sign-up Page
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/a-hidden-backdoor-bypassing-recaptcha-on-the-sign-up-page-2b5b3c18257f … ⌘ Read more
** Cache Me If You Can: How I Poisoned the CDN and Hijacked User Sessions**
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/cache-me-if-you-can-how-i-poisoned-the-cdn-and-hijacked … ⌘ Read more
Leaking in Plain Sight: How Short Links Expose Sensitive Data ⌘ Read more
hey @prologic@twtxt.net heads up - my pod is suddenly having weird 400 bad request errors on things like posting twts, new user registration, following, and more. it’s not just me because a friend is also having these issues as a new user and can’t post. i saw one exception in the logs but i’m not sure if it’s related, i’ll link it in a reply to this
Dmytro Prudnikov, former product designer at Komoot, who was still featured last December in a post on LinkedIn, but got, as many others, fired, posted an emotional video on YouTube. Together, he and a lot of other former colleagues, they spent some time together for a last gathering. ⌘ Read more
I Tried 10 Recon Tools for 7 Days — Here’s What Actually Found Bugs
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/i-tried-10-recon-tools-for-7-days-heres-what-actually-found-bug … ⌘ Read more
$750 Bounty: for HTTP Reset Password Link in Mattermost
How an Unsecured Protocol in a Critical Workflow Opened the Door for Network-Based Account Takeovers
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/750-bounty-for … ⌘ Read more
@movq@www.uninformativ.de yes, I think:
<!--[if !IE]><!-->
<link rel="stylesheet" href="../simplicity.css”>
<!--<![endif]-->
Should work, but I haven’t tested it.
Find Secrets in Hidden Directories Using Fuzzing ️
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/find-secrets-in-hidden-directories-using-fuzzing-%EF%B8%8F-1666d6f34fd8?source=rss—-7b722bfd1b8d- … ⌘ Read more
I Gave Myself 60 Minutes to Find a Bug — This Is What Happened
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/i-gave-myself-60-minutes-to-find-a-bug-this-is-what-happened-e5fa76563a33?so … ⌘ Read more
How to install Windows NT 4 Server on Proxmox
Windows NT 4 doesn’t virtualise well. This guide shows how to do it with Proxmox with a minimal amount of pain. ↫ Chris Jones Nothing to add, other than I love the linked website’s design. ⌘ Read more
️My Top 7 Mistakes as a New Bug Hunter (And How to Avoid Them)
Free Article Link only for you
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8Fmy-top-7-mistakes-as-a-new-bug-hunter- … ⌘ Read more
Exploiting Unsanitized URL Handling & SQL Injection via Deep Links in iOS App: Write-up of Flipcoin ⌘ Read more
@prologic@twtxt.net it says in the linked page;)
** They Missed This One Tiny Parameter — I Made $500 Instantly**
✨Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/they-missed-this-one-tiny-parameter-i-made-500-instantly-f2f7d1c1c1d9?source=rss—-7 … ⌘ Read more
I Broke Rate Limits and Accessed 1000+ User Records — Responsibly
👉Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/i-broke-rate-limits-and-accessed-1000-user-records-responsibly-8c45f … ⌘ Read more