ryanc

@ryanc@infosec.exchange

I hack binaries.

Security researcher, cryptography geek, ex-sysadmin, expat (US๐Ÿก‚UK), queer, enby, etc.

My continuing mission:
To explore strange new platforms.
To seek out new bugs and new software.
To boldly shitpost where no one has shitposted before!

This profile is from a federated server and may be incomplete. Browse more on the original instance.

soatok, to random
@soatok@furry.engineer avatar

Young conservatives' obsession with placing liberal and leftist men in the "failed masculinity" box is actually useful in 1:1 conversations

It belies two things:

  1. A recognition that your sex is not your gender, because even if you're an adult male, they don't consider you "a man"

  2. A recognition that two genders isn't sufficient even if you're only focused on maleness. Press them. "If failed masculinity is a thing, what are adult 'beta males' if not men?"

If done well, you can sometimes make them interrogate their own worldview.

However, don't ever expect to accomplish this through public debate, which is more about attitude than substance.

ryanc,

@soatok Did you see my "I can't decide if where this lies on the serious-shitpost scale" thread positing that gender is too complex for homosexuality to exist outside of clonecest scenarios?

rose, to random
@rose@503junk.house avatar

deleted_by_author

    •
    ryanc,

    @rose April 1st is coming up if you want to commit to this bit hard enough to write an RFC.

    GossiTheDog, to random
    @GossiTheDog@cyberplace.social avatar

    If anybody remembers the UK company called DROP TABLES "COMPANIES";-- LTD, I just noticed that this has happened - before and after. https://find-and-update.company-information.service.gov.uk/company/10542519

    The back story is the UK government changed the law (lol) to stop it - specifically the Economic Crime and Corporate Transparency Bill 2022.

    ryanc,

    @GossiTheDog

    Very "To boldly shitpost where no one has shitposted before!" vibes.

    ryanc, to random

    Iโ€™m still alive, please stop asking.

    ryanc, to random

    UK banks like to make you pick a "memorable word" and then will ask you for two or three letters when you log in.

    Given even two letters, there usually won't be many possibilities...

    ryanc,

    @timelordiroh yes

    ryanc,

    @bh11235 now that you mention it, I think I once wrote a CTF challenge that was a lot like wordle, except it was intended to force the players to automate it.

    ryanc,

    @BenAveling If you observe one login, you can probably guess the word before it locks.

    ryanc,

    @BenAveling It's just wordle.

    ryanc,

    @BenAveling The positions are specified by the prompt, the customer chooses the word. The word not being chosen randomly matters a lot.

    Sure, an attacker can't get into every account, but if they phish 100 people, they'll probably be able to get into most of them.

    ryanc,

    @BenAveling My original post was implicitly about phishing.

    The banks claim the reason they only ask for two or three of the letters is to prevent replay attacks (capture via phishing or man-in-the-browser) from being used to login.

    This feature is touted as a sort of one time password MFA, but it absolutely is not.

    ryanc, to random

    On the fence about going to EMF Camp.

    Who do I know who is going to be there?

    ryanc,

    @Edent If I weren't planning to go to ToorCamp in the US at the end of June, EMF Camp would be an instant yes, TBH. It was great two years ago.

    ryanc,

    Oh, but my ex might be there. ๐Ÿ˜ฌ

    adamhotep, to random

    Am I missing something wrt Craig Wright claiming to be Satoshi Nakamoto? Doesn't he just have to sign something with one of Nakamoto's keys or transfer the first bitcoin in a publicly verifiable manner? Bitcoin is pseudonymous rather than anonymous...
    https://www.wired.com/story/craig-wright-satoshi-nakamoto-trial/

    ryanc,

    @adamhotep He put forth multiple fake proofs that were unimpressive in their technical sophistication. I'd have done better.

    I had a brief interaction with him on Twitter where he clearly didn't understand things Satoshi would have known.

    At some point he called me a "monkey" some sort of article he wrote.

    ryanc,

    @adamhotep He's full of shit and I would be happy to go say that in court so long as he's there and I get to flip him the bird.

    ryanc, to random

    @dalias Ugh, I hate you.

    Here's the diff between Mac OS X 10.8.5 and 10.9 that introduced gotofail.

    The bug was found within three months.

    https://gist.github.com/ryancdotorg/c5e92a5241125ce57e33bbda94ee7ab0#file-sslkeyexchange_10_8_5_to_10_9-diff-L300

    ryanc, to random

    Coworker: You'll need to speak with security leadership in your org and get alignment.
    Me: checks org chart, finds no other principal+ security engineers anywhere under their great grandboss's reporting structure
    Me: ...I appear to be the security leadership in my org...

    ryanc,

    @aris I have no idea. Also people keep pointing out potential issues with my project and they're all things I've already had meetings about and discussed costs vs benefits.

    Like, what the hell happened? It's almost like I know what I'm doing.

    0xabad1dea, to random

    A few times I have told the anecdote that the singly most baffling thing I ever saw in a code review โ€” not the most insecure, just the most โ€œhow could a real programmer have written this? how could this ever make sense?โ€ thing โ€” was simply a C++ variable โ€œnumber_of_trucksโ€ โ€ฆ declared as float. Unambiguously referring to real physical trucks in a fleet.

    Reader, itโ€™s been over ten years and I am blowing the gods damn whistle. I had edited that story to protect the guilty: the variable was named number_of_planes. It was shipped by a company whose name begins with โ€œBโ€ and rhymes with โ€œGOING out of business.โ€

    ryanc,

    @0xabad1dea I think I might forgive counting boats using a float purely because it's funny, but holy shit yikes.

    beka_valentine, to random
    @beka_valentine@kolektiva.social avatar

    for the love of god people if you make a domain specific language, make sure you have validity checks in place. smdh

    silent failures for invalid inputs is BAD and you should feel BAD

    ryanc,

    @beka_valentine reminds me of CoffeeScript

    ryanc, to random

    Apple did a bit of a self-own with gotofail and posted a fix for iOS before the Mac OS one was ready, and the patch got reversed almost immediately, and the bug hit the news.

    I had my finger on the trigger to buy gotofail.com, and had already built the test service before hand, so it got linked a lot, and from the logs it looked like Apple engineers were using it to verify the Mac OS fix.

    ryanc, (edited ) to random

    It's been ten years, so a short story about the "gotofail" bug.

    Someone came to me about a catastrophic vulnerability in Apple's TLS implementation.

    I shit you not, they'd overheard someone at a bar drunkenly bragging about how they were going to sell it to a FVEY intelligence agency for six figures.

    They didn't know exactly what it was, just some vague details and the key point that it allowed use of the real certificate.

    This was enough for me to find the bug (yay open source), which would go on to be known as "gotofail", and produce a working exploit in less than a day.

    The details were anonymously back channelled to Apple, who released a fix.

    @matthew_d_green posted on Twitter about it, concerned by Apple's vague release notes.

    I used a burner phone to share the details with him anonymously.

    Then everyone forgot about the whole thing because heartbleed.

    ยฏ_(ใƒ„)_/ยฏ

    ryanc,

    @coldclimate It's not a thread I want to pull.

    ryanc,

    @PurpleBooth @matthew_d_green I posted the exploit down thread.

    An actually interesting example:

    https://github.com/ryancdotorg/libsdsock

    ryanc,

    @argv_minus_one @mithfindel they do now, because of that bug

  • All
  • Subscribed
  • Moderated
  • Favorites
  • โ€ข
  • JUstTest
  • thenastyranch
  • magazineikmin
  • ethstaker
  • khanakhh
  • rosin
  • Youngstown
  • everett
  • slotface
  • ngwrru68w68
  • mdbf
  • GTA5RPClips
  • kavyap
  • DreamBathrooms
  • provamag3
  • cisconetworking
  • cubers
  • Leos
  • InstantRegret
  • Durango
  • tacticalgear
  • tester
  • osvaldo12
  • normalnudes
  • anitta
  • modclub
  • megavids
  • lostlight
  • All magazines
    •