FR/EN
Account dedicated to #Offsec/#Infosec/digital stuff
Involved in
#UnifiedPush #MollyIm
| Github | https://github.com/p1gp1g |
| Codeberg | https://codeberg.org/s1m/ |
| Liberapay | https://liberapay.com/S1m/ |
| Blog | https://s1m.fr |
So, it turns out the German implementation of eIDAS (electronic ID wallet for e.g. age attestation) will require an Apple/Google account to function
Absolutely pathetic
On the fediverse we could do collectively better at not shooting down initiatives.
It’s a bit demoralizing to see someone announce their project, only for a mob to come and tell them they’re wrong and they should never have started it.
I’m not saying we should accept the unacceptable. I’m saying we should embrace imperfection to go in a better direction.
You often see us reporting our RB status, and might wonder what's so important about #ReproducibleBuilds – want a recent example? Take a look at https://web.archive.org/web/20260402133949/https://github.com/Nekogram/Nekogram/issues/336 – and the POC at https://github.com/RomashkaTea/nekogram-proof-of-logging
In short: Release APK was built from different code, including a logger to catch all phone numbers contacted. Oh, and the dev thinks that's fine (https://t.me/NekoUpdates/531).
RB would have failed for that app, and shown the diff.
Stay safe out there!
(1/2)
Steps to reproduce Install and login to your telegram account Now your phone number belongs to Xi Jinping... jk. to Nekogram creator Expected behaviour Not leaking phone numbers Actual behaviour Ma...
In today's episode of "Can It Run Doom": DNS fucking TXT records.
Some absolute madlad (cough Adam Rice cough) compressed the entire shareware DOOM WAD, split it into around 1,964 chunks, shoved them into Cloudflare TXT records, and wrote a PowerShell script that reassembles and runs the whole goddamn game from DNS queries alone. Nothing touches disk. The DLLs are in DNS. THE FUCKING DLLS ARE IN DNS.
RFC 1035 was written in 1987. Those engineers are spinning in their graves fast enough to generate municipal power.
Bonus: this is a fully functional globally-distributed covert data exfil channel that your NGFW will never fucking see if you're not doing deep DNS inspection. Sleep well.
blog: https://blog.rice.is/post/doom-over-dns/
repo: https://github.com/resumex/doom-over-dns
Also lmao @ every blue team that has never once looked at their DNS query volume. How's that DLP policy working out for you.
It was always DNS.
Apps should only resort to this if they're forced to do it. Root-based attestation provides minimal security and is easy to bypass. It's inherently insecure due to trusting the weakest security systems. A leaked key from the TEE/SE on any device can be used to spoof attestations for any device.
Play Integrity permits a device with years of missing security patches. It isn't a legitimate security feature. It checks for a device in compliance with Google's Android business model, not security.
🎉 The critical amendment 34 (rejecting automated assessment of unknown photos and texts) PASSED by ONE vote, paving the way for the extension of Chat Control 1.0 to be overwhelmingly REJECTED!
Initial analysis by @echo_pbreyer : https://www.patrick-breyer.de/en/end-of-chat-control-eu-parliament-stops-mass-surveillance-in-voting-thriller-paving-the-way-for-genuine-child-protection/
You did it! 🥳
European Parliament just decided that Chat Control 1.0 must stop.
This means on April 6, 2026, Gmail, LinkedIn, Microsoft and other Big Techs must stop scanning your private messages in the EU. #PrivacyWins 💪
Felicitas Pojtinger 🌅
Fedilab Apps
Thib
Izzy
Joseph Cox
Team KeePassXC
k3ym𖺀
GrapheneOS
Fight Chat Control
Tuta