🦠Toxic Flange (Gurjeet)🔬⚱️🌚

755 Followers
1.1K Following
2.4K Posts

A broken man on a #Halifax pier. Just some wannabe,suppose I could do better. Middled aged Canadian, child of immigrants who can't relate to them. Attempting every day to be a good person to all walks of folks and life. I don't always succeed. Love all things computer related, admirer of engineers professional and amateurs especially. Hoping your motivation rubs off on me.

Backup: @Toxic_Flange

Githubhttps://github.com/gclair

It's amazing, whenever I know I have to sit down and study up on something I don't know (Azure, .Net, C#) or not very good at, I'll do anything else and fall down rabbit holes on everything but..

Update: This has so far included trying to define my dislike for publicly presenting an #AIgenerated summaries to other people as if its their own work (directed at LinkedIn mainly, it might as well be moltbook itself), and how to setup a seemless #SSH CA for other hosts without having to throw files around.

#AI

#Audioslave first release was 25 years ago.

#genx #old #music

😿

NorthSec 2026 speaker lineup is here ...and it's our best yet!

31 talks & workshops. Two days in Montréal. Tickets going fast (get yours by April 1st to secure a badge and a t-shirts). 👇

𝗧𝗮𝗹𝗸𝘀:
• Guillaume Valadon & Gaetan — Private Key Leaks in the Wild: Insights from Certificate Transparency
• Philippe Pépos Petitclerc — A systematic approach to evading antivirus software
• Émilio Gonzalez — Increasing detection engineering maturity with detection as code
• François Labrèche — A Needle in a Haystack: Identifying an Infostealer Attack Through Trillions of Events in a Large-scale Modern SOC
• Wietze — Trust me, I'm a Shortcut - new LNK abuse methods
• Reza Sharifi — Internet Blackout 2026 in Iran — Next-Level Internet Censorship: A Technical Breakdown of Techniques and Tactics
• Andrew Buchanan, Max CM & Connor Laidlaw — Commit, Push, Compromise: Attacking Modern GitHub Orgs
• Dirk-jan Mollema & Sanne Maasakkers — Researchers vs. Threat Actors in Cloud Attacks
• Jeremy Miller — Measuring AI Ability to Complete Long Cybersecurity Tasks
• Manu Jose — The Merchant of Venice: Trading Latency for Security at Scale
• Joshua Prager & Ben Schroeder — Mapping Deception Solutions with BloodHound OpenGraph
• Christian Paquin — Doxxing-proof authentic digital media: trust the asset, protect the source
• Robbe Van Roey — Hacking Browsers: The Easy Way
• Ron Bowes — Adventures in Process Injection (How I Accidentally Built a Debugger - Again!)
• Xavier Facélina — Le futur s'invente avant-hier
• Charl-Alexandre Le Brun & Simon Lachkar — The OpenGraph diary: Attack path management applied to Ansible
• François Proulx — Living Off The Pipeline: Defensive Research, Weaponized
• Pierre-Nicolas Allard-Coutu — Stolen Laptops: Defeating DMA Countermeasures
• Philippe Marchand — Cybermenaces géopolitiques au Canada: État des lieux et perspectives stratégiques
• Kristine Barbara — From Experts to Everyone: Democratizing Threat Modeling at Ubisoft
• Chirag Savla — When Serverless Becomes a Foothold: Abusing Azure Function Apps in Modern Cloud Environments
• Brad Edwards — APTL: An Open Source Agentic Purple Team Lab
• Maxime Arquilliere & Coline C — Sold to the highest bidder: the escalation of ADINT from geolocation tracking to intrusion vector
• Sébastien Dudek — Hacking 5G: From Radio Security to the APIs

𝗪𝗼𝗿𝗸𝘀𝗵𝗼𝗽𝘀:
• Logan Maclaren & Lewis Moore — Command & Conquer: A hands-on C2 primer for aspiring Red & Blue teamers
• Santiago Abastante — AWS Security - The Purple Team Way
• Faan Rossouw — Agentic AI for Threat Hunting
• Ben Gardiner — Hardware RE: a gentle intro
• Tammy Harper — The Ransomware Negotiation Lab
• Mark El-Khoury — DIY Continuous Security: Practical Security Engineering
• Ashley Manraj & Philippe Dugré (zer0x64) — Breaking and Hardening the Cloud: Advanced Hooking and Shellcoding in a Hardened Environment

#NorthSec #cfp #infosec #cybersecurity

Sorry that my overview of Bill C-22 (Lawful Access Act, 2026) was 40+ minutes long. The second half, starting here, is what I think Canadians should understand. The open internet should not be deputized to collect more information for cops and spies. https://youtu.be/tZFbTYttuN8
Lawful Access is back: All about Bill C-22 (Spoiler alert: Part 2 is very troubling.)

YouTube
Tune in here on Thursday morning at 9:30 Eastern Time to watch the Supreme Court of Canada appeal in Facebook v. Privacy Commissioner of Canada. This is a very important case about meaningful consent and safeguarding personal information. https://www.scc-csc.ca/cases-dossiers/hearings-audiences/live-endirect/
Supreme Court of Canada | Live hearing

Here's my overview of the Federal Court of Appeal decision that Meta/Facebook is appealing: https://blog.privacylawyer.ca/2024/09/appeal-court-reverses-facebooks.html
Appeal court reverses Facebook’s Canadian privacy win

The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.

The new Bill C-22 (Lawful Access) will create new info demands and require "electronic service providers" to create new surveillance capabilities. Part 1 is improved from Bill C-2 but Part 2 is bad creating an expansive surveillance infrastructure. https://youtu.be/tZFbTYttuN8
Lawful Access is back: All about Bill C-22 (Spoiler alert: Part 2 is very troubling.)

YouTube
Intel's Heracles chip computes fully-encrypted data without decrypting it — chip is 1,074 to 5,547 times faster than a 24-core Intel Xeon in FHE math operations

No decryption occurs inside the processor, eliminating entire classes of attacks.

Tom's Hardware

I thought strings could help. Had to use some switches i never expected to exist or ever use :) Problem is the switches I used only limits strings to 7-bit encoding for bytes, which will drop legitimate utf-8 characters / emoji's etc. When i use the -eS that counts for utf-8, it still includes the PUA range.

So, its not as easy as I thought with simple default tools (not that I know all the options and tools!) . I guess any adequate protection to this exploit case would be to limit the range of characters allowed in your source code or included source code.

So while my solution "sort of" works, its not practical for today's worldly developers, and especially if you want to include other regional language strings in your code.

Good exercise though and a reminder of utf-8/unicode usage as well!

#infosec #supplychain