Mastodawn

https://blog.xvrqt.com/nix-wireguard.html

Writing a new series on using Nix to configure Wireguard. It's probably overly ambitious as I have had the completed flake done for personal use for weeks now, but writing the blog means redoing it step by step in excruciating detail.

I had to keep cutting scope for each post and now, after typing all day, I finally have... the basic option setup for it. How is writing so hard? Why would a loving god cause such agony?

Feedback welcome, as I think part of my problem is I don't understand who my audience is so I never know what I can leave out and what I should explain further.

#nix #nixos #linux #wireguard #kernel #flakes #foss

nix wireguard

Wireguard1 is a Linux Kernel Module which allows you to easily configure encrypted network interfac...

xvrqt

lizzie moratti 3d ago

3d ago

looks like anthropic got rid of the claude refusal triggering string :(

lizzie moratti 3d ago

Volpeon

Mar 10

I unironically think people would be more careful about the output of LLMs if the go-to icon were 🎲 rather than ✨ .

Show thread

lizzie moratti 5d ago

I have to speak my mind on this.

One of the more overlooked issues in this blog post is that a protections against pointing an autonomous AI agent at non-scoped public targets were circumvented.

It also showed the destructive default payloads for SQLi.

This and other autonomous pentesting are autonomous weapon systems masquerading as a commercial offering. Unregulated. No export controls.

They should be classified as such, in my opinion.

lizzie moratti 6d ago

Bert Hubert NL 🇺🇦🇪🇺🇺🇦6d ago

Vrienden van de #opendata, ik zie op https://www.rijksoverheid.nl/documenten staan dat rijksoverheid.nl op 1 april stopt met documenten publiceren, en dat we dan direct naar open.overheid.nl moeten gaan. Maar die hebben geen feed. Weet iemand of https://www.rijksoverheid.nl/rss wel blijft werken?

Documenten | Rijksoverheid.nl

Zoek in alle documenten van de Rijksoverheid.

Show thread

lizzie moratti 6d ago

https://blog.richardfan.xyz/2026/03/14/pentesting-a-pentest-agent-heres-what-ive-found-in-aws-security-agent.html

Yet another example of why you shouldn’t use pentest agents. The DROP TABLE in SQLi is just incredible.

I resent that years of my professional work are probably in the dataset for this AWS Security Agent. AWS single-handedly kept several prominent US security consultancies afloat during the pandemic with volume work, but they demanded increasing levels of “artifacts” of pentesting.

Pentesting a pentest agent - Here’s what I’ve found in AWS Security Agent

Richard’s blogs on Cloud Security

Virtual Security Car

lizzie moratti 6d ago

https://www.propublica.org/article/microsoft-cloud-fedramp-cybersecurity-government

I feel vindicated about my criticisms x1000.

Didn’t even make it past MS Exchange in a FedRamp review. No one should use their cloud offerings, especially governments.

Oh wait what’s this? https://mxmap.nl/
…..
🥲

Federal Cyber Experts Thought Microsoft’s Cloud Was “a Pile of Shit.” They Approved It Anyway.

A federal program created to protect the government against cyber threats authorized a sprawling Microsoft cloud product, despite the company’s inability to fully explain how it protects sensitive data.

ProPublica

Show thread

lizzie moratti Mar 16

@pollyglot !0x90

lizzie moratti Mar 14

Jul 26, 2025

that's right! it goes in the DOWNLOADS folder

lizzie moratti Mar 12

https://trufflesecurity.com/blog/claude-tried-to-hack-30-companies-nobody-asked-it-to

Well. That’s a new one. Who is liable when an LLM exploits the SQL injection is too juicy, even when you never asked it to?

This reminds me of an old coworker who used SQLMap on an external network test and dropped the databases of I think 10 or 15 websites. Backups were 3 months old. Happened over a weekend (contractor) when the engineers were at home, they kept the scans going because nothing seemed wrong. The engineers definitely noticed on Monday.

An nmap scan with the wrong flags can bring down a SCADA system. I know of people who caused outages with the first command ran on a pentest. Yes, really.

One of the reasons you don’t want to allow unqualified person pentesting is because some systems are fragile.

Claude Tried to Hack 30 Companies. Nobody Asked It To. ◆ Truffle Security Co.

We gave AI agents simple research tasks on cloned corporate websites. When the legitimate path was broken, the agents autonomously discovered and exploited SQL injection vulnerabilities to complete the task - with zero hacking instructions in any prompt.