Mastodawn

I didn't realize the facebook execs Mozilla acqui-hired last year have been promoted! I was assuming they were still just heading the ads division of Mozilla, but oh boy, I fucking wish.

Now the former Senior VP of Marketing of facebook (2008-2022, the finest years of facebook) is the CHIEF FINANCIAL OFFICER of the entire Mozilla.

And the former VP of Ads in Facebook (2012-2022), is now the Senior VP of Product of Mozilla.

Let me repeat this:

The guy who used to lead the facebook team that was literally "advertising to teenagers based on their emotional state" is now the guy who decides the direction of Firefox as a product. But hey, let's keep giving Mozilla the benefit of the doubt uh? I'm sure these people-who-should-be-on-trial-in-the-hague are going to do great things for the community!

edit: Bradwood has been promoted to Chief Business Officer of the Mozilla Corporation, not Chief Financial Officer, my bad

edit2: as @[email protected] pointed out, even if Graham Mudd's title is "SVP of Product", the bio in his page talks about him as the SVP of Product for the Mozilla Ads division specifically. So it may be the case that he hasn't been promoted and he's just on top of the ad division. That being said, Mozilla doesn't have a Chief Product Officer anymore, and that makes Mudd the most senior product person in the entire Mozilla organization, outranking the VP that seems to be org-wide.

Mozilla Leadership

Mozilla

Eicar Arlettaz Feb 24

Clément Labro Feb 24

It's a blog post I should have published months ago, but here we finally are.

"CVE-2025-59201 - Network Connection Status Indicator (NCSI) EoP"

Credit goes to t0zhang (on X) for the discovery.

👉 https://itm4n.github.io/cve-2025-59201-ncsi-eop/

I'd like to write more of those but it's so time-consuming. 😔

#cve #windows

CVE-2025-59201 - Network Connection Status Indicator (NCSI) EoP

It’s been a while since I last dug into a Patch Tuesday release. With an extraordinarily high number of 177 CVEs, including 6 that were either already public or exploited in the wild, the October 2025 one seemed like a good opportunity to get back at it. The one I ended up investigating in depth was CVE-2025-59201, an elevation of privilege in the “Network Connection Status Indicator”.

itm4n’s blog

Eicar Arlettaz Feb 24

buherator Feb 24

Team TESO CVS archive

https://github.com/hackerschoice/team-teso

GitHub - hackerschoice/team-teso

Contribute to hackerschoice/team-teso development by creating an account on GitHub.

GitHub

Eicar Arlettaz Nov 20

lcamtuf

Nov 19

Me: I want to have more friends

Tech companies:

Eicar Arlettaz Nov 19

César Córcoles Nov 18

just in case nobody has done it before

On AI Slop vs OSS Security
https://devansh.bearblog.dev/ai-slop/

On AI Slop vs OSS Security

I have spent the better part of a decade in the bug bounty industry, and my perspective on this industry is shaped by this experience. The first five year...

devansh

Eicar Arlettaz Nov 6

nixCraft 🐧Nov 6

End of Japanese community at Mozilla due to the introduction of AI-based translation.

The community members have expressed disappointment and frustration that their long term volunteer efforts and local knowledge were being replaced by machine translation, which they felt did not match the quality of human provided support.

This is why Mozilla sucks so much, they are going crazy like rest of the industry.

Source
https://support.mozilla.org/en-US/forums/contributors/717446

Added screenshot in case Mozilla decided to remove it

Eicar Arlettaz Nov 3

Alexandre Dulaunoy Nov 3

I think the best summary until now about Post-quantum cryptography is from Peter Gutmann in the cryptography mailing-list.

Given that after 20 years and hundreds of millions of dollars spent researchers have yet to demonstrate a single legitimate cryptanalysis result using a quantum physics experiment, it's a bit like arguing over which brand of unicorn repellent is the most cromulent.

The current state of things in terms of pure vs. hybrid systems seems to be:

- Governments = Pure: “We’re putting all our eggs in one basket and hoping that the dial stops spinning at ‘not broken’”

- Everyone else = Hybrid: “We trust this new stuff so little that we’re requiring you use the crypto that we claim is broken alongside it”

Peter.

#cryptography #pq #postquantum #postquantumcryptography

https://www.metzdowd.com/pipermail/cryptography/2025-October/039129.html

Eicar Arlettaz Oct 20

circl Oct 19

In 2 days @hack_lu is starting we hope to see you there. There are still some seats for the lighting talks and the call for failures. If you are already registered check your mail for the submission link and if you want to send a failure 10 minutes presentation. You can still register

https://2025.hack.lu/cff/

don’t forget to follow @hack_lu on the #fediverse

#hacklu #conference #cybersecurity #europe #luxembourg #infosec #opensource

Call for Failure (CfF 0x1) - Over Fail the untold truth behind the magic of cybersecurity

10-minute talks during hack.lu to present (the/your) biggest failure in cybersecurity you’ve ever experienced and what have you learned from it (or not)

hack.lu 2025