Ville Turpeinen

@vinski@infosec.exchange
18 Followers
99 Following
2.6K Posts

The U.S. Will Incinerate 500 Tons of Emergency Food Aid - The Atlantic

“Nearly 500 metric tons of emergency food—enough to feed about 1.5 million children for a week—are set to expire tomorrow, acc to current and former government employees with direct knowledge of the rations.

Within weeks, two of those sources told me, the food, meant for children in Afghanistan and Pakistan, will be ash.”

https://www.theatlantic.com/health/archive/2025/07/usaid-emergency-food-incinerate-trump/683532/

The U.S. Will Incinerate 500 Tons of Emergency Food Aid

Federal workers warned for months that the high-energy biscuits would go to waste.

The Atlantic

To any Austrailians being misinforned by Sky News, please know that Europe is just fine.

The fact that Sky News has found some social media clips of a few criminals committing crimes in Spain and France does obviously not mean that a continent of 744 million people “has fallen”. All it means is, Australia needs better media.

The UK Environment Agency has some tips for the public to help conserve water, including

> Deleting old emails to reduce pressure on data centre servers

I kid you not.

https://www.gov.uk/government/news/england-faces-5-billion-litre-public-water-shortage-by-2055-without-urgent-action

England faces 5 billion litre public water shortage by 2055 without urgent action

England faces 5 billion litre a day shortfall for public water supplies by 2055 – and a further 1 billion litre a day deficit for wider economy.

GOV.UK
Fun* thing I just noticed, the bulleted list markers in the Qantas "you got breached" email? 717kB PNG file.
Before you advocate #Linux as an alternative for #Windows, it has to be fit for purpose first. This requires understanding and empathy for your (potential) users, which I am not sure a large chunk of the community is capable of.
“If you're baffled as to why
they're murdering health
workers in Gaza, it’s because
they are the people who will
testify in court as to what has
been done. They are killing the
witnesses.”
Liam Cunningham
North Korea supplied Russia with 12 million rounds of 152mm shells, South Korean intelligence estimates

The report estimated that North Korea could have provided Russia with around 28,000 containers containing weapons and artillery shells to date.

The Kyiv Independent
If you want to know how a country gets to the point where people from a targeted minority are forced to wear some sort of visual signifier of their identity on their clothing, it really seems like this is the progression.

RE: https://bsky.app/profile/did:plc:2vtbmhmrwzbqcfv4we4uxzzt/post/3ltqejx5tgs2g

I received an email earlier this week from EA asking if I wanted to be added to a public acknowledgement page they were creating for individuals who responsibly disclosed vulnerabilities to them.

For all the shit people give EA, of the 100+ companies I contacted in the last two years, they were the only company I would say had a decent incident response.

They fixed the issue within 12 hours after validating it as critical, and proactively provided me multiple updates over time.

When the IR was done on their side, they reached out again with some more information about the potential impact if the issue hadn't been solved quickly, and also offered me a reward.

I did not have to keep chasing anyone for updates, I wasn't asked for non-disclosure, or offered money in exchange for it, and people replied instead of ignoring me.

I wasn't blamed for their mistake, either, or reported to the authorities.

Unfortunately, at least one or multiple of the things mentioned above are present in most of my other incidents reported; it's a real shit show out there.

#cybersecurity #infosec #responsibledisclosure #vulnerability #ea #electronicarts

×
Fun* thing I just noticed, the bulleted list markers in the Qantas "you got breached" email? 717kB PNG file.
@akent yep, it’s a big-ass PNG, that’s for sure. https://ecm.loyalty.qantas.com/imgproxy/img/3004766859/bull.png
@georgeharito @akent also some amusing URL enumeration fun to be had with those URLs... The image name doesn't matter, just the ID.
@ret @georgeharito @akent
We need to check out all the other image URLs between 0000000001 and 3004766859 to see what they are.

@negative12dollarbill @georgeharito @akent if somebody engaged in that it would be entirely embarked upon under their own volition. My indication of the potential for URL enumeration is not a suggestion to exploit such a vulnerability should it exist.

uwu.

Forced browsing | OWASP Foundation

Forced browsing on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

@akent I put several of these in each edition
@akent They are good at computer.
@akent Equal parts lmao and witaf
@akent bull dot png, emphasis on the bull
@akent
Tired: ul
Wired: table
@akent @lyndaljane I’ve just imagined explaining to my three decades younger self that we’ll regularly not care about sending an email that link to files that we would only be able to fit two of on a floppy, and they’re just the list element dingbats.
@akent @daedalus clearly basic HTML is beyond their ken.
@akent I did wonder how they got them to look so smooth.
@akent You discovered the black hole that is sucking up all the entropy of the universe. Nice find! Don't get too close to the event horizon.
@akent remember when tracking elements used to be a 1x1px gif?
@akent How did they manage to fail to compress an image that looks so easily compress-able? 🤣
@akent That's 717 kB wasted. Literally a single unicode character would have sufficed here
@akent what information is in there, did you look? (Beside the 144 pixels)

@josgeluk It's 1024x1024 8 bit RGBA so more than 144 pixels... but good question -- there is also a bunch of metadata that looks like signing keys or something: https://pastebin.com/raw/WUgadPyf

Check the png here direct if you like: https://ecm.loyalty.qantas.com/imgproxy/img/3004766859/bull.png

I smell some "vibe" coding.

@akent @josgeluk The fact that they (may) have used ChatGPT to generate a bullet point is nothing short of crazy.
@wale @akent @josgeluk It has made me groan loudly.
@akent The image has been optimised for future Retina displays and Safari.
@akent @bert_hubert things that would have never 🥁 🥁 flown 🥁 🥁 20 years ago due to internet bandwidth constraints :)
@akent and it appears to have OpenAI/GPT-4o fingerprint info in the metadata. As well as TruePic Lens things. Bizarre.
@daedalus I also just found this too. I smell some vibe coding.
Of course! Why waste an opportunity to track mail openings when reaching out to your audience could go unmeasured instead?
But yeah, this is absurd, given less than one hundred bytes of SVG would to, if going fancy, or a simple or something.
@akent they saved 2 bytes by shortening the name to bull.png.
@bartjan @akent 4 bytes, if you know what I mean ;-)
@akent That's two times pokémon red, for a dot..
@akent There must be a name for this stupid kind of data bloat. Using pictures as a substitute for text. Using HTML in email. Reminiscent of how MS Word stretches a hundred word "text" document to a megabyte of file size by attaching unwanted repetetive metadata like "spacing-adjustment=-0.0; colour-scheme=microsoft" to every actual word of text (paraphrased; have blissfully avoided touching Microsoft stuff for years and hate it when people occasionally inveigle me to do so).

@julian @akent "there must be a name" -> https://en.wikipedia.org/wiki/Software_bloat#Types_of_bloat -> "This section needs expansion with: more on the topic: these are not the only forms of bloat. You can help by adding to it. (July 2024)"

We should come up with a name 😂. Because of citogenesis https://xkcd.com/978/

Software bloat - Wikipedia

@akent Is there some silly steganography going on with almost but not quite shades of black in there?
You have to try really hard to create a png that badly compressed.
@akent chuck loading=lazy on those bad boys and you've got scroll tracking
@akent This is a company who takes "control your supply chain" seriously.
@akent
That would nearly fill an Amiga floppy disk!
@akent How. Why. What. The fuck?!
@akent @GossiTheDog did they go out of their way to reduce the png compression to the lowest possible setting
@akent
But they'll charge you $15 if your carry-on is 500g over. The cheek of it.
@akent please say its a different PNG for each item as well?

@akent while the png is oversized this is a fairly relevant way to code emails (although I agree with other commenters I would have used • myself.) Email clients are very inconsistent in rendering and lists are one of the things that has historically been a pain to get right across clients. The mantra in the email world has long been, "code it like it's 1999." It's been very slowly getting better as older clients roll off but I don't think it's ever going to be on-par with the state of the art Web HTML.

I just wanted to dispel some of the commentary here in the replies because it's clear most people here haven't coded many emails and are making assumptions about it.