Remote follow

Caligin Tsukihara @caligin@octodon.social

Errorist. Weeaboo. Security Sleepwalker & BevOps @ ThoughtWorks UK (Views are mine etc...). 0x7AD2E918B3D5FFB7

165 Toots

45 Following

41 Followers

Toots Toots and replies Media

**Caligin Tsukihara** · Jul 01, 2018, 21:16

Caligin Tsukihara boosted

**Jerry Bell** @jerry@infosec.exchange · Jul 01, 2018, 21:16

Seven Critical Things To Protect Your Infrastructure and Data
https://infosec.engineering/seven-critical-things-to-protect-your-infrastructure-and-data/

#infosec

**Caligin Tsukihara** @caligin · Jun 09, 2018, 22:22

**Caligin Tsukihara** @caligin · Jun 09, 2018, 22:22

errm, does this mean that using maven is a risk? https://github.com/snyk/zip-slip-vulnerability
I'm tempted to say that as long as you only use dependency from trusted publishers and from a trusted repository it's alright but I'm pretty sure I'm minimizing the issue here. #swdev #security #infosec #maven #zipslip

**Caligin Tsukihara** @caligin · Jun 09, 2018, 18:43

**Caligin Tsukihara** @caligin · Jun 09, 2018, 18:43

Ron Jeffries - Developers Should Abandon Agile https://ronjeffries.com/articles/018-01ff/abandon-1/
#agile #swdev

**Caligin Tsukihara** @caligin · Jun 03, 2018, 01:34

**Caligin Tsukihara** @caligin · Jun 03, 2018, 01:34

after being away from java and spring for a while this was quite a good overview of what's new in the core framework: https://youtu.be/0V-3kUMfWCc

**Caligin Tsukihara** · May 29, 2018, 20:46

Caligin Tsukihara boosted

**mkb** @mkb@mastodon.social · May 29, 2018, 20:46

Conversation here reminded me of this awesome piece by James Mickens:

https://www.schneier.com/blog/archives/2015/08/mickens_on_secu.html

It's not often I get to describe #infosec writing as simultaneously informative and fucking hilarious but Mickens fills the bill.

**Caligin Tsukihara** · May 29, 2018, 21:30

Caligin Tsukihara boosted

**wohali** @wohali · May 29, 2018, 21:30

tech tribalism, security exploits Show more

**Caligin Tsukihara** · May 28, 2018, 09:41

Caligin Tsukihara boosted

**Mews** @SpewingMews@mastodon.art · May 28, 2018, 09:41

One of the Patreon sketches from the other night that I thought turned out cute!

**Caligin Tsukihara** @caligin · May 23, 2018, 23:29

**Caligin Tsukihara** @caligin · May 23, 2018, 23:29

finally bottled my latest #homebrew. it's a truffle stout, so I called it "Proof of Wort"

**Caligin Tsukihara** · May 10, 2018, 19:41

Caligin Tsukihara boosted

**always coming home** @nightpool@cybre.space · May 10, 2018, 19:41

holy shit.

https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_sshdecorator_package/
https://twitter.com/x0rz/status/994116668086542336

"The ssh-decorator package from Python pip had an obvious backdoor"

sends host + username + password to an external website

**Caligin Tsukihara** · Apr 29, 2018, 14:41

Caligin Tsukihara boosted

**bugshiv** @bugshiv@infosec.exchange · Apr 29, 2018, 14:41

There are two natural paths to progress as a programmer:

1. Pick up farming, because all software is terrible.
2. Get into infosec, because f*** all software.

**Caligin Tsukihara** @caligin · Apr 29, 2018, 15:25

**Caligin Tsukihara** @caligin · Apr 29, 2018, 15:25

@bugshiv good to know, I actually have no idea how device ids work so didn't think about it

**Caligin Tsukihara** @caligin · Apr 29, 2018, 15:13

**Caligin Tsukihara** @caligin · Apr 29, 2018, 15:13

"How to Use Signal Without Giving Out Your Phone Number"
https://theintercept.com/2017/09/28/signal-tutorial-second-phone-number/ #signal #privacy

**Caligin Tsukihara** · Apr 24, 2018, 18:23

Caligin Tsukihara boosted

**varx** @varx@infosec.exchange · Apr 24, 2018, 18:23

About 7 hours ago, Amazon's Route53 #DNS service suffered a #BGP hijack lasting about 2 hours:

https://doublepulsar.com/hijack-of-amazons-internet-domain-service-used-to-reroute-web-traffic-for-two-hours-unnoticed-3a6f0dda6a6f

Only confirmed victim so far is a cryptocurrency site, lol.

**Caligin Tsukihara** · Apr 23, 2018, 23:35

Caligin Tsukihara boosted

**❄️🦊** @icefox · Apr 23, 2018, 23:35

Because I live in fear that there exist people who don't know about this: https://godbolt.org/

Want to know what a compiler actually does with your code? Find out, with nice highlighting of sections! Supports C, C++, Haskell, Go, Swift, Rust, and various other languages.

See. Explore. Understand.

**Caligin Tsukihara** · Apr 21, 2018, 19:42

Caligin Tsukihara boosted

**Jerry Bell** @jerry@infosec.exchange · Apr 21, 2018, 19:42

Defensive Security Podcast Episode 216
http://defensivesecurity.org/defensive-security-podcast-episode-216/
#infosec

**Caligin Tsukihara** @caligin · Apr 21, 2018, 17:46

**Caligin Tsukihara** @caligin · Apr 21, 2018, 17:46

#homebewing a truffle #stout! I don't really know what I'm doing but I'm sure the result will be interesting! #beer

**Caligin Tsukihara** @caligin · Apr 17, 2018, 20:32

**Caligin Tsukihara** @caligin · Apr 17, 2018, 20:32

til ham+cheese+mustard sandwiches from eat are tastier than the ones from pret

**Caligin Tsukihara** · Apr 10, 2018, 22:56

Caligin Tsukihara boosted

**Eugen** @gargron@mastodon.social · Apr 10, 2018, 22:56

Sen. Catherine Cortez Masto

we are 𝙞𝙣𝙨𝙞𝙙𝙚

**Caligin Tsukihara** @caligin · Apr 07, 2018, 17:17

**Caligin Tsukihara** @caligin · Apr 07, 2018, 17:17

went snowboarding last week, got on the slopes right in time for the end of the season on the Dolomites
weather was great, sunny clear sky with soft snow

**Caligin Tsukihara** · Apr 06, 2018, 23:04

Caligin Tsukihara boosted

**varx** @varx@infosec.exchange · Apr 06, 2018, 23:04

This was kind of delightful: https://holeybeep.ninja/

It's a half-joking vulnerability disclosure for a privesc bug in `beep` of all things (CVE-2018-0492). Lots of ridiculousness in the text.

But their recommended patching method is a poker-faced usage of an unpatched issue wherein `patch` can be told to call `ed`, which allows arbitrary command execution: https://rachelbythebay.com/w/2018/04/05/bangpatch/

Older