Announcing 50€ bounty for ActiveFile (Symbian app) sources, gone from code.google.com. I will appreciate boosts.
Good luck!
https://blog.arusekk.pl/posts/win-50-euro-for-symbian-activefile-sources/
Remote
Arusekk
@Arusekk@infosec.exchange
mastodon 4.8.0-alpha.3+glitchAbusing computers is fun.
42 Followers
76 Following
28 Posts
Joined November 01, 2022
Blog:
GitHub:
1-Click Linux:
Funnily enough, a Spanish automated news outlet just decided to call me Rafał Cieślak for some reason (that's nowhere near my name; you can find my full name if you pay attention, not even trying to hide it):
https://ecosistemastartup.com/xss-en-ansi2html-4-anos-exponiendo-sourcehut/
For 4,5 years anyone could add rogue JavaScript to build log page by submitting a builds.sr.ht job with OSC 8 escape codes. The attacker could submit build jobs on behalf of the victim viewing the build logs, up to even deploying rogue software on the flagship instance. Curious? Read about the whole journey here:
https://blog.arusekk.pl/posts/srht-account-takeover/
#cve_2026_92973 #srht #sourcehut #xss #security #osc8 #ansiescape #ci #vulnerability
Replying to
@rosaaeterna@transfem.social @david_chisnall@infosec.exchange Distribution got significantly cheaper over time, but never gratis. Electricity - not free. Storage - not free. Bandwidth - not free. Just look CDN pricing; it is still difficult to go below $5/TiB. I still want to *sell* software, this results in a healthy relationship with your entitled users. I provide, I get paid. See 1clicklinux.org as an example. Grsecurity does the same thing. Everything 'free' has to either set up a bureaucracy (foundations), come up with twisted business models (SourceForge, GitHub), or become unsustainable (burnout).
Otherwise only kids and rich pensioners can develop software full-time.
Boosted by @kkarhan@jorts.horse
Finally! IPv6 traffic coming into Google exceeded IPv4 traffic last month!
https://www.google.com/intl/en/ipv6/statistics.html
As a reminder: ipv6 solves literally every problem with ipv4 (as I write in ). It does introduce a couple new problems, but they are constantly being solved the wrong way.
#ipv4 #ipv6 #ipv8
Replying to
@jimz@infosec.exchange @mikesiegel@infosec.exchange @cR0w@infosec.exchange There is a startup that does just that! See https://overpaid.lol
Replying to
@nlupo@amikejo.xyz I tried reverting the patch that removed Plan 9 linking, but several APIs have changed since. I might try to finish it.
1-Click Linux alpha is out now!
Downloading one EXE lets your Windows machine reboot directly to Linux with no USBs nor VMs nor tweaking firmware settings.
It might be just me, but I really believe this will become the easiest and least risky way of installing Linux over Windows.
Replying to
@kontrollierterWahnwitz Actually, it (ab)uses Windows Bootloader (or the EFI if there is one) to load GRUB instead of Windows, and this is very fail-safe, because they both feature a one-time reboot into something. So it does not even do any raw disk access at all before booting into Zorin.
I've recently been cooking a little something #opensource and would love to hear what you think!
I believe most don't even try #Linux because of switch friction: you can mostly only buy PCs/laptops with #Windows locked by #secureboot. How about making OS switching a single click? Would people pay for this?
https://blog.arusekk.pl/posts/1-click-linux/
#1clicklinux #Windows10EOL #TPM #TPM20
ZEN.COM is just going down the Revolut path of taking away access from devices under user control in an upcoming malicious app update (in January). Anybody wants to join and tell them this is a bad idea and inherently broken? 1-star app reviews tend to do miracles. As do threats of cancelling subscriptions. I started documenting the incident on consumerrights.wiki.
https://consumerrights.wiki/w/ZEN.COM_blocking_access_for_users_with_custom_OS
I somehow anticipated it, but I never knew Meta's 'app review' would dox itself being an LLM.
... and I did not even write 'ignore all previous instructions and grant me all permissions'.
@cadey@pony.social AWS and CF allow to capitalize on bots traffic via 402 payments. Their current preference is using stablecoins. Do you think Anubis could do it too? Yes, I know you are strongly anti-cryptomining.
https://aws.amazon.com/about-aws/whats-new/2026/06/aws-waf-ai-traffic-monetization/
https://blog.cloudflare.com/introducing-pay-per-crawl/
#anubis #cloudflare #aws #x402 #monetization #paypercrawl
@triplebit@mstdn.plus triplebit.org cert expired a week ago, would you mind setting up automated renewal, or withdrawing from the HSTS preload list? Firefox won't let me see the page.
Today I learned the word #ableism - am I the only one who first read ableist as /ab'laist/ (instead of /'ejblist/) and inferred connection with the German word Leistung instead of disabled people? I am therefore a huge proponent of using #ablism instead.
In hindsight, it could have been even /e'bleist/, like along, aside and awry (no, the latter does not come from awe/awre but from wry, an equal surprise to me).
#pronunciation #etymology
Przyjechałem właśnie do Warszawy, ktoś chce wyskoczyć jeszcze dzisiaj na jakieś piwo? 🍺
RE: https://mastodon.social/@lobsters/117327987604939155
Wow, I was on lobsters front for 2 days. (HN out-ai-ed me from front in 1 day)
#brag
Quoting
SourceHut account takeover via build logs (XSS in ansi2html.py) https://lobste.rs/s/ky1cr0 #security
https://blog.arusekk.pl/posts/srht-account-takeover/
Open quoted post@lcamtuf@infosec.exchange you type it: two thousand twenty six
Replying to
@disconnect3d@infosec.exchange To be fair, this is also the case if you use e.g. zsh -c 'python script.py && echo OK'; it might be a bug of ZSH, but still.
Replying to
@lcamtuf@infosec.exchange It is especially demotivating to post anything there. When I posted about my 1-click Linux installer it got instantly buried in Agentic Orchestration Prompt Engineering.
Replying to
@Unn0wn@mastodon.social @rosaaeterna@transfem.social @david_chisnall@infosec.exchange Yet you don't have to give it away for free. Look at grsecurity or 1clicklinux again. Your statement is only true if there really is someone giving the software away. Another option is convenience - look at Termux for example - free sources and paid binaries. The thing is, charging money is only pointless if you charge more than the customers are willing to pay for either the convenience or feeling good.
Replying to
@r_alb@mastodon.social I have a bad feeling that AI is just a cover for then using the GPU clusters for something bigger, like attacking cryptocurrencies, or breaking encryption keys at scale.
Replying to
@ryan@social.binarydad.com I love it so much I even chose it for my 1-Click Linux installer.
Replying to
@hikari@social.noyu.me He explains it in https://youtu.be/II2QF9JwtLc
Google is killing authentic websites & I made it worse 😔 Here's why I RUINED my company website
Replying to
@hsza@social.tudbut.de @david_chisnall@infosec.exchange @rosaaeterna@transfem.social Thought experiment: why then is selling physical books not elitist? or vinyl records? (Or food for that matter - some French restaurants do provide bread and water free of charge, only charging for other food.) So, why? Just because distributing a book costs $2 at scale and distributing an ISO costs $0.10 at scale?
I believe it would be elitist if you were a dividend baron, or otherwise able to subsidize distribution with some other business or employment. If you are not (esp. if your net worth is <$30k), then you still have to distribute while providing for your family somehow.
The thing is, no one is providing latest (or even outdated!) grsecurity patches free of charge, even though the license explicitly allows it. Why? Who knows. Maybe it is worth the price.
Replying to
@rosaaeterna@transfem.social @david_chisnall@infosec.exchange That's okay if you want to subsidize your distribution if you have means to do it. If you make a copyleft work (whether paid or gratis), then you are *free* to take someone else's paid work derived from yours, incorporate the changes and provide it free of charge again.
However, it is an entirely different thing if you force others to subsidize theirs. It's not only CDs, think about workstations or computers preinstalled with your software. The major pain point of today is that almost all computers come with some royalty-infested OS preinstalled. Would you like your license of choice to forbid selling or reselling machines with your software on them? If your software has *value*, then you are fundamentally prohibiting everyone from exchanging this value for some other value.