Thank you for reporting the vulnerability on https://wtfismyip.com/.env, "Security Researcher". I must have fucked up and uploaded my credentials!
Remote
wtfismyip
@wtfismyip@gnu.gl
mastodon 4.7.3I toot and boost random #cloud, #infosec, #IPv6, #Linux and #BSD stuff. Frequently #profane. Only CVEs are from before CVEs were cool.
Brought to you by https://wtfismyip.com/
631 Followers
616 Following
50 Posts
Joined January 12, 2023
Website:
Source code:
Signal:
Call attestation and ANI:
1-507-I-ATTEST (1-507-428-8378)
This is my absolute favorite performance of Philip Glass' Mad Rush: https://www.youtube.com/watch?v=gsU-a7ATt3I
Philip Glass - Mad Rush (Marimba Duet)
So I left a window with https://whatismyip.com/ open for 20 minutes. The result: 183 MB transferred, 525 MB uncompressed. What. The. Fuck.
Happy Friday, Motherfuckers!
It's never too late to stop being an asshole.
Seen elsewhere!
This is a wild #rust toolchain bug:
Can only repro when the call to gettid is in a library crate, and only when it has a certain name, and only when not using -C target-feature=-crt-static, only when using LTO... The boundary is exactly at std! Crate names alphabetically ≥ std fail (including std itself), and crate names < std work!
Claude Wrote a Full #FreeBSD Remote Kernel #RCE with Root Shell (CVE-2026-4747): https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd
In March 2026, Kubernetes will retire Ingress NGINX, a piece of critical infrastructure for about half of cloud native environments... Existing deployments will continue to work, so unless you proactively check, you may not know you are affected until you are compromised:
https://kubernetes.io/blog/2026/01/29/ingress-nginx-statement/
#security #infosec #k8s
Incredible testimonial about the weight open source development can have on mental health:
https://myip.wtf/ had a cert expiry this morning, sorry motherfuckers. Should be good again.
Happy Friday, Mothefuckers!
High severity authorization #vulnerability in Keycloak:
- Of course it's because of JWT
- If a project with a sole purpose is authn/authz is getting #JWT wrong, you probably are too.
Merge requests are always fucking welcome for https://myip.wtf https://codeberg.org/wtfismyip/wtfismyip/src/branch/main/wtf/wtf.go
What a shitshow for Trivy: https://github.com/aquasecurity/trivy/discussions/10425
Great #security resarch from the Qualys folks: https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt
Multiple vulnerabilities in AppArmor - everything from information disclosure to DoS to LPE!
For you fuckers who love XML, https://myip.wtf/ now properly escapes in on the https://myip.wtf/xml endpoint: https://codeberg.org/wtfismyip/wtfismyip/commit/c0043c13dc04c2ba0970b3b14bed1acfd1ac25af
Updated https://gnu.gl/ to Mastodon v4.5.8 motherfuckers!
Note to developers: If an HTTP request fails to connect, PLEASE do not say in the error message that it's an "HTTP 000 response code".
RE: https://gnu.gl/@wtfismyip/116156907775318513
aquasecurity/trivy — PAT theft via pull_request_target — Full repo compromise. PAT stolen; repo renamed/privatized; releases deleted; malicious VSCode extension pushed.
I run the majority of my containerized workloads using
Replying to
@leo@twit.social I enabled server-status to investigate some other issue, but noticed there were a bunch of requests against my Mastodon instance.
If you use nginx-ingress, update your Kubernetes clusters folks, like right now:
https://github.com/kubernetes/kubernetes/issues/136677
https://github.com/kubernetes/kubernetes/issues/136678
https://github.com/kubernetes/kubernetes/issues/136679
https://github.com/kubernetes/kubernetes/issues/136680
#infosec #k8s #security
Replying to
@trancilo@fosstodon.org There's a lot more where that came from: https://codeberg.org/wtfismyip/wtfismyip/src/branch/main/wtf/static/static
RE: https://az.social/@godber/116126523215134662
87 here on Friday, I was really hoping we'd have a real winter
Replying to
Identified - A misconfiguration while adding the new primary mirror temporarily impacted access to the kernel archives on our mirrors. A fix has been implemented, and we are currently working to restore all content.
Couple of days ago, guess they're still restoring.
Replying to on az.social
@godber@az.social We've got a bit of a heat wave in LA coming this week after some cool weather. Do you have it coming too?
Fediverse: There's a field recording of children singing a song in a relatively obscure album (RIding Alone For Thousands of Miles: A Boldogság Minden Reményét Elragadták).
Can anyone identify the language or the song?
https://assets.gnu.gl/kids.mp3
And WTF is wrong with MIcrosoft these days? https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/
We can only afford 1 can of Easy Cheese, babe.
Replying to on toot.wales
@robert@toot.wales No alerts from my monitoring and graphs look file- https://myip.wtf/traffic
I'm really sad that Amazon hasn't offered to take https://awsc.li/ off my hands
From some other site
Here's some additional Apparmor config bits to tighten down Mastodon: https://codeberg.org/wtfismyip/mastodon-hardening
#apparmor #infosec #hardening
Practical quantum computing might be here sooner rather than later, motherfuckers!
https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/
And we're on v4.5.7 motherfuckers!
RE: https://infosec.exchange/@cure53/116176749631571550
Don't be that guy!
Fuck outlook autocomplete.
That is all, carry on!
WTF Anthorpic?
However, I need to let you know that we are unable to issue compensation for degraded service or technical errors that result in incorrect billing routing
https://github.com/anthropics/claude-code/issues/53262#issuecomment-4319753593
Replying to
@robert@toot.wales Can you tell how it's broken on your side? Are you getting DNS issues? Timeouts? Resets?
Replying to
@alexskunz@mas.to Yeah, the song could be Hungarian! The rest of the samples/recordings on the album have Iraq war themes, so I was thinking it could also be Arabic.