Akash Mahajan

yeah, i'd cap spend too. a stolen key shouldn't come with an open-ended budget.

People too polite to say it. No other reason other than to deliberately weaken the cert signing process so that this can used for MITM purposes. They could have done bunch of other things that would have been far too difficult to detect. - Keys that were weak in a way they knew about it instead of 4 - Generated certs for domains that aren’t so popular. Not everyone is watching for such issuances - maybe code signing certs - maybe it’s meant for devices who don’t do revocation Guessing this isn’t something they do normally. Got forced and the moment faced scrutiny decided to leave the business altogether. Curious thing for me is how come they had an entire CA business just for a few customers.

The Reporters Collective की इस report को उनके Instagram page से हटा दिया गया। जब उन्होंने हटाई गई report को दोबारा से publish किया, उसे भी 2 मिनट के भीतर हटा दिया गया। क्या है इस report में जो सरकार आपको जानने नहीं देना चाहती... आप ख़ुद देखिए 👇 @reporters_co @TweetSumedha @ShubhangiJourno

Everyone keeps asking who is the secret weapon behind @boardyai… Give this guy a follow. Boardy would not be Boardy without Chris

eMudhra disabled FIPS on the HSM, exported the private key into Python on a computer, and then it got truncated when they re-imported it I have to admit I did not realize CAs were running HSMs with the ability to do this. How many CAs are exporting private keys to computers??

OpenAI and Anthropic have a tabula rasa problem with cybersecurity. It’s been barely six months since the frontier labs started investing heavily in security data for model training. Once Mythos landed, it was clear the “AI breaks the game” moment had arrived. Anthropic claimed to be very focused on working with the cybersecurity ecosystem to “integrate the model safely”, but in reality it ignored almost every conventional approach in the industry. The biggest problem is the very one-dimensional narrative the frontier labs are building, in which the technical side of AppSec is treated as the whole field of cybersecurity. Security is first and foremost about people, process and systems. Technology plays a useful role, but the areas where we try to reduce risk are numerous and hard to tackle. Finding and fixing bugs is just one part of the game: sometimes very important, sometimes completely irrelevant. Exploiting a zero-day in a critical system doesn’t achieve much if the attacker has no way to move laterally within the network and only limited access to relevant data. There’s a reason the majority of successful breaches come down to insider risk and stolen credentials rather than the exploitation of novel bugs. What AI has clearly democratized is access to zero-days. They mostly used to be in the hands of a far larger group than the nation-state actors, elite ransomware crews and occasional 200 IQ obsessive loner who traditionally had them. Today, they’re available to anyone who can spin up an abliterated LLM. What it has really exposed is how poorly almost every company manages risk across people, process and systems. Rather than working with the wider security community to reshape how we work, the frontier labs have often chosen to be adversarial with key researchers and practitioners in the field. To some extent, their goal is to replace every security vendor. That can look greedy, but it’s arguably well deserved. Compared with most other software categories, security vendors are far more likely to: - Sell you software that doesn’t work at all - Sell you software that works but breaks when integrated with the rest of your tools, making it useless - Sell you software that works and fits into your workflow but comes with predatory pricing and deliberate lock-in It’s one of the griftiest corners of the software industry, and the majority of practitioners hate almost every vendor with a passion. Those vendors have responded by pouring money into distribution, building large sales organizations that burn a lot of cash for very little in return. So the frontier labs looked at this and decided to create a new problem, become the main solution to it, and then take over more and more of the industry’s technology layer over time. Pretending that everything after Mythos is a blank slate, and that we’re only now “discovering” cybersecurity, is cynical at best and highly irresponsible at worst. My message is simple: this strategy will fail unless you structurally focus on people and process first. Whether the leadership at OpenAI and Anthropic cares is another matter. They’ve shown repeatedly that they don’t care about the opinions of players in the ecosystem unless they’re big API consumers. But don’t try to erase 30 years of ideas, practices and technology just because they get in the way of token consumption.

This is post is describing a software factory (sort of) and then saying you don't need one. I agree that its not a great term but I haven't come across a better one so until we can come up with one it is a useful word to discuss a pattern: We all need a system that consistently applies a process of shipping code with many concurrently working agents that asynchronously pick up queued work, work 24/7, work in the cloud, and work with a team & product level scope. They are making decisions across an entire team's work. Every team's version of this looks different so we should all assemble a factory that fits our own needs. But saying "its just good engineering" is vague and doesn't help talk about a thing all good engineering teams have to discuss, understand, and build.

If an imposter is misusing the name of @DelhiPolice to threaten @Slfc05 & @internetfreedom then the matter is even more serious. At this rate people will totally stop trusting the uniform... 🚨 fake police is beating up students at Jantar Mantar 🚨 fake police is making 'digital arrests' 🚨 fake police is making extortion calls 🚨 fake police is raping minor girls What the hell is the real police doing then??

#BREAKING X informs Delhi High Court that takedown notices sent to Internet Freedom Foundation and SFLC were by some impostor and not by Delhi Police. X says complaint has been filed to find the impostor and no action is taken against IFF and SFLC. @Slfc05 @internetfreedom

Claude code trouble continues

- They pulled credentials from inside their app's container and used them to request every secret on the platform: ours and every other customer's. - They tried our cloud provider's metadata endpoint, the standard way to steal credentials for the host a container runs on. - They asked the cluster what those stolen credentials were allowed to do. - They went looking for our databases and caches by guessing their internal names. - They port-scanned our whole internal network, all 65,536 addresses, twice. - It was about 24 commands over 15 minutes, done on purpose and scripted. No app was ever run. - Every attempt was blocked. Nothing was accessed.

The Revenge of the Indian American. TRUMP COSIED UP TO PAK. BERATED INDIA AND INDIAN AMERICANS. Big mistake. They voted to punish him.

We’re continuing to investigate the security incident. Our DNS server records were compromised through our domain registrar. We are currently unable to receive emails sent to our domain. Based on our initial investigation this attack targeted the website of a specific customer. We have not seen any indication of a compromise of our internal systems, though we will continue to investigate this.