Matt "msw" Wilson

I added a sentence to the #curl hackerone submission page:

"Please present your case briefly and to the point. Do not use an AI to help you blab hundreds of line that will exhaust us to death instead of making us understand your claim."

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | Amazon Web Services Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat g...

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182)

aws.amazon.com/blogs/securi...

Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" ... Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.

Throwback Thursday...

socket.dev/blog/node-js...

Node.js — Updates on CVE for End-of-Life Versions Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

These were the rules when the original plan was made to issue CVEs merely because Node.js versions were EOL. This outcome was easy to predict...

nodejs.org/en/blog/vuln...

Why? Because

4.1.13 The state of a Product being EOL, by itself, MUST NOT be determined to be a Vulnerability.

www.cve.org/resourcessup....

Node.js — Tuesday, January 21, 2025 Security Releases Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Vendored deps are not unusual at all...

But, unfortunately, misuse of the CVE program is all too common in the NodeJS community.

Let's take CVE-2025-23087, CVE-2025-23088, and CVE-2025-23089 for example. All of these CVEs are REJECTED. nodejs.org/en/blog/vuln...

> The decision to publish a second CVE for Next.js was made due to these exceptional circumstsances: Next.js does not include React as a traditional dependency - instead, they bundle it "vendored"

react2shell.com

There are definitely PoCs circulating…

Unpopular opinion: a vulnerability that was disclosed privately by researchers and had a coordinated response from vendors and service operators under an (albeit short) embargo is not a “0-day”.

4.1.12 The act of updating Product dependencies MUST NOT be determined to be a Vulnerability, regardless of whether the dependencies have Vulnerabilities.

www.cve.org/resourcessup...

A public service announcement regarding CVEs: one identified vulnerability gets one CVE.

Each vendor doesn't get their own CVE that corresponds to their security bulletin.

CVE-2025-66478 is REJECTED as duplicate of CVE-2025-55182
www.cve.org/CVERecord?id...

YouTube video by RedMonk Not overselling #aideveloper and #devtools as magical at #aws with Ali Maaz & Jessie VanderVeen

To celebrate #awsreinvent, @redmonk.com has been publishing New Builders conversations w @awscloud.bsky.social leaders every day this week & TODAY IS MY DAY 🎉🎉🎉!! Hear AWS's Ali Maaz & Jessie VanderVeen chat all things #AI & #DevTools w me redmonk.com/videos/insid... www.youtube.com/shorts/Ot0gy...

Unpopular opinion: through an economics lens, the optimal number of CVEs in most software systems is almost never 0.

Culture eats AI adoption strategy for breakfast, lunch, and dinner.

"Our only modification part is that, if the Software (or any derivative works thereof) is used for any of your commercial products or services that have more than 100 million monthly active users, or more than $20M in monthly revenue, you shall prominently display 'Kimi K2' on the user interface"

I mean, honesty is a human trait. The humans who built that particular AI system biased the set of mysterious numbers (through reinforcement, filtering, etc.) so it assembles tokens in a way that conveys information about the properties and limitations of the system they built.

That's all.

The sun rises at the horizon, reflecting of the water of Eagle Harbor. The car deck of the Washington State ferry Tacoma is in the foreground.

#FerryLife #WAWX #Seattle #Sunrise

Strengthening Liquibase Community for the Future Liquibase Community now uses the Functional Source License (FSL). Learn what this means for developers, contributors, and enterprises, and how it protects sustainability.

"As adoption has grown, so has our responsibility to ensure the project remains sustainable and continues to thrive. That’s why, with the release of Liquibase 5.0, we are updating the license for Liquibase Community."

www.liquibase.com/blog/liquiba...

Metrics are increasingly employed as trust deteriorates. Recommended reading ⬇️

#monktoberfest

a.co/d/im8AStV

Coming to a New Awareness of Organizational Culture

Ref: Edgar H. Schein sloanreview.mit.edu/article/comi...

#monktoberfest

“Organizational culture is the pattern of basic assumptions that a given group has invented, discovered, or developed in learning to cope with its problems […], and that has worked well enough to be considered valid, and, therefore, to be taught to new members.”
The stories we tell are how we teach.

"apparently web traffic is down because Google is giving you an answer already in the results, and you no longer have the need to visit a website"

I mean, this has been a complaint for a while, even before AI entered the timeline? Who needs to go to a music lyrics website when it's in the Info Box?

"Piracy lost, but it was always going to lose. Streaming won."

But did the reader / listener / viewer win?

And did the content creators win?

🤔

PSA: attacks on public infrastructure like software package registries are on the rise. Here’s an active one targeting folks who have crates.io accounts.

I am happily paying Nabu Casa for Home Assistant Cloud.

And in the words of @booch.com “Every line of code represents a moral decision"

It’s really hard for OSS projects too. Imagine a leaked GH access token from a project maintainer who is not responding, and who is not an employee because OSS isn’t a company. How do you the project get that token revoked? You can’t. You have to de-list the maintainer from your GH org.

Tricky thing is when people have built their own automation (predating Actions), using CI/CD tools and services, making for something other than a “pure GitHub” implementation. 😬

That said: prevention > detection, as always

Also, speaking for myself, hurray for watchful, diligent security folks detecting things before vandals could fix their syntax error.