CraHan

GitHub MCP Exploited: Accessing Private Repositories via MCP Comments

GitHub MCP Exploited: Accessing private repositories via MCP https://invariantlabs.ai/blog/mcp-github-vulnerability

Blockchain companies rebranding as Web3 companies rebranding as Metaverse companies rebranding as NFT companies rebranding as AI companies

So, since when does ChatGPT use request information (e.g., IP address) to determine the user's location? Shouldn't it just be using the prompt data? 🤔 #chatgpt

So much this! Anyone who creates single line scripts needs to start doing this by default. There really is no downside to it. From a Python script perspective it's just a comment block.

Honestly, I feel like this is a low effort PR for most GitHub projects.

Ripping a page right out of @deviantollam.bsky.social's air travel book. I started using this pouch for transatlantic flights, hooked onto the seat in front of me with 2 little carabiners. But I know myself. If I don't document this properly, I'll be wondering how I packed it out the last time. 😄

YouTube video by 0xdf Python UV for Hackers

I use Python all the time in most of the roles I've had in information security. One challenge has always been managing virtual environments for packages and one-off scripts. uv solves all that! In this video, I'll walk through how.

www.youtube.com/watch?v=G36Q...

It has completely replaced pyenv for me. Total game changer! Every so often I run `uv clean` to get rid of some stale data and the speed at which it sets everything up again when you run the script or tool from scratch is really impressive. 1-2 seconds for me in most cases.

Sign that says "I've seen smarter cabinets at IKEA"

Another fantastic sign from today at the mall.

a major issue with video games is that they produce a bunch of people who consider themselves brain geniuses for solving problems that were designed to be solvable. as a remedy, we should be making more games that are actively and irreconcilably hostile to the player. thank you

Here comes trickle-down economics 2.0... AI edition! 🙄

Text exchange: them: there was a big accident this morning, just north of us and it took out a transformer me: oh wow. probably the Decepticons

this is what it's like dating me fyi

When Your Threat Model Is Being a Moron No phone, no app, no encryption can protect you from yourself if you send the information you’re trying to hide directly to someone you don’t want to have it.

When your threat model is being a moron

No phone, no app, no encryption can protect you from yourself if you send the information you’re trying to hide directly to someone you don’t want to have it.

🔗 www.404media.co/when-your-th...

Make it happen Cupertino! #severance

End-to-end encryption is secure because it protects the contents of your communications in transit between the endpoints. If you make one of those endpoints an editor at The Atlantic, no amount of encryption is going to save you from your own stupidity.

YouTube video by Congressman Jared Moskowitz Moskowitz Mocks Signal Chat Between Administration Officials

"When we're in like a chat with friends..." 😂 www.youtube.com/watch?v=Modc...

Screenshot from Top Gun: Maverick depicting a computer animated topographical diagram of a mountain range topped with anti-aircraft missile installations.

Blueprint diagram of the G.I.Joe aerial vehicle called the "FANG" or "Fully Armed Negator Gyrocopter"

Crayon drawing from the movie "Home Alone" entitled "Battle Plan" depicting several rooms of a house equipped with assorted traps like broken glass ornaments, icy steps, swinging paint cans, and a tripwire-enabled fan set to blow feathers on a glue-covered intruder.

Screenshot from Star Wars scene where rebel pilots are being briefed on the plan to attack the Death Star.

Liven up the group chats you're in by posting any or all of these images along with some bullshit bombastic emojis like 🇺🇸🤜🤛🇷🇺🧙‍♂️🥵🍆💦

Then abruptly delete it all about 15 minutes later, saying something like...

"Wait, shit, is this the chat WITH reporters or WITHOUT reporters??"

Also, every single one of these provides an RSS feed containing the full length articles. Not something you see so often anymore these days.

Best of all, all of these amazing news sources also provide RSS feeds with full length articles!

The Trump Administration Accidentally Texted Me Its War Plans U.S. national-security leaders included me in a group chat about upcoming military strikes in Yemen. I didn’t think it could be real. Then the bombs started falling.

holy shit www.theatlantic.com/politics/arc...

The Exalted Victory of Cold Harbor Wallpaper — Basic Apple Guy Praise Kier as Mark S. prepares to finish refining his 25th & final Macrodata file.

Download the 6K Wallpaper: basicappleguy.com/haberdashery...

If a client demands an agent in a device, it's going on *their device*.

Yes, that sometimes means I'm carrying 3 laptops to service different clients. It's a cost of doing business.

You might think you know all about IDOR, but that's just because you haven't seen @joswr1ght.bsky.social talk about it!

Mark is beloved by millions of kids, which makes it particularly great that he’s teaching them how to inform their parents that Tesla is a danger to children. This is another one of those “we don’t need a ‘Rogan of the left’, we need normal men” examples.

If you're looking for a Linux Arm64 build of cloudfox, I've got you covered. Builds are available at github.com/crahan/cloud... until my pull request is merged into the main repo. The 'linux-arm64' branch has the updated Makefile in case you want to roll your own. #pentesting #cloud #arm64

Come on down to the White House Tesla Auto Mall!

Tangent of the day: fixing the VMware Workstation icons that don't follow the Papirus icon theme. Good thing you can just grep for the icon names in the .so files.

We got another "critical vulnerability" on #curl reported. I figured you might enjoy it.

"The authentication mechanism in cURL does not properly restrict the number of failed authentication attempts, allowing an attacker to brute-force credentials"

Yawn. Away, away you go.

10/10. No notes.