Matthias Luft

#NoKings in Munich, Germany.

Regarding U2F: It is a small detail, but I learned to love the pattern of requiring additional verification for truly sensitive actions. Drastically reduces admin ATO impact.

Not from the US, but is that this “why did the chicken cross the road” thing?

Well well well...
It's all starting to make sense now!

#TACO started by @megancnbc.bsky.social - and she has way too few followers for that, let’s change that.

TACO.

linux_smb_vunlerability_prompt.txt linux_smb_vunlerability_prompt.txt. GitHub Gist: instantly share code, notes, and snippets.

If you read the post about O3 finding a SMB bug in the Linux Kernel, I did a few tests and I what I suspected looks true: Gemini 2.5 PRO can more easily identify the vulnerability. My success rate is so high that running the following prompt a few times is enough: gist.github.com/antirez/8b76...

It’s funny that you can go through 20 years of schooling without ever seeing the idea that writing is a tool for thinking.

YES!

Most companies are getting AI implementation wrong.

They’re focused on using it to *replace* humans rather than *enhance* humans.

The ones that recognize this now will gain a massive lead in this race.

I wrote up some more information on the differences between adding SYS_ADMIN and CAP_SYS_ADMIN to pods in Kubernetes. It highlights some new things I learned about how the CRI you use can affect how pods are run. raesene.github.io/blog/2025/04...

YouTube video by World Wide Technology Staying Ahead of AI Policy and Governance with a Global Framework

Trustworthy and Responsible AI....it's a real thing!

www.youtube.com/watch?v=fhcY...

ls-lint An extremely fast file and directory name linter - Bring some structure to your project filesystem

I didn't even think about this yet, but linting file- and directory names in project structures makes a lot of sense - and there is of course a tool for it:

ls-lint.org

Alright AKS, pick a lane:

Kubenet: Pods receive IP from an overlay network. Retires March 2028

Azure CNI Standard: Pods receive IP from VNET

Azure CNI Overlay: Pods receive IP from an overlay network.

Great article on using GitHub as a workflow platform:

github.blog/engineering/...

Can absolutely recommend for security workflows and management as well!

Quick note on exploits trying to use `nginx.ingress.kubernetes.io/server-snippet`: That annotation has been identified as an issue before and has been disabled to mitigate CVE-2021-25742.

GitHub - hakaioffsec/IngressNightmare-PoC: This is a PoC code to exploit the IngressNightmare vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974). This is a PoC code to exploit the IngressNightmare vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974). - hakaioffsec/IngressNightmare-PoC

Quite some #IngressNightmare #CVE-2025-1974 PoCs on GitHub now that look good at a cursory review:

github.com/hakaioffsec/...

github.com/yoshino-s/CV...

github.com/Esonhugh/ing...

github.com/hi-unc1e/CVE...

github.com/lufeirider/I...

github.com/zwxxb/CVE-20...

github.com/rjhaikal/POC...

IngressNightmare: Kubernetes Ingress-NGINX Vulnerabilities Explained | Averlon Discover how IngressNightmare — including CVE-2025-1974 — exploits internal exposure in Kubernetes. See what’s at risk and how to secure your ingress path.

I wrote up some details on exploiting #IngressNightmare #CVE-2025-1974:
www.averlon.ai/blog/kuberne...

Where are we at with releasing a full PoC?

The 'IngressNightmare' vulnerabilities in the Kubernetes Ingress NGINX Controller: Overview, detection, and remediation | Datadog Security Labs Learn how the Kubernetes Ingress NGINX Controller vulnerabilities work, how to detect and remediate them.

Great #IngressNightmare CVE-2025-1974 write-up:
securitylabs.datadoghq.com/articles/ing...

Key point missing from many other sources: Exploitation from Internet is non-default and unlikely, but privilege escalation within cluster is by default possible.

Last week we launched a free webapp that shows the tens of thousands of UK companies whose ownership is being hidden, in most cases unlawfully.

It's now easier to use, faster, and has way more features. Quick thread.

GitHub - FFmpeg/asm-lessons: FFMPEG Assembly Language Lessons FFMPEG Assembly Language Lessons. Contribute to FFmpeg/asm-lessons development by creating an account on GitHub.

TIL that because the FFmpeg project has gained so much experience in hand-writing assembly code to provide huge speedups, they now are putting together a series of lessons for learning assembly:

Vibe coding is fun and all, but this is probably a better use of time!

github.com/FFmpeg/asm-l...

About webhooks - GitHub Docs Webhooks provide a way for notifications to be delivered to an external web server whenever certain events occur on GitHub.

Wow, GitHub not supporting IPv6 for Webhooks:

docs.github.com/en/webhooks/...

In an effort to bring here what little of value is still on the birdsite, allow me to present some absolutely bonkers corporate espionage, in which Deel's execs had a spy at rival Rippling. The complaint is a gripping must-read! rippling2.imgix.net/Complaint.pdf

GitHub - uchi-mata/dostainer Contribute to uchi-mata/dostainer development by creating an account on GitHub.

I updated my #Kubernetes resource exhaustion testing tool to include inode exhaustion:
github.com/uchi-mata/do...

Trump vs Gov of Maine.

Watch this

German elections on Sunday as well, we might well join you in that sentiment 😅