Luca Bertozzi

Okay this looks cool for a rollercoaster building game

There's no functor like Hom

Update for the blue sky world. In the time passed since my last Skeets I have:
- Found a job as a #C++ developer. The codebase is dogshit but me and another colleague are trying to improve it bit by bit
- Haven't done much cyber security related
- Started learning #Haskell and having a lot of fun

can you explain this better or link something explaining it?

I still have my two bugs, but I've been told I need one more so

well its been since around mid-December I havent looked into this and I literally forgot most stuff I did.

I still have notes, but I definitely forgot a lot of stuff

(please re-post for reach - thank you!)
Learned a cool new Linux trick? Know an interesting quirk in a network protocol? Or have something else to share?

Write a 1-page article for the #6 issue of Paged Out! :)
pagedout.institute?page=cfp.php

Soft deadline is Feb 1st.

gotcha

what about the mannequin?

You go all the way to infect a popular npm package and then deploy xmrig

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack Compromised Rspack npm packages exposed 445,000 users weekly to IP tracking and XMRig malware.

#Rspack: a popular alternative to webpack - a JavaScript bundler written in Rust - #npm package with 300,000+ downloads/week version 1.1.7 compromised with attackers injecting cryptocurrency mining malware:
#SoftwareSupplyChainSecurity
👇
thehackernews.com/2024/12/rspa...

my blog now has a dark mode so at night you dont hurt your eyes anymore

oh there was another one that is pretty obvious. yeah i periodically go back to the challenge, will solve it sooner or later (hopefully sooner)

You post so often about so much cool stuff. Great job

found that 44 percent of the top 100 most-followed accounts on Bluesky had at least one “doppelganger,”

That isn't how statistics works, you don't take 100 accounts and see that 44 of them follow some property and then say 44 percent

My latest blog post is live! nastystereo.com/security/cro...

Read how to send a cross-site POST without including a Content-Type header (without CORS). It even works with navigator.sendBeacon

i added a skeet button to my blog to allow people to easily share content on Bluesky. See it for example here lucabtz.com/blog/pwning-...

cool research!

unrelated question: is the link in the replies because of the X algorithm

Someone needs to make an app to make it easy to follow people you follow on X also on bluesky. Or if it exists already I would like to know the name

Should be better specified though

Whether that is a vulnerability depends on how the script is used, what the source for the handle parameter is etc

pinksky.app it is

Actually I think I found one of the bugs right now!

BlueSky seems less political then both the other options, I hope I can find some cool people on here, on X I got some cool mutuals after my latest blog post ended up on exploits.club, I hope I can find you here too

Mastodon is cool, but it is filled with politics too. While my personal political views are closer to those there and I don't mind it as much as on X, I'd like a place to talk computers, not politics

turns out BlueSky is pretty good: it is similar to what Twitter used to be before becoming X.

X sadly became a MAGA place, my For You page is unusable, filled with posts of Musk and other MAGA accounts which I don't care to read.

I wish my mutuals and the accounts I follow there would move here

finally a reasonable take

Optimist: the cup is half full
Pessimist: The cup is half empty
Topologist: the cup is a donut