Aaron Parecki

Between the 3 Sept and 10 Sept, secure env vars of *all* public @travisci repositories were injected into PR builds. Signing keys, access creds, API tokens.

Anyone could exfiltrate these and gain lateral movement into 1000s of orgs. #security 1/4

https://travis-ci.community/t/security-bulletin/12081

@vibronet on stage: BROWSER FEATURES VS. IDENTITY PROTOCOLS: AN ARMS RACE?
#eic2019

We need permissionless innovation. No to pay pilgrimage to browser vendors to sacrifice the first born. #EIC2021 by @vibronet

Contacted @Teradek about this backdoor in their IP video device firmwares in 2020. They were not interested in it (stopped replying at a point), released an updated firmware in 2021 but without a fix.

Ok, then here is the full disclosure: https://an0n-r0.medium.com/full-disclosure-0-day-rce-backdoor-in-teradek-ip-video-device-firmwares-85a16f346e15

I do know who needs to hear this: good field data and bad lab data might mean that you’ve built a web site targeted specifically at a wealthy audience

this has been your monthly web performance subtweet ok bye

I'd kind of forgotten what it's like to be a daily Windows user, but the amount of 0-day security patches from Apple lately is making me remember.

I can tell how hard the problem I'm working on is based on my inability to pick a codename that doesn't conflict with prior art and the stream of dead bodies before it :)

😬

Struggling to understand how an email/martech platform fits into Intuit’s “fintech for shit that should actually be free or not even exist” go to market