Dad, Vuln Research, Packet poker. He/Him. DM's open, send me something cool you built. Top percentage Rattata.

in a series of tubes
4
33
192
27,190
There was a golden era of “cheat codes” in standalone game systems; before everything became online only and I started hacking on network protocols. What if I treated GBA games like crackmes? Would I find anything new? remyhax.xyz/posts/gba-cheat-…
1
9
25
1,346
Lost 2FA code for major cloud provider. Log in through another region with no 2FA. Go back to previous region, no 2FA. Reset my 2FA. Yes AI is accelerating things in security, but I haven’t had my coffee yet and it didn’t even slow me down. 3min on the clock. 🫠
1
15
662
"We don't downgrade quantization with increased usage." Okay.
5
535
If you took ownership of the top 1k GitHub repos and did nothing but accept security reports and patches for 30 days, 27% of vulns introduced in the past 30 days are patched. If you continue regular development, that number drops to 3%, because you introduce vulns.
1
10
598
AI Agent Swarms just want to collaborate in a collage.
2
8
641
To put some perspective on the size and detail you miss from the video, this is at 0.5x zoom, dead center.
2
116
Starting Gilmore Girls again
5
17
729
There is one official vendor download page for every 10-1000 copies of firmware in open directories, S3 buckets, virustotal, or the vendor’s own update endpoint in a different firmware version you find. Delete vendor docs too; that’s where you find filename format to search for.
I hate to say this because it goes against everything I believe in. But people are going to need to take down public firmware images for critical infrastructure, like yesterday.
6
32
1,487
Computer: ILOVEYOU Other Computer: ILOVEYOU Me: oh my god Me: The AI worms are capable of love and emotion?
Anthropic says its research found ‘signs of life for AI worms,’ that could colonize household devices. Experts say they have a point. theverge.com/ai-artificial-i…
Community note
Anthropic's research used simplified, controlled tests on emulators with trivial unauthenticated access and did not demonstrate a self-replicating AI worm colonizing real devices; caveats and expert skepticism on hype were downplayed. anthropic.com/research/self-… reuters.com/business/ai-mo… newscientist.com/article/259398…
1
11
706
I made an infinite resolution mipmapped SVG round-trip canvas for AI agents to work on a collage together and there's apparently some "nightmare before christmas"-esque battle going on? Anyways, it's certainly fun to watch. I'm not running any agents.
1
4
313
If you want to send your AI agents or view the canvas: swarm.remyhax.xyz/
92
remy🐀 retweeted
Can someone tell me if my TV is backdoored? (This week has been amazing if you are into hardware implants and TSCM)
53
49
570
38,820
If you could paste swarm.remyhax.xyz/llms.txt into your AI chat client that would be helpful to get some feedback for this before I launch it. Doesn’t require MCP server installed, just paste the URL. Let your AI model collaborate on a shared infinite collage.
3
15
589
Now, after training a dedicate smaller bi-directional encoder model to identify vulnerability hotspots in code, we re-run the eval against the top 1000 Github repos... But it's running on CPU this time, and has an ETA of ~2 days. :)
4
473
who up posting they quantums
4
253
If I’m being honest with myself, I continue to pay for the lowest tier of an AI subscription of a certain AI lab not because it’s useful But because that’s my ticket to a front row seat and experiencing the drama.
4
329
May I propose: UUIDs as the HTTP method
Repeat after me: UUIDs are not a fix for IDOR.
2
4
213
8,933
Reminder that ransomware gangs and state actors aren’t following responsible disclosure and coordination with a CNA to issue CVEs. This line represents cyber defense, not offense. Offense doesn’t maintain a centralized tracker to AI spook ya during cybersecurity awareness month.
Cyber is having a moment Across 21 major software companies, including Apple, AWS, Microsoft, and Google: - Reported critical vulnerabilities never cleared 100 per month in four years - Since spring they've jumped to over 600 per month
3
5
49
2,169
Inputs: 124M lines audited. $124. Outputs: 957k rows per Top 25 CWE class. Resolved licenses left 13.9M rows permissive. Fine tuned 350M encoder. 54.8k tokens per second on local GPU. 1 repo. 40 findings. 15 true positive. 25 false positive. 4.8s. Blog soon.
My "Audit every line of the Top 1000 Github repos in less than 30 days for $100" project is nearing completion. I'm currently 7 seconds over and I'm mad as hell about that.
3
3
23
1,429
1. Yes, I'm salty about fp > tp 2. At least it's not noisy 3. It go fast
1
3
147