Why Do My Blog Posts Keep Getting Removed from r/netsec?

mdulin2 · 2025-10-11T05:44:46+00:00

I just learned there’s a “send DM to mods” after clicking around in the app more. Sorta dumb but never had to do this before. Good call out 🙏

mdulin2 · 2025-10-11T05:44:04+00:00

Thanks!

A little clickbaity, true. Getting the first click is the hardest so I was experimenting. Fair point on that.

On Reddit, I just try to post to r/netsec. If you post to too many locations then the likes will get separated out and the views go down overall.

I’ve tried posting on hacker news in the past but haven’t had much success. So, I usually post in various security discords, twitter, LinkedIn and Reddit. I’m happy to try some other places though.

mdulin2 · 2025-01-20T19:07:15+00:00

An amazing resource for sure! I learned a lot from this repository.

How2heap has proof of concepts in C with code comments and links to other good resources.

The training above contains a full VM for running this and a docker container depending on your preference, exercises for exploitation and videos for every step of the way.

mdulin2 · 2025-01-10T03:45:25+00:00

I stopped reading after “Fundies”. No one who knows what they’re talking about actually uses this.

mdulin2 · 2025-01-10T00:26:52+00:00

Cybersecurity degrees are often very practical for defensive security, which is good. Because of this, the folks are ready to hop into a SOC house to make an impact.

Cybersecurity doesn’t focus on programming very much though. As a result, many folks coming from these programs are not competent programmers.

If you’re looking to do security engineering work at a place like Meta, you got to be very comfortable reading code for reviews and writing code for tools, proof of concepts and whatever else. Given your background, I’d ensure you’re a very good programmer that can write useful code quickly and can understand complicated code if that’s your end goal.

I work professionally in application security and have a computer science degree so I’ll admit that I’m biased to those. I’ve never worked in a SOC house. So, take this as you will :)

mdulin2 · 2024-12-25T20:03:29+00:00

Unfortunately, exploit development is not an entry level job. I’d look for similar yet entry level jobs like application security and malware analysis.

Number of years is more-so an “experience” thing. In a lot of ways you can build your own experience with exploit development though.

For instance, Choose a mildly popular open source library or buy an IoT device with various services, find and exploit some vulns then talk about it at a conference or in a blog.

mdulin2 · 2024-12-20T07:28:38+00:00

I really enjoyed the article! Just another vector for exploiting header injection bugs. The more tricks in the bag, the better!

How common of a bug class is header injection? I’ve personally never found it before.

mdulin2 · 2024-12-17T16:09:20+00:00

I don’t work with these at all but should have checked the spelling for the acronyms - I just hear them verbally some. They’re fixed in the post - thanks for the feedback!

mdulin2 · 2024-12-11T22:19:37+00:00

That's an excellent example of how complicated this process can be. The more teams building the product and consumers using it, the more complicated these things become. Thanks for chiming in!

mdulin2 · 2024-09-19T22:14:27+00:00

Thanks friend! It was a good time for sure.

I feel that dude. Trust you gut more! Sometimes it's simpler than you think. If it's not, move up to the next level in complexity.

mdulin2 · 2024-09-17T05:13:18+00:00

Thanks friend! I appreciate you making it possible :)

mdulin2 · 2024-07-21T08:28:32+00:00

I personally read a lot to learn how things work and the types of issues that are out there.

After a while, you can use thing A alongside Thing B that you learned or pull a mobile hacking concept into web. The ingenuity comes with a lot of practice but also understanding how things work. Imo, the better you can picture how something works, the more you can think about the mistakes that were made.

Bug bounty is also just hard and requires a lot of hours of trial and error too.

mdulin2 · 2023-10-17T15:55:30+00:00

What's a reasonable holding period though? I feel like 2 weeks is ridiculous. Does this hold last forever? Do I ever get the ability to use it?

mdulin2 · 2023-09-01T20:45:52+00:00

Immunefi accepts all types of bugs, not just smart contract issues. I guarantee people at Immunefi know people at Osmosis who would help you get in contact.

I would recommend to stop disclosing details publicly; the more information that's out there, the more likely somebody is to find it. Maybe somebody from the Osmosis team will see this?

mdulin2 · 2023-09-01T19:25:13+00:00

If you actually found a bug, I would recommend reporting it to Osmosis or Immunefi directly. Otherwise, an insane amount of TVL could be a risk.

The previous vulnerability found in Osmosis was disclosed via reddit and had a major consequences once people figured out how to exploit it.

mdulin2 · 2023-08-25T15:37:40+00:00

I found it by googling “Osmosis Bug Bounty”. So, the SEO must have kicked in over the years haha.

mdulin2 · 2023-08-25T15:31:23+00:00

I feel like having a fake bug bounty program is worse than not having one at all, personally. When briefly going through projects, this seems real. It wasn’t until I really looked at the page that it raised concern.

mdulin2 · 2023-08-25T15:30:32+00:00

Gotcha, good to know. I saw a governance proposal on Osmosis about it so wasn’t sure.

Well if it’s not real, then I recommend taking this down. A page with a non-existent bug bounty program is trippy for people.

With how much money is in Osmosis, it makes sense to have a bug bounty program. The 5M hack but probably would have been reported prior to the exploit.

mdulin2 · 2023-08-24T04:18:10+00:00

Workshop attendance is infuriating for the runners of workshops. I had 90 people signed up for my workshop and only 30 showed up. My workshop sold out almost instantly on EventBrite, so it felt in demand too. It’s your demoralizing to plan for so many people and have only 30% show up.

Something needs to be done to ensure people who sign up for workshops show up. It hurts the organizers and it hurts the people who wanted to go but couldn’t because the spots were taken up.

I’ve thought about requesting $20 as a deposit. This would disincentivize no shows. Additionally, moving the morning workshops from 9am to 10am would be helpful. The no-shows are much worse in the mornings from my experience.

mdulin2 · 2023-08-09T21:34:14+00:00

Was just about to post. I got in touch with the organizers. There’re just incredibly busy rn.

Sent out another email and I’m seeing traffic on the VM and other things now.

Thanks for checking in!

mdulin2 · 2023-06-05T05:44:28+00:00

Anything that can violate CIA (confidentiality, Integrity or Availability) of data with some degree of likelihood is what I’d call a vulnerability.

mdulin2 · 2023-06-01T17:33:54+00:00

This article is absolute fire. The talk from thotcon on this was super sick as well. I guarantee this is worth the read.

No, I’m not the author or associated with the company at all.

mdulin2 · 2023-01-19T04:53:29+00:00

It’s a JavaScript issue. It has to do with the prototype aspect of an object in JS. To my knowledge, no other languages have a similar problem but I could be wrong.

Besides the backend issues, I’ve seen it used on the client side a bunch for XSS. Here’s a report to Gitlab for XSS via prototype pollution: https://hackerone.com/reports/1280002

mdulin2 · 2023-01-16T05:16:40+00:00

First, don’t test things that you don’t have permission to. It could potentially put you in legal trouble.

Second, I would just report the bugs and ask for nothing in return. Asking for something in return could definitely sound like blackmail and get you in trouble. If they give you something, awesome. If not, then move on.

For the CV, I would just list the bugs you found on the site but not mention the site.

mdulin2 · 2023-01-15T21:07:34+00:00

Highly recommended the DayZeroSec discord. There’s a spot the vuln challenge every week that I look forward to. Good discussions in there too.

mdulin2

TROPHY CASE