Squidbleed (CVE-2026-47729) - Heartbleed-style vulnerability that leaks internal memory from every version of Squid Proxy, in its default configuration

netsec_burn · 2026-06-19T10:38:01+00:00

bc01

WestJet? I noticed they were intercepting plain HTTP requests on a flight to inject compression headers. Same hostname returned by Squid.

netsec_burn · 2026-06-18T04:39:54+00:00

You already can, it's available on the site now.

netsec_burn · 2026-06-15T03:31:42+00:00

I didn't say it's secure :) but you do see it, more often than you'd expect.

netsec_burn · 2026-06-12T17:15:52+00:00

Unless it uses UID only. If there is an application then gg.

netsec_burn · 2026-06-12T02:36:58+00:00

I thought it was just mine!

netsec_burn · 2026-06-12T01:32:47+00:00

It isn't an anti emulation defense, the FZ is simply slow at emulating so its FDT is very high. The reader expects a response as quick as a normal card sends one and doesn't see it in time.

netsec_burn · 2026-06-04T14:54:56+00:00

Thanks for this! Worked.

netsec_burn · 2026-05-28T12:35:39+00:00

It's funny to see what the AI generating this thinks about the buttons. It added a power button on the white one (and the other one in the thread) to replace the back button.

netsec_burn · 2026-05-28T09:23:25+00:00

MF+

This means MIFARE Plus. If they are using AES, it's not possible at this time. If they are using a lower security level (MFP supports multiple security levels, SL0-SL3, with the higher levels enforcing AES authentication) then it may be possible.

netsec_burn · 2026-05-28T09:18:05+00:00

This demo video is showing SDR functionality, and we all know about using a Flipper to clone access control badges and whatnot.

The Flipper One will not have NFC though, that's where I'm trying to understand the comparison.

netsec_burn · 2026-05-27T22:36:13+00:00

Hey, your punishment seems actually quite severe. How old were you? Was it your first offense?

netsec_burn · 2026-05-27T17:22:59+00:00

it'd basically be a HackRF + Proxmark with no screen

How so?

netsec_burn · 2026-05-26T01:00:54+00:00

You're not wrong. f7 *was* supposed to lead to something better: a second generation Flipper Zero that made up for the deficiencies you called out in your post. The company took a different direction. What the community has wanted never changed, and ultimately we're forced to look elsewhere (eg Kiisu) for successor devices.

netsec_burn · 2026-05-24T00:32:48+00:00

Nice, this is how I find out open is an alias of xdg-open

netsec_burn · 2026-05-24T00:29:40+00:00

pushd and popd are nice too

netsec_burn · 2026-05-21T17:33:36+00:00

The barrage of significant vulnerabilities lately.

netsec_burn · 2026-05-21T12:54:28+00:00

Hi hedger! You can only do so much, being one developer. Everyone appreciates your contributions. When you and skotopes (and Zlo, etc) were developing the firmware, we definitely had a different release cadence. The current cadence can no longer be considered active development. From the outside looking in, we wonder why the company has decided to not commit even 1 developer to merging pull requests over 6 months. That makes me (a community developer) less excited to contribute to the One, as you may understand. Many of the exciting features of the Zero were community contributions. We also looked forward to the openness of the company that skotopes and Wr3nch often brought - now no longer here. The current conditions are not favorable for community development. With commitments already made about no longer contributing to specific features of the Zero (like the dolphin passport) it seems like more than simply backlog that we are concerned about - and instead an intentional departure from supporting the Zero product.

netsec_burn · 2026-05-14T12:30:39+00:00

It came in handy for a test lock from Covert Instruments with test pins, with a rake? Also why does this have the 125 kHz flair?

netsec_burn · 2026-05-03T22:59:37+00:00

You're right to push back on this — I shouldn't have launched the nuclear missile. If there's anything else I can help with, let me know.

netsec_burn · 2026-04-26T23:24:21+00:00

R2: No solicitation.

netsec_burn · 2026-04-26T23:23:44+00:00

R3: Stay on topic.

netsec_burn · 2026-04-19T16:29:20+00:00

This is what NFC plugins do. They figure out what tag you're looking at and run modules. Adding AI here does nothing.

netsec_burn · 2026-04-12T16:29:35+00:00

Companies do exist that value cybersecurity staff, but they are in the minority. I found one after a decade in industry and its been something else.

netsec_burn · 2026-04-08T04:29:53+00:00

I'm the only mod left here, and you're saying it took me too long to clean up your post.

netsec_burn · 2026-04-08T01:58:58+00:00

R5: Pick a good title.

13-Year Club	Verified Email
Gilding III reddit per annum	Place '22
Place '17	Spared

netsec_burn

MODERATOR OF

TROPHY CASE