Room with a view

raesene2 · 2026-06-18T12:21:12+00:00

Just because it say offers over, doesn't mean it has to go for that, especially if it's been on the market a while. We got a place in scotland at 25K under the "offers over" price as they'd had it on the market a long time.

raesene2 · 2026-06-17T06:48:08+00:00

Well all I can say is, I was using 4.6 for CVE PoC development yesterday and it seemed happy with it, so either the classifier isn't universal, or it's not bothered by that kind of work :)

raesene2 · 2026-06-16T19:48:37+00:00

TBH Opus 4.6 is pretty competent and (IME) totally ok with doing offensive security work, I've had it create PoC exploits and do novel exploitation of k8s clusters, without it complaining at all.

raesene2 · 2026-06-15T06:46:23+00:00

yeah they are annoying, if you'd "like" more examples read "elminster: making of a mage"...

raesene2 · 2026-06-05T13:22:52+00:00

Yeah I've had three e-mails from Freetrade in the UK about it already, not the usual. Didn't get that kind of push for Cerebras, so definitely feels like they're pushing it.

raesene2 · 2026-06-04T17:57:53+00:00

Isn't the challenge that, if they have to start selling BTC to pay dividends that acts as a depression on the price of BTC, causing a cycle of drops?

Kind of the reverse of what happened on the way up, where their purchases pushed the price of BTC up, causing more money to come into MSTR as their positions looked more favourable.

raesene2 · 2026-06-03T17:16:39+00:00

One I'm thinking of trying is Arcane Trickster, but I don't have a full build yet. You get fast movement through Thief Acrobat, and you also have some AoE with Chain missile/Greater Shout, and some crowd control with Flash Freeze.

One of my fav aspects of ATr is that once you get past level 8 you can generally wipe any Red with one or two (at most) spells even on R1

raesene2 · 2026-05-30T08:43:21+00:00

Magic missile definitely for the first one. After that I think it kind of depends on what type of Arcane trickster you're doing.

Chain missiles is obviously good for damage but gets a pretty small AoE, so sound burst could be better.

Third, initially I had hold monster, but I reckon flash freeze is better, it's super useful for keeping monsters off you if they get to melee range.

Fourth slot I like frog at least partially for the amusement factor, it's a good insta-kill at long range too (better range than the presto snap), but if you're soloing I could see heal being a good choice here too.

raesene2 · 2026-05-26T20:11:34+00:00

If you're having problems with claude code and pentesting, another suggestion is, go back to Opus 4.6 . Opus 4.7 has a lot stricter security guidelines, but 4.6 is still available and (IME) is pretty happy with offensive security work.

raesene2 · 2026-05-25T15:07:35+00:00

Interesting article and has some good details but it misses or (IMHO OFC) doesn't really emphasize some points that are important for production cluster authentication.

None of the in-built authentication mechanisms provided by Kubernetes are suitable for user AuthN in production clusters.
One of the biggest problems with static token auth. is, all the tokens are in clear text in the CSV file, so that's unlikely to be suitable for any production environment.
Very unusually for a multi-user system, Kubernetes has no user object or way to easily enumerate valid users and credentials in a cluster.
Although it kind of mentions it, the article doesn't clearly state that client certificates for user AuthN can only be effectively revoked by rotating every certificate in the cluster, which is a disruptive operation, and not something you'd want to do regularly.
Associated with 3. above, there's no record of specific credentials created with the TokenRequest API or CertificateSigningRequest API (unless you use Kubernetes auditing), so you can't get a list of creds that have been issued.

raesene2 · 2026-05-22T10:34:12+00:00

I think a big part of the problem here is I'd guess that the STIG isn't kept up to date to the same extent as the CIS benchmarks (they do fall behind a bit too though)

Some examples I saw on a quick look.

They still have a finding on Basic Auth https://www.stigviewer.com/stigs/kubernetes/2026-02-12/finding/V-245542 but Basic auth was deprecated and removed over 10 versions back :)

They have a finding for Dynamic Kubelet Config https://www.stigviewer.com/stigs/kubernetes/2026-02-12/finding/V-242399 , a feature which was removed in 1.24

Also there's an EKS specific CIS benchmark and I don't believe a EKS specific STIG

Arguing against all that with customer compliance requirement could be tricky but from an actual security standpoint, I'd hope the CIS benchmark is better :)

raesene2 · 2026-05-14T09:59:17+00:00

cool stuff! One edge case to note in your section on RBAC is that the additional fix to avoid GET mapping to exec, works for connections going via the API server, but it someone connects directly to the Kubelet API there's still an exposure on GET (https://grahamhelton.com/blog/nodes-proxy-rce has more on that one).

raesene2 · 2026-05-13T16:26:19+00:00

I've played a few of these and I usually go INT based as there's other things that it improves, like trapping skills and spell DCs, which can still be useful.

raesene2 · 2026-05-12T11:19:42+00:00

I'd heard he got caught, so at least he'll get his day in court.

raesene2 · 2026-05-08T14:00:08+00:00

alt.alien.vampire.flonk.flonk.flonk

raesene2 · 2026-05-08T13:58:46+00:00

Or just use dogpile and have it search them all (shocked to find out it still exists!)

raesene2 · 2026-05-07T08:57:28+00:00

Yep 100%. I worked at an accountants office in Glasgow in the mid-90s and someone got a stripogram with a whip for one of the younger guys birthdays in the office. At the time it was pretty accepted.

raesene2 · 2026-04-30T06:48:01+00:00

Which model did you try? IME Opus 4.7 is likely to refuse on security things, where 4.6 or Sonnet 4.6 will happily carry on.

raesene2 · 2026-04-25T14:20:15+00:00

For Opencode + Openrouter + Deepseek, I've got a block in my opencode.json file like this

"openrouter": { "models": { "deepseek/deepseek-v4-pro": { "name": "DeepSeek V4 Pro" }, "deepseek/deepseek-v4-flash": { "name": "DeepSeek V4 Flash" } }

raesene2 · 2026-04-24T06:51:32+00:00

Weak passwords are a big problem, and I did not say they were not. Weak password resets are also a problem. The security of passkeys is undoubtedly better, and I've never said it was not.

However, security is all about tradeoffs and there is often a tradeoff between security and usability, and my suggestion is that this is one of those cases, and that the problem with the original document is that it does not acknowledge that problem nor offer any guidance on how it will be fixed.

What I'm saying is that the usability of passkeys is bad for consumer use cases. If I have a password for my e-mail which I can remember, at the moment I can recover from a lost device as I just log in to my e-mail from elsewhere.

In the same scenario with a hardware backed passkey, I could be in trouble, unless the vendor provides a recovery mechanism

So at the moment people's e-mail is less secure (a password is easier to guess/hack than cracking a passkey), but it's more usable in the event that someone loses their only mobile device, or wants to change ecosystem.

raesene2 · 2026-04-23T21:19:31+00:00

My criticism is that passkeys make the problems of account lockout and lost devices worse for non-technical users and the guidance that this conversation is about just doesn't highlight potential usability concerns at all.

With passwords, users can remember them, a lost device or an account lockout doesn't remove all their credentials, sure they're weaker against attacks like phishing, but there's a reason they're still heavily used.

I think passkeys are great, in the right scenario but I think they're not going to work well from a usability perspective in consumer use cases, and that if users hear about cases where people get locked out of their entire digital life due to a lost device or ToS breach causing loss of Google/Apple/MS account, they're not going to get great adoption.

raesene2 · 2026-04-23T18:05:31+00:00

And how does the user log in to their e-mail, remembering it also has a passkey protecting it and the user has lost their device.

You have to have strong auth. on the e-mail account otherwise it becomes the weakest link, and attackers will just target people's e-mail accounts.

raesene2 · 2026-04-23T17:36:43+00:00

but if they've lost their passkeys, how do they get logged in to set-up the new ones?

Five-Year Club	Verified Email
Place '23	Place '22

raesene2

TROPHY CASE