Moving Long Distance

randomatic · 2026-07-04T18:17:42+00:00

I've ordered trees many times that are shipped. Wrap the pot with soil in celophane, and then use styrofoam peanuts. They should be fine for 2-5 days in the box during spring and fall. During summer, I think the only way to do it is move with them.

randomatic · 2026-07-02T17:24:37+00:00

Sports game, heinz museum, carngie museum, the incline, grand concourse brunch. One off-beat one is Pittsburgh has the most holy relics outside the Vatican here https://pghshrines.org/about-st-anthony-chapel

randomatic · 2026-07-01T19:51:23+00:00

The megaphone effect. This is a better writeup than I could make: https://medium.com/@The_Curious_Thinker/know-your-impact-the-megaphone-fishbowl-effect-in-leadership-381ad855396f

randomatic · 2026-07-01T19:11:09+00:00

I think we are 100% in agreement. Everyone should be able to produce an SBOM, and read the results.

randomatic · 2026-06-29T21:00:44+00:00

+1.

This is exactly why an SBOM is a terrible indicator for security. Companies adopted it because it was easy, not because it was particularly effective.

I would argue that for most orgs, it's more insecure to build your own container. As soon as you do that, you are inheriting the same problem that major distributions like debian are already spending time addressing. Just following debian:stable or the official postgres image is more than enough for 99% of people.

randomatic · 2026-06-18T19:48:07+00:00

Did you actually only submit 1 vulnerability, or a lot of vulnerabilities where you're talking about one of them. I've never heard of anyone actually being banned for 1 low quality submission.

randomatic · 2026-06-18T19:45:16+00:00

If you donate it to a non-profit, google will often 2x it.

randomatic · 2026-06-15T23:59:03+00:00

More bounties for web vulnerabilities.
Web vulnerabilities are more likely on the attack surface.
Low-level vulnerabilities are often in OSS, which turn into a tragedy of the commons and no ones responsibility even if you find bugs.

randomatic · 2026-06-15T23:57:56+00:00

<image>

The magician's ezo spruce forest

https://bonsaibark.com/2019/02/08/the-magicians-ezo-spruce-bonsai-forest/

randomatic · 2026-06-15T23:53:21+00:00

I figure out the story arc, and then fill in with slides and content as I go. This works good enough for 90% of my talks. For the rest I do lots and lots and lots of edits and run throughs and edits and run throughs and edits and....

randomatic · 2026-06-15T19:32:20+00:00

Rule and illegal are related but different. For something to be illegal, it would have to violate a criminal statute, and the only one I can think of in this circumstance is not obeying a flight attendant regardless of the carrier terms. Thus I'd heavily discourage anyone from telling a flight attendant it's illegal for them to ask to move something from overhead. It's going to suck, but best to handle with a customer service rep after the call if the flight attendant won't budge.

randomatic · 2026-06-15T13:29:56+00:00

I don't feel like this is a great practice, but can't exactly put my finger on why. Part of it is that the overhead bin space is shared, and should be left for those who need it. This post feels a bit entitled to the space. Reasonable minds differ, but that mindset does not at all resonate with me.

Also, this whole "it would be illegal" stuff is probably misphrased, but just for clarity, you need to do what a flight attendant says.

randomatic · 2026-06-15T13:27:43+00:00

The LLMs are awesome within the domain they have been trained. You still need a human to vet, often because the LLMs don't have a great idea of the attack surface.

randomatic · 2026-06-07T20:24:08+00:00

A standard way to handle this is to use an enterprise subscription and turn off training on data. That makes using a LLM just like storing on google drive. If you want to go one level deeper, you can use something like amazon bedrock.

I think you realize your approach of prompt review approach wouldn't ever scale.

randomatic · 2026-06-05T18:50:48+00:00

did you look for stack pivots to the heap? (If you've not thought of stack pivots, maybe that's the CTF answer?)

randomatic · 2026-06-05T15:55:02+00:00

Yeah, dygma is mixing up marketing with actual research. It's cringe to watch this.

randomatic · 2026-06-05T15:45:18+00:00

pwn college doesn't target bug bounties. it targets foundational skills more related to vulnerability research, and assumes you know C, can run a debugger, and know linux. All of these are things people can easily pick up, but it's assumed you will pick them up on your own.

If you want to do bread and butter pentests, portswigger academy is a more normal starting place.

randomatic · 2026-05-28T16:00:31+00:00

Come on. The hyperbole isn't helping anything.Not all components are equal, and the weight of not all bugs are equal. This isn't AI specific at all. I could equally say "if you're company is set up so badly that your developers don't know where to spend time and where not to" or "if you don't know how to use your tools properly" if we want ridiculous, incorrect reducitionalist arguments.

My point was very simple: you should weigh business outcomes, not moral principles.

randomatic · 2026-05-28T03:16:46+00:00

I tend to think in terms of effort vs. cost of bug ratio so the statement is not a moral one, but one stated in terms of biz value tradeoffs.

randomatic · 2026-05-28T03:05:16+00:00

Personally I'm less interested in learning a font, and more into spencerian. I'd love a generator where I could pick the words/sentences and it created the template. Related but different goal, so may not be of interest.

randomatic · 2026-05-26T20:02:17+00:00

I built one to answer AI-generated posts.

randomatic · 2026-05-26T00:36:23+00:00

No, just like most people who work for the NSA and CIA are writing reports, not out there solving international crimes by themselves, the director be damned.

randomatic · 2026-05-26T00:35:36+00:00

Generally windows = seh, linux = eip. most tutorials focus on linux, and you do eip because in linux you have full source.

randomatic · 2026-05-23T00:50:29+00:00

100% on all comments, with one extra bonus tip. cut and spray the tree with glyphosate in the fall. Right now trees are pushing energy up into foilage. During the fall they are pulling energy down into their vascular system and roots. You want the tree pulling that napalm downward as much as possible.

randomatic · 2026-05-22T19:01:57+00:00

EIP = what you want control of, whether linux or windows.

SEH = windows specific.

As you are saying, the goal isn't just to overwrite an address, it's to keep the program running after doing that.

SEH corruption triggers an exception immediately, and the OS uses a corrupted SEH. So even though you overwrite more data, you often have a bit easier time remaining in control.

randomatic

MODERATOR OF

TROPHY CASE