Cybersecurity professional with an interest/background in networking. Beginning to delve into binary exploitation and reverse engineering.

  • 0 Posts
  • 76 Comments
Joined 2 years ago
cake
Cake day: March 27th, 2024

help-circle


  • I have a Logitech g502, so I have 2 extra buttons next to m1 and 3 on the side. Quick melee is always on a side button as well lol. Holding middle mouse to aim grenades always feels awkward to me because of the roll, and that’s always been my first switch to fail on pretty much every mouse I’ve ever owned. I honestly think it’s the single worst physical key to bind an action to in a video game from a tactile perspective.

    In super fast paced fps shooters I usually use G, but that’s just because of muscle memory going back to like Half-Life 1/CS1.6. I tried swapping to a side button for my grenades in the finals and it was not viable for me at all lol.








  • If anyone’s curious, this is the AWS Tanner Campus. It’s right across the street from the official, marked on the map location for AWS’s us-east-1, and they are all IAD- buildings, so they’re part of what makes up the us-east-1 AWS region. The project was announced as early as 2020.

    It consists of four single-story data center buildings spanning nearly 800,000 square feet, which are supported by a massive 192-megawatt electrical substation and backup diesel generators.

    As others here have said, this is not an “AI” data center, it’s a data center that runs massive swathes of the internet as we know it. Either way it’s fucked that they’re approved to build this shit right behind peoples houses. They are right across the street from a regional airport, so maybe that areas zoned commercial? It’s definitely a weird area in general. Driving down prince william parkway you’re seeing tons of straight industrial support shit, like metal shops and construction supply stuff and warehouses with performance car shops with dynos and everything, then you just hit houses.

    It was probably zoned back when nobody ever thought anyone but the rednecks already out there would live that far outside the beltway, but now commuting from Manassas/Gainesville into DC or somewhere else inside the beltway is normal, and they’re building houses where they never thought they’d be building.

    Again though, fuck Amazon and Prince William County for assaulting these people like this.


  • If you’re submitting a vulnerability to a public repo, that’s also your job. These slop reports that are wasting maintainers time should never have been reported. The person tasking the LLM is out of their depth and can’t be the human in the loop that verifies the vulnerability report before submitting because they don’t have the required knowledge to do that. It’s a shame, because if people who had the requisite knowledge were the ones submitting, the ratio of valid reports to noise would be way higher than 5% and open source maintainers wouldn’t be feeling burned the fuck out.


  • I’ve been fucking around with using Claude to solve CTF challenges. I’m using a harness built out of a custom agent I wrote that progressively loads specific a specific skill for the challenge category, cryptography, binary exploitation, reverse engineering, forensics, etc.

    It’s solving the simple shit in <1m using sonnet. It’s solved some shit that I couldn’t figure out at all during the CTF in the time limit we had in ~20 minutes. There’s been 2 challenges that after about 25 minutes I’ll kill the agent working on it, change to opus, then opus solved them in about 20m. One crypto challenge was so math heavy i never would have figured it out. One bin exp challenge didn’t provide a local binary, everything was remote. There was a catch that I never would have solved bc it was remote only and I couldn’t locally debug it.

    It’s fucking scary good at solving these things. I just prompt with “use <agent> to solve ./category/challenge/“ and it fully just does everything. It’s definitely akin a fuzzer that can be used for way more than just finding crashes and memory leaks. It takes some work and understanding to make it context/token efficient I think, but it lowers the bar so tremendously that I definitely see why there’s concern here. And again it’s solving most of these things with sonnet, not even opus and definitely not fable.

    All told, this feels like the same panic that happened when metasploit first got released/demo’d at defcon back in the day.