aberoham

Engineers often over-think compliance. SOC2 is regulatory capture, and an audit that tests your controls. You define the appropriate controls. As long as you do what you say you're going to do, you should pass the audit. It's not rocket science. It's a feature of a correct system that it is auditable. How easy it is to audit is really a function of your maturity. SOC2 and its ilk such as ISO27001 are just maturity signalling mechanisms. Stop overthinking it or applying black and white rules -- in actual practice its always shades of grey and most auditors are just happy to have an engaged and switched on team to be auditing, vs someone who treats it as adversarial. You're paying them!

What would it mean if someone were to successfully exploit these? Most or all L2 ecosystems or the magic components that let them speak to each other would need a hard reset?

I wonder about this technique vs simple SVM classifiers: https://x.com/rosmine/status/2056406399471558872?s=20

He’s busy with MathAcademy earning XP-SEC

export CLAUDE_CODE_DISABLE_1M_CONTEXT=1

UpCloud

I'm really hoping this means GCP Security Command Center quickly gets subsumed by Wiz

"the remaining 2% were large batch requests", [which made up 50% of the work] .. who really watches that many shows on Netflix? What was in those batches, if someone is watching that much, why bother with serendipity at all? Most serendipitous thing you could do is shut off their subscription.

Claude Cowork grabs local DNS resolution on macOS which conflicts with secure web gateway aka ZTNA aka SASE products such as Cloudflare Warp which do similar. The work-around is to close Cowork, let Warp grab mDNSResponder's attention first, then restart Claude Desktop, or some similar special ordering sequence. It's annoying, but you could say that about everything having to do with MITM middleboxes.

Wow, you have to try claude code with Opus-4.6..

Can relate. The UK electronic eVisa app was pure garbage. The major redeeming feature of the UK civil service and the various regulatory quagmires is that they're effectively open source. You (or Claude) can read through their practice manuals or policies and find a work-around. But my goodness is it annoying until you figure that out. Another fascinating bit is you may think the various departments are connected but they are not. The nice looking UK Government Digital Service (GDS) Design System gives everything a veneer of connected competence, but under the bonnet, that slick UI signal is as reliable as a posh accent. Don't become a migrant if you don't have to.

It sounds like you want the sort of logs that Teleport captures https://github.com/gravitational/teleport

Meredith's talk was extremely scripted, not very original and then she ducked out of taking any audience questions. Udbhav awkwardly stood there but seemed like he could have had much more to say. It was hard to watch.

Mona Wang's talk early on Day 2 wasn't recorded but was the polar opposite -- Original, off-the-cuff, engaging, and just fun to witness.

https://fahrplan.events.ccc.de/congress/2025/fahrplan/event/... https://m0na.net/papers/wirewatch.pdf

I find Jesse's style to be fascinatingly apt storytelling, and not until recently after reading many of his prior posts did I realise that he's not in fact some old-timer who lived through the history he often writes about. Bravo for putting this original content out there, JB. What's next?

For context: https://news.ycombinator.com/item?id=46065585 OpenAI's announcement and https://news.ycombinator.com/item?id=46065208 CoinTracker’s

Someone running cloudflared accidentally advertising a critical route into their Warp namespace and somehow disrupting routes for internal Cloudflare services doesn't seem too far fetched.

We vibe coded a tool to mass disconnect Cloudflare Warp for incident responders: https://github.com/aberoham/unwarp

To go along with the shenanigans around dealing with MITM traffic inspection https://github.com/aberoham/fuwarp

The irony is even deeper than it appears. According to current US copyright doctrine, if Claude genuinely did all the work with minimal human creative input, the Salt Bae dash of ASL2.0 is essentially decorative - you can't license rights that don't exist.

The research shows the US Copyright Office hasn't caught up with `claude` code: they claim that prompting alone doesn't create authorship, regardless of complexity. Without "substantial" human modification and creative control over the final expression, the code lands in public domain by default. Not that it matters here, but anyone could theoretically use Ronacher's library while ignoring the Apache 2 terms entirely.

What makes this fascinating is that Ronacher knows this ("Is that even valid when there's barely a human in the loop?") but published anyway. It's a perfect microcosm of our current predicament - we're all slapping licenses on potentially unenforceable code because the alternative is.. what exactly?

I've found this from an old-school systems geek to be useful https://github.com/giantswarm/mcp-debug -- especially its REPL mode

Did you try rustls-tls-native-roots? rustls-tls defaulting to only use the webpki bundle caught me off guard on a system with a bespoke CA

May we please have another mod based within GMT to round out this follow-the-sun pattern that's slowly rising

projectdisovery’s timeline matches https://github.com/projectdiscovery/shuffledns

The abstract and conclusion of the linked paper[1] is a better entry point than the article:

> In this paper we present Topaz, a new authoritative nameserver architecture for anycast CDNs which encodes DNS objectives as declarative, modular programs called policies. Nameservers execute policies directly in response to live queries. To understand or change DNS behavior, operators simply read or modify the list of policy programs. In addition, because policies are written in a formally-verified domain-specific language (topaz-lang), Topaz can detect policy conflicts before deployment. Topaz handles ~1M DNS queries per second at a global CDN, dynamically deciding addresses for millions of names on six continents. We evaluate Topaz and show that the latency overheads it introduces are acceptable.

1: https://files.research.cloudflare.com/publication/Larisch202...

AVIF images being automatically disabled by default in Lockdown Mode is painful. That and various automatic family sharing things (such as shared photos or children app install requests) no longer working has made Lockdown a deal breaker in some cases where the user doesn’t appreciate the threat.

This talk was one of the best so far, highly recommended.

aider-chat

Alex's product vision is fantastic. I hope https://github.com/self-actuated gets noticed by more folks out there who are hitting the limits of GitHub's hosted runners.

Also note the IoC script — This script allows to scan iTunes backups for indicator of compromise by Operation Triangulation. https://github.com/KasperskyLab/triangle_check

Did you use elliptic curve instead of RSA?

Teleport has two person rule + hardware token enforcement, https://goteleport.com/resources/videos/hardened-teleport-ac...

Tragic news. I had the privilege to catch Kris at FOSDEM 2020[0][1]. Such a force. RIP Kris.

[0] https://mirror.as35701.net/video.fosdem.org/2020/K.1.105/kub... [1] https://archive.fosdem.org/2020/schedule/event/kubernetes/