Instance Logo

threatactor.club

Profile for joern

Header for joern
Avatar for joern
Display name
joernchen :cute_dumpster_fire:
Username
@joern@threatactor.club
Role
admin

About joern

Bio

Your mom's favorite hacker!

My other account is @joernchen

Stats

Joined
Posts
686
Followed by
1129
Following
261

Recent public posts

exclude boosts
joernchen :cute_dumpster_fire: , @joern
(open profile)
Boost of @wirepair@mastodon.social
wirepair , @wirepair@mastodon.social
(open profile)

If you could go back and time and reverse ONE thing, which would it be?

Poll closed , 47 votes total
  • Option 1, Covid never happened
    48.94% , 23 votes
  • Option 2, LLMs / GenAI never happened
    51.06% , 24 votes

I’m slightly mad….

What stands in my way of having a nice vulnerability is the apparent inability of certain LLMs to emit \r (carriage return). For some reason they keep emitting \n (newline) instead.

joernchen :cute_dumpster_fire: , @joern
(open profile)
Boost of @MrTuxracer@infosec.exchange

I found myself posting this little comic at work A LOT currently.

It's really interesting, especially in the context of (agentic) AI, how features can be bugs or even vulnerabilities and vice versa, depending on whom you ask about it. It's always the context which matters and a lot is personal preference/risk appetite of whoever is using the 'feature'.

I tend to advocate for secure defaults with an option to let anyone choose if they want to take the risk of e.g. AI 'yolo' mode.

 Bug vs. Feature comic. Where the actual bug (insect) is titled 'Bug' on the left, and the same bug in a suit is titled 'Feature' on the right.

So I just met someone in person a few days ago. They said: "Oooh you're busy looking into AI stuff lately? That's good so you wont bother $THING with vuln reports! :P"

Guess where I just found a nice vuln :trollface:

joernchen :cute_dumpster_fire: , @joern
(open profile)
Boost of @hailey@hails.org
Hailey , @hailey@hails.org
(open profile)

As an extra layer of protection against the npm worm currently circulating, I've uninstalled node on my dev system and cooked up this node-container-exec script to use instead. My node and npm commands now exec through node-container-exec.

It mostly transparently runs node stuff in an ephemeral node:24-trixie-slim container with podman. By default it only read-only bind mounts top-level files and directories tracked by git to avoid accidental secret leakage into the container. You can override what gets bind mounted by setting the NODE_CONTAINER_BIND and NODE_CONTAINER_BIND_RO env vars. Use direnv to do this on a per-project basis.

No, containers do not provide flawless security, but all of the npm malware I've seen so far is just script kiddy shit that a container would adequately protect against.

You might find the script useful too: gist.github.com/haileys/a4eb8a

Ich muss sagen ich bin schon ein bisschen beeindruckt wie smooth eine Onlinezulassung für ein Kfz läuft, ABER wenn ein einfaches & in den Eingabedaten so eine Fehlermeldung auslöst triggert mich das ein bisschen zu sehr ;). :cute_dumpster_fire:

Ich hab dann aber mal nicht an dem Ast gesägt auf dem ich saß.

 Es ist 1 Fehler aufgetreten Es ist ein nicht registrierter Fehler aufgetreten, Key=[KBA_NACHRICHT_NICHT_SCHEMAVALIDE] Sie haben noch 2 Versuche. Ihre Antragsnummer: [redacted] Im Fehlerfall bitte immer angeben).
joernchen :cute_dumpster_fire: , @joern
(open profile)
Boost of @trailofbits@infosec.exchange
Trail of Bits , @trailofbits@infosec.exchange
(open profile)

Ruby's Marshal deserialization has been broken for over a decade, and patches don't solve the fundamental issue. Read our full analysis of 11 years of Ruby deserialization exploits and why fundamental change is needed: blog.trailofbits.com/2025/08/2