Watching Devil May Cry Season 2 @ Netflix It feels like they made a super awesome sound track then decided they needed an anime in between to present the sound track. www.youtube.com/playlist?lis...

Devil May Cry Season 2 Soundtrack - YouTube

youtube.com

AI changes attacker iteration cost. AppSec cannot rely only on smarter vulnerability queues. Verification capacity, smaller stacks, attack surface reduction & safe remediation throughput now matter more New Article: AppSec in the New Security Cost Model cyfinoid.com/appsec-in-th...

AppSec in the New Security Cost Model

AI changes AppSec economics. Learn why teams need smaller stacks, stronger verification, & safe remediation.

cyfinoid.com

Panel discussions in Conferences are a gamble sometimes they work mostly they dont. I have noted some things I have learned while being on all 4 sides of it (Audience, Organizer, Panelist, Moderator) blog.anantshri.info/security-panels/

Security panels are not broken. We just keep using them badly. | Blog of Anant Shrivastava

A practical field guide to making conference panels useful by setting clearer expectations for organizers, moderators, and panelists alike everywhere.

blog.anantshri.info

AI should help us move from messy exploration to owned structure. Use models to find patterns, then encode what works, reduce dependence, and keep guesswork only where the world genuinely stays fuzzy. https://blog.anantshri.info/ai-should-help-design-its-own-exit/

I just need the world to pause for like 60 days; need time to catchup :D

Open source is generosity, not a vendor SLA. Stop treating volunteers like suppliers. Declare your support level, offer paid tiers if you want, and make users fund or fork what they depend on.

Open Source, Unpaid Expectations

Open source is generosity, not a vendor SLA. Stop treating volunteers like suppliers. Declare your support level, offer paid tiers if you want, and make users fund or fork what they depend on.

blog.anantshri.info

AI is making it cheap to replicate small SaaS workflows. Vendors sell suites, teams need slices, and bundling feels shakier at renewal time.

Vendors Sell Suites. Teams Need Slices. AI Made It Cheap.

AI is making it cheap to replicate small SaaS workflows. Vendors sell suites, teams need slices, and bundling feels shakier at renewal time.

blog.anantshri.info

Hacking Archives of India – Website Revamp Update I am thrilled to announce a major update to Hacking Archives of India (HAI). My mission has always been to document the history and contributions of the Indian information security community. To better serve that mission, I have completely revamped…

Hacking Archives of India – Website Revamp Update

I am thrilled to announce a major update to Hacking Archives of India (HAI). My mission has always been to document the history and contributions of the Indian information security community. To better serve that mission, I have completely revamped both the looks and the internals of the website. Whether you are looking for specific tools, historical talks, or the journey of specific hackers, the new HAI is faster, cleaner, and now machine-readable. Here is a deep dive into the new features and changes you will find. 1. Visual Overhaul: Big Data, Big Cards…

blog.anantshri.info

And badges are live on my website now : anantshri.info/badges/#:~:t... and github.com/anantshri/hu... <- theme has support for boinc badges also now.

Anant Shrivastava@anantshri.info · 6mo ago

I wanted a simple JSON API to fetch my BOINC stats and badges for my website. There was no clean endpoint, so I built one. boincstats.apps.anantshri.info It is still scraping, just done once on my side instead of everyone doing it badly. You get clean JSON, updated every 24 hours.

I wanted a simple JSON API to fetch my BOINC stats and badges for my website. There was no clean endpoint, so I built one. boincstats.apps.anantshri.info It is still scraping, just done once on my side instead of everyone doing it badly. You get clean JSON, updated every 24 hours.

I have been building zero install security tools where the browser is the base. I wrote about the “why” here: blog.anantshri.info/making-secur... I realized many others are building similar browser-first tools, so I made a curated collection: anantshri.github.io/awesome-in-b... PRs & links welcome

SBOMPlay v0.0.7 - Custom SBOM support - Improved SBOM auditor: checks against baselines - EOX detection (EOL and EOS) - Dependency confusion detection - Clear rate limit warnings - Explicit list of outbound hosts for paranoid self-hosting deployment cyfinoid.com/sbomplay-v0-...

Introducing SBOMPlay v0.0.7: Enhanced Features Unveiled

Explore the latest updates in SBOMPlay v0.0.7, featuring enhanced capabilities, custom SBOM support, and improved auditing tools.

cyfinoid.com

Discover Readwise Wrapped, your personalized reading recap with stats, insights, and highlights from your reading journey over the year.

Readwise Wrapped: my year in reading

TL;DR: I built Readwise Wrapped. It gives you a Spotify Wrapped style year-in-review for your Readwise highlights. You paste your Readwise token, pick a year, and it spits out a clean, shareable, good-looking reading recap.Link:

blog.anantshri.info

I am assuming people are right now collecting their year wraps. I found it was not available for readwise so i made a tool that can get you a year unwrap for readwise readwise-wrapped.apps.anantshri.info Have a go at it and suggest if you feel something is missing.

Discover Fedi Wrap, the easy tool for generating your year in review report from fediverse mastodon api compatible servers, prioritizing privacy and local analysis. https://blog.anantshri.info/building-fedi-wrap-my-year-in-review-for-the-fediverse/

🚀 3rd Party Tracer v1.0.6 🚀 New features: • Quick scan mode added • More sources added for subdomain enum • Email security dashboard • Batch analysis • JSON Import • Pdf export Try: cyfinoid.github.io/3ptracer/ Star: github.com/cyfinoid/3pt... Client-side only. No data leaves your browser.

All the new 3rd party modules must not be installed immediately, unless its a critical zero day, unless the author informs you to do so, unless a gazillion other exceptions. Infosec needs to make up their mind what should dev/admins do. and ya everyone with buy my product can go to hell.

🚨 BLACK FRIDAY MEGA SALE 🚨 All Cyfinoid security tools are 100% OFF! Get our security tools for the low price of $0.00! SBOM analyzer? FREE 3PTracer? FREE Act fast! This deal expires in... *checks notes* ...never. Because they've always been free cyfinoid.github.io

With cloudflare being down, and as a result, most things I use being down, I came here to say hi 🤭 I guess I will use other AIs than chatgpt today!

New version of #SBoMPlay is available cyfinoid.github.io/sbomplay/ Source code : github.com/cyfinoid/sbo... Bunch of New Features in experimental mode - Aggregate List of authors - Identify version sprawl amongst projects - common dependencies across projects - License changes in package versions

#DEFCON34 Call for #CTF Organizers is OPEN! After four excellent years, Nautilus Institute is retiring from running the official #DEFCON CTF. The search is on for the next team. Is it your turn? Is your crew the future of live hacking competitions? defcon.org/html/links/d...

Final hours for Black Hat EU Early Bird! 🚨 Save £300 today and join my 0wning the Cloud training this December in London. We’ll cover AWS, Azure, GCP, DigitalOcean & Aliyun with hands-on attack + defense labs. 🔗 Register before midnight: www.blackhat.com/eu-25/traini...

Black Hat

Black Hat

blackhat.com

We just dropped GH Navigator 🎉 Paired with KeyChecker, it gives full GitHub coverage: Data plane: what can be read Control plane: what can be changed Check out the release post 👉 cyfinoid.com/gh-navigator...

Introducing GH Navigator: Optimizing GitHub Security Tools

Discover how GH Navigator and KeyChecker enhance GitHub security by providing visibility and testing for both data and control planes.

cyfinoid.com

“OpenAI admits AI hallucinations are mathematically inevitable, not just engineering flaws” https://www.computerworld.com/article/4059383/openai-admits-ai-hallucinations-are-mathematically-inevitable-not-just-engineering-flaws.html

Everyone talking about npm hacks. But is it really more attacks or just more visibility? Maybe attackers are piling on npm Maybe the ecosystem is just easier to monitor Maybe sloppy practices make it an easy catch What nags me more: silence in PyPI, RubyGems, Maven. No attacks, or no one looking?

#BSidesLDN205 Call for Workshops is still open! Want to pass on the knowledge you have? Here's your chance: cfp.bsides.london/bsides-londo... Any topic. 2-4hrs long Not a commercial presentation 30 people minimum audience (mixed experienced levels) #Security #BSIdes #London

To all of the people pushing hard to coin the term “vibe security,” the joke is on you. Security has always been about vibes. 😆

Determinism builds trust, non-determinism builds discovery. The art lies in knowing when the world needs certainty - and when it needs the unexpected gift of surprise.

Not Every Nail Needs a Non-Deterministic Hammer

Determinism builds trust, non-determinism builds discovery. The art lies in knowing when the world needs certainty - and when it needs the unexpected gift of surprise.

blog.anantshri.info

Most say ‘think like a hacker,’ but infosec fights adversaries with goals, not curiosity. Real defense means blending hacker creativity with adversary realism.

Hacker Vs Adversary

Most say ‘think like a hacker,’ but infosec fights adversaries with goals, not curiosity. Real defense means blending hacker creativity with adversary realism.

blog.anantshri.info

My thoughts on how LLM behaviour makes me rethink my own brain’s inner workings. A prediction engine as a mirror for a mind.

What LLMs Teach Me About My Own Brain

My thoughts on how LLM behaviour makes me rethink my own brain’s inner workings. A prediction engine as a mirror for a mind.

blog.anantshri.info