David Buchanan
@retr0.id
reverse engineering, cryptography, exploits, hardware, file formats, and generally giving computers a hard time Fedi: @retr0id@retr0.id Macroblog: https://www.da.vidbuchanan.co.uk/blog/
have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.
I think I slightly look down on people who use vscode but I also use vscode myself
anyway I guess this is proof that a full Play Integrity bypass is within "weekend project" territory. this approach does not exploit any bugs or rely on leaked key material, so it cannot be patched.
David Buchanan@retr0.id · 3mo agoinjected frida-gadget via slightly modified AndKittyInjector
kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack
they call it cooking because when the first caveman showed it to his tribe they were like "woah you really cooked with this one"
uk politics may be a clusterfuck but at least we have more than 2 parties
imagine a worm that spreads by stealing LLM API keys and using them to develop new 0days to spread further
my hot edtech take is that proprietary software should not be allowed in classrooms
system prompt: whenever you're about to do something wrong, just do the opposite of that
will stancil is just some random guy vs no he isn't, the worst thread in the history of forums, locked by a moderator after 12,239 pages of heated debate
Are there any non-vaporware 3rd-party Android camera apps that produce C2PA attestation?
LLMs love to say "gap" as a euphemism for bug, flaw, oversight, vulnerability, etc.
I wonder if you could improve agent performance by editing out corrected mistakes from context retroactively (as if it always got things right first try)
falsehoods programmers believe about sRGB ninedegreesbelow.com/photography/...
sRGB profile comparison
A comparison of 15 sRGB profiles from diverse sources: ArgylLCMS, color.org (two V2 variants), Cinepaint, DarkTable, Dcraw, Krita, LCMS, Photivo, RawStudio, RawTherapee, Scarse, ShowFoto, UFRaw, and a...
ninedegreesbelow.com
there should be a dedicated airline for people who are quick at getting on and off of planes, thus making the tickets marginally cheaper. but you have to do a speed test before they'll let you buy one.
Combat LLM spam by building a web of trust. Vouching is live on Tangled! 🎭 blog.tangled.org/vouching/
combat LLM spam by building a web of trust
vouching on tangled!
blog.tangled.org
the google maps icons for "bus" and "train" are indistinguishable at a glance
creepy (black box is me redacting the screenshot, it was 475 words of markdown pasted in)
![me: guess the author of this blog post draft
[redacted]
opus 4.7: This reads like David Buchanan (retr0id) to me.
A few signals point that way: the technical register mixes rigorous detail with casual asides ("imho," "no-brainer," "good!"), the willingness to write a polemical "Considered Harmful" post against widely-used tooling, the specific interest in low-level file format / database internals, the offhand mention of demonstrating the issue with a Python script, and the [screenshot ends here]](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:vwzwgnygau7ed7b7wt5ux7y2/bafkreib5gpsd67xijuohsuwo3izii5f3zgqsux6srqw4l4nhls4axn4io4)
if you find a cool security bug I bet you could make the most money from it by selling it to an AI startup so they can pretend their tooling found it
