There is a missing feature I’ve been intending to add to though, which is that any link that looks like a URL that might be an image, for example, ends with .png or .jpg or whatever, we should just render that as an image and not expect users to wrap it in Markdown image links 
@movq@www.uninformativ.de @kat@yarn.girlonthemoon.xyz I also wondered for a very long time why nobody improved the man experience in the terminal. I’d love to see links and more colors.
Chamada aberta pro encontro brasileiro de programação criativa - Compoética 2025 … https://compoetica.github.io/links/
37C3 and New Year’s Eve 2023
Another one from the vaults. The 37C3 conference took place in
December, 2023. This report was mostly written in January, 2024.
Mostly finished it at night in my cottage between 28 and 29th
December, then edited and added some stuff in July, 2025. So… Only
1.5 years late?
It was a little ironic, and a little sad, that I was finishing the
37C3 report during 38C3. I didn’t manage to get any tickets for me and
#3 for 38C3 and had to make do with watching the stream.
The links to the talks go to [C … ⌘ Read more
setpriv on Linux supports Landlock.
@prologic@twtxt.net Yeah, it’s not a strong sandbox in jenny’s case, it could still read my SSH private key (in case of an exploit of some sort). But I still like it.
I think my main takeaway is this: Knowing that technologies like Landlock/pledge/unveil exist and knowing that they are very easy to use, will probably nudge me into writing software differently in the future.
jenny was never meant to be sandboxed, so it can’t make great use of it. Future software might be different.
(And this is finally a strong argument for static linking.)
setpriv on Linux supports Landlock.
Another example:
$ setpriv \
--landlock-access fs \
--landlock-rule path-beneath:execute,read-file:/bin/ls-static \
--landlock-rule path-beneath:read-dir:/tmp \
/bin/ls-static /tmp/tmp/xorg.atom
The first argument --landlock-access fs says that nothing is allowed.
--landlock-rule path-beneath:execute,read-file:/bin/ls-static says that reading and executing that file is allowed. It’s a statically linked ls program (not GNU ls).
--landlock-rule path-beneath:read-dir:/tmp says that reading the /tmp directory and everything below it is allowed.
The output of the ls-static program is this line:
─rw─r──r────x 3000 200 07-12 09:19 22'491 │ /tmp/tmp/xorg.atom
It was able to read the directory, see the file, do stat() on it and everything, the little x indicates that getting xattrs also worked.
3000 and 200 are user name and group name – they are shown as numeric, because the program does not have access to /etc/passwd and /etc/group.
Adding --landlock-rule path-beneath:read-file:/etc/passwd, for example, allows resolving users and yields this:
─rw─r──r────x cathy 200 07-12 09:19 22'491 │ /tmp/tmp/xorg.atom
Pessoas da comunidade brasileira de #ProgramaçãoCriativa por muitos anos fizeram encontros sob o nome promovido pela Fundação Processing, os chamados #ProcessingCommunityDay, fizemos encontros em várias cidades e então depois de 2020, com a pandemia do COVID-19, fizemos três eventos nacionais muito inspiradores em 2021, 2022 e 2023 (vide https://compoetica.github.io/links/)
Ano passado não conseguimos fazer e este ano pretendemos retomar, só que usando outro nome: #Compoética. Vamos aos poucos divulgar mais sobre o encontro brasileiro de programação criativa em https://compoetica.github.io/CP2025/
Meus agradecimentos profundos ao @guilhermesv@guilhermesv que dedica generosamente um enorme esforço para organizar esses eventos da comunidade e cria o design e peças de comunicação sempre emocionantes de lindos.
@movq@www.uninformativ.de Yeah, it’s a shitshow. MS overconfirms all my prejudices constantly.
Ignoring e-mail after lunch works great, though. :-)
Our timetracking is offline for over a week because of reasons. The responsible bunglers are falling by the skin of their teeth:
- The error message neither includes the timeframe nor a link to an announcement article.
- The HTML page needs to download JS in order to display the fucking error message.
- Proper HTTP status codes are clearly only for big losers.
- Despite being down, heaps of resources are still fetched.
I find it really fascinating how one can screw up on so many levels. This is developed inhouse, I’m just so glad that we’re not a software engineering company. Oh wait. How embarrassing.
we should bring back XFN that is the cutest shit in the world i want to link to my friends and have the internet know they are my friends through the markup!!!!!!!!!!!
Thumbnail novo para a minha página sobre compreensão de listas… #Python
https://abav.lugaralgum.com/material-aulas/Processing-Python-py5/comprehension.html
(preciso dar uma melhoradinha na página, por umas imagens, arrumar links quebrados)
@prologic@twtxt.net no, good man. Follow the link, follow eet! :-)
@kat@yarn.girlonthemoon.xyz i linked the normal length edit instead of the full 15 minute music video because i’m not gonna subject you all to that amount of my bullshit
(…15 minute version is a great watch though)
@bender@twtxt.net Yeah, well, it’s a bit like twtxt. There is a Gopher community, but it’s small. I actually don’t like that HTTP is so easily accessible. I don’t like it that much when people post links to my site on HackerNews or something like that. Too much exposure.
Gopher is a small world. It’s slow and cozy.
And much like twtxt, the protocol is simple®, so it’s easier to tinker with it.
I’ve told that whomever has this link will be able to watch live the third and edition of “Secret Garden festival”.
“We bring you the delights of Scott Marshall Hurdy Gurdy, and Bristol’s Dead Space Chamber Music, with a little Sieben to kick off proceedings. Come join us in the garden!”
Starting now!
@quark@ferengi.one Ta. Hmm, what’s wrong with the blue text color? Is it too dark on the black background for you? :-?
Normal links are blue while images are teal. I thought I differentiate the two if I easily can. The underline of URLs comes from my terminal and is not tt’s fault.
Configuring colors is in the todo list. But of course, providing a sane default is definitely something I’d like to have.
Passing of Jean-Raymond Abrial
Jean-Raymond Abrial, father (in particular!) of the Z notation, but also of the B method, and then Event-B, passed away on May 26. I was surprised to see that this piece of news, which may be of some interest to formal method folks, doesn’t seem to be very well known (there’s not much material on the web).
Here are some links (on LinkedIn, sorry):
[by Bertrand Meyer](https://www.linkedin.com/posts/bertrandmeyer_i-am-saddened-to-report-from-todays-print-activity-7335684948974034944-SJf1? … ⌘ Read more
GraphQL Gatecrash: When an Introspection Query Opened the Whole Backend ️
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/graphql-gatecrash-when-an-intro … ⌘ Read more
Radeon Software For Linux Dropping AMD’s Proprietary OpenGL/Vulkan Drivers
Direct link to upstream release notes.
Perth’s first east-west rail connection opens after 18 months of disruption
The Thornlie-Cockburn link and adjacent rail elevation in Perth’s south-east is part of WA Labor’s flagship infrastructure project Metronet. ⌘ Read more
Samsung’s Summer Sale Includes Steep Discounts on Monitors, TVs, Galaxy Phones, and More
Samsung’s new Discover Samsung sale is still going on this weekend, and it includes savings on monitors, TVs, Galaxy products, and more.
How a Welcome Email Can Be Used for Malicious Redirection
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-a-welcome-email-can-be-used-for-malicious-redirection-fd833ec71550? … ⌘ Read more
**☠️ CORS of Destruction: How Misconfigured Origins Let Me Read Everything **
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8F-cors-of-destruction-how-m … ⌘ Read more
Charge dropped against US conspiracy theorist linked to Wieambilla attack
Donald Day Jr — who regularly communicated with Wieambilla killers Gareth, Stacey, and Nathaniel Train — is facing charges relating to making alleged threats and violating firearms laws. ⌘ Read more
What can be done about the ‘new world’ of extreme weather?
Farmers say the recent floods in NSW were unprecedented and exhausting, but some stop short of blaming climate change. ⌘ Read more
@lyse@lyse.isobeef.org I cannot / could not imagine that, either – but if it’s publicly available on the internet and something links to it, they’ll eventually find, scrape it, use it. ☹️
Trump official who shut down Russia propaganda unit has links to Kremlin ⌘ Read more
Exploiting the Gaps in Password Reset Verification
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/exploiting-the-gaps-in-password-reset-verification-9bb86ec95d29?source=rss—-7b722bfd1b8d– … ⌘ Read more
Family pleads for answers 18 years after baffling, cult-linked disappearance
The family of Chantelle McDougall and her daughter Leela appeals for information as they continue to live with the “emotional roller-coaster” of their 2007 disappearance. ⌘ Read more
The overlooked link between perimenopause and disordered eating
Women are at risk of developing an eating disorder during perimenopause but there is a lack of research, education and support. ⌘ Read more
Older Australians are losing millions in scams involving crypto ATMs
Australians are losing millions of dollars each year to scams involving cash deposits at cryptocurrency ATMs — machines authorities warn are increasingly being exploited by criminals for money laundering. The rapid rise of crypto ATMs has outpaced regulation, creating opportunities for criminal misuse. ⌘ Read more
Bug Bounty from Scratch | Everything You Need to Know About Bug Bounty
📌Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bug-bounty-from-scratch-everything-you-need-to-know … ⌘ Read more
Nigeria arrests 4 Pakistani nationals over terror links ⌘ Read more
Cool tools I’ve learned about this afternoon during #WikiConPT :
https://mapcomplete.org/
https://osm.wikidata.link
Thanks @waldyrious@waldyrious !
Zelda ready to give herself to Link ⌘ Read more
A Hidden Backdoor: Bypassing reCAPTCHA on the Sign-up Page
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/a-hidden-backdoor-bypassing-recaptcha-on-the-sign-up-page-2b5b3c18257f … ⌘ Read more
** Cache Me If You Can: How I Poisoned the CDN and Hijacked User Sessions**
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/cache-me-if-you-can-how-i-poisoned-the-cdn-and-hijacked … ⌘ Read more
Leaking in Plain Sight: How Short Links Expose Sensitive Data ⌘ Read more
hey @prologic@twtxt.net heads up - my pod is suddenly having weird 400 bad request errors on things like posting twts, new user registration, following, and more. it’s not just me because a friend is also having these issues as a new user and can’t post. i saw one exception in the logs but i’m not sure if it’s related, i’ll link it in a reply to this
Dmytro Prudnikov, former product designer at Komoot, who was still featured last December in a post on LinkedIn, but got, as many others, fired, posted an emotional video on YouTube. Together, he and a lot of other former colleagues, they spent some time together for a last gathering. ⌘ Read more
I Tried 10 Recon Tools for 7 Days — Here’s What Actually Found Bugs
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/i-tried-10-recon-tools-for-7-days-heres-what-actually-found-bug … ⌘ Read more
$750 Bounty: for HTTP Reset Password Link in Mattermost
How an Unsecured Protocol in a Critical Workflow Opened the Door for Network-Based Account Takeovers
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/750-bounty-for … ⌘ Read more
@movq@www.uninformativ.de yes, I think:
<!--[if !IE]><!-->
<link rel="stylesheet" href="../simplicity.css”>
<!--<![endif]-->
Should work, but I haven’t tested it.
Find Secrets in Hidden Directories Using Fuzzing ️
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/find-secrets-in-hidden-directories-using-fuzzing-%EF%B8%8F-1666d6f34fd8?source=rss—-7b722bfd1b8d- … ⌘ Read more
I Gave Myself 60 Minutes to Find a Bug — This Is What Happened
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/i-gave-myself-60-minutes-to-find-a-bug-this-is-what-happened-e5fa76563a33?so … ⌘ Read more
️My Top 7 Mistakes as a New Bug Hunter (And How to Avoid Them)
Free Article Link only for you
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8Fmy-top-7-mistakes-as-a-new-bug-hunter- … ⌘ Read more
Exploiting Unsanitized URL Handling & SQL Injection via Deep Links in iOS App: Write-up of Flipcoin ⌘ Read more
@prologic@twtxt.net it says in the linked page;)
** They Missed This One Tiny Parameter — I Made $500 Instantly**
✨Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/they-missed-this-one-tiny-parameter-i-made-500-instantly-f2f7d1c1c1d9?source=rss—-7 … ⌘ Read more
I Broke Rate Limits and Accessed 1000+ User Records — Responsibly
👉Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/i-broke-rate-limits-and-accessed-1000-user-records-responsibly-8c45f … ⌘ Read more
The Most Dangerous Bug I’ve Ever Found (And No One Was Looking)
👉Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-most-dangerous-bug-ive-ever-found-and-no-one-was-looking-2e96e5079a01? … ⌘ Read more
**Token of Misfortune: How a Refresh Token Leak Let Me Regenerate Unlimited Sessions **
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/token-of-misfortune … ⌘ Read more
Amazon’s Weekend Sale Has Great Deals on AirPods Max, Apple Watch, iPad, and More
Amazon is hosting a big collection of discounts across multiple Apple products this weekend, including notable deals on AirPods, Apple Watch, iPad, Apple Pencil Pro, and MacBook Air.
0 to First Bug: What I’d Do Differently If I Started Bug Bounty Today
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/0-to-first-bug-what-id-do-differently-if-i-started-bug … ⌘ Read more
Part-2️♂️Bug Bounty Secrets They Don’t Tell You: Tricks From 100+ Reported Bugs
✨Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwri … ⌘ Read more
☕Best Tool for Analyzing Java Files (90% of Hackers Don’t Know This)
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/best-tool-for-analyzing-java-files-90-of-hackers-dont-know-this- … ⌘ Read more
@kat@yarn.girlonthemoon.xyz I FOUND ANOTHER ONE OF THESE TUX GUYS FROM THIS SAME SHOP ON EBAY, IT’S NOT THE SAME ONE I LINKED BUT I MADE AN OFFER, EVERYONE PRAY FOR ME I WANT A TUX ARMY
** JWT Exploitation: How I Forged Tokens and Took Over Accounts**
🔐Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/jwt-exploitation-how-i-forged-tokens-and-took-over-accounts-2e7ab1cf4df8?sour … ⌘ Read more
How I Found a Way to Prolong Password Reset Code Expiry
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-found-a-way-to-prolong-password-reset-code-expiry-6214391023de?source=rss—-7b7 … ⌘ Read more
How I Deleted Any User’s Account— No Interaction Needed
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-deleted-any-users-account-no-interaction-needed-faae0442ff4f?source=rss—-7b722bfd1 … ⌘ Read more
@eldersnake@we.loveprivacy.club awww ty! it’s mostly fun stuff and links to my friends :) the buttons have been revived by indie web folks and the people at neocities, it’s super fun!
SSRF via PDF Generator? Yes, and It Led to EC2 Metadata Access
👨💻Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/ssrf-via-pdf-generator-yes-and-it-led-to-ec2-metadata-access-39b8e5b41840 … ⌘ Read more
**The Hidden Language: Exploiting GraphQL for Unauthorized Data Dump **
Free Link🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-hidden-language-exploiting-graphql-for-unauthorized-data-dump-8 … ⌘ Read more
Bug Hunting in JS Files: Tricks, Tools, and Real-World POCs
✅Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bug-hunting-in-js-files-tricks-tools-and-real-world-pocs-b4d43dd41d8e?source=rss—-7 … ⌘ Read more
API Key Exposure in NASA GitHub Repository Leads to Unauthorized Access to Academic Data
🔓Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteu … ⌘ Read more
Subdomain Takeover: My $450 Win & How You Can Do It Too
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/subdomain-takeover-my-450-win-how-you-can-do-it-too-3337ca0513b6?source=rss—-7b722 … ⌘ Read more
You can post a link. \0 from Ulyanovsk.
You can now shop using ChatGPT, but is it worth the hype?
AI chatbots can now recommend products and link you to the purchase page. In the near future they’ll handle carts and checkout too. ⌘ Read more
Naked objects
Was browsing Strvct and saw the link to Naked Objects. It resonated with the repost of VPRI’s Steps report: creating a world of domain objects with a tangible, interactive representation and transparent storage.
@movq@www.uninformativ.de OH SHIT I TOTALLY FORGOT LOL! thanks for telling me! they’re just frontends for ultimate guitar - so these links
https://tabs.ultimate-guitar.com/tab/fifty-fifty/cupid-twin-version-chords-4667768?no_redirect
https://tabs.ultimate-guitar.com/tab/chappell-roan/good-luck-babe-chords-5191149?no_redirect
Also spent the morning continuing to think about a new design for EdgeGuard’s WAF. I’m basically going to build an entirely new pluggable WAF that will be designed to only consider Rate Limiting, IP/ASN-based filtering, JavaScript challenge handling, Basic behavioral analysis and Anomaly detection.
The only part of this design I’m not 100% sure about is the Javascript-based challenge handling? 🤔 I’m also considering making this into a “proof of work” requirement too, but I also don’t want to falsely block folks that a) turn Javascript™ off or b) Use a browser like links, elinks or lynx for example.
Hmmm 🧐
️Recon Automation Like a Pro: My 5-Stage System to Catch More Bugs
✅Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8Frecon-automation-like-a-pro-my-5-sta … ⌘ Read more
@prologic@twtxt.net ah that’s alright! the banner is just for fun :] it might be easier to skip to the comments with this link if you want (it’s in the site view mode rather than my page’s theme) https://luckyzukky.dreamwidth.org/98451.html?style=site#comments
Bug Hunting in JS Files: Tricks, Tools, and Real-World POCs
🗝️Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bug-hunting-in-js-files-tricks-tools-and-real-world-pocs-70406e3eb72e?source=rss—-7 … ⌘ Read more
$100 Bounty: How a Spoofed Email Could Change Any Username on HackerOne
A simple email spoofing trick could let anyone hijack your HackerOne username and profile link
[Continue reading on InfoSec Write-ups »] … ⌘ Read more
Is Your App Protected? The Branch API Vulnerability You Need to Know About
$fallback_url is a helpful feature in Branch’s deep linking system — until someone uses it to redirect your users to phishing … ⌘ Read more
$1000 Bounty: Account Takeover via Host Header Injection in Password Reset Flow
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/1000-boun … ⌘ Read more
@ About the URL, since it no longer used for hashing there might be no need to change it. I agree that we keep all the parts that already are out there for the most parts. Instead of a contact field you could also just use links like: link = Email mailto:user@example.dk or link = Signal https://signal.me/sthF4raI5Lg_ybpJwB1sOptDla4oU7p[...]
@andros@twtxt.andros.dev Thanks for consolidating a lot of good ideas. Especially how you have deiced to just extend the mention syntax for location-based treads. This might even be backward compatible with older (pre-yarn) clients.
What about using Z for UTC +00:00- is that allowed in your specs?
Regarding url = I would suggest to only allow one and the maybe add url_old = or url_alt = !?
I’m still not a fan of a DM feature, even thou it helps that i have now been split out into a separate feed file. Instead if would suggest a contact = field for where people can put an email or other id/link for an established chat protocol like signal or matrix.
** Bypassing Regex Validations to Achieve RCE: A Wild Bug Story**
✨Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bypassing-regex-validations-to-achieve-rce-a-wild-bug-story-4c523f69b9f8?sourc … ⌘ Read more
$750 Bounty: Sensitive Data Exposure
When Deep Links Go Deeply Wrong: The Zomato Insecure WebView Story
** How I Found Internal Dashboards Using Google Dorks + OSINT**
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-i-found-internal-dashboards-using-google-dorks-osint-5f2c9515fcd6?source=rss—-7b7 … ⌘ Read more
@bender@twtxt.net Yes, you right. But is premium for more than that.
I use a feature I love a lot: customising different searches with different themes or links.
It’s easy to understand with an example. I have a search with the name “Django”. I set sources: Django documentation, stack overflow, topic “programming” and so on. It’s very quick to find Django solutions.
I also have another way to find my stuff: search my blog and repositories.
I had problems paying for the first mouths, now it’s a working tool for me.
**What Recruiters Look for in a Cybersecurity Resume in 2025 **
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/what-recruiters-look-for-in-a-cybersecurity-resume-in-2025-dcc81fa3154e?source=rss- … ⌘ Read more
$300 Google Cloud Free Trial: Create Your First VM
Non-members can read this article for free using this link.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/300-google-cloud-free-trial-create-your-first-vm-5a12b6821b0f?source=r … ⌘ Read more
☁️How to Setup a Custom Subdomain on xss.ht — A Complete Hacker’s Guide
Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8Fhow-to-setup-a-custom-subdom … ⌘ Read more
** Login? Who Needs That? Bypassing OAuth Like a Lazy Hacker on Sunday ☀️**
Free Link🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/login-who-needs-that-bypassing-oauth-like-a- … ⌘ Read more
** How to Turn Cybersecurity Into a Full-Time Income (My Blueprint)**
💡Free Article Link
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-to-turn-cybersecurity-into-a-full-time-income-my-blueprint-f4d70 … ⌘ Read more