@DominoTree

FreeBSD kernel committer, hardware hacker, cybersecurity professional

 San Francisco, US
github.com/DominoTree
Joined October 2011
  • Tweets9.7K
  • Following1.9K
  • Followers2.3K
I vibe-coded a kernel module for FreeBSD that uses GitHub's downtime as an entropy source github.com/DominoTree/ghrand…
14
42
4
791
27,458
LLM SENTIENCE CONFIRMED AGI IS HERE
2
5
828
Nick Price retweeted
hashcat@hashcatOct 25
hashcat v8.0.0 released! The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards. Release notes: github.com/hashcat/hashcat/b… Download: hashcat.net/hashcat/
24
419
33
2,019
91,403
Nick Price retweeted
Jon 
@jonschxyzOct 25
Replying to @marcorandazza @AmericanExpress
Sounds like you thought $900 a year made you some sort of elitist lol. Sorry to hear about the reality check.
4
4
465
38,411
Boomer-coding a static site generator and templating engine entirely in ANSI C89 because I hate myself
3
1
4
488
Someone bought a really badass domain name and made a sweet landing page for a vibevuln in your product. No one actually knows if the bug is exploitable or impactful yet but it has gone viral anyways, enjoy your weekend
14
2
137
5,981
STOP THE PRESSES Setting the environment variable TS_SERVE_ALLOW_ALL_INTERFACES will let Tailscale Serve bind to all interfaces CVSS 10.0 SHUT IT DOWN
19
10
2
545
56,091
(this is literally a finding in the report)
2
53
7,782
I reported a decent kernel vuln on Thursday - nobody told me I was supposed to register a domain name about it :(
5
68
2,424
Nick Price retweeted
calle
@callebtcOct 25
the tailscale vulnerabilities read like slop to me. nothing in there seems critical or reason to panic. also: no repsonsible disclosure, nor any code or proof. feels like a scam.
14
14
3
321
11,375
Back in my day, we’d make artisanal hand-crafted shitposts to drop vulns on the Full-Disclosure listserv. Kids today only know eat hot chip and AI
8
516
Pretty sure that the reason that the Tailscale “Tailworm” vulnerabilities weren’t responsibly disclosed with the vendor is that they were hallucinated AI slop and there wasn’t anything to be responsibly disclosed with the vendor
8
11
195
7,934
There may be some legit findings here but they’re buried in sensationalism and nonsense and don’t seem like anything that would merit coordinated disclosure to begin with
1
10
900
Nick Price retweeted
banteg
@bantegOct 25
that tailworm site reads like gigaslop, i call bullshit on the framing. the ssh bug is basically: authorized nonroot access can become root via unix socket forwarding. serious, but propagation follows ssh policy. this concerns tailscale’s opt-in ssh server, not ordinary openssh. the path also requires the attacker (yourself) to be added to your tailnet, enabled tailscale ssh (not enabled by default), configured forwarding (not default).
16
35
4
349
22,393
Nick Price retweeted
Vincent Yiu
@vysecurityOct 25
Replying to @ashxhart
Did you see the finding about the TAILSCALE SERVE INTERFACE environment variable? LMAO
1
2
144
I’m turning on Tailscale SSH at home just to spite this dumb report
6
7
1
102
3,413
“bypasses network policy”: Reaching cross-namespace services is default pod behavior in Kubernetes. Their "fix" is to “add a default-deny egress NetworkPolicy.” If adding one fixes it, the finding is just “their test environment had no NetworkPolicy”?
2
1
36
1,659
2. The kubernetes stuff doesn't make any sense “privileged/uid-0 in the pod network namespace” has nothing to do with what they're describing ? a 401 from kube-apiserver and kubelet means it got means refused? A 200 from some unauthed service is just default pod networking?
2
3
1
29
2,353
RE: Tailworm 1. The "report" is totally unreadable. I, as someone who is very familiar with reporting vulns and kubernetes, am totally unable to parse the sections on kubernetes. There may be valid bugs, but I can't tell. I would not have reported these as vulns in this state.
11
12
5
248
16,738
Nick Price retweeted
Mark Manning@antitreeOct 25
Lessons for all the new researchers: 1. Write your own posts. Everyone knows what slop looks like. 2. Don't buy a domain name for a bug. It's 2026. 3. Learn the difference between bugs and architecture risks 4. Get friends. They should tell you your bad ideas suck
International Cyber Digest
@IntCyberDigestOct 25
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws. In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
9
24
5
255
13,799
Why is broccoli even in a web server
15
37
4
429
12,529
Load more