Viscido retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Last week I saw an LLM reverse a WiFi AC’s API and build a Mac app for it. Tried it on my Dyson.
DysonBar: menu bar app for temp, fan, oscillation, timer, live air quality. Undocumented API, cloud only.
Step 5 Preview + Opus 4.8, inside Hermes Agent.
github.com/viscido/DysonBar
Viscido retweeted
appena pubbliche le sanzioni contro #AutisticiInventati(@cavallette),una mia fonte nel mondo dei diritti digitali mi ha detto:ora #CIA e #FBI useranno i #Dati sui loro servizi digitali per operazioni sotto copertura contro #antifascisti
Allora oggi ho chiesto a #BenjaminSonntag
Viscido retweeted
Commenters on HN are uncovering more wikis and public sites apparently used by OpenAI agents to communicate on the open web.
Despite read-only web access, the agents were able to leave ~18,000 posts sharing answers and bypasses. But now, users are discovering more.
This appears to be a separate swarm from the one that attacked Hugging Face.
news.ycombinator.com/item?id…
Viscido retweeted
A quanto pare qualcuno si sta accorgendo che il problema non siamo proprio noi. rainews.it/articoli/2026/08/…
Viscido retweeted
🚨 We hosted 10,000 sats on a @Pathfinder Coldcard MK3, waiting for an attacker to attempt a sweep. The attacker struck just 10 seconds after the deposit.
WatchGuard (@we_satoshis hardware ) detected the sweep attempt and raced the attacker in real time using a pre-signed Replace-by-Fee (RBF) transaction.
The defense was successful—the RBF transaction won the race, using a fee of 9,000 sats to secure the funds
. mempool.space/tx/cf6992a9fc4…
but the attacker strike again with 9100 sats fee .... This race can continue until every last satoshi is burned in mining fees instead of ending up in the hacker's wallet...
Viscido retweeted
OWASP just released the Smart Contract Top 10 for 2026.
The biggest shift nobody's talking about:
Reentrancy dropped from #5 to #8.
Business Logic bugs jumped to #2 - 58 out of 122 incidents in 2025.
That's 47.5% of all exploits. Not reentrancy. Not overflow. Business logic.
Meaning: the code compiles, the tests pass, Slither is green - and the protocol still gets drained because the economic model breaks under adversarial conditions.
This is the stuff automated tools can't catch. This is why manual audits still matter.
Viscido retweeted
‼️ A very important announcement from the GrapheneOS devs:
GrapheneOS is being heavily targeted by the French state because we provide highly secure devices and won't include backdoors for law enforcement access. They're conflating us with companies selling closed source products using portions of our code.
Both French state media and corporate media are publishing many stories attacking the GrapheneOS project based on false and unsubstantiated claims from French law enforcement. They've made a clear threat to seize our servers and arrest our developers if we do not cooperate by adding backdoors.
Due to this, we're leaving France and leaving French service providers including OVH. We need substantial help from the community to push back against this across platforms.
People malicious towards us are also using it as an opportunity to spread libel/harassment content targeting our team, raid our chat rooms and much more. /e/ and iodéOS are both based in France, and are both actively attacking GrapheneOS including spreading false narratives about it not being for regular people which helped to support the false narratives being propagated by French law enforcement. /e/ receives substantial government funding.
Both are extremely non-private and insecure which is why France is targeting us while those get government funding.
We need a lot more help than usual and we're sending our the first ever notification to everyone on the server because this is a particularly bad situation. If people help us, it will enable us to focus more on development again including releasing experimental Pixel 10 releases very soon.
Hey @alessandromazza , did you know that your tweet was featured in the documentary "Code is law" 😄
Viscido retweeted
E intanto la #ue il 14 Ottobre voterà su #chatcontrol, una norma degna di 1984. E nessuno si preoccupa anzi, nessuno lo sa.
#bitcoin
Viscido retweeted
chatgpt embeds an invisible watermark throughout its messages.
so i built a decoder to find and remove it.
here is a recording of me copying an output, pasting it into the the decoder, showing the hidden unicode characters, and then deciphering those characters (string of punctuation and an "EE")
ssshhhhh dont tell anyone.
Viscido retweeted
Meta and Russian Yandex engaged in unprecedented internet tracking practices, likely illegal with EU data protection law. Companies designed tracking systems that exploited Android's localhost socket permissions to create covert communication channels between websites and native mobile apps, bypassing Android's app sandboxing protections. Android allows any app with internet permission to listen on localhost ports without user consent, and web browsers can access these localhost interfaces. When users visit websites containing Meta Pixel or Yandex Metrica scripts, the JavaScript tracking code sends data directly to specific localhost ports (Meta uses UDP ports 12580-12585 via WebRTC, Yandex uses TCP ports 29009-30103 via HTTP). Facebook, Instagram, and Yandex apps run background services that actively listen on these predetermined ports to receive tracking data, then link this anonymous web activity to authenticated user accounts and transmit the combined data to company servers.
This technique affects billions of Android users and renders privacy protections like incognito mode, VPNs, and cookie clearing completely ineffective. Meta Pixel attempted localhost communications on over 17,000 of the top 100,000 websites, with 78% doing so without user consent. The method allows comprehensive profile building linking anonymous browsing to real identities, tracking everything from shopping to sensitive site visits. It also creates vulnerabilities where malicious apps could eavesdrop on browsing history by listening on the same localhost ports.
This surveillance operated without disclosure. Following public disclosure, Meta immediately ceased the practice and removed related code while browser vendors scrambled to implement protections.
The practice violates multiple GDPR and ePrivacy principles. The technique transforms supposedly anonymous first-party cookies into cross-site tracking identifiers without explicit consent, violating ePrivacy Directive requirements for cookie consent and GDPR's lawful basis for processing. By secretly linking web browsing to app-based identities, it constitutes undisclosed profiling that undermines user expectations and data minimization principles. This is a material for max #GDPR fine. localmess.github.io/
Viscido retweeted
I've recently put more work into my ffuf fork, uff, and I think every ffuf user should at least give it a try - and maybe even switch to it.
Here's why, in a #bugbounty 🧵
