Do you still stand by this, now that we have CVEs, kernel 0days dropping left, right and center these days?
@mitchellh
Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).
If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!
I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.
Feeling pretty swell about this mentality with all the supply chain attacks happening.
"Think about what you want today and you'll spend your time.
Think about what you want in 5 years and you'll invest your time."
–@JamesClear
Ujjwal retweeted
If you want a good podcast about #hacking stories, listen to @DarknetDiaries.
Ujjwal retweeted
I don't normally RT my own tweets, but this scam is off the hook right now. Just had a good friend and security expert fall for the Zelle fraud scam. The phishers initiated 2 unauthorized purchases on his credit card, then spoofed an SMS from his bank about fraudulent charges.
The Zelle fraud scam is rampant. You get an SMS about a suspicious Zelle transfer from "your bank." If you respond you get callerID spoofed scam call. To "verify your ID" they ask for your username. Then they password reset & ask you to read back the code krebsonsecurity.com/2021/11/…
Ujjwal retweeted
Don’t make the mistake of confusing productivity with busyness. Doing lots of stuff in a visible manner does not mean you’re being productive.
High-Quality Work Produced = (Time Spent) x (Intensity of Focus)
azeria-labs.com/the-importan…
Ujjwal retweeted
🎉🎉🎉Giving away one
@PentesterLab subscription valid for
🔥🔥 3 months 🔥🔥
Will select a random person from the retweets .
Thanks to the person who gave it to me to share with the community 🙏
"If what you do can be automated you've already lost" 👌🏻
I'm sure there are exceptions to this though
Ujjwal retweeted
My fuzzer for the iOS kernel networking stack is now open source! You can read the implementation details here: googleprojectzero.blogspot.c…
Ujjwal retweeted
I think this video is the most comprehensive coverage of the sudo Heap Buffer Overflow CVE-2021-3156.
We talk about discovery through fuzzing and code review, the bug analysis and finally exploitation.
youtube.com/watch?v=TLa2VqcG…
Ujjwal retweeted
Every time I feel imposter syndrome creeping up on me, I look at this pic and try to change my mindset to the one this dude has. Pretty healthy mindset in my opinion.
Ujjwal retweeted
I am planning to mentor (not spoon-feed) Five folks who are new into Application Security/Penetration Testing/Bug Bounty, etc.
Cost: Pay it Forward [Free]
Comment in this thread about the following:
- Why you need mentorship?
- Your Career Goals
(1/2)
#bugbounty #infosec
Ujjwal retweeted
@PentesterLab wants to give back to the community by helping a few people, if you know someone who could benefit from access to PRO, please share:
forms.gle/ppSHZcHvZCNRxVRXA
I will pick a few people next week. There is no right or wrong answers, just be honest.
Ujjwal retweeted
I didn't get here alone. I found these bugs because I have spent my life surrounded by amazing people willing to help me get where I am. As such, I want to give back. I'm putting up 10 3-month subs for @PentesterLab and they've graciously offered to match me! Reply below to enter
Yay, I was awarded a $33,000+$8,250 bounty on @Hacker0x01! hackerone.com/daeken #TogetherWeHitHarder
Ujjwal retweeted
📢 ASPIRING HACKERS! Want to learn to hack? Since it's virtual anyways, we're opening our Fall 2020 ASU Computer Systems Security / CTF course to the WHOLE WORLD! More info, including lecture times, youtube/twitch/presentation links, and practice problems: pwn.college
Ujjwal retweeted
📢ASPIRING HACKERS! A bit lost in the first pwn.college challenge set? We've pushed some more context (and an additional video) here: pwn.college/modules/suid