Combined articles and posts feed
This past few months (maybe even years) have been reset after reset after reset for me. I don't at all have to stretch my imagination to find poetic parallels between this spring season, moving apartments, turbulence at work , or the landslide evacuation of a neo-fascist regime from the helm of a captured state . Over and over, I've been finding myself dealing with the proverbial emotional…
Career After close to two decades in various disclipines of design (most recently prior to this change, in UX design leadership) I’ve pivoted my career into cybersecurity in early 2025. More specifically I’m now a full-time ethical hacker. I’m trying to recenter and find a new balance in this role. Alongside, I’m participating in bug bounty programs in my free time, and I consider the endeavor a…
I wrote this some time ago while on a train; didn't feel like posting it in the moment, for some reason. I’m on a train. I’ve been itching to write for a while, but it’s difficult to discern whether I actually have something to say, or if it’s just one more way my brain finds to contort any creative downtime I might (perceivably) have into something “productive.” Like many people, I’ve also been…
tl;dr Tested versions: Google Web Designer 16.3.0.0407 (released April 2025) After my recent discovery of two client-side remote code execution vulnerabilities in Google Web Designer (previously disclosed in my articles earlier this year: CVE-2025-1079 , CVE-2025-4613 ), in April 2025 I've found yet another serious issue in the app. Versions prior to 16.4.0.0711 (released July 29, 2025) had…
I didn’t anticipate this becoming a food blog, but after coffee and a certain high value smoothie , here I am writing about mangos. They’re great. Thanks for coming to my TED talk. Jokes aside though. I did not have a chance to fully appreciate this fruit until my adulthood, because it was expensive (and often impossible) to get ahold of certain tropical fruit in a small town in ’80s and ’90s…
We don’t cook much, and so we don’t plan ahead much, so our pantry and freezer tend to be a mish-mash of various versatile ingredients. Every once in a while, I crave a smoothie — a genre of food that lends itself well to our, uh, chaotic neutral kitchen habits. On one of these occasions, after getting the blender ready I ended up piling in the following: 150g of dates (sun dried) 3 scoops of…
40 minute video. In May 2025 I had the opportunity to present at BSides Budapest 2025 , an annual local conference, part of the BSides global network of independent information security conferences. Download the recording (2.1GB MP4 file), or watch it above. You can also find it on BSides Budapest’s YouTube channel . The talk is a small selection of the most interesting bugs I’ve found in my first…
In the spirit of posting casually , I wanted to write a few words about coffee. We've had our Lelit Mara X for a few years now. Even though I've gotten fairly okay at making milk-based coffee drinks, 9 times out of 10, my drink of choice throughout most of the year is the double espresso. I mostly drink my coffee right when I start work, and right after lunch, and so the jolt I get from espressos…
I've been meaning to (re)start casual blogging for quite some time now, probably decades at this point. My recent experiences writing articles on cybersecurity made me reconnect with this desire, and I mostly had the framework in place in my static site generator to enable it. So, here I am, posting! Woohoo! I'm making an effort to have low expectations regarding blogging. I tend to dream big and…
tl;dr Tested versions: Google Web Designer 16.1.0.0530 (released cca. June 2024) and 16.2.0.0128 (released February 28, 2025) This issue is tracked as CVE-2025-4613 , and has been fixed in version 16.3.0.0407 , released cca. April 19, 2025. Shortly after finding my first RCE on the app , in February 2025 I’ve discovered a vulnerability in Google Web Designer that exposed its users to another…
tl;dr Tested version: Google Web Designer 16.1.0.0530 (released cca. June 2024) This issue is tracked as CVE-2025-1079 , and has been fixed in version 16.2.0.0128 , released February 28, 2025 . In November 2024 I’ve discovered a vulnerability in Google Web Designer that exposed its users on macOS and Linux to the possibility of client-side remote code execution via improper symbolic link…
tl;dr When the stars stylesheets align just right, it’s possible to escalate a harmless content injection issue to a marginally less harmless one by using certain Unicode characters to stand in for pixels in a QR code. (For fun, not profit.) Read on for details. In this article I’ll be showing you how I was able to render arbitrary QR codes in a web app that was not at all designed to do that,…