(untitled)
AI, by the way is free:
David Leadbeater
Public posts from @dgl@infosec.exchange
Latest posts
(untitled)
Was just looking at the possible specs of the Lenovo X1 Carbon Gen 14. Rather expensive option here! Also does anyone know what the $20 "Haptic Touchpad" means in terms of actual hardware?
(untitled)
Interesting talk from 39c3: https:// gpg.fail including my favourite classes of issues ANSI escape spoofing and abusing CR. A partial response from GnuPG is here https://www. gnupg.org/blog/20251226-cleart ext-signatures.html — although there’s other issues that do seem more fixable. IMO better to use age if it makes sense and/or ssh signing (e.g. for git commits)
(untitled)
Can I use has a strange entry for Zstandard on Safari ( https:// caniuse.com/zstd ). I can’t find many references for it but indeed, if you serve Zstd to Safari >= 26 it does work. There doesn’t even seem to be a feature flag to turn on sending it in the Accept-Encoding header.
(untitled)
I’m experimenting with @ bsky.brid.gy so this account is now bridged to Bluesky as @dgl.cx — there was a previous Bluesky account which that replaces (it now shows as “invalid handle”) and Bluesky doesn’t have a a Mastodon like way of migrating followers, so you will need to refollow if you’re on Bluesky.
(untitled)
Gcore.com are an interesting provider. It took two separate support tickets over a month to work out their docs are wrong. If anyone is using them, *some* API endpoints need the authentication token to be in mixed case, for example "Authorization: APIKey ..." which is against what their documentation says ("apikey"). Admittedly I wasn't trying hard to solve this, as it's a side project, but…
(untitled)
If you have a bash command line of "exec program ..." and you can control the "..." can you make it not run the exec and do something different? The answer is yes. Even if "..." is somewhat sanitised for shell metacharacters. If you can inject $[+] it will make bash error on that line and run the next. This is how https:// dgl.cx/2025/10/bash-a-newline- ssh-proxycommand-cve-2025-61984 works.
(untitled)
For those of you who saw my BSides Canberra talk, here's a vulnerability I couldn't talk about in the talk, yet, but is very much in the spirit of it: https:// dgl.cx/2025/10/bash-a-newline- ssh-proxycommand-cve-2025-61984
(untitled)
Did you know Cloudflare documents how to use DNS in Google Sheets? Because if you have a problem, DNS is clearly the answer. https:// developers.cloudflare.com/1.1. 1.1/additional-options/dns-in-google-sheets/
(untitled)
I probably should have polished my @ ComfyConAU talk. Instead I got sidetracked into wondering just how much I could tunnel over DNS: https:// dgl.cx/2025/09/images-over-dns
(untitled)
Noticed my SLAAC IPv6 address happens to end in :fade. Fade to black?
(untitled)
I'll be speaking at BSides Canberra: https:// cfp.bsidescbr.com.au/bsides-ca nberra-2025/talk/8TWF8X/ -- this will cover my recent find of an RCE in Git and how that and some other vulnerabilities could be used against developers. # bsides # security
(untitled)
I found a vulnerability in git. CVE-2025-48384: Breaking git with a carriage return and cloning RCE - https:// dgl.cx/2025/07/git-clone-submo dule-cve-2025-48384 As the post explains this is one of my favourite classes of vulnerability, using characters that are old and sometimes forgotten. # git # security # rce # ascii
(untitled)
🍋🟩 The ChatGPT app can happily render a lime, but it insists it doesn't exist.
(untitled)
If only solving my problem was this simple.
(untitled)
New blog post: Ghostty 1.0.0 terminal security; https:// dgl.cx/2024/12/ghostty-termina l-title (CVE-2024-56803)
(untitled)
New blog post: restricting SFTP access with Linux user namespaces. Wherein I pass off a pretty awful shell script as a good idea. https:// dgl.cx/2024/10/restricted-sftp -with-userns
(untitled)
also, locale specific escaping, thanks Windows.
(untitled)
I do like bugs that involve Unicode rehashes of 10 year old bugs: https:// labs.watchtowr.com/no-way-php- strikes-again-cve-2024-4577/
(untitled)
Saw xxd in colour in a FOSDEM talk (James Bottomley's one on TPMs). I know there's plenty of hex editors, but cool to have it built in to a standard tool. (Needs a pretty recent xxd, it's from https:// github.com/vim/vim/pull/12131 )