And also at night, almost all mirrors of the popular Funstat service were blocked.

This service collects information about users (their messages, which groups they are in, as well as their profile history).

Google has released the AI function in Sheets.

You can now use AI in your spreadsheets to generate text, analyze sentiment, or summarize and categorize information.

Source

4chan is hacked.

here are some details we know about this:

- The source code is leaked. (we don't know what's inside of the source code, so please open it with caution, inside of a vm preferably)
- The source code is compact PHP code.
- we still don't know if the hacker exploited a 0-day vulnerability or not.
- The person behind this, leaked all the moderator's emails as well as the internal moderation board (although only the older stuff, since they moved to discord)
- He said he won't leak the user pass data (weren't they hashed?!?!)
- He said he has cleaned the source code a bit, but there are still some secrets (e.g. environment variables?) left that will need replacement
- He said "he won't be leaking any DB" and that he doesn't want to hurt the actual users blah blah blah, but yeah who knows, he might sell it later or something, we don't know

With all these things, 4chan will be down for a few days to clean things up, unless they are quick

GitHub suffers a cascading supply chain attack compromising CI/CD secrets (one month old btw)
Article, Comments

Google is done migrating all projects made in Project IDX to its Firebase Studio

basically he used PDF files

977 commits invalidated
(thanks to a certain someone who caused this)

time mocking library for python

https://github.com/adamchainz/time-machine
https://pypi.org/project/time-machine/
written in C

An even funnier way to disable windows defender. (through WSC api)

https://github.com/es3n1n/defendnot/

How it works:

There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender.
This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation.

The initial implementation of no-defender used thirdparty code provided by other AVs to register itself in the WSC, while defendnot interacts with WSC directly.

btw, at first he used Avast's dll files to call WSC api, but now he reverse-engineered the way WSC works, a "clean" implementation in fact
blog post

Hyperparameter Optimization (Hyperopt):
It's an automated way to explore many different combinations of some parameters to find a set that performs the best according to a specific goal.

1. It uses smart algorithms (not just random guessing) to try different parameter values from the ranges you define in your code.
2. For each combination it tries (called an "epoch" or "trial"), it runs a quick backtest.
3. It keeps track of which combination gave the "best" result based on your chosen function(s).

Burnt out again award 🎖

CVE-2024-42367: In aiohttp, compressed files as symlinks are not protected from path traversal (risk: 6.3/10)

Static routes which contain files with compressed variants (.gz or .br extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links.

Affected versions: < 3.10.2

Links:
- CWE-61: UNIX Symbolic Link (Symlink) Following
- GitHub Advisory
- Patch
- VersionEye

#vulnerability #cve #python #aiohttp

If you think about it, why would you put so much faith in the tool you are using, in the first place?
maybe it's because you have no faith in yourself...and that's a pretty serious problem.

The tool matters considerably less than the individual using it; the skills, and most importantly, the intent of the individual using it.