Ichigo: Local real-time voice AI
GitHub, Comments

It has very interesting references:

1. Chameleon: Mixed-Modal Early-Fusion Foundation Models
2. Adam-mini: Use Fewer Learning Rates To Gain More
3. High Fidelity Neural Audio Compression
4. WhisperSpeech: An Open Source Text-to-Speech System Built by Inverting Whisper

Try googling this:

yahoo_site_admin/credentials/db.conf

DO NOT FORGET PEOPLE:

1. DISABLE your webserver's Directory Listing feature (at the very least on prod)
2. DISABLE your swagger/openapi route (at the very least on prod); usually at /docs or /swagger (if it's generated automatically, like FastAPI framework does it).
3. RESTRICT access to *.config, *.conf, *.db, *.cfg, etc etc... if you are using an unknown or outdated webserver.

current versions of these webservers are known to be safe for "path traversal vulnerability" by default:
1. nginx
2. IIS
3. Apache

but make sure they are not misconfigured, otherwise (same as the examples above), they might leak sensitive information (resulting in a information disclosure vulnerability).

Helpful links and similar vulnerabilities:
1. CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
2. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
3. CWE-23: Relative Path Traversal
4. CWE-24: Path Traversal: '../filedir' and CWE-25
5. CWE-34: Path Traversal: '....//' and CWE-35

6. And then there is CWE-36: Absolute Path Traversal which can sometimes literally cause a RCE vulnerability; such as CWE-40: Path Traversal: '\\UNC\share\name\' (Windows UNC Share)

All of these are decades old and no one believes there are still systems which are vulnerable to this; yet just a google search proves that they still do exist 🤦‍♂️

Escaping the Chrome Sandbox Through DevTools (to run arbitrary code on client's device)

Today following the disclosure of a Call of Duty Ricochet vulnerability which allows the arbitrary banning of users, another researcher operating under the moniker "Timoxa5651" disclosed a method to arbitrarily banning users under the BattleEye anticheat

https://www.unknowncheats.me/forum/anti-cheat-bypass/667333-bannleeye-banning-arbitrary-players-using.html#post4228108

tldr: change the game name and ID on some battleye game server that's available (e.g. dayz), connect to it from the client, get detected, and the ban arrives on the account that you faked

C++ proposal: There are 8 bits in a byte (2024-10-15)

C has the CHAR_BIT macro which contains the implementation-defined number of bits in a byte, without restrictions on the value of this number. C++ imports this macro as-is. Many other macros and character traits have values derived from CHAR_BIT. While this was historically relevant in computing’s early days, modern hardware has overwhelmingly converged on the assumption that a byte is 8 bits. This document proposes that C++ formally mandates that a byte is 8 bits.

CrossLinked: LinkedIn enumeration tool to extract valid employee names from an organization through search engine scraping.

https://github.com/m8sec/CrossLinked

It can provide accurate results without the use of any API keys, credentials, or accessing LinkedIn directly.

modern malloc