Hacker News: colemannugent

New comment by colemannugent in "Chained PHP2Shell exploit roots 25 servers, including US Government servers"

colemannugent — Thu, 29 Oct 2026 15:09:36 +0000

Reading this I'm almost certain the firewall vendor is Palo Alto Networks. They included a PAN-OS setting verbatim and the SELinux config matches my experience.

New comment by colemannugent in "Chained PHP2Shell exploit roots 25 servers, including US Government servers"

colemannugent — Thu, 29 Oct 2026 15:08:25 +0000

This is 100% PAN-OS

New comment by colemannugent in "ICANN Reveals 2026 Round Applications for New Generic Top-Level Domains"

colemannugent — Wed, 07 Oct 2026 22:46:30 +0000

Also noticed .not

New comment by colemannugent in "ICANN Reveals 2026 Round Applications for New Generic Top-Level Domains"

colemannugent — Wed, 07 Oct 2026 21:39:04 +0000

I think .cos and .con should probably be rejected for typosquatting concerns.

New comment by colemannugent in "Pass the Passkey: A Novel Attack Surface in Passwordless Authentication"

colemannugent — Wed, 05 Aug 2026 00:17:59 +0000

It kinda is. If they use Chrome and it's cloud backed password manager, odds are they use GMail. That plus full access to a trusted device (which you have in this scenario) allows you to change their Google account password. Boom, full persistence.

I can think of at least a dozen easier ways to do nefarious things with this level of access that are at least that simple. As an example, faking user attribution would be trivial.

How could Google patch this? If the client is compromised and the attacker can manipulate the local TPM or it's equivalent there's no defense.

New comment by colemannugent in "Pass the Passkey: A Novel Attack Surface in Passwordless Authentication"

colemannugent — Tue, 04 Aug 2026 23:58:46 +0000

>4. Using the hash of that handshake, the attacker interacts with the victim’s TPM and uses the extracted identity key to sign the handshake hash together with the assertion request

Huh? If you have this level of local privileges you can just read session cookies from the browsers store? I guess stealing all the keys is notable, but you can manipulate any password manager with this level of access right?

What's the threat model here, that synced passkeys should be secure in even in situations involving compromised clients? How?

New comment by colemannugent in "[dead]"

colemannugent — Thu, 23 Jul 2026 17:22:37 +0000

Not on the public status page, you have to be signed in to a Microsoft account to access this link.

One of the recent updates:

>Starting at 14:44 UTC on 23 July, 2026, customers may have experienced intermittent connectivity failures, increased latency, or difficulty accessing Azure services in West US region. Customers with traffic traversing the West US region may also experience downstream impact. Impacted services include, but are not limited to:

>API Management, Application Gateway, Azure Database for PostgreSQL, Azure Kubernetes Service (AKS), ExpressRoute Circuits, ExpressRoute Gateways, Network Infrastructure, Power BI Embedded, Virtual WAN, VPN Gateway

>We have identified a potential trigger and are isolating certain impacted devices and redirecting portions of traffic to healthier devices as part of a mitigation plan. We are actively monitoring traffic patterns and service recovery. We will continue to evaluate the effectiveness of mitigation, assess customer impact, and investigate contributing factors. We will provide additional information as soon as it becomes available.

New comment by colemannugent in "Found a simple tool for database modeling: dbdiagram.io"

colemannugent — Sun, 27 Apr 2025 16:23:52 +0000

DBeaver will generate an ER diagram from a connected DB

New comment by colemannugent in "Firewall rules: not as secure as you think"

colemannugent — Fri, 30 Aug 2024 00:20:51 +0000

They can pin certs, but at least you know that you can't see that traffic and make a policy decision about allowing it anyways or trying to force the vendor to drop it.

New comment by colemannugent in "Firewall rules: not as secure as you think"

colemannugent — Fri, 30 Aug 2024 00:11:37 +0000

Which is why you need a modern firewall that MitMs both TLS and SSH. Not hard to do these days.

New comment by colemannugent in "Hacking Google Bard – From Prompt Injection to Data Exfiltration"

colemannugent — Mon, 13 Nov 2023 17:56:14 +0000

TLDR: Bard will render Markdown images in conversations. Bard can also read the contents of your Google docs to give responses more context. By sharing a Google Doc containing a malicious prompt with a victim you could get Bard to generate Markdown image links with URL parameters containing URL encoded sections of your conversation. These sections of the conversation can then be exfiltrated when the Bard UI attempts to load the images by reaching out to the URL the attacker had Bard previously create.

Moral of the story: be careful what your AI assistant reads, it could be controlled by an attacker and contain hypnotic suggestions.

New comment by colemannugent in "Show HN: Scorecard.gg – minimalist scoring tool for your favorite board games"

colemannugent — Tue, 07 Nov 2023 16:59:01 +0000

Could you add a general "game" for round-based games?

The current Scrabble score-card is close, but it would be nice to have a per-round score and a running total as columns.

New comment by colemannugent in "My $0->$100M->$0 in 5 years story"

colemannugent — Sat, 12 Aug 2023 18:45:31 +0000

Seriously, ~120 comments and this is the first one to question the posts legitimacy?

The reddit poster goes on to comment:

>15 minutes phone call to decide to file for bankruptcy and for them to take their money back (and then some) and shut down my company

What? In no world would that happen. Even a mostly failed company has quite a bit more value than $0.

No mention of the name of the company or even the vertical. 100% BS.

New comment by colemannugent in "Guerrilla guide to CNC machining, mold making, and resin casting (2015)"

colemannugent — Wed, 11 Jan 2023 19:08:47 +0000

>https://www.r-c-y.net/posts/machining/

Great info, thanks for posting!

New comment by colemannugent in "Uber investigating breach of its computer systems"

colemannugent — Fri, 16 Sep 2022 03:16:51 +0000

>scan their intranet and find a network share

Did their IDS/IPS not go off on this? I wonder if this was a sophisticated scan designed to go slow and evade detection or if it was just nmap lol

I can't wait for the post-mortem, hopefully lots of good lessons to learn.

New comment by colemannugent in "Act-1: Transformer for Actions"

colemannugent — Wed, 14 Sep 2022 22:00:18 +0000

So here's the main problem I see with this:

>Anyone who can articulate their ideas in language can implement them

I'd be shocked if even 10% of the users who can't navigate a GUI could accurately describe what they want the software to do. To the user who doesn't know they can use Ctrl-Z to undo, the first half dozen times the AI mangles their inherited spreadsheet might be enough to put them off the idea.

New comment by colemannugent in "Excuse me but why are you eating so many frogs"

colemannugent — Thu, 08 Sep 2022 16:09:06 +0000

This is a shockingly coherent summary. The accuracy leaves a bit to be desired, but this is perfectly usable for distilling things you don't have time to fully evaluate.

New comment by colemannugent in "Data-Driven Deportation in the 21st Century"

colemannugent — Fri, 13 May 2022 21:12:19 +0000

Keeping with ancient Solomonic tradition, I say we deport some top ICE officials until they knock it off.

New comment by colemannugent in "DeepMind: A Generalist Agent"

colemannugent — Thu, 12 May 2022 17:11:00 +0000

What I really want to know is what kind of robot arm motion is produced when the network is given a cat image to classify. More specifically, what kind of insights has it learned from one control domain that it then applied to another?

I imagine that the simulated 3D environment and the actual control of the robot arm must have some degree of interconnection neurally.

New comment by colemannugent in "Using LEOs and GEOs"

colemannugent — Thu, 28 Apr 2022 16:35:30 +0000

It's related to the Bandwidth Delay Product:

https://en.wikipedia.org/wiki/Bandwidth-delay_product

https://networklessons.com/cisco/ccnp-route/bandwidth-delay-...

Every now and then some network middlebox ends up screwing with your TCP window sizing and then the bandwidth delay product rears its ugly head.