tehfishman

_very_ hypothetically: it could be a supply chain attack. The systems could already be compromised, and there's a script waiting in a cron job to execute. That would explain the time window, and why they're saying there's no "vulnerability"

2026-08-12 01:52:14 UTC

- reply

did you catte too hard? Is there such a thing?

2026-07-09 15:12:20 UTC

- reply

This whole process was born out of their own failures too. Customers regularly tripping over land-mines when patching turned into customers demanding assistance with identifying which release they should install without blowing up production. I'm not sure if Palo still does this, but prior to the preferred release process they would tell customers to pay for Professional Services to figure out which release to upgrade to. Because fuck you for wanting your already expensive product to actually work, I guess?
So technically this is better than it was. But only because the bar was in hell and everyone was tripping over it.

2026-07-09 14:59:08 UTC

- reply

I can't speak for watchTowr but there are fun side-effects of this process as a customer. If you patch because of vulns (most people), and you call up support with an issue and you're ahead of the preferred release, sometimes they give you lip about not using the preferred release. Which is extra crazy when considering that customers effectively have to test the releases in production before support declares them "preferred".
Also they have rolled back preferred release versions a few times. Which would imply that even with this approach of letting less risk-averse customers test in production for them, they still miss major bugs that cause huge negative impact to customers when they tell everyone to move up to a release.

2026-07-09 14:29:14 UTC

- reply

yeah but it's literally just "preferred" and "everything else". Palo has been doing that for a few years now for PAN-OS. It's not anything to do with a formal alpha/beta/prod cycle though, or even anything to do with vulns present in a release. The way a Palo person explained it to me is that their support side basically says "we've seen enough people using this and our support teams are familiar with troubleshooting its bugs now that we'd like most of our customers to use it to make our lives easier"

2026-07-09 14:14:40 UTC

- reply

I think Palo is also huffing their own farts with regards to their skewed vulnerability scoring. The "preferred" release is still 11.2.10-h3, which was released in February like 3 high-severity (by their own metric) vulnerability announcements ago.

2026-06-18 15:47:38 UTC

- reply

I'm not excoriating Andrew personally. I do hope my message doesn't come across as a personal attack, because it's not meant as one. As I said, an individuals contributions and feelings are totally valid.
But I've seen each of the four examples you provided play out multiple times. So when I see someone inside the Infosec industry making bold claims about saving the world and that the Infosec Industry should be treated as critical infrastructure, my reaction is not immediately positive. This is an Infosec industry problem created by the Infosec industry.

2026-06-18 14:50:39 UTC

- reply

Adding on: an individual security researcher as an employee at a security company can easily have the feeling and view that their contributions are "saving the world". That feeling is valid. But eventually, the profit motive of the company will get in the way of that goal.
This isn't a new story, and it isn't unique to Infosec. But most industries don't try to found themselves on trust, and the infosec industry keeps taking a hammer to that foundation. An #ISAC won't fix that core issue, because y'all will be at each other's throats when a potential customer wants an actionable IoC feed.
https://files.ioc.exchange/iocexchange/media_attachments/files/116/771/653/978/128/418/original/a36b115e46226978.png

2026-06-11 14:43:07 UTC

- reply

I'm going to start a business for people to help solve this solution across the industry. The business model will be for frustrated clients to send their IoC lists to me when crappy vendors do not have reasonably easy ways to consume them. I will then print out the lists on paper, tie them to a brick, and hurl them through a window at the vendor main offices. Round 1 seed funding will finance legal defense funds and the commissioning of a trebuchet mounted on a flatbed truck.

2026-06-10 19:40:53 UTC

- reply

I've had that conversation with them about it and their response was basically "why would you want to do that yourself? We have Talos". Shocking lack of understanding for why a customer might have reasons for wanting to define _addresses to block on a firewall_

2026-06-10 19:35:50 UTC

- reply

hell, Cisco doesn't even support it unless you also own a threat license. I've been using hacked up solutions for their firewalls for years now.

2026-06-04 15:44:24 UTC

- reply

wait is that the source for @npub16kg…afn8 's PFP?

2026-06-03 18:24:06 UTC

- reply

Forcing the two largest mobile network mega corps to share a SIM slot in a device is clearly dom behavior send toot

2026-05-31 02:11:17 UTC

- reply

it's fucking crazy. And review sites don't even talk about it. Like if Honda or whoever gated functionality to a gas generator behind an Internet-requiring authentication prompt they'd get torn apart. But as soon as something is considered *smart tech* and uses an app it gets a pass for all manner of fuckery

2026-05-15 16:50:54 UTC

- reply

best I can do is an off-center screenshot of text with horrible jpeg artefacts

2026-04-22 02:17:28 UTC

- reply

i am not good at potatochop, but <picture of professor farnsworth with catte head, macro text of "good news, it's a suppository", holding up teams icon>

2026-04-21 20:31:48 UTC

- reply

teams as document suppository 🤔

2025-11-18 17:07:18 UTC

- reply

That's how I'm reading it. It would be extra funny if the reason for the config file growing "unexpectedly" large was because CF was tracking IP's in a botnet whose portal is protected by Cloudflare.