Nostr notes by Daniel Cuthbert

unprompted will be releasing all slides soon

2026-10-28T22:39:57Z

In reply to nevent1q…r4a7
_________________________

unprompted will be releasing all slides soon

kudos to @npub1nxm…s88r showing the true costs of finding bugs. ...

2026-10-27T23:06:03Z

kudos to XBOW (npub1nxm…s88r) showing the true costs of finding bugs. their recent chrome bug is a great example of modern bug hunting and I've oodles of love for them showing said costs and approaches

things do change but, and yes I'm biased here being a ...

2026-10-27T22:35:05Z

In reply to nevent1q…763z
_________________________

things do change but, and yes I'm biased here being a reviewer, the content is still solid and phrack-like. this edition is a brilliant read I feel and yeah that cover art is sexy af

great to see the print version available for all. 40 years of ...

2026-10-27T16:35:29Z

great to see the print version available for all. 40 years of Phrack (npub1am3…j6qn) and here's to so many more

no screen time Sundays... ...

2026-10-25T19:22:00Z

no screen time Sundays...

Yah, and US banking is even more behind then EU banking. ...

2026-10-17T10:20:48Z

In reply to nevent1q…6ph7
_________________________

Yah, and US banking is even more behind then EU banking.

"rogue agents.." pfft

Aah yes, "rogue agent" argument whereas lets be honest, ...

2026-10-17T10:13:47Z

Aah yes, "rogue agent" argument whereas lets be honest, this is more about banks shitting themselves over what is fundamentally a panic over the end of the ultimate banking free lunch.

For decades, traditional high-street banks have relied on customer inertia. People leave their cash sitting in a checking account earning a paltry % simply because moving it takes a bit of friction and effort. That cheap liquidity is the bedrock of their lending margins.

The liability and regulatory arguments are valid secondary headaches, but the existential threat is pure margin compression.

https://www.ft.com/content/f49c8e39-f07f-4177-9948-aabe55e5ed91?syn-25a6b1a6=1

Proof being a CISO is stressful, Darrin quit and decided to drive ...

2026-09-27T07:25:17Z

Proof being a CISO is stressful, Darrin quit and decided to drive his Land Rover all over one of the most spectacular countries I’ve ever been to: Namibia

https://youtu.be/RYGsa9c7PzM?is=oa_UQRAhQWkp6TZs

So if you like the wilderness and stuff, give it a watch and subscribe and help an ex-CISO recover

Overheard and can’t un-hear it: “Kubernetes is this ...

2026-09-23T09:43:15Z

Overheard and can’t un-hear it:

“Kubernetes is this generations writing shit in PHP”

hah good to know. Okay, I will make more.

2026-09-22T04:52:10Z

In reply to nevent1q…y5c9
_________________________

hah good to know. Okay, I will make more.

yessir. She has a fully stocked garden area where she can grow ...

2026-09-20T17:37:04Z

In reply to nevent1q…4286
_________________________

yessir. She has a fully stocked garden area where she can grow stuff now too. Happy wife, happy life

yeah I’ve seen the adverts and I won’t lie, I’m intrigued

2026-09-20T16:43:56Z

In reply to nevent1q…93a2
_________________________

yeah I’ve seen the adverts and I won’t lie, I’m intrigued

yeah dedicated account, linked into YouTube and then controlled. ...

2026-09-20T15:06:04Z

In reply to nevent1q…pq9g
_________________________

yeah dedicated account, linked into YouTube and then controlled. YT kids they hate.

Phase 3 of Mick’s restoration adventure, our 1956 Land Rover ...

2026-09-20T15:00:22Z

Phase 3 of Mick’s restoration adventure, our 1956 Land Rover series 1 107, has begun. The truck spent 70 years of its life in the Australian outback, and as such whilst there is no serious structural rust, there is a metric shit ton of outback dirt and surface rust, of which we need to remove..

i’m toying with the idea of getting this bead blasted and then powder coated, which should prolong its life far beyond when I have shuffled off this mortal coil and it’s up to my boys to then enjoy it.

It’s that or the boys and I get intimate with some masks and the wire wheel.

apologies, grab ...

2026-09-19T19:49:05Z

In reply to nevent1q…f5et
_________________________

apologies, grab https://families.google/intl/en-GB_ALL/familylink/

By far the best parental control feature ever made: the ability ...

2026-09-19T09:46:51Z

By far the best parental control feature ever made: the ability to completely block YouTube Shorts. Whoever on the product team thought Shorts was a good idea genuinely needs to be dragged outside & throttled.

It is ugly, addictive, useless tech that provides zero actual value.

The change in behavior with my dudes is something else. I wish Google made this the default and explained how dangerous shorts are.

oh that would heaven. I’d eat both and then feel sorry for ...

2026-09-14T18:25:29Z

In reply to nevent1q…a5er
_________________________

oh that would heaven. I’d eat both and then feel sorry for myself but happy and full

When your wife enters the baking phase of her life, you are ...

2026-09-14T18:06:23Z

When your wife enters the baking phase of her life, you are doomed to never be lean again.

Friday chocolate chip cookies
Sunday Oreo crumble cake
Today, banana bread with chocolate

This is impossible

RIP HELCH. Huge part of Londons graffiti scene. Whilst there were ...

2026-08-30T12:44:13Z

RIP HELCH. Huge part of Londons graffiti scene.

Whilst there were many favs, the American carwash for me was the best.

https://drorhadadi.com/en/helch-graffiti-2/

Last burst of those summer rays... The Light Lens Lab 50mm F2 ...

2026-08-30T07:46:34Z

Last burst of those summer rays...

The Light Lens Lab 50mm F2 Speed Panchro II, designed by Mr. Zhou in China, is possibly one of the characteristic lenses I own.

The original Cooke Speed Panchro II is a beautiful piece of optical history, but rare, expensive and increasingly difficult to find. Unless I turn to cybercrime, this lens is an easier way of shooting that famous “Cooke look”.

What I love most about it is the imperfections. Modern photography is too perfect.

The glow, the softness, the vignetting, the gentle fall-off and the way it renders light. Modern lenses are designed to correct these imperfections. The Speed Panchro embraces them, and somehow, those imperfections are what give the image its character.

Not technically perfect. Just beautifully imperfect with flaws and renderings more how we see stuff.

Modern technology has spent decades trying to remove imperfections: more resolution, better dynamic range, less distortion, less flare, sharper corners, cleaner high ISO, perfect autofocus.

And now there's a cultural reaction to that perfection

https://www.theguardian.com/artanddesign/article/2024/aug/16/the-mistakes-are-romantic-gen-zs-revival-of-point-and-shoot-cameras

People are deliberately choosing older cameras because the limitations create an aesthetic. The blur, grain, harsh flash, colour shifts and blown highlights aren't necessarily defects anymore, they're part of what makes the photograph feel distinctive and human

We dont see perfectly. Our eyes are amazing but modern smartphone and digital camera sensors dont reflect what we process.

https://www.fastcompany.com/91050385/why-gen-z-is-obsessed-with-point-and-shoot-digital-cameras

So here's to more mistakes. More blurs, more harsh colours and not what tech bro's in the valley think we want or need just because their wealth depends on it.

Shut up and explore this amazing planet of ours. A mantra I’ve ...

2026-08-28T13:22:55Z

Shut up and explore this amazing planet of ours. A mantra I’ve had since I was a teen and it’s so good to see a Norwegian do what I want to do before I shuffle off this mortal coil: ride around Afghanistan on a bike just with my Leica and film

https://youtu.be/OMC7pj-0wQY?is=rWzQMWjQmVhrl701

You go Tom. This is living. Afghanistan looks amazing.

same and the idea of making stuff is just too appealing. I’ve ...

2026-08-28T12:11:15Z

In reply to nevent1q…6f4n
_________________________

same and the idea of making stuff is just too appealing. I’ve also got a lot of stuff I need to make, currently restoring a 1956 Land Rover series 1, the Lancia delta integrale, 2 x classic Mercedes and a few other things

One has to pay respect for the effort that was clearly monumental ...

2026-08-28T08:28:00Z

One has to pay respect for the effort that was clearly monumental for this edition of tmpout

https://tmpout.sh/5/

that ASCII art is off da faken scale

I’ve entered that phase of my life where a lathe is looking ...

2026-08-28T07:43:01Z

I’ve entered that phase of my life where a lathe is looking like a solid decision for the workshop.

Shit.

I don’t think so. I look at what Apple has specifically done ...

2026-08-26T07:56:14Z

In reply to nevent1q…e97s
_________________________

I don’t think so. I look at what Apple has specifically done with proprietary hardware fasteners also the enclave where “allowing unverified third-party components compromises user security.”

Piss off. They’ve allowed imageio to be shit for ages and consistently be abused. This is not about security but control

Designing a product that is almost impossible to repair is a dick ...

2026-08-26T07:21:55Z

In reply to nevent1q…7fwj
_________________________

Designing a product that is almost impossible to repair is a dick move. Apple is the master in this, look at the AirPods and how they make it harder to replace parts with non-Apple components

They aren’t alone. We’ve somehow accepted that when it breaks we need to buy a new one, which is incredibly wasteful.

I know it’s easy and cool to dunk on EU red tape but this is ...

2026-08-26T07:18:05Z

I know it’s easy and cool to dunk on EU red tape but this is actually sexy af: https://commission.europa.eu/news-and-media/news/right-repair-new-consumer-rights-easy-and-attractive-repairs-2026-07-31_en

For the last decade (or maybe more actually) hardware engineering has leaned heavily on proprietary screws, anti-repair software pairing, and literal buckets of industrial adhesive.
This piece treats the EU Directive as a tactical defeat for aggressive silicon anti-features.

Actually I think the right to repair is vital. We’ve got too much e-waste as it is so I welcome such efforts to make and mend.

Silicon Valley won’t like it but honestly, they are the problem in most cases

Don’t need a 16mm camera Don’t need a 16mm Don’t need a ...

2026-08-20T18:01:38Z

Don’t need a 16mm camera
Don’t need a 16mm
Don’t need a
Don’t need
Don’t

Hmmm. I mean…..

I do love the fact that we are seeing film stock being developed at the moment.

euphoria season 3 is shot on this and I can’t wait to watch it

I'm blown away by what we have today. Take ...

2026-08-20T08:08:49Z

I'm blown away by what we have today. Take https://huggingface.co/Qwen/Qwen3-Embedding-0.6B which is just brilliant at taking output from RAPTOR and the datasets we create from our /understand (attack path, src, sink, dataflow, threat model etc) and then doing careful extraction, not crystal-ball nonsense. It’s capable enough to understand technical security language and follow a structured schema, but small enough to run properly on an 8GB M1 Mac mini.

I run it with temperature 0, an 8,192-token context and a tightly defined output schema, num_predict = 1400 which bounds the output.

The model has enough room for the structured labels but cannot wander into an enormous response or hallucinate as much in my experience.

Then, I use qwen3-embedding:0.6b to spot semantically related labels

Honestly this is such an exciting period for us, well at least me finding bugs 'n shit.

on the dinosaur front, we set about making a bloody solid sandbox and control/telemetry plane for RAPTOR: https://github.com/gadievron/raptor/issues/889

oh and it works really well from stopping it from eating your face.

ethernet? what's that??? ;p

2026-08-18T09:25:14Z

In reply to nevent1q…tr5j
_________________________

ethernet? what's that??? ;p

As AI creeps more and more into the creative arts, I love hearing ...

2026-08-18T09:20:30Z

As AI creeps more and more into the creative arts, I love hearing what real artists are coming up with as a result

https://www.youtube.com/watch?v=jEfWTJzlMoY

Andre just builds this so well. You can almost imagine the smoke and the sweat and throbbing bodies dancing to this at 0300 and then it just goes on and on.

Here's to more like this

then today is very much a hardware hacking day, bear with me. ...

2026-08-18T07:14:16Z

then today is very much a hardware hacking day, bear with me.

Some cool research by fellow Blackhat review board'r, Ben Nassi and Co

https://www.nassiben.com/video-based-crypta

Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED

Then AndrewMohawk :verified: (npub1sqj…2cmf) spent time on [@bunnie](https://social.treehouse.systems/@bunnie )'s badge

https://andrewmohawk.com/2026/08/16/dc34-badge-hackin/

Now then, it's kinda known that the best watch in the world ...

2026-08-18T07:12:44Z

Now then, it's kinda known that the best watch in the world is a Casio F-91w (god-tier), fact, but surely this is screaming out to be a close hackable contender

https://www.casio.com/uk/watches/casio/product.F-B100W-1A/

Step tracker, Bluetooth sync and no charging cable? Oh hell yes

CR2016 and say no more.

Oh and hackable you bet. At that price point, this seems like a good winter exploration project with the kids here.

yeah the swell can be fun sometimes ;) Been coming here since I ...

2026-08-17T07:25:08Z

In reply to nevent1q…f0zx
_________________________

yeah the swell can be fun sometimes ;)
Been coming here since I was 2, such an amazing set of islands

Anyhoo. Los canarias… ...

2026-08-16T09:00:28Z

Anyhoo. Los canarias…

same but I’ve this ugly feeling it’s cooked. Bag was inside ...

2026-08-16T08:48:20Z

In reply to nevent1q…g78n
_________________________

same but I’ve this ugly feeling it’s cooked. Bag was inside for longer as they don’t like the brass that the Leica is made of.

Finally had a chance to shoot my CineStillFilm 800 and I’ve an ...

2026-08-16T08:44:34Z

Finally had a chance to shoot my CineStillFilm 800 and I’ve an ugly feeling it will be fogged TF thanks to minimum wage security idiots at the airport refusing a hand search

The security theatre at airports continues. Shoes off. Oh wait that watch looks dangerous. Oh no this film could be bad!!

This badge. No really, this bloody @npub1dqd…8xy4 badge by the ...

2026-08-07T00:56:12Z

This badge. No really, this bloody DEF CON (npub1dqd…8xy4) badge by the legend that is @bunnie.treehouse.systems is something else.

First up, Bunnie is my hero and his hardware foo is on another level. The Baochip SoC is <insert superlative here>, I mean it builds on his epic Precursor device ethos

“Do you really know what is going on inside the CPU?”

The chip is transparent to infrared light. Take a modified USB microscope and voila, have a look at the transistors

oh it’s wild. We’ve almost got to the point where you need to ...

2026-07-25T18:20:51Z

In reply to nevent1q…smqr
_________________________

oh it’s wild.
We’ve almost got to the point where you need to do a physical assessment of the cars telemetry systems in order to block them, or at least find out where the hell they are at first

That or we need an EDR or WAF for the cars. Heaven help us all

I never thought i'd side with Gen Z in how they think, but ...

2026-07-25T10:14:11Z

I never thought i'd side with Gen Z in how they think, but when it comes to analogue devices, we are very much in sync.

Vinyl's back. Mechanical watches are back. Gen Z reads more physical books than the algorithm and tech bro's wearing patagonia would like.

I'm here for it.

I remember being with Jeff Moss (npub12ts…x422) in London talking about cars and tracking a while ago and it has always been in the back of my mind.

I'm not anti-tech, I'm just anti-tech for techs sake. I own a modern car, it's from 2009 and it's the newest I have and have ever had actually.

It has knobs. It has sliders. There's no stupid ipad in the display. I don't have it snitching on me. I don't have a sub to warm

Turns out I'm not just being sentimental about this. From January 2026, Euro NCAP won't give a car five stars unless it has physical controls for indicators, hazards, the horn, windscreen wipers and such.

physical knobs. wild I tell ya

Their own research found touchscreen tasks can take 20+ seconds, enough to cover half a kilometre at motorway speed without your eyes on the road.

Then there's the data, and this is the part that actually worries me professionally. Mozilla tested every major car brand's privacy practices. Every single one failed. Their conclusion: cars are the worst product category they've ever reviewed for privacy (https://www.bbc.co.uk/future/article/20260513-your-car-is-spying-on-you-its-about-to-get-worse)

None of this is a human underwriter looking at your file anymore. It's a model turning your braking patterns, night trips and cornering speed into a risk score and quietly adjusting your price.

Insurers are moving further into AI-processed pricing and claims, and even within the industry the reasoning behind a given decision is often described as a "black box" that's hard to unpick

So I'm not being precious about buttons for the sake of it. I'm against tech that fails silently, phones home without asking, and quietly builds a profile of me that I'm not allowed to read. Tech for tech sake is what VC's and tech bros want and the reality is, most others dont

And that's the part I can't get past, being on the inside of this stuff. I know exactly where that data goes. It's not sitting in a drawer somewhere. It's a row in a Postgres table, or an embedding in a vector database, waiting for some frontier model to slurp it up

Often with shoddy security engineering processes and "oh crap we got hacked but no honestly, we DO take your security seriously" lines we've all heard to death.

So here's to more analogue, less tracking and less bloody data generation

If you got this far, watch Julia James Davis (she's very cool, I like her series on the death of beauty)

https://www.youtube.com/watch?v=V7GKFmAbTB8&t=1s

Anyway here's to hacker summer camp, tinkering and breaking and hacking.

So @npub1j54…42x7 and I are on a mission to find creative ...

2026-07-14T06:59:48Z

So chompie (npub1j54…42x7) and I are on a mission to find creative artists who want to help design the cover for Phrack #73.

retro sci-fi & chrome futures
▸ cyberpunk / terminal aesthetics
▸ dystopian systems
▸ hacker manuals from an alternate timeline
▸ weird cool stuff and machines

Keen? Fancy helping?

📮 arts@phrack.org
⏰ Deadline: August 15

Ever since @npub12ts…x422 mentioned the concept of agency to ...

2026-04-26T06:12:55Z

Ever since Jeff Moss (npub12ts…x422) mentioned the concept of agency to me, I’ve not stopped thinking about how much modern technology asks us to relinquish control of our data.

I’ve never used music streaming services. I always disliked the idea of not owning my music. For me, the original iPod was the epitome of agency: mine to do with what I wanted, when I wanted.

With the relentless march of frontier models consuming as much of our data as possible, we need more agency today, not less. Control over who has access to our data. Control over when they have it. Control over what they are allowed to do with it.

Silicon Valley has given us some truly amazing inventions, but it has also welcomed some ugly things into our lives. Systems where we have very little control, very little ownership, and very little say.

That needs to change. Really looking forward to DEF CON (npub1dqd…8xy4) this year

Day two of Black Hat and I got a chance to see my friend Ariel ...

2026-04-24T02:38:47Z

Day two of Black Hat and I got a chance to see my friend Ariel Herbert-Voss
do the keynote. It opened a floodgate of thoughts.

Oh and yay, GPT-5.5 is here and it feels like we’re entering another mad period of growth for frontier models and security research.

The big thing I’m seeing is that we need less scaffolding around these models. Give them code, context, a goal and some tools, and they are getting much better at cracking on.

That matters for bug hunting. A lot

But let’s not pretend the machines have solved vuln research. They haven’t.

The biggest gains are still at the shallow end.

Low severity bugs, obvious logic mistakes, unsafe patterns, missing checks, boring-but-real issues, that’s where models are starting to clean up. If the bug class is well documented and the code is clear, they move quickly.

The low-hanging fruit is getting hoovered up at pace. The easy stuff is becoming cheaper to find, well sorta cheaper.

We’re also seeing decent gains on modest bugs. Not deep chains. Not always novel research. But useful findings where the model can read, reason, trace, and join enough dots to help.

Where it still gets spicy is state.

Models can talk about state all day, but they don’t really feel it. They still struggle with temporal bugs, race conditions, lifecycle weirdness, multi-step flows, and those “only happens after you do these seven things in this exact order” bugs.

Spotting something dodgy is not the same as proving it is exploitable.

On the exploit side, validation, exploitability and reliability are improving, but more slowly. This is one of the big areas John and I have been working through with RAPTOR: getting away from “looks interesting, mate” towards “this is real, reachable, and repeatable”.

Because exploit reliability is still a graft. Targeting is still fragile. You still need iterations.

Oh and the human in the loop is still vital.

We all thought fuzzing would solve the bug problem. It didn’t. It changed the economics of bug discovery, but we still needed harnesses, triage, context, exploit dev, judgement, and all the boring engineering bits that make the work useful.

I think frontier models are having a similar moment.

The best results won’t come from throwing a giant model at a repo and hoping it finds magic. They’ll come from layered systems: frontier models for reasoning and code understanding, smaller focused models trained on private data, internal vuln history, remediation patterns, product context, validation loops, and humans who know when the model is chatting crap.

As models get better at writing code, they get better at breaking it. Capability doesn’t scale politely. It compounds.

Better tool use helps validation.

Better context helps reachability.

Better reasoning helps exploit chains.

But it still needs structure.

It still needs evidence.

It still needs humans who know what good looks like.

The shallow bugs are already getting compressed. The interesting bit is what comes next.

“We are going to crave more authentic in-person experiences as ...

2026-04-23T23:31:31Z

“We are going to crave more authentic in-person experiences as our online interactions are seemingly less authentic”

Jeff Moss (npub12ts…x422) utterly nailing it

From the “no shit, didn’t see this coming” department: ...

2026-04-04T06:34:07Z

From the “no shit, didn’t see this coming” department:

District Judge Jeremy Daniel in Chicago said drivers in the proposed class action ⁠can try to prove that Allstate violated the Federal Wiretap Act by monitoring their travel locations, trip distances, speed, acceleration, braking, phone usage and attention to the road, and tried to monetize that data to boost profit.

Reminds me of the cool chat Jeff Moss (npub12ts…x422) and I had years ago at Blackhat London about the oncoming privacy nightmares of modern cars

https://www.reuters.com/legal/government/allstate-must-face-privacy-lawsuit-over-cellphone-tracking-drivers-2026-03-04/#:~:text=Summary,when%20they%20rode%20as%20passengers.

Aaaah yiss, 144mb of Infamy A few weeks back, I started a bit of ...

2025-08-16T08:35:40Z

Aaaah yiss, 144mb of Infamy

A few weeks back, I started a bit of a passion project. I wanted to capture the faces of the '90s and early 2000s hacking scene using the tech of the time. We're talking a Sony Mavica camera and a vintage computer for editing.

The first photos are now ready for a look. You can see all the grain and glorious low-res details here: https://dcuthbert.exposure.co/144mb-of-infamy

PR merged after 72 hours of mega work, if anyone fancies ...

2024-11-07T10:45:35Z

PR merged after 72 hours of mega work, if anyone fancies seeing/commenting, i'd love the insights

https://github.com/OWASP/ASVS/blob/master/5.0/en/0x14-V6-Cryptography.md

Very interesting issue with Okta here, especially with the use of ...

2024-11-02T07:13:49Z

Very interesting issue with Okta here, especially with the use of bcrypt

https://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username/

As Yan (@bcrypt) said

“reminder that the bcrypt hash function ignores input above a certain length! so if you do bcrypt(username || password) for some reason, a sufficiently long username will make it accept any password. to fix this you can sha256 the input first”

It has taken a while but Mark Carney and I have just done a pull ...

2024-11-01T08:43:24Z

It has taken a while but Mark Carney and I have just done a pull request to the OWASP ASVS 5.0 branch introducing major changes to V6 Cryptography

https://github.com/OWASP/ASVS/pull/2212

It builds upon the work we’ve done to hopefully make apps more secure from a cryptographic perspective & we are sure will see a lot of good discourse from all involved

We’d love to hear your thoughts and comments, as it’s a community-driven standard and always has been

https://github.com/OWASP/ASVS/pull/2212