Nostr notes by faebudo

New Cloudflare blog post due tomorrow. We let an intern and 5000 ...

2026-10-22T17:47:34Z

In reply to nevent1q…pl74
_________________________

New Cloudflare blog post due tomorrow. We let an intern and 5000 agents rewrite PHP in rust and already put it in production.

Also their CVSS 4.0 calculation only has VA:H, both VC and VI are ...

2026-10-04T10:21:34Z

In reply to nevent1q…f7jv
_________________________

Also their CVSS 4.0 calculation only has VA:H, both VC and VI are None. So either they're lying or they didn't fix all the vulnerabilities used in this attack but only the triggering DoS condition but not the one leading to RCE.

Use pktmon like this: - pktmon filter remove (to remove the ...

2026-09-04T05:13:02Z

In reply to nevent1q…zu4v
_________________________

Use pktmon like this:
- pktmon filter remove (to remove the filters Defender for Endpoint uses by default)
- pktmon filter add -p 3389
- pktmon start -c --pkt-size 0 -m real-time

It will show the pakets on all layers of the network stack including WPF so you will be able to see the drop reason for the syn pakets.

- pktmon stop

You can also run it without -m real-time and then convert the etl using pktmon etl2txt to get the same output non-interactive.

I don't know if this is what you want but you can already do ...

2026-04-20T16:20:17Z

In reply to nevent1q…5evy
_________________________

I don't know if this is what you want but you can already do this with EDL (External Dynamic Lists) if you have a webservice delivering the IPs for the ASNs:
https://iserv.nl/files/edl/feed.php

Trend Micro replied to a similar Feature Request that they don't have a good enough data source to allow this (I suggested MaxMind ASN).

amazon.com doesn't have AAAA records, it's only reachable ...

2026-04-03T19:29:23Z

In reply to nevent1q…w2p0
_________________________

amazon.com doesn't have AAAA records, it's only reachable via IPv4 but it redirects to www.amazon.com which has IPv6 connectivity.

Oh Scheisse, das IPv4 Netz auf das die Source genattet wird ist ...

2026-02-15T13:36:06Z

In reply to nevent1q…0hev
_________________________

Oh Scheisse, das IPv4 Netz auf das die Source genattet wird ist ein RFC5737 Documentation Address Block.
Das kann sich einfach niemand ausdenken..

Ich würde einfach mal ganz frech raten das das Ihre Lösung ist ...

2026-02-15T12:44:13Z

In reply to nevent1q…z00x
_________________________

Ich würde einfach mal ganz frech raten das das Ihre Lösung ist für einen grossen Kunden der einen Grossteil der Infrastruktur bei AWS mit IPv6 hat (IPv4 kostet extra) und für "digitale Souveränität" trotzdem noch einen Dienst bei StackIT im Backend benutzt und diesen erreichen will.

Ganz geil ist ja auch das man nach dem NAT64 gar nicht mehr weiss woher der Traffic kommt und einfach alles an Traffic akzeptieren muss.
Somit hat man als StackIT Kunde keine Chance mehr irgendwelche Angriffe auf Netzwerkebene abzuwehren.

While you cannot uninstall the Office Assistant from Office 97, ...

2025-11-22T10:47:16Z

In reply to nevent1q…3ehw
_________________________

While you cannot uninstall the Office Assistant from Office 97, you can eliminate it by moving all the Actorfiles (*.act) in the Actorsfolder to a backup directory. The default installation directory for the Actor files is:

\Program Files\Microsoft Office\Office\Actors

From the questionnaire: "What IPv4-only applications does ...

2025-11-18T18:49:12Z

In reply to nevent1q…y0uw
_________________________

From the questionnaire: "What IPv4-only applications does your organization use that require the use of Windows CLAT?"

- GitHub
- Microsoft Teams
Come to mind as first answers :ablobjoy:

As a non-native english speaker I understand "several ...

2025-08-27T20:50:21Z

In reply to nevent1q…hvnn
_________________________

As a non-native english speaker I understand "several independent preconditions" as "any of the following conditions can be true to fulfill the prerequisites for it to be exploitable".

I think the problem is that I am only seeing your side as I am ...

2025-04-20T06:02:16Z

In reply to nevent1q…700g
_________________________

I think the problem is that I am only seeing your side as I am following you on mastodon and don't follow them anywhere. So my timeline is full of you saying that you are harassed but I am not aware of the harassment you are experiencing.

I don't know if it would be a good idea to make public those false claims and attacks or if it would support the attackers, but as I said at the moment I only see you and never saw the attacks.
Just as in a domestic violence cases where outsiders only see the victim snapping but not the attacks it would maybe good to have a diary collecting evidence on the attacks.

I think it is always ill-advised attacking competitors, no matter ...

2025-04-20T05:29:47Z

In reply to nevent1q…dldn
_________________________

I think it is always ill-advised attacking competitors, no matter the reason.
It would be better from my viewpoint when GrapheneOS had a FAQ page listing the points that are listed against them and the answer to rebut the point including references to code/forum posts etc supporting it. So I don't have to search for social media for it but can refer to this FAQ page instead.

So the update fixes CVE-2025-21204 by updating folder permissions ...

2025-04-14T09:36:27Z

In reply to nevent1q…tm2c
_________________________

So the update fixes CVE-2025-21204 by updating folder permissions for C:\inetpub even if it was created by a user beforehand. Also a normal user can't create files in C:\ only folders.

https://www.windowslatest.com/2025/04/11/windows-11-microsoft-warns-do-not-delete-inetpub-folder-after-causing-confusion/

Users that already deleted the folder should temporarily install IIS to create the folder again with correct permissions.

Yes it opens a new one. But does the created folder by the update ...

2025-04-10T16:15:02Z

In reply to nevent1q…3dc6
_________________________

Yes it opens a new one. But does the created folder by the update still allow a user to create files in C:\inetpub or are the permissions locked down to administrators?

There are now sites that say that you can safely delete the ...

2025-04-10T16:06:23Z

In reply to nevent1q…wgt3
_________________________

There are now sites that say that you can safely delete the folder after installation of the kb.

My assumption is that the folder has been created to fix a possible vulnerability where a user can place a folder/file there to exploit a bug in another component and elevate privileges. I would leave it there.

This list was made by an intern running wireshark on Windows and ...

2025-01-15T17:19:29Z

In reply to nevent1q…gy7w
_________________________

This list was made by an intern running wireshark on Windows and clicking through dialogs. Not by engineers and developers.
It often contains wrong/misleading information as the one creating it did not check which process the traffic originates from and made some assumptions.

If you want to control where connections are mad from the information in the RTLFB guide is much more precise: https://learn.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services
Add some DNS-Client Event Logs, Get-DNSClientCache and pktmon and you can get accurate information.

I just checked some telemetry and only iexplore.exe is connecting ...

2025-01-15T16:59:57Z

In reply to nevent1q…26fc
_________________________

I just checked some telemetry and only iexplore.exe is connecting to iecvlist.microsoft.com (8 connections in the last 30 days over a fleet of ~1000 clients and 200 server).
It's used with something called dual_engine_adapter_x64.dll from the Edge installation folder in Windows 11. So as I can see used for IE Mode.

And it's used directly by iexplore.exe on a Server 2012 R2 (why is this server still running? 😬)

iecvlist is afaik used to load compability lists for IE (probably ...

2025-01-15T16:23:16Z

In reply to nevent1q…980y
_________________________

iecvlist is afaik used to load compability lists for IE (probably also IE mode). I don't think this will have a big (if any) impact.

There's a GH issue to report problems with ajax.aspnetcdn.com if you want: https://github.com/dotnet/AspNetCore.Docs/issues/34049
Also the documentation (https://learn.microsoft.com/en-us/aspnet/ajax/cdn/overview) states: "The Microsoft Ajax CDN has no SLA above and beyond using an Azure CDN."

Delkin/Swissbit make microSD for heavy use with SLC flash: ...

2024-08-30T03:12:09Z

In reply to nevent1q…gccd
_________________________

Delkin/Swissbit make microSD for heavy use with SLC flash: https://www.digikey.com/en/products/detail/SFSD2048N1AS1TO-I-QG-221-STD/1052-SFSD2048N1AS1TO-I-QG-221-STD-ND/16891107