@jayden_windle
Pinned post
1/ While top-of-the-market #NFT projects continue to become more financialized, there are still a number of NFT projects looking to bring utility-driven use cases back to NFTs.
@saypien breaks these down use cases, including token-bound accounts below.👇🧵View quoted post on X
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...View quoted post on X
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-yo…
luckily alt social network protocols were developed. they took a giant step forwarded and open sourced their file storage + indexer. allowing anyone to run their own infra.
it still required technical skills + the costs would steadily rise as the network grew.
the question remains: who will pay for it? why would they pay for it?
what is the incentive to pay $$ to host your own infra for this protocol? no clear incentives are defined...View quoted post on X
