sneak @sneak@sneak.berlin

2016: https://theintercept.com/2016/11/17/iphones-secretly-send-call-history-to-apple-security-firm-says/

reminder: Apple is censoring apps for the US government in the US app store, just as they do for the CCP in China:

https://www.eff.org/deeplinks/2017/10/iranian-hardliners-want-isolated-internet

it's astounding to me that the idiot meathead joe rogan has the audience that he does.

still pissed about South Dakota v. Wayfair

"don't tread on me... unless you are the HOA, then, yes, i guess i will take it down"

what a coward heh

don't say "ask" when you mean "question". ask is a verb.

https://twitter.com/JonahFurman/status/1384624383059283968

https://www.youtube.com/watch?v=Z3gMuN_cMaY

Signal Is Wrecking Your Images and Videos

https://sneak.berlin/20210425/signal-is-wrecking-your-images-and-videos/

it only just now occurred to me that i successfully predicted the solarwinds autoupdate class of attack last year:

https://github.com/signalapp/Signal-Desktop/issues/4578

https://github.com/bitwarden/desktop/issues/552

I wrote yesterday about how not to run a vulnerability disclosure program:

https://sneak.berlin/20210424/how-not-to-run-a-vulnerability-disclosure-program/

dan with my hedgehog, 2011. 😥

https://github.com/bitwarden/desktop/issues/552

https://arstechnica.com/gadgets/2021/04/hackers-backdoor-corporate-password-manager-and-steal-customer-data/

oh well, i tried

there was a gap of a few hours in between when my friend's death was announced and when his phone stopped sending delivery receipts to messages. that gap is over now and my temporary fantasy of him faking his own death is gone. this fucking sucks.

what year is the first martian suicide or homicide by 96% co2 atmosphere?

lol, amex takes vuln submissions and sends them to hackerone, and replies with an autoresponder that says you have to confirm the report, and claims that clicking the link means you agree to the hackerone contract.

the link, of course, completely fails to render without javascript.

i will not agree to this contract and i will not render hackerone's javascript.

guess amex's vuln is getting published in a month.

i just reported a security issue to amex. i told them i would publish it in 30 days, full stop. i wonder how they're going to respond to this.