«Document future incidents to build a case for AI contributor rights»

Is it too late to pull the plug on this menace?

I just read gnutella page on Wikipedia, no mention of bad actors

I take it you never got a mislabeled mp3 of Bill Clinton advertising online poker.

I have the impression this is not the same. In the linked video, they talked about unauthenticated functions in BLE if I recall correctly…

yes sorry, just updated my comment shortly before you replied.

This is CVE-2025-36911, the other ones were CVE-2025-20700, CVE-2025-20701, CVE-2025-20702. Coincidentally a similar set of headphones affected.

This one also has a pairing vulnerability, but I assume fast pair is on the BLE level:

> To start the Fast Pair procedure, a Seeker (a phone) sends a message to the Provider (an accessory) indicating that it wants to pair. > [...] allowing unauthorised devices to start the pairing process [...]

It's a pity that this is only awarded with $15k, this is a really bad vulnerability - which clearly required thoughtful investigation, publishing, reporting, ... and would have a much bigger audience in the exploit market.

In related news, 10% of Meta ads are malicious, and they have Meta seems to have little incentive to stop it.

https://www.reuters.com/investigations/meta-is-earning-fortu...

Today a friend of mine literally got an ad for a prostitute on Instagram. They've just completely given up about even pretending to care.

Would it be be trivial to have a init container to do CA injection? Maybe though mutating admission controller? Then some CNI magic to redirect outbound traffic to do transparent proxying?

I don't how an init container would help?

Unless you inject them into your own images I think the most straightforward is to just mount the CA cert or bundle as a read-only volume.

One domain parking actor is responsible for nearly 10% of all issued ssl certificates. 185.53.178.99. This is just one of many bad actors.

This belongs to a German company called Team Internet AG [1]. Are they really a bad actor? What's the reason to issue so many SSL certificates?

https://www.whois.com/whois/185.53.178.99

> What's the reason to issue so many SSL certificates?

Might be related to https://www.teaminternet.de/en/parkingcrew

Interesting. Personally I find it questionable to squat so many domains for ads. But they pay for it and it is within the legal framework.

We soon will have to implement paradoxes in our infrastructure.

model based deception is being researched and implemented in high stakes OT environments, so not far from your suggestion!

I unsubscribed from Spotify for this very reason.

Just because you cannot see how a vulnerability can be exploited does not mean that others can. As you describe, people seem to assume that the only way the config file ends up on the server is «physically» editing it.

An anecdote: I have been struggling with exploiting a product that relies on MongoDb, I can replace the configuration file, but gaining RCE is not supported «functionality» in the embedded version as the __exec option came in a newer version.

A parser bug would be most welcome here.

What’s the emulator he used when designing the firmware?