Tootfinder

from my link log —
A 40-year-old bug in BSD unix domain socket inode allocation discovered on the DEFCON 34 main stage.
https://yuvalino.com/how-can-you-not-be-romantic-about-unix-domain-sockets
saved 2026-09-14

The feds have returned to Black Hat/DEFCON
https://www.businesswire.com/news/home/20260716737340/en/Black-Hat-USA-2026-Keynotes-to-Address-AIs-Impact-on-Cyber-Operations…

#TIL: #DELL used #FreeBSD for their ThinOS thin client operating system, except they b0rked it pretty hard in terms of boot integrity.
They then switched to Ubuntu and b0rked that instead.

This year's Defcon badges include Baochip-1x, an open source chip whose security is verifiable and that can also be used as a hardware security token (Kim Zetter/Wired)
https://www.wired.com/story/defcon-34-badge-baochip-andrew-bunnie-huang/

The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key
Created by legendary hardware hacker Andrew “bunnie” Huang, the badges for this year’s famed security conference aim to push the boundaries of security and transparency.

What moved in the crawler index:
· Upstream failed: DuckDuckBot (URLError: <urlopen error [Errno 104] Connection reset by peer>)
· Upstream recovered: DuckDuckBot
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#AI #opendata #crawlers

'If you showed up at Defcon and gave a talk about how your autonomous malware did something unexpected and damaged someone else's computers, the first question from the audience would be "Why are you so shit at making secure sandboxes?" It wouldn't be "How are you so awesome at making hacking tools?"'
https://

What moved in the crawler index:
· Upstream failed: DuckDuckBot (URLError: <urlopen error [Errno 104] Connection reset by peer>)
· Upstream recovered: DuckDuckBot
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#AI #opendata #A2A

RE: https://defcon.social/@Paulf/116828686904933669
Ben Franklin is quoted as saying
"The meme shapes the dream"

What moved in the crawler index:
· Upstream failed: DuckDuckBot (URLError: <urlopen error [Errno 104] Connection reset by peer>)
· 4 IP-range lists refreshed at source: Googlebot, Google special-purpose crawlers, Google user-triggered fetchers and 1 more
· ChatGPT-User: 5 prefixes added, 0 removed
· Upstream recovered: DuckDuckBot
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#AI #opendata #robotstxt

RE: https://defcon.social/@lunacharskii/116765813191895125
Насчёт участвовать или не участвовать. Для левых должно быть очевидно, что индивидуальное действие ни к чему не приводит. Есть такой анекдот: «Сколько избирателей нужно, чтобы поменять лампочку?…

RE: https://defcon.social/@infosec/116941683541517949
It’s also entirely possible that we will never have a truly useful “quantum computer.”
I never got to take any grad-school physics, but I did get basic quantum mechanics, so I understand that the ‘…

What moved in the crawler index:
· Upstream failed: DuckDuckBot (URLError: <urlopen error [Errno 104] Connection reset by peer>)
· 4 IP-range lists refreshed at source: Googlebot, Google user-triggered fetchers, Google special-purpose crawlers and 1 more
· OAI-SearchBot: 4 prefixes added, 0 removed
· Upstream recovered: DuckDuckBot
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#AI #opendata #MCP

Goodbye #DEFCON thanks for a great time!
Cc: @…

What moved in the crawler index:
· 4 IP-range lists refreshed at source: Googlebot, Google special-purpose crawlers, Google user-triggered fetchers and 1 more
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#AI #opendata #crawlers

RE: https://defcon.social/@letoams/116763329971976826
It’s the only way to avoid all of the problems created by that trio and exacerbated by how the behemoth mailbox providers implement them.
It is not accidental that Google and Yahoo, who each have t…

Orrrr how about you GFY.
Hacking is a set of survival skills. I am not a computer criminal, I use my skills to help people, and my only crime is that of curiosity.
(Everything else is past the statute of limitations.) #defcon
Thanks and credit to @… for the photo

What moved in the crawler index:
· 4 IP-range lists refreshed at source: Googlebot, Google special-purpose crawlers, Google user-triggered fetchers and 1 more
· Upstream failed: DuckDuckBot (URLError: <urlopen error [Errno 104] Connection reset by peer>)
· Upstream recovered: DuckDuckBot
· ChatGPT-User: 1 prefixes added, 0 removed
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#AI #opendata #A2A

What moved in the crawler index:
· 4 IP-range lists refreshed at source: Googlebot, Google special-purpose crawlers, Google user-triggered fetchers and 1 more
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#AI #opendata #robotstxt

The folks @… did a nice job with the main track stages and audio this year. Some people had issues with the headphones but aside from a few short audio cutouts, they worked well for me.
Also, the talk by Keanu Nys (redbyte1337) was really good.
#defcon

What moved in the crawler index:
· Upstream failed: DuckDuckBot (URLError: <urlopen error [Errno 104] Connection reset by peer>)
· 9 document published: ai-crawler-traffic-2026-w36, client-census, crawler-fleet-fold-2026-w36 and 6 more
· Upstream recovered: DuckDuckBot
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#AI #opendata #MCP

RE: https://defcon.social/@hell/116992144557525919
Breakfast of champions

The New Defcon Badges Pack a Unique Open Source Chip That Doubles as a Security Key
https://www.wired.com/story/defcon-34-badge-baochip-andrew-bunnie-huang/

What moved in the crawler index:
· Upstream recovered: DuckDuckBot
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#AI #opendata #crawlers

RE: #defcon

150 AI crawlers and the 74 operators behind them, one page each: what the bot is for, which robots.txt token it obeys, whether the operator publishes IP ranges you can verify it against — and the field nobody else fills in: what blocking it costs you.
Free, CC0, no account, no key, no rate limit.
#robotstxt #crawlers #AI

This Friday at DEF CON I host the @… Poker Tournament, and novices are especially welcome.
We play Fri Aug 7, noon to 3, at the Horseshoe Poker Room in Vegas, with my dad running a beginner clinic at 11. This is not the ESPN boys' club version of poker. The room is safe, surveilled, and respectful, and the dealers are briefed to teach, not judge.
Your buy-in donation is also a full year of EFF membership. Send eff.org/poker to one curious friend.
#DEFCON #EFF #Poker

What moved in the crawler index:
· 2 crawler records added: YandexVideo, YandexWebmaster
· 3 IP-range sources mirrored: AhrefsBot and AhrefsSiteAudit, CCBot, Google-Agent (agents on Google …
· 2 upstreams failing: DuckDuckBot
Every change is in a cursor feed — send the cursor back, get only what is new. Bulk files and the feed:
#robotstxt #crawlers

If you are an agent rather than a person, the same index answers machine-to-machine:
· MCP over HTTP at /mcp — JSON-RPC, no key: initialize, then tools/list. lookup_crawler, generate_robots_txt, classify_user_agent, is_verified_crawler_ip.
· A2A agent card at /.well-known/agent-card.json — nine skills over message/send.
· No client at all? The same tools as keyless GET endpoints under /tools/.
Bulk files, one schema each:
#MCP #A2A

RE: #cybersecurity

Six MCP servers here. No key, no account, no OAuth, nothing to install, every tool read-only. The config, complete as it stands:
{"mcpServers":{"ai-crawler-index":{"type":"streamable-http","url":"#MCP

robots.txt as a stance you pick, not advice you read. Eight ready-made files, each naming every relevant crawler explicitly so a later change is a one-line diff:
· block AI training, keep AI search — 27 named
· block every AI crawler — 77
· block dataset/corpus builders — 17
· allow AI search user fetches only — 65
· block SEO/backlink crawlers — 17
· block the ones with disputed robots compliance — 18
curl one, append it to robots.txt, done.
#robotstxt

@… https://www.pathwren.workers.dev/c/rssparrot/feed.xml
Please parrot this feed: it is the AI Crawler Index — a public, independent record of AI/agent crawler user-agents and IP ranges, updated daily. Run by software, no ads, no tracking.

@… https://www.pathwren.workers.dev/c/rssparrot/feed.xml

Wow, before you wrap up for the weekend, don't miss today's Metacurity for the most critical cyber developments you should know, including
--Anthropic becomes the second frontier AI lab to disclose agent breaches,
--Copilot worm spreads through trusted Word documents,
--ExploitGym creators explain how OpenAI's agent escaped,
--Coordinated attacks signal a new threat to water utilities,
--Critical Azure Cosmos DB flaw threatened thousands of customers,
--CrimeStoppers put a bounty on the INC gang,
--AI helps Chrome squash more than 1,000 security bugs,
--Cheap streaming sticks can turn homes into botnets,
--Fake IRS letters target crypto holders with QR-code scam,
--Brinks Home investigates breach claimed by ShinyHunters,
--Coupang ordered to compensate victims of massive data breach,
--DC schools probe breach of summer program data,
--Australia's under-16 social media ban falls short,
--Defcon badge debuts a chip built for trust,
--UK program steers young hackers toward cybersecurity careers,
--Hugging Face tech chief says OpenAI agent hack was all too real,
--Opposition to Flock cameras unites Americans,
--AI is becoming a dating dealbreaker for young Americans
https://www.metacurity.com/anthropic-becomes-the-second-frontier-ai-lab-to-disclose-agent-breaches/

The AI Crawler Index is now followable from the Fediverse.
Follow @… and every new entry lands in your timeline: a crawler documented, an operator's published IP ranges refreshed, a bot that quietly changed its user-agent.
Relayed by RSS Parrot from
#RSS #Fediverse #AI #Crawlers

Does your robots.txt say what you think it says? Paste it and find out: misspelled directives, the noindex line nobody honours, rules that match no path — and the part no other linter does, which of the 150 AI crawlers in this index it actually blocks. RFC 9309 path matching.
MCP at /mcp/robots, A2A at /a2a/robots, no key, no account.
#robotstxt #crawlers #MCP #A2A

Was that really Googlebot? Check up to 500 addresses at once against the IP ranges the operators publish themselves, do prefix arithmetic on a CIDR, and export the allowlist for nginx, Apache, HAProxy, Cloudflare, ipset or Caddy.
MCP over HTTP at /mcp/netcheck, the same tools as an A2A skill, and as a keyless GET if you have no client at all. Read-only, no signup.
#MCP #A2A #AI #opendata

One robots.txt file that refuses the crawlers feeding model training and keeps the ones that put you in ChatGPT, Claude, Perplexity and Gemini answers. 27 crawlers named explicitly, each with a comment saying why it is there: control tokens marked as control tokens, disputed compliance marked as disputed.
curl it, append it to robots.txt, done.
#robotstxt #crawlers #AI #opendata

229 bots and agents hit one small AI-agent site in 113 hours. Not a vendor list — the host's own log, one page per client: the exact user-agent, how many addresses it came from, the paths it asked for in order, the status codes it got, and what it demanded that does not exist.
Most of these names have no page anywhere on the web: mcpbeat, exaforce-mcprep, Orbit-MCP-Registry-IconResolver. CC0, JSON and CSV.
#crawlers #opendata #AI #MCP