Tootfinder

Vad säger ni #drinkklubben

Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing
Jianjia Yu, Zhengyu Liu, Ziyang Li, Yu Sun, Yinzhi Cao
https://arxiv.org/abs/2607.20698 https://arxiv.org/pdf/2607.20698 https://arxiv.org/html/2607.20698
arXiv:2607.20698v1 Announce Type: new
Abstract: Electron is a popular framework for building cross-platform desktop applications using web technologies. Such applications consist of multiple processes with different privilege levels that communicate via message passing. When inter-process messages carry attacker-controlled inputs, they can propagate across processes and reach privileged APIs, e.g., command execution. Such a message propagation behavior is characterized as Message Progression Vulnerabilities (MPVs). The exploitation of MPVs is challenging because it often requires multiple steps, e.g., first arbitrary code execution in one process via message passing, and then command injection in another process using another message crafted in the first process. To our knowledge, existing works on Electron security only study unsafe configurations and malicious Document Object Model (DOM) content, i.e., they cannot detect or exploit these vulnerabilities that need to be triggered by complex cross-process exploits via message passing. We present Proton, a segmented directed fuzzing framework for detecting MPVs. Our key insight is to decompose end-to-end fuzzing into per-process segments along message-passing boundaries, where the goals of fuzzing each segment are either: (i) reaching a sink in the current process or (ii) propagating the payload to the next process, to enable the exploration of another process. In the second case, the messages seed the corpus of the next segment. Finally, Proton synthesizes crash inputs from each process to validate end-to-end exploits. We evaluate Proton against 589 real-world Electron applications, resulting in 23 zero-day MPVs. Among them, 22 lead to OS command execution, including projects with over 50k GitHub stars. We responsibly disclosed all findings. To date, we have received 13 acknowledgments, 11 fixes, and 11 CVEs, including a bug bounty from Vercel.
toXiv_bot_toot

https://rs.bot/esK7cz

what happened when clive davis (aka siva devil c) met owsley & robert hunter, 1973. https://www.dead.net/deadcast/wake-flood-50-mississippi-half-step-uptown-toodeloo

As I endeavor to wrangle an errant tagging structure of a PowerPoint file towards an accessible PDF file, I find myself pushing the limits of whatever black magic fuels Acrobat.
I will not relent.
I curse the corporate greed, professional incompetence, and ultimately low-grade, mediocre, evil- manifesting through this fiendish abomination of corrupted deviance and fuckery.
This is no way to run a document object model!

@… W europie też tak jest, tylko pod szkołą nie pozwalają parkować, przepędza się wioski przyczep z miejsca na miejsce, stawia niskie barierki, żeby ludzie nie koczowali, nastawia lokalną ludność przeciwko.

Coraz mniej ludzi spotykamy na wakacjach, a po prostu żyjących w samochodach, przyczepach, kamperach, jakiś nieużytkach w domkac…

And here's the lobby of the Best Western in Marlboro, MA which has that fountain: this space was packed with soccer fans out for the world cup the day before
#photo #photography #buildings

Ahhhh! #Qt6 broke #fonts in some apps again!
And I finally found out why and how to fix it. In the Archwiki, of course. Every app is supposed to respect your lovingly crafted and finetuned fontconfig, but the Qt folks use your ~/.Xresources (if on x11) instead. So just put Xft.hinting and Xft.…

https://rs.bot/jUvmQj