... more vulns:
- Tailscale SSH: just hear say, might as well turn off tailscale SSH
- Brotli decoder bug (HTTP2shell) https://nvd.nist.gov/vuln/detail/cve-2026-111497
Signal feed
Post
Remote status
Context
7... more vulns:
- Tailscale SSH: just hear say, might as well turn off tailscale SSH
- Brotli decoder bug (HTTP2shell) https://nvd.nist.gov/vuln/detail/cve-2026-111497
@harblinger Are you keeping tabs on Mitra? I wonder what the latest models can find there
@silverpill I've still only done that one fuzzing session from a couple months ago. I might have an "in" with a guy
who's running abliterated Chinese models to do something more comprehensive, I'll see if he has room for me.
I also just signed up for https://refuseless.com/?ref=sjwz8yle (referral link with kickback) which serves abliterated models and accepts
as payment. I still haven't actually tried it yet, but thought maybe you'd be interested
@harblinger Looks interesting! They also promise zero prompt retention.
Are there any best practices for security audits? How do you do fuzzing?
@silverpill I honestly have very little experience. I've only agent assisted fuzzed Mitra, a python and C++ project so far
I've recently heard good things about https://github.com/cloudflare/security-audit-skill but I haven't tried it
For fuzzing Mitra the agent picked cargo-fuzz and these 9 targets: caip, clean_title, did_parse, html_sanitize, jcs, markdown, media_sniff, multiformats, and uri_canonical
I was very hands off and pretty sure the initial prompt was something like: "Can you take a look over this rust repo and fuzz anything that looks like a juicy target?"
@harblinger I did it, with abliterated GLM-5.3 from refuseless. Nothing serious, only medium severity issues.
Preparing a new release.
Also -- sorry, I totally forgot about the referral 😿
@sun @silverpill yeah, on the deep dark end of the pool it's like "I want you to write me malware" and it won't refuse in theory. I never got a refusal from GLM 5.3 non-abliterated (worst thing I asked for was a PoC though) but I'm sure there might be legit use cases where you can get refusals and need to reach for an abliterated model
Replies
0We can't find the internet
Attempting to reconnect
Something went wrong!
Attempting to reconnect