@cultcrit@LouiseS1996@ShamashAran The command in the screenshot is (arguably) safe. But the more you get used to this, the easier it is for threat actors to trick you down the line with fake lookalike pages if you don't read the script every time you paste. And, as mentioned, they have been successful with that.
@cultcrit@LouiseS1996@ShamashAran Easy to fall for if your metric for trust is if the website looks and feels familiar and isn't about reading everything closely. And when you just want to get the thing installed, it's easy to just copy paste and not check. /end
@cultcrit@LouiseS1996@ShamashAran "as long as they're from a trusted source" is doing a lot of heavy lifting. Homebrew uses this install method and there've been successful malware campaigns where they just copy the homepage and change the script. /1
@vatsal_manot The "Automation" permission (granted per app), behind the scenes, allows (or disallows) the ability to send Apple events to specific target apps (with each target controlled individually). I see no reason why they wouldn't be able to do the same or similar for Accessibility. /end
@vatsal_manot They could still heavily lock down the full-size Accessibility permission and just add granularity. The granular perms would likely not be of interest to most bad actors, but would be very much of interest for legitimate programs. Apple already does this for Apple events. /2
@zeroxjf Honestly, I feel like it was a bit too wordy and lacked a clear direction. It meandered around different points that I don't think were bad to make, but it just all blends together.
@BitcoinComfy@tonygo_ I never said "marked as duplicate" didn't happen. I never said any of this "didn't happen". There are details the post I quoted added to the stories that are not supported in the context I see.
🚨APPLE ADVERTISES $2 MILLION FOR FINDING SECURITY BUGS.. THEN CALLS YOUR DISCOVERY A "DUPLICATE".. PATCHES IT SILENTLY.. GIVES YOU NOTHING.. AND BANS YOUR APPLE ID IF YOU COMPLAIN..
Two researchers found a critical macOS vulnerability that let attackers steal passwords,
@yo_yo_yo_jbo Maybe I'm just autistic and rule-brained, but I feel like that's how change *should* happen. Compiling stories about how bad MSRC (et al) is and vaguely asking them to "do better" isn't going to solve things. Give concrete suggestions, don't just complain. /end
@yo_yo_yo_jbo In my opinion, paths forward involve actual substantive policy arguments. Should vendors pay every reporter instead of just the first? Should vendors not be allowed to be CNAs for their own products? *Those* are things we should talk about if we want things to get better. /3
@IntCyberDigest@midwestneil This is incorrect, according to my reading.
@mysk_co posted, upset abt not getting a bounty due to their report being a duplicate (+ not being told until the end).
@midwestneil said "apple did this to me". I assume "this" is not paying a bounty for a dupe, not "stonewalling".
2K Followers 422 Followingprompt engineer for binaries | reverse engineer, exploit developer, equally bad at both | https://t.co/FJ88dlQw7W | mastodon: @[email protected]
former s.c
485 Followers 380 Followingadministrating your systems since never, administrating my own systems since ages ago, attempting to secure shit, follow requests subject to vibe check
110 Followers 706 FollowingI play roblox and I love messing with Windows OS: Windows 10, Android 15, iPadOS 18.7.8 I help Asher get streams on @KreekVODArchive on yt ALT: @TrueRobloxPro
673 Followers 1K FollowingCreating assistive technologies | OVERSEER // ACK // NEON FLUX // VITALITY.SYS // Protocol: Hydration | Cybersecurity hobbyist | I use X more as a dev log
904 Followers 1K Followingswe student, ex econ student, sweden or poland, 19, he/him.
my pfp is my cat, her (ginger females are kinda rare, 20% chance) name is molly and she's 1.5y old
534 Followers 419 Followingmusician turned infosec analyst. premium goofs as a service. my employer has no clue this account exists but my thoughts are my own.
2K Followers 93 FollowingFounded by @LambdaMamba & @cybersyrupblog | Run by World Cyber Health Non-Profit | Discord: https://t.co/JE25nRRco6 | Email: [email protected]
5K Followers 1K FollowingSweeping the floor at https://t.co/CM8ErzxC5z (we are hiring). Previously at Microsoft/Veramine/Apple. author of Practical Reverse Engineering.
388 Followers 237 FollowingEngineer, thinker, procrastinator, idealist. Too many projects, not enough time. He/him. Currently @warpdotdev; formerly @youtube, @gmail.
1K Followers 16 FollowingWhat if the world's best hackers rebuilt AppSec from the ground up with AI?
Meet Xint - autonomous, comprehensive, fast, and actionable.
4K Followers 3K Following@missionbit board member. Former founder/CTO of Mochi Media and Fig. Sometimes enjoys writing code. he/him https://t.co/8VABmVoPGI & https://t.co/XjXgNrSq8s bsky
485 Followers 380 Followingadministrating your systems since never, administrating my own systems since ages ago, attempting to secure shit, follow requests subject to vibe check
39K Followers 10K FollowingInfosec dork, boxer, poker player, dog owner/operator, spiller of things. Cars, vidya games, and cooking are my jam. #ChiefsKingdom and Royals fanatic. #SecKC