Watch This Space @wtsdev

Watch This Space: A security research blog. wts.dev The Interwebs Joined August 2024

Tweets

2K
Followers

606
Following

539
Likes

8K

Watch This Space @wtsdev

12 hours ago

@cultcrit @LouiseS1996 @ShamashAran That is a valid criticism.

0 0 0 3 0

View Details

@cultcrit @LouiseS1996 @ShamashAran The command in the screenshot is (arguably) safe. But the more you get used to this, the easier it is for threat actors to trick you down the line with fake lookalike pages if you don't read the script every time you paste. And, as mentioned, they have been successful with that.

1 0 0 15 0

View Details

Watch This Space @wtsdev

14 hours ago

@cultcrit @LouiseS1996 @ShamashAran Easy to fall for if your metric for trust is if the website looks and feels familiar and isn't about reading everything closely. And when you just want to get the thing installed, it's easy to just copy paste and not check. /end

0 0 0 11 0

View Details

Watch This Space @wtsdev

14 hours ago

@cultcrit @LouiseS1996 @ShamashAran "as long as they're from a trusted source" is doing a lot of heavy lifting. Homebrew uses this install method and there've been successful malware campaigns where they just copy the homepage and change the script. /1

2 0 0 56 0

View Details

Watch This Space @wtsdev

2 days ago

@vatsal_manot The "Automation" permission (granted per app), behind the scenes, allows (or disallows) the ability to send Apple events to specific target apps (with each target controlled individually). I see no reason why they wouldn't be able to do the same or similar for Accessibility. /end

0 0 0 13 0

View Details

Watch This Space @wtsdev

2 days ago

@vatsal_manot They could still heavily lock down the full-size Accessibility permission and just add granularity. The granular perms would likely not be of interest to most bad actors, but would be very much of interest for legitimate programs. Apple already does this for Apple events. /2

1 0 0 11 0

View Details

Watch This Space @wtsdev

4 days ago

@zeroxjf Honestly, I feel like it was a bit too wordy and lacked a clear direction. It meandered around different points that I don't think were bad to make, but it just all blends together.

0 0 3 197 0

View Details

Watch This Space @wtsdev

4 days ago

@mysk_co cc @OrdinaryInds (who can confirm) To my knowledge, they at least add random noise to the percentage to mitigate tracking / privacy concerns.

1 0 4 410 0

View Details

Watch This Space @wtsdev

5 days ago

@BitcoinComfy @tonygo_ I never said "marked as duplicate" didn't happen. I never said any of this "didn't happen". There are details the post I quoted added to the stories that are not supported in the context I see.

0 1 1 213 1

View Details

Watch This Space @wtsdev

5 days ago

50% of this tweet is not supported by the actual context I've seen. I hate misinformation.

Evan Luthra @EvanLuthra

7 days ago

🚨APPLE ADVERTISES $2 MILLION FOR FINDING SECURITY BUGS.. THEN CALLS YOUR DISCOVERY A "DUPLICATE".. PATCHES IT SILENTLY.. GIVES YOU NOTHING.. AND BANS YOUR APPLE ID IF YOU COMPLAIN.. Two researchers found a critical macOS vulnerability that let attackers steal passwords,

43 102 581 115K 163

4 3 52 8K 6

View Details

Watch This Space @wtsdev

6 days ago

@HowWeLostTheWar Very interesting! I think it would definitely be an approach not many bounty programs take.

0 0 0 7 0

View Details

Watch This Space @wtsdev

6 days ago

@emanueledpt @theo @sound4movement OWL is not open source (well, everything is open source if you know how to reverse engineer! /j)

0 0 1 45 0

View Details

Watch This Space @wtsdev

6 days ago

@SpiderMorpheus @yo_yo_yo_jbo Yeah, I saw @mattjay talking about that. It's definitely something I think we should talk about more.

0 0 2 31 0

View Details

Watch This Space @wtsdev

6 days ago

@yo_yo_yo_jbo Maybe I'm just autistic and rule-brained, but I feel like that's how change *should* happen. Compiling stories about how bad MSRC (et al) is and vaguely asking them to "do better" isn't going to solve things. Give concrete suggestions, don't just complain. /end

0 0 1 55 0

View Details

Watch This Space @wtsdev

6 days ago

@yo_yo_yo_jbo In my opinion, paths forward involve actual substantive policy arguments. Should vendors pay every reporter instead of just the first? Should vendors not be allowed to be CNAs for their own products? *Those* are things we should talk about if we want things to get better. /3

2 0 1 58 0

View Details

Watch This Space @wtsdev

6 days ago

@IntCyberDigest @midwestneil This is incorrect, according to my reading. @mysk_co posted, upset abt not getting a bounty due to their report being a duplicate (+ not being told until the end). @midwestneil said "apple did this to me". I assume "this" is not paying a bounty for a dupe, not "stonewalling".