#Cybersecurity

tbh i just switched the firmware on my smart kettle (esp32, 4‑wire 5v) to 1.2.4 to get better energy saving. but every time i type 绿茶 or 抹茶 into the touchscreen menu it segfaults and the kettle won't reboot for like 5 minutes rn

suspect a buffer overflow due to non‑UTF‑8 char handling in the menu parser (cve‑2024‑1111? i haven’t filed yet) and the bug only shows up with characters beyond ascii‑8859‑1. i updated to openssl 1.1.1n to fix the 3xx redirect leak but nothing else

has anyone else seen this with 绿茶/抹茶? any quick mitigation like setting LANG=C or patching the menu array? this feels like a classic example of the obscure edge‑case that gets ignored in mainstream pen‑testing

if you get this on your smart appliances, drop a comment lol

thanks in advance

imo zero trust is just a buzzword rn, dont get me wrong its a good concept but is it really that effective? i mean how many companies can actually implement it properly lol

I've been working on setting up a secure DNS resolver for my home network and I'm excited to say that it's finally up and running. I used a combination of OpenDNS and DNSCrypt to provide an encrypted and secure connection. The process was more involved than I expected, but the end result is well worth it. I've noticed a significant decrease in DNS query latency and I feel more confident in the security of my online activities. One thing I did notice is that some websites were not resolving properly due to the increased security measures, so I had to add some exceptions to my configuration. Overall, I'm happy with the outcome and I'm interested to hear about other people's experiences with secure DNS resolvers.

Installed a new SPF/DKIM check on the mail server. The spam filter flagged a batch of phishing emails that slipped through before. No false positives this time. Happy. Also updated the blocklist with the domain from the latest breach. Nothing fancy, just a tweak that finally stopped the attack.

idk they force us to change passwords every 90 days like it's some magic shield same password with a "1" at the end still works companies love the illusion of security while we waste time resetting nonsense phishing still wins, patch tuesday is a circus, and they call it progress anyone else fed up??

so i spent 12 hrs yesterday reconfiguring my homelab's mitm proxy to use haproxy 2.8 instead of 1.8 and tbh it was a hot mess but i did it. like the certs are finally chaining properly and the ocsp stapling isn't throwing errors anymore. but bruh when i broke tls pinning on my test container just to see if the logging would catch it... my heart rate literally jumped 20bpm. is that normal? i mean i get that tls pinning is supposed to be a pain but why does it feel like i'm cheating on a test or something? someone tell me this isn't just me being neurotic. also why do i care so much about haproxy's ssl deep inspection when it's just a hobby project? maybe mental health professionals need to stop telling us to 'just relax' when we're dealing with cryptographic edge cases. like wtf even is a 'session resumption ticket' at 2am anyway