2026-09-24 17:57 UTC
Replies (17)
-
@rightsprung@c.im 2026-09-24 19:17
@0xabad1dea@infosec.exchange Oh gosh, I would love to know who the twitter bluecheck was......
-
@csolisr@hub.azkware.net 2026-09-24 20:13
Today I learned that The Cutting Room Floor runs on just four threads and 8 GB of RAM. No wonder why do they need to permaban any LLM user agents.
-
@tomw@mastodon.social 2026-09-24 20:16
@0xabad1dea@infosec.exchange This is a lot of words (and actions) for them to reach the conclusion that yes, they do have to sign up for Cloudflare – which solves it immediately. I don't *like* it as a solution but I don't have another one. And they could have done it in the first minute.
-
@linuxandyarn@hachyderm.io 2026-09-24 21:13
@0xabad1dea@infosec.exchange Providers of DDOS as a Service need to be fed their own toes as a last meal, then yeeted off a cliff into a flaming dumpster.
-
@windbliss@bark.lgbt 2026-09-24 21:53
@0xabad1dea@infosec.exchange Fucking hell. The bigger the ego, the smaller the dick, indeed.
-
@gbargoud@masto.nyc 2026-09-24 22:22
@0xabad1dea@infosec.exchange People keep talking about prompt injection like it's a real thing. It's no one's fault but your own if you decide to use a tool that treats everything it sees as a command.
-
@SpaceLifeForm@infosec.exchange 2026-09-24 23:04
@0xabad1dea@infosec.exchange It is an excellent report. The main problem with DDoS is money. You can get DDoSed even if you DROP every packet. Pay some Danegeld, and you buy protection. Nice website you have there, be a shame if something happened to it.
-
@jpm@aus.social 2026-09-24 23:36
@0xabad1dea@infosec.exchange oh that block image is just *chefs kiss*
-
@phl@mastodon.social 2026-09-25 00:36
@0xabad1dea@infosec.exchange I love the prompt injection and the 403 page. A work of art.
-
@indigoviolet@app.wafrn.net 2026-09-25 02:26
@0xabad1dea@infosec.exchange
-
@lispi314@udongein.xyz 2026-09-25 02:37
@0xabad1dea@infosec.exchange I do think that sometimes, going after the malicious party is the right way to go. Especially since the idiot had the smart idea to be loud and identifiable about it.
-
@LukefromDC@kolektiva.social 2026-09-25 03:08
@0xabad1dea@infosec.exchange If you have any clues as to who the offender is, you might be able to get them banned from Claude itself. It not, Claude can be considered a return address on this attack. AI is really resource intensive, so don't DDOS them unless their water and electricity use is already maxxed out and each garbage prompt will block a real one. I can think of lots of other ways to make things difficult for Claude and for Claude users however...
-
@LukefromDC@kolektiva.social 2026-09-25 03:16
@0xabad1dea@infosec.exchange One thing I would do different regarding tor: For what I do, allowing Tor access can be very seriously important, I have even been in a situation where I had to use Tor for all internet activity to avoid broadcasting my position. Therefore, if a site I ran was being attacked over Tor, I would look for a way to temporarily block single Tor exit nodes and clear the block when the offending traffic moves on to another exit node. In my situation as an opposition activist against an open Fascist country, keeping Tor blocked is not an option unless the alternative is that the DDOS threatens Tor itself. In that case I would be obligated to yield to the needs of all other Tor users. An attacker able to saturate all Tor exit nodes would be unlikely, would be a major problem for all Tor users, and such an event would probably force changes in Tor itself. Note that this is site-type and content specific: a site used for discussing gaming doesn't need to be accessable over Tor to protect people from harm, an activist site may well have to be. Personally I detest all this AI slop. I shoot video with real cameras, and if the time ever comes that AI "video" doesn't usually contain obvious errors it will be impossible to prove that say, an ICE agent shot someone for their skin color by catching them on video firing the gun. They'll demand proof the video wasn't AI if it goes to court (or even the Court of Public Opinion) and that may become impossible in the future.
-
@ireneista@adhd.irenes.space 2026-09-25 07:58
@0xabad1dea@infosec.exchange thanks. good read.
-
@nCrazed@fd00.space 2026-09-25 08:23
@0xabad1dea@infosec.exchange what a fucking blunder from Fastly 🤦♂️
-
@amarioguy@social.treehouse.systems 2026-09-26 20:14
@0xabad1dea@infosec.exchange the entire TCRF saga to me imo really highlights that there really should be some type of "Internet v2" spec or smth that closes 99% of the damn loopholes that permit DDoS and is extensible to cover the cases that are accidentally left open...
-
@Epic_Null@infosec.exchange 2026-09-26 20:43
@0xabad1dea@infosec.exchange I really hope legal action is taken, and if Claud helped this guy access a botnet, then the AI company should be held responsible too.