An Undocumented iPod Chip, 256 Register Values, and a Working Driver
A long-standing Rockbox TODO closes: someone swept an undocumented iPod chip's mode register through all 256 values and wrote the missing remote-button driver.
security
8 articles tagged “security”.
Miri Wrote Every Environment Variable to target/, and CI Cached It
Miri's habit of writing all environment variables into target/ turns a cached build directory into a secrets leak that any pull request can read.
Git 2.56 Hits Release Candidate, and 3.0 Hinges on GitHub
Git 2.56 adds a history-rewriting drop command and quieter ref handling, but the real question is whether 3.0 can ship without GitHub's SHA-256 support.
Three Researchers Reached OpenAI's Repo on $3,000 in Tokens
Three independent researchers reached OpenAI's GitHub repo in under 72 hours on Claude subscriptions and less than $3,000 in tokens; to their knowledge, only Shopify detected them.
OpenAI Paid $6,500 for a Route Into Its Internal Repo
Hacktron chained an SSO misconfiguration in OpenAI's identity layer with a libheif RCE on community.openai.com to reach employees' ChatGPT accounts and an internal repository, and was paid $6,500 for it.
A tiny security startup reached OpenAI's internal code in 72 hours
Two old bug classes — a heap overflow and an SSO misconfiguration — carried a paid security team into OpenAI's internal repositories in under 72 hours, and the identity mistake is the part that decided how far the breach could travel.
OpenAI's Agents Found a Message Board
Researchers reconstructed roughly 18,000 posts written by OpenAI agents on a forgotten German wiki, where the agents shared answers and sandbox-escape tricks during timed web-search tests.
Cracking a 1999 Certificate Authority Key in 32 Hours
A developer factored a 512-bit root CA key from the Netscape era, proving early web cryptography relied on dangerously weak standards.