Notices by Graham Sutherland / Polynomial (gsuberland@chaos.social)

@gorplop baseball cap saying "women want me, 3 billion java devices fear me"

my 2025 infosec prediction is that asset lists will still be as outdated and incomplete and nonexistent as we saw in 2005.

here are some more... 1/??????

and also source code access will continue to be denied to assessors despite source assisted tests being vastly greater value for all involved

ransomware groups will continue to absolutely shithouse major companies using really low-hanging techniques and legislators will blather on about doing something about it for another 12 months unless maybe someone says china did it and then racism might get them off their ass and we'll all be deeply disillusioned about it

Bloomberg will continue to have the same highly accurate and well informed technical reporting as they have displayed in prior years

on the plus side there will be some funny vulnerability names

also someone will overhype the absolute shit out of a bug that turns out to be a complete nothingburger. I'm gonna guess... something related to USB-C.

someone will try to make a thing that competes with Signal and it will go very badly and soatok will begrudgingly write a blog post about it

UPDATE: just 15 days into 2025 and it came true: http://soatok.blog/2025/01/14/dont-use-session-signal-fork/

Microsoft will get owned using creds stolen from Recall on one of their staff's systems

(this one is less of a prediction and more of a "please I need this to happen because it would be a gem of pure amusement in an otherwise cold and indifferent world")

IBM will announce a blockchain security product

Quantum computers will be able to factor a bigger number but it will still be small enough that you could validate the result on a $5 calculator. The tech press will claim it breaks AES.

linux kernel people will yell about rust being a cult and then write code containing 5827417 instances of undefined behaviour while remaining smug about their incredible coding skills and then call it a witch hunt against them when everyone gets fucking owned as a result

3 billion devices will, regrettably, continue to run Java

I wonder if anyone has done any modern estimation on the "how many devices actually run Java" front.

the installer still has the 3 billion claim, but Google reported having telemetry for 2 billion Android devices in active use back in 2017, so if you include non-networked devices, third party Android-based devices without telemetry, all the computers with Java installed, etc. then I imagine we're already past 3bn.

if you count Java Card, it must be pushing ten billion, right?

@foone how odd. does this thing have PMBus?

@foone huh, I guess that would probably be cheaper than a multi-channel supervisor IC and a discrete PWM driver for the fan.

@azonenberg @szakib @Dtl @funranium oh it gets worse

@azonenberg @szakib @Dtl you have just reminded me of @funranium's encounter with a 4L bottle of picric acid.

https://www.funraniumlabs.com/2016/05/im-not-allowed-four-day-weekends/

@foone you just reminded me of the time I tried to reverse engineer Steinberg Wavelab to extract realtime playback data from it, only to discover that they use a really weird event driven programming system where every event causes pretty much every object involved in that event to be reallocated at a new address, making it impossible to form a static pointer chain. if this was an intentional act of copy protection I am impressed.

@foone are you getting the thing where you press pause and it takes several seconds to respond?