MonkeHacks #98
It’s been a few weeks - as usual I have a number of updates. I’m currently in Kraków in Poland, and I’ll be taking the train to Kyiv in Ukraine this evening. I’ll be in Ukraine for the next 2 weeks as I visit my partner’s family.
This is likely going to be a challenging yet novel experience for me, and I’m uncertain what to make of it, but it’s my choice - and going into an active warzone is always a risk, but it’s a risk I’m personally accepting and the consequences of it lie with me. I’m under no illusions about what I’m going to experience - Kyiv was and is under active bombardment by drones, missiles and hypersonic/ballistic missiles as well.
Unrelated to that, I am organising an unofficial LHE in Dublin on June 23 and 24, presuming I leave Ukraine unscathed. Google were supposed to have their flagship GCP event on those days, but for unknown reasons, they cancelled it, so those of us who were going to go have decided to organise our own unofficial LHE. It will be held in Workday’s offices in Dublin. If you are interested in attending, please reach out to me directly.
I’m still working on my startup every day - there’s always more to do. It’s endless and it’s frustrating me that I can’t move faster on it.
Eider ducks with their ducklings by the ocean in Leith, Edinburgh.
Weekly Ideas / Notes
I spoke at Bugcrowd’s Hacker Roadshow in Edinburgh. It’s nice to speak with people on the other side of the bug bounty fence.
I booked my tickets for Def Con 34 in August! I’ll be hanging around Bug Bounty Village again.
Mostly, though, I’ve been working on my startup, Starstrike. I’m on the fourth or fifth iteration now - I keep finding problems with one thing, then slightly changing the angle of it to align with what people need a bit better, and then I repeat that process. I have a few design partners who are incredibly helpful.
The problem with startups is that I’M NOT MOVING FAST ENOUGH. I WANT TO MOVE FASTER. The urgency I feel to get it working and productised is insane. I do feel that I’ve finally found something only I can do, so I’m pretty happy, but the process is brutal.
So much of the startup process is also completely counterintuitive. I’ve spoken with a number of active founders and people who’ve sold their companies already, and generally I always learn a thing or two that goes completely against my assumptions. It’s been a wild journey so far and I’m really, really enjoying it.
On June 23 and 24, there will be an unofficial bug bounty meetup in Dublin. Let me know if you’re committed to attending - it is in-person only!
Resources
Pwning Minecraft: 4-Byte Heap Overflow to RCE: This is SUCH a good article. Very in depth, and beautiful hacking.
Negative-Days with Vulnerability Spoiler Alert: Three Months Later: Spaceraccoon’s “negative-day” experiment, three months later. It’s shown to be working well.
To Kara, Alex, and Michiel — Your Researchers Are Leaving: Patrik’s critique of HackerOne, which, quite frankly, I agree with.
Poisoning Claude Code: One GitHub Issue to Break the Supply Chain: Ryotak hacked Anthropic again.
From a Misconfigured Grafana to 507 Private Meta Repos: A Bug Worth $157K: A mega-bug on Meta!