FreeBSD kernel committer, hardware hacker, cybersecurity professional
San Francisco, US
Joined October 2011
- Tweets9.7K
- Following1.9K
- Followers2.3K
- Likes11.5K
Pinned Tweet
I vibe-coded a kernel module for FreeBSD that uses GitHub's downtime as an entropy source
github.com/DominoTree/ghrand…
Nick Price retweeted
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Boomer-coding a static site generator and templating engine entirely in ANSI C89 because I hate myself
Nick Price retweeted
Someone bought a really badass domain name and made a sweet landing page for a vibevuln in your product. No one actually knows if the bug is exploitable or impactful yet but it has gone viral anyways, enjoy your weekend
STOP THE PRESSES
Setting the environment variable TS_SERVE_ALLOW_ALL_INTERFACES will let Tailscale Serve bind to all interfaces
CVSS 10.0
SHUT IT DOWN
I reported a decent kernel vuln on Thursday - nobody told me I was supposed to register a domain name about it :(
Back in my day, we’d make artisanal hand-crafted shitposts to drop vulns on the Full-Disclosure listserv.
Kids today only know eat hot chip and AI
Pretty sure that the reason that the Tailscale “Tailworm” vulnerabilities weren’t responsibly disclosed with the vendor is that they were hallucinated AI slop and there wasn’t anything to be responsibly disclosed with the vendor
Nick Price retweeted
that tailworm site reads like gigaslop, i call bullshit on the framing.
the ssh bug is basically: authorized nonroot access can become root via unix socket forwarding. serious, but propagation follows ssh policy. this concerns tailscale’s opt-in ssh server, not ordinary openssh.
the path also requires the attacker (yourself) to be added to your tailnet, enabled tailscale ssh (not enabled by default), configured forwarding (not default).
Nick Price retweeted
Did you see the finding about the TAILSCALE SERVE INTERFACE environment variable? LMAO
Nick Price retweeted
“bypasses network policy”: Reaching cross-namespace services is default pod behavior in Kubernetes.
Their "fix" is to “add a default-deny egress NetworkPolicy.” If adding one fixes it, the finding is just “their test environment had no NetworkPolicy”?
Nick Price retweeted
2. The kubernetes stuff doesn't make any sense
“privileged/uid-0 in the pod network namespace” has nothing to do with what they're describing ?
a 401 from kube-apiserver and kubelet means it got means refused?
A 200 from some unauthed service is just default pod networking?
Nick Price retweeted
RE: Tailworm
1. The "report" is totally unreadable. I, as someone who is very familiar with reporting vulns and kubernetes, am totally unable to parse the sections on kubernetes.
There may be valid bugs, but I can't tell. I would not have reported these as vulns in this state.
Nick Price retweeted
Lessons for all the new researchers:
1. Write your own posts. Everyone knows what slop looks like.
2. Don't buy a domain name for a bug. It's 2026.
3. Learn the difference between bugs and architecture risks
4. Get friends. They should tell you your bad ideas suck
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
Readers added context they thought people might want to know
The Tailscale SSH findings require prior authorized access on the tailnet per the researcher's report; Tailscale stated issues concern post-authorization behavior only and did not recommend disabling SSH for everyone.
tailworm.com
x.com/IntCyberDigest…
