... more vulns:
- Tailscale SSH: just hear say, might as well turn off tailscale SSH
- Brotli decoder bug (HTTP2shell) https://nvd.nist.gov/vuln/detail/cve-2026-111497
0 Boosts
0 Likes
@silverpill I've still only done that one fuzzing session from a couple months ago. I might have an "in" with a guy 
who's running abliterated Chinese models to do something more comprehensive, I'll see if he has room for me.
I also just signed up for https://refuseless.com/?ref=sjwz8yle (referral link with kickback) which serves abliterated models and accepts 
as payment. I still haven't actually tried it yet, but thought maybe you'd be interested
@harblinger Looks interesting! They also promise zero prompt retention.
Are there any best practices for security audits? How do you do fuzzing?
@silverpill I honestly have very little experience. I've only agent assisted fuzzed Mitra, a python and C++ project so far
I've recently heard good things about https://github.com/cloudflare/security-audit-skill but I haven't tried it
For fuzzing Mitra the agent picked cargo-fuzz and these 9 targets: caip, clean_title, did_parse, html_sanitize, jcs, markdown, media_sniff, multiformats, and uri_canonical
I was very hands off and pretty sure the initial prompt was something like: "Can you take a look over this rust repo and fuzz anything that looks like a juicy target?"
@harblinger I did it, with abliterated GLM-5.3 from refuseless. Nothing serious, only medium severity issues.
Preparing a new release.
Also -- sorry, I totally forgot about the referral 😿
@silverpill awesome, yeah Rust is good at forcing memory safety at least.
Aw too bad on the referral, I don't think I've loaded any credits there yet, just a few bucks on NanoGPT (was messing with their gembrain models... slow and unreliable). Sounds like that GLM model worked pretty well through refuseless? I've used the non-abliterated version a few times, most recently for doing weird stuff with a LimeSDR and ESP32. (Un)fortunately no esoteric spell was found to diddle the BLE stack ... yet?
Sounds like that GLM model worked pretty well through refuseless?
Yes, I connected it to opencode, and I'm pretty happy with the results. Among all findings ranked "high" and "medium", only one was hallucinated.
And that is for less than a dollar 
![ᴀʟɪᴄᴇ[𝐠𝐫𝐞𝐲𝐪𝐮𝐞𝐞𝐧.𝐞𝐱𝐞]](https://soc.klan5.am/media/01M50JW1WS7EJ3S2BK39VDJ27G "ᴀʟɪᴄᴇ[𝐠𝐫𝐞𝐲𝐪𝐮𝐞𝐞𝐧.𝐞𝐱𝐞]")
@silverpill@mitra.social @harblinger@wizard.casa what variant are you on? typically when i'm auditing i go adversarial between 3 models until they meet consensus, then i hand validate the poc(s). we should talk shop the three of us sometime .
@alice @harblinger Mostly on glm-5.3-flash. I also tried to play with glm-5.3 but haven't noticed any difference.
@harblinger Are you keeping tabs on Mitra? I wonder what the latest models can find there