Open Source Software Engineer 👨‍💻 and Security. Mostly post at 🐘 infosec.exchange/@dgl

Joined April 2008
1 Photos and videos
You have a bash command line of "exec program ..." and you control "..." can you make it do something different? What if it is somewhat sanitised for shell metacharacters? If you can inject $[ ] it will make bash error on that line and run the next. 👀 dgl.cx/2025/10/bash-a-newlin…

153
I'll be speaking at BSides Canberra: cfp.bsidescbr.com.au/bsides-… -- this will cover my recent find of an RCE in Git (dgl.cx/2025/07/git-clone-sub…) and how that and some other vulnerabilities could be used against developers.

1
2
335
New blog post: Ghostty 1.0.0 terminal security; dgl.cx/2024/12/ghostty-termi… (CVE-2024-56803)

1
4
200
For once a non-security terminal thing. I'm sure someone else has written this but I couldn't find it; here's a simple script that makes commit IDs in "git log" clickable (in many terminals): gist.github.com/dgl/ef848e75…
1
3
483
David Leadbeater retweeted
David Leadbeater @davidgl from G-Research has taken the #BlueHat stage for his talk: Houdini of the Terminal.
1
2
12
1,434
David Leadbeater retweeted
📣 Speaker Announcement 📣 David Leadbeater @davidgl, software engineer at G-Research, will be speaking at #BlueHat this week. David’s talk will explore over 20 years of terminal vulnerabilities, from attacks via Apache's log files to attacking via Kubernetes. 👏
3
20
2,261
David Leadbeater retweeted
Security tip for those about to appear on TV goo.gl/7YT1f

2
141
19
Wondering why twitter won't let me have a https:// url as my home page..