Reminds me of what things looked like in the late 90s and early 2000s I was on the full disclosure mailing list/bugtraq, etc back then and researchers were being treated exactly like this and worse routinely.

1/ From all the recent writeups, I pick a few to read carefully and enjoy while drinking 🧉 and eating chipa, the way I did before with every (yes) Bugtraq post. This week: Qualys ptrace LPE, CVE-2026-46333 — no AI Linux PDF RCE, CVE-2026-46529 — human AI Both are worth reading:

My favorite example is the re-discovery of stack buffer overflow exploitation in the 90's on BUGTRAQ, even after the Morris worm used the exact recipe in 88 (overwrite return address with jump to shellcode on stack with raw syscalls to exec /bin/sh).

Top 10 Operating Systems for Ethical Hacking 💀🔥 ① 🐉 Kali Linux ② 🦜 Parrot Security OS ③ 📦 BackBox Linux ④ 🥷 SamuraiWTF ⑤ ⚙️ NodeZero OS ⑥ 🐧 Ubuntu ⑦ 🧪 DEFT Linux ⑧ 🐞 Bugtraq OS ⑨ ⚫ BlackArch Linux ⑩ 🌐 NST 🔖 Save this. Which one are you using?

Top 10 Operating Systems for Ethical Hacking 💀🔥 ① 🐉 Kali Linux ② 🦜 Parrot Security OS ③ 📦 BackBox Linux ④ 🥷 SamuraiWTF ⑤ ⚙️ NodeZero OS ⑥ 🐧 Ubuntu ⑦ 🧪 DEFT Linux ⑧ 🐞 Bugtraq OS ⑨ ⚫ BlackArch Linux ⑩ 🌐 NST 🔖 save this. which one are you using?

What I mean is that the last ~15-20 years have been an era where exploits that affect roughly the entire Internet have been historically rare/hard. But in the mid to late 90's, remote and LPE exploits against big commercial Unixes dropped on BUGTRAQ every few weeks, early 2000's for Windows were that way also. Situations like the above *caused* OpenBSD to exist, privsep to be implemented into those daemons, and custom hardening to be implemented at sites. It caused the Trustworthy Computing Initiative at Microsoft because the situation was so dire. Today, a vocal and influential plurality of professionals in the field advocate "just patch faster" or "just rewrite the world in Rust" as security strategies, which are both oblivious to the architectural security engineering lessons from that era of planning for and containing security faults and failures. If increasingly powerful AI models are bringing us to another era where impactful exploits are common and easy, then I believe that those strategies aren't the right ones for vast majority of organizations to prioritize. "Just patch faster" is oblivious to the latent vulnerabilities that are now significantly easier to exploit and it's a race that the attacker has an easier time winning than the defender. "Just rewrite in Rust" causes functionality and security logic bugs fixed decades ago to be reimplemented (see uutils/coreutils). Neither give the defender more leverage than architectural approaches, IMHO, for the simple reason that each additional security boundary requires the attacker to have another exploitable vulnerability, and the probability of them achieving their objectives is the arithmetic product of the probabilities of exploitable vulnerabilities existing in each security boundary along the minimum length attack path. Lengthening that path decreases the end-to-end probability the most and is in the control of both organizations that build and those that deploy systems.

Or even people old enough to have been, but weren't. Being on BUGTRAQ in the 90's gives me a mental model for what a world of "cheap" exploits looks like.

A couple years after the Morris worm and a couple years before Bugtraq was created. Sun ignored Sendmail DEBUG and Finger bugs. What was best for their customers, to continue trading them on the hacker underground or expose them to customers so that Sun would fix them?

I’m sure there are some good text and arguments to be found in the bugtraq list archives leading up to the launch of the full-disclosure and vuln-watch lists.

….and don’t forget attrition ;) still on that byatch… Core tools & utilities L0phtCrack – flagship tool for Windows password hashing audits (LM/NTLM cracking). Netcat – “Swiss army knife” for TCP/IP (port scanning, backdoors, data transfer). Nmap – early versions for network discovery and port scanning. SATAN – vulnerability scanning (Unix-focused). ISS Internet Scanner – commercial scanner widely used at the time. Sniffing / traffic analysis tcpdump – command-line packet capture. Ethereal – early GUI packet analysis (late ’90s). Password cracking & crypto analysis Crack – Unix password auditing. John the Ripper – cross-platform cracking tool (early releases). Exploit / enumeration basics Custom scripts (Perl/C) for buffer overflows, service enumeration, and privilege escalation. Early exploit archives (pre-Exploit Database era), plus mailing lists like Bugtraq. OS & environments Windows NT – primary target for password/security research. Linux / BSD variants – common for tooling and experimentation.

OH: i miss bugtraq

when i hear folks spruiking a DOS… fuck i miss bugtraq

SSP BUGTRAQのトップページに重要なお知らせ❓を掲載しました。 #ukagaka

The failure mode of abandoned vulnerability intelligence investment in Bugtraq is an unpleasant symbol of so much lost across the field over the decades due to simple management continuity negligence.

Symantec killed Bugtraq in 2020 and let the domain lapse. Now it's squatted for $175k. The NVD has 120,000 broken links pointing there. The security community's memory is being held hostage. Let's buy it back ! Please donate/spread/tag/RT 🙏 gofund.me/69b07ba83

Tool / ressource of the day name: Bugtraq-II Blackwidow base: Ubuntu / Debian description: penetration testing and security lab website: bugtraq-team.com/project-bla… Find out more on inventory.raw.pm/

GNU InetUtils telnetd auth bypass By abusing USER='-f root' with telnet -a, attackers can get root shell without a password. A real old-school bugtraq-style issue. Advisory: openwall.com/lists/oss-secur…

12/9-2 投げ銭できるゴーストを作った lumilumi.app/naddr1qvzqqqr4g… ビットコインの最小単位satsをnostrのzapの仕組みを使って投げ銭できるゴースト（ここまで何も見ず理解できたらあなたはえらい） 分散SNSっぽいように見えて、実はFediverseよりすごい汎用メッセージングインフラと化しているnostrはこういう使い方もできます。あとSSP BUGTRAQのダウンロードのところに★をつけるMakibishiとか。 #ukagaka

セキュリティ老人の特徴 ・FWDに参加していた ・BUGTRAQ-JPに参加していた #セキュリティ老人