jet

joined 2 years ago
MODERATOR OF
[–] jet@hackertalks.com 1 points 23 hours ago (1 children)

Their statement is based on research and is an official statement. That is reality.

We are just talking in circles at this point. We have different standards of evidence.

[–] jet@hackertalks.com 1 points 23 hours ago (1 children)

Ps appeal to authority isn’t a fallacy when it is directly related to the subject and supported by evidence in their body of work, which the WHO does both and which I cited directly.

We are just talking in circles, we have different standards of evidence.

[–] jet@hackertalks.com 1 points 23 hours ago (3 children)

Today i ate liver with ground beef. .

The WHO opinion isn't research.

[–] jet@hackertalks.com 1 points 23 hours ago (5 children)

Processed meats absolutely cause ass cancer.

Can you please cite the non-epidemiology study establishing this causation?

people were eating things like liver, heart, brain, tongue, and other organs that have unique stores of vitamins (eg coq10). People only eat muscle meat now, rarely do they have access to organ meat that isn’t also processed.

The carnivore community agrees that every part of animal needs to be eaten from tip to tail in the same proportions as in the animal.

[–] jet@hackertalks.com 1 points 23 hours ago (3 children)

Ps - why arent you posting about how processed meat is bad for carnivore dieters due to the cancer risk? You claim to care about others, yet crickets on that…

Because this post is about the moderator decision.

Processed meat should be avoided, the carnivore diet is about eliminating processed foods, sugars, fructose, etc. So no need for crickets because we never promote processed meat.

They only publish established science and are very slow. If they say it is true, then it is super true.

This is just a SUPER version of appeal to authority. Associative epidemiology cannot establish causation.

[–] jet@hackertalks.com 1 points 23 hours ago (7 children)

You haven't been banned.

The WHO has not established causation. Cancer rates globally have risen geometrically since the 1900s, red meat consumption as actually gone down globally since 1900. If red meat is a problem it isn't a new problem, so it can't be responsible for the rise in cancer since 1900.

[–] jet@hackertalks.com 1 points 23 hours ago (5 children)

The IARC is a body that reviewed associative data and published an opinion, that is the definition of expert opinion.

So if you want to actually review the studies...

https://www.dietdoctor.com/low-carb/red-meat#cancer

In large reviews and meta-analyses of observational studies, researchers have found inconsistent results. One very large meta-analysis found that the absolute effects of red meat on cancer risk are extremely low, with the certainty of evidence being low to very low. While some have shown no association of red meat and cancer risk, others have shown a positive association with gastric, esophageal, breast, and prostate cancer.

For those that did show an association, the hazard ratios were quite small, in the range of 1.06 to 1.4. In comparison, cigarette smoking has a hazard ratio greater than 20 for being associated with cancer. Therefore, although these observational studies can suggest an association between red meat and cancer, the very low hazard ratios weaken the assertion that red meat causes cancer.

If you are satisfied with the WHO as your absolutely authority on truth, I respect that, but then there isn't much point in us talking.

[–] jet@hackertalks.com 1 points 1 day ago (7 children)

I welcome you to post in !carnivore@discuss.online

The IARC is not evidence, its expert opinion, which is a form of appeal to authority

https://www.dietdoctor.com/low-carb/red-meat#cancer

In October 2015, the International Agency for Research on Cancer (IARC) issued a press release classifying processed meat as “carcinogenic” and red meat as “probably carcinogenic” in humans. While the epidemiological studies reviewed by the committee suggest an association, other studies question the strength of the association.

At the above link they go over the associations in detail. I point this out to demonstrate there are other experts with different opinions. This is the problem with expert opinion.

[–] jet@hackertalks.com 4 points 1 day ago

bill that would require chipmakers such as Nvidia to embed location tracking into export-controlled hardware

How does this work?

[–] jet@hackertalks.com 4 points 1 day ago

I should do another run

[–] jet@hackertalks.com 1 points 1 day ago* (last edited 1 day ago)

spiritual-magic-metaphysics

Quite a few scenes in the movie rely on the spiritual / super natural / magic

  • the alpha sending other zombies out without communication
  • the alpha controlling flocks of crows to spy on spike
  • the farm house collapses because of a dream....

I don't like this because its lazy writing, but mostly because it cheapens everything that has come before. If birds are controlled by the infected, well... good by quarantine, europe should be overrun just by birds.

 

In 2002, during the initial outbreak of the Rage Virus,[a] a young boy named Jimmy Crystal flees his house in the Scottish Highlands as his family are attacked by the infected. He takes refuge in the local church with his father, a minister, but finds him praying in ecstasy, since he interprets the virus as a harbinger of the end times and the Day of Judgement. Jimmy's father bequeaths him a cross necklace and helps him to safety before submitting to the infected as they break in.

WTF.... I'm not unhappy i watched this film, but I am confused about what i just watched.

The decision to intermix period films, dream sequences, reality, and delusions throughout the entire runtime was a STRONG editorial choice. It got to the point where I didn't really trust anything I was watching.

I get the impression this is the VIBE screen writing version of world war z (the book).

Overall, I would consider this a art house experimental film kung foo hustle meets kill bill set in a pseudo medieval setting. I would recommend watching it, just for the slow motion train wreck.

As far as a zombie or survivor film goes it doesn't have much to say, spends lots of time not saying it, and just kinda fills time.

The biggest weakness is they tried to do too many things at a very shallow depth, they would have been much better off picking one theme and exploring it to make a film worth watching.

things that didn't make sense

  1. the zero-to-eleven urgency to take the mother to see a doctor based on ONE signal fire

  2. The villagers avoiding the doctor because he was burning the infected (which seems pretty damn sensible)

  3. The fucking swedish boat survivors not doing any type of suppression or bounding, they had the firepower and training, they could have setup a kill box and overlapping fields of fire and survived the first encounter. The scene was so fucking random and out of place I got whiplash

  4. zombie baby birth... why? What did it add to the story? What did they do with it? It's like checkovs gun dry fired.

  5. Jimmy.... this was some weird wish fulfillment, the absolute lunacy of it... it felt like they were setting up a comic book film at the very end. Which I could dig...

[–] jet@hackertalks.com 2 points 2 days ago (1 children)
  • List of votes for bananaisaberry@lemmy.zip:

  • Total post upvotes: 8

  • Total post downvotes: 15

  • Total comment upvotes: 107

  • Total comment downvotes: 90

Not bad, not bad!

 

Highly recommend. The red planet you can sleep on

 

There are many succulent Cree delicacies that have been passed down from generation to generation. They're made with wild game and fresh ingredients using traditional methods. In Whapmagoostui, elder Sandy Masty invites us to his camp and shows us how to make some delicious pemmican!

 

The membership of the current Australian Dietary Guidelines expert committee (of which Dr James Muecke was blocked despite a public promise from the then Health Minister, Greg Hunt) can be found here https://www.nhmrc.gov.au/health-advice/nutrition/australian-dietary-guidelines-review/committees/dietary-guidelines-expert-committee

The chair has previously conducted systematic reviews for the World Health Organisation and they continue to meet behind closed doors. We encourage you to express your concerns about potential bias in the process to committee members.

summerizer

Summary

The video, presented by Dr. Paul Mason, critically examines the history and politics behind the widely accepted food pyramid and its association with dietary guidelines that vilify saturated fat. Contrary to popular belief, the food pyramid was not the product of rigorous scientific consensus but rather the outcome of political influence and flawed research beginning in the mid-20th century. The narrative traces the origins of the saturated fat-heart disease hypothesis to early 20th-century animal studies and highlights the pivotal role of Ancel Keys, a scientist whose biased and politically driven advocacy shaped public health policy despite contradictory evidence. Mason reveals how major studies, such as the Minnesota Coronary Survey, which failed to support Keys’ hypothesis, were suppressed or delayed, contributing to decades of misinformation. The video further exposes how U.S. government policies, influenced by agricultural interests and grain surpluses, led to exaggerated recommendations for grain consumption, exacerbating public health issues like diabetes and metabolic disorders globally, including Australia. Despite emerging scientific reassessments and some experts’ revised views recognizing that saturated fats from natural sources are not linked to heart disease, current dietary guidelines stubbornly resist change. However, recent developments, including a governmental review and parliamentary inquiries into diabetes, offer a cautiously optimistic prospect for future dietary recommendations that align better with scientific reality.

Highlights

  • 🥩 The saturated fat-heart disease hypothesis was rooted in flawed early 20th-century animal studies and politically motivated science.
  • 🧪 Ancel Keys’ biased research and aggressive suppression of dissent shaped decades of dietary guidelines despite contradictory evidence.
  • 📉 The Minnesota Coronary Survey (1970s) found no harm in saturated fats but its results were delayed and partially suppressed.
  • 🌾 U.S. agricultural policies influenced dietary guidelines to promote grain consumption, contributing to the rise of metabolic diseases.
  • 🌍 Australia and other countries adopted similar flawed guidelines, leading to a global increase in diabetes and metabolic disorders.
  • 🔍 Recent scientific reviews challenge the vilification of saturated fats, recognizing that dairy, meat, and eggs do not increase heart disease risk.
  • 💡 Ongoing governmental inquiries and involvement of health advocates like Dr. James Muki provide hope for evidence-based future dietary guidelines.

Key Insights

  • 🧬 Historical roots of the lipid hypothesis were based on inappropriate animal models: The foundational research by Nicolai Anakov using rabbits, herbivores with different physiology, led to a misleading conclusion that dietary cholesterol and saturated fat clog arteries. This species mismatch undermines the validity of applying such findings directly to human nutrition and disease. It emphasizes the importance of choosing appropriate biological models in nutritional science.

  • ⚖️ Science was overshadowed by politics and vested interests: Ancel Keys’ rise to influence was marked by political maneuvering and intimidation of dissenting scientists, which distorted the scientific discourse. His association with the American Heart Association and the involvement of corporate sponsors like Proctor & Gamble highlight how financial and political interests can compromise scientific integrity and public health policy.

  • 🕰️ Suppression and delay of contradictory evidence delayed progress: The Minnesota Coronary Survey, a large randomized controlled trial, showed no benefit in reducing saturated fats but was withheld from publication for over a decade. This delay contributed to the persistence of flawed dietary advice and the entrenchment of the food pyramid, illustrating the dangers of selective data reporting and lack of transparency in research.

  • 🌾 Agricultural economics shaped dietary guidelines: The U.S. government’s response to grain surpluses in the 1970s led to inflated recommendations for grain consumption, which were incorporated into national dietary guidelines. This decision prioritized economic interests over health, inadvertently fueling the rise in metabolic diseases such as diabetes, revealing how policy decisions can have profound unintended health consequences.

  • 🌐 Global adoption of flawed guidelines has widespread health impacts: Australia's adoption of U.S.-inspired dietary goals, largely uncritically endorsed by Professor Stuart Truswell, exemplifies how scientific laziness and ideological bias can propagate poor nutrition policies internationally. The resulting rise in metabolic illnesses underscores the urgency for countries to critically evaluate imported guidelines rather than blindly accept them.

  • 🔄 Emerging scientific consensus is overturning old dogmas: Recent reviews and statements by former guideline committee members Janet King and Tom Brenner acknowledge that saturated fats from natural sources like dairy, meat, and eggs are not linked to increased heart disease risk. This shift suggests that dietary guidelines must evolve in response to accumulating evidence, separating ancient, nutrient-dense foods from modern processed dietary villains.

  • Public advocacy and political engagement are crucial for change: The involvement of health advocates like Dr. James Muki, who successfully lobbied for parliamentary inquiries into diabetes, demonstrates the power of informed activism. Meaningful reform in dietary guidelines requires sustained public pressure, transparency in scientific review processes, and willingness from policymakers to confront entrenched dogma and vested interests.

Additional Context and Analysis

The video underscores a critical lesson in public health nutrition: that scientific conclusions must be based on rigorous, transparent, and reproducible evidence, free from political or commercial influence. The case of the food pyramid exemplifies how policy driven by flawed science and political expediency can lead to widespread public harm, as seen in the rising incidence of metabolic diseases globally.

It also highlights the importance of revisiting and revising public health guidelines as new evidence emerges. The reluctance of guideline committees to re-examine the saturated fat question, even when challenged by robust new data, reflects systemic inertia and a fear of admitting past errors. This resistance jeopardizes public trust in nutrition science and health agencies.

Finally, the narrative calls for greater public engagement and advocacy, recognizing that scientific truth alone is insufficient without political will and public pressure to implement evidence-based policies. The ongoing Australian inquiry into diabetes and participation of figures like Dr. Muki suggest that change, while slow, is possible through transparent review and active civic involvement.

This story serves as a cautionary tale not only for nutrition science but for all areas where science intersects with policy — emphasizing the need for vigilance, transparency, and integrity to truly serve public health interests.

 

https://www.alnwickgarden.com/the-garden/poison-garden/

https://en.wikipedia.org/wiki/Alnwick_Garden

The Alnwick Garden is a complex of formal gardens adjacent to Alnwick Castle in the town of Alnwick, Northumberland, England. The gardens have a long history under the dukes of Northumberland, but fell into disrepair until revived at the turn of the 21st century. The garden now features various themed plantings designed around a central water cascade. The revival of the gardens led to several public disputes between the Duchess of Northumberland and various garden experts concerning preservation and the use of public funds.[1] The garden now belongs to a charitable trust, which is separate from Northumberland Estates, although the 12th Duke of Northumberland donated the 42-acre (17 ha) site and contributed £9 million towards redevelopment costs.

of course.... this is a bit tongue and cheek -

https://www.who.int/news-room/fact-sheets/detail/natural-toxins-in-food

But if you combine the WHO toxins... the metaphors is delicious!

 

Everyone I personally know who has tried Carnivore has done so from a data driven approach. Recording metrics, going in with a skeptical empiricism. They tend to be the "prove it" kind of people. The kind of people who actually read the literature (not just the abstracts).

The bulk of philosophically driven advice is against Carnivore - which acts as a giant filter for those who actually do it. Science minded people very much have the EXPERIMENTAL thought process - I'm seeing multiple theories, what is my falsifiable hypothesis - how do I measure it?

I'm genuinely impressed at how eager people are to share their data, there is a glee of discovery, even if the results are not perfect. This is real biohackers ethics, the joy of improving each others lives.

 

Simon sits down with RC Carter, a fourth-generation rancher from Wyoming and the force behind Carter Country Meats.

They dive deep into the future of regenerative agriculture, covering everything from soil biology and carbon-rich hayfields to managing 1,000-head herds with virtual fencing across 40,000 acres.

RC shares his bold vision for sustainable beef production, the hidden power of cattle as ecological tools, and the challenges of going direct-to-consumer with nutrient-dense, chemical-free meat.

They also discuss RC’s nonprofit Eversoil, which is reimagining land development in the arid West through nature-based water management and food transparency tech.

If you care about the land, the food system, or what’s on your plate, don’t miss this one.

summerizer

Summary

In this episode of the How to Carnival podcast, host interviews Richard Carter (RC) from Carter Country Meats, a regenerative farmer based in Wyoming. RC shares the journey of how his family became regenerative farmers—initially by accident—and how they transitioned from conventional grain-finished beef production to a holistic, nature-aligned regenerative system. He explains the challenges and rewards of regenerative agriculture, emphasizing soil health, biodiversity, and sustainable land management. RC discusses how integrating technology, such as virtual fencing, has revolutionized managing large herds across vast landscapes, reducing labor while improving land stewardship. The conversation covers the contrast between nature’s cyclical systems and capitalist demands, highlighting that regenerative practices, while initially challenging and costly, can be financially viable and ecologically restorative. RC underscores the importance of nutrient-dense, clean beef free from chemicals and heavy metals, and the need for transparency in food production through scientific testing and traceability initiatives. He also explains the critical role of managed grazing to mimic historic buffalo herds, promoting ecosystem health and combating undergrazing—the real cause of rangeland degradation. The podcast touches on the family’s lifestyle, the value of freedom in Wyoming’s open spaces, and the vision behind their nonprofit, Ever Soil, which aims to inspire and educate other producers and influence policy on public land management. Ultimately, RC advocates for a regenerative food system that respects nature, improves human health, and creates community value beyond mere profits.

Highlights

  • 🌱 Richard Carter’s shift from conventional to regenerative farming was accidental but transformative.
  • 🐄 Cattle are used as ecological tools to restore soil health and biodiversity.
  • 💧 Increasing soil organic matter boosts water retention, creating “land lakes” even in arid regions.
  • 📱 Virtual fencing technology enables efficient, low-labor herd management over 40,000 acres.
  • 🥩 Carter Country Meats focuses on nutrient-dense, chemical-free beef marketed direct to consumers.
  • 🌍 Ever Soil nonprofit works to develop regenerative land models and promote transparency in agriculture.
  • 🔄 Managed intensive grazing mimics natural bison herds, solving undergrazing and improving rangeland health.

Key Insights

  • 🌾 Regenerative agriculture requires a paradigm shift from extraction to restoration: RC emphasizes that traditional farming focuses on maximizing yields and extracting value, often at the expense of soil biology and ecosystem health. Regenerative agriculture flips this by prioritizing soil biology, organic matter, and long-term land resilience. This shift requires patience and financial resilience but ultimately yields healthier ecosystems and more nutrient-dense food.

  • 💧 Soil organic matter is key to water retention and drought resilience: RC highlights a remarkable increase in organic matter on their irrigated pastures—from 3% to 5% in four years—doubling what was achieved in the previous 60 years. This organic matter acts like a sponge, holding enormous quantities of water, which is crucial in arid environments like Wyoming and even more so in drought-prone regions like Australia.

  • 🐄 Cattle function as ecological engineers: Rather than viewing cows solely as meat producers, RC describes them as tools to manage vegetation and soil health. Strategic grazing weakens invasive weeds, distributes nutrients via manure, and stimulates grass regrowth, mimicking the historical impact of massive buffalo herds that shaped healthy ecosystems. This approach challenges the conventional wisdom that overgrazing is the problem; instead, undergrazing and poor management are the real threats.

  • 📲 Technology is transforming regenerative farming efficiency and scalability: Managing 40,000 acres with hundreds of cattle was once labor-intensive and physically demanding. Virtual fencing collars and GPS tracking now allow RC to monitor and control herd movements remotely on his phone, reducing physical labor and increasing precision. This integration of innovation sustains the farmer’s longevity and quality of life while ensuring better land outcomes.

  • 🥩 Nutrient density and food safety are critical differentiators in regenerative beef: Testing shows Carter Country Meats’ beef has superior omega-6 to omega-3 ratios, no antibiotics, and no heavy metals, contrasting with conventional grain-finished beef, which often contains glyphosate residues and lower nutritional quality. This scientific validation supports marketing premium products and educating consumers about the health benefits of regenerative meat.

  • 🌿 Transparency and data-driven certifications can redefine food trust: RC’s nonprofit, Ever Soil, aims to provide measurable data on soil health and food quality, linking each batch of meat to its environmental impact and nutrient profile via QR codes. This transparency addresses consumer skepticism and could establish a new industry standard, encouraging other producers to adopt regenerative practices by proving their value.

  • 🤝 Community, education, and long-term vision are essential for scaling regenerative agriculture: RC stresses that regenerative farming is not just a business but a community effort. Teaching the next generation to think innovatively and work with nature, rather than against it, is vital. The nonprofit’s goal to influence public land management and reduce bureaucracy reflects the need for systemic change to scale regenerative impacts beyond private lands.

Additional Context and Analysis

RC’s story reflects a broader global trend where farmers are rethinking agricultural models to balance environmental health with economic viability. His hands-on approach, combined with cutting-edge technology, exemplifies how tradition and innovation can coexist. The emphasis on soil organic matter underscores a foundational principle in regenerative agriculture: soil is the basis of all life, and improving its biology leads to cascading benefits for water cycles, plant health, wildlife, and carbon sequestration.

The discussion about grazing patterns—high intensity, short duration followed by long rest—demonstrates a sophisticated understanding of grassland ecology. This method prevents selective overgrazing of preferred species, promotes even vegetation use, and stimulates root growth, improving the carbon cycle and soil structure. It also reframes the debate on rangeland degradation, highlighting that absence of grazing can be as damaging as overgrazing.

By addressing the economics of direct-to-consumer sales and the challenges therein, RC reveals the complexity of scaling regenerative practices. While consumer demand for clean, nutrient-rich beef is growing, the operational burden remains high, underscoring the need for improved systems and collaborations.

Finally, the integration of ethical farming, family involvement, and regional identity (Wyoming’s wide-open spaces and libertarian spirit) adds a cultural dimension to this regenerative narrative. RC’s passion and vision demonstrate that regenerative farming is as much about lifestyle and values as it is about economics and ecology.

Conclusion

This conversation offers deep insights into the practical realities, philosophical underpinnings, and future potential of regenerative agriculture. Richard Carter’s experience shows that combining ecological wisdom, technological innovation, and community-driven initiatives can restore landscapes, produce healthier food, and sustain farming livelihoods. His work with Carter Country Meats and Ever Soil provides a replicable model for farmers worldwide seeking to align farming practices with nature’s cycles while meeting modern economic demands.

 

SharePoint's all over are getting hacked, and the exploit is pretty crazy.

https://github.com/rapid7/metasploit-framework/pull/20409 https://github.com/MuhammadWaseem29/CVE-2025-53770

summerizer

Summary

This video discusses a critical security vulnerability in Microsoft SharePoint that led to a significant breach of the U.S. National Nuclear Security Administration (NNSA). The presenter outlines how this exploit, dubbed "Tool Shell," leverages two major bugs in SharePoint to bypass authentication and execute arbitrary code on the server. The first bug is an authentication bypass caused by improper reliance on the HTTP referer header, allowing attackers to gain editing privileges without valid credentials. The second bug involves unsafe deserialization of compressed .NET objects within a SharePoint scorecard component, enabling attackers to run malicious code remotely. The presenter provides a detailed walkthrough of setting up a vulnerable SharePoint environment on Windows Server, the frustrations of managing Windows servers, and demonstrates the exploit using the Metasploit framework and Kali Linux. The video concludes with a warning for SharePoint administrators to apply patches promptly, emphasizing the severe implications of this vulnerability, especially considering SharePoint’s widespread use in government and enterprise environments.

Highlights

  • 🐞 A critical SharePoint vulnerability led to the hacking of the NNSA, a key U.S. nuclear security agency.
  • 🔐 Authentication bypass was achieved using manipulation of the HTTP referer header, allowing unauthorized page editing.
  • 🧩 Unsafe deserialization of compressed .NET serialized data enabled remote code execution through SharePoint scorecards.
  • 🖥️ Setting up a SharePoint test environment is complex and frustrating, involving specific Windows Server versions and configurations.
  • 💻 The exploit was demonstrated using Metasploit and Kali Linux, showing full remote control over the target server.
  • ⚠️ Microsoft has released patches, but administrators must urgently apply them to prevent exploitation.
  • 🔄 This vulnerability highlights the dangers of broken trust boundaries and unsafe data deserialization in widely used web applications.

Key Insights

  • 🕵️ Authentication Bypass via Referer Header: The exploit abuses the HTTP referer header to trick SharePoint into believing the user was authenticated, bypassing standard login mechanisms. This reveals a fundamental flaw in how SharePoint validates user sessions, showing the pitfalls of relying on client-supplied headers for security-critical decisions. This is a textbook example of broken authentication controls that can have catastrophic consequences.

  • 💥 Deserialization Vulnerabilities in .NET Environments: The unsafe deserialization of the compressed data tables within SharePoint scorecards is a classic security issue where serialized objects contain executable code. Attackers can manipulate these serialized blobs to execute arbitrary .NET bytecode on the server. This vulnerability underscores the risks inherent in handling serialized data without stringent validation or sandboxing.

  • 🏢 SharePoint’s Ubiquity Makes Exploits Particularly Dangerous: SharePoint is widely used, especially in government and large organizations. A vulnerability like this not only affects individual entities but also poses systemic risk to critical infrastructure. The NNSA hack illustrates how security weaknesses in common platforms can become national security threats.

  • 🛠️ Complexity and Fragility of Windows Server Environments: The presenter’s struggles with installing and configuring SharePoint on Windows Server 2019 reveal the operational challenges administrators face. Requirements like needing multiple CPU cores or specific server versions can cause silent failures, which complicate patching and defense efforts. This suggests that operational complexity contributes to security risks.

  • 🔄 Metasploit’s Role in Streamlining Exploitation: Metasploit abstracts the complex steps of coupling exploits with payloads, making it easier for attackers to leverage vulnerabilities effectively. The presenter demonstrates how an exploit module can be combined with a reverse TCP shell payload to gain full control of the target. This highlights the importance of defenders understanding attacker toolchains to better anticipate threats.

  • 🧪 Trust Boundaries are Critical in Software Security: The vulnerability arises because SharePoint incorrectly assumes that authenticated users’ data can be trusted implicitly. Once the authentication barrier was bypassed, the deserialization of malicious objects led to remote code execution. This emphasizes the need for strict boundaries and validation even for “trusted” data sources.

  • 🔒 Patching and Defense Must be Proactive: Microsoft is aware of this issue and has released patches, but the window for exploitation remains open until patches are applied. The video serves as a stark reminder that administrators must prioritize timely updates, especially for widely deployed platforms handling sensitive data.

Summary Expansion

The presenter opens by expressing frustration over managing Windows servers, setting the tone for the difficulty in replicating and demonstrating the vulnerability. The bug, called "Tool Shell," is a SharePoint exploit currently under mass exploitation, notably involving a simple curl command that chains two vulnerabilities together.

SharePoint, a widely used Microsoft platform for collaborative document management and organizational workflows, is common in many government agencies, including the NNSA. Due to its complexity and integration with Windows environments, it presents a large attack surface. The first vulnerability involves an authentication bypass where SharePoint trusts the HTTP referer header to determine if a user has already authenticated. By spoofing this header to simulate coming from a sign-in page, attackers gain unauthorized access to page editing features.

The second vulnerability revolves around the unsafe handling of serialized .NET objects embedded in SharePoint scorecard components. These scorecards accept Excel-style data which is serialized into a compressed Base64-encoded blob. Because this deserialization occurs without proper validation or authentication checks—exacerbated by the authentication bypass—attackers can inject malicious .NET bytecode that executes arbitrary commands on the server.

The presenter compares this to Python’s insecure pickle module, which similarly allows arbitrary code execution if untrusted data is deserialized. The analogy helps viewers understand the core risk: deserialization of untrusted data leads to code execution.

To demonstrate the exploit, the presenter details the challenges of setting up a vulnerable SharePoint server, including issues with Windows Server versions and hardware requirements, highlighting the operational complexity often overlooked in security discussions.

Using Kali Linux and Metasploit, the presenter runs the exploit module that exploits the authentication bypass and deserialization bug, sets a reverse TCP shell payload, and gains remote control over the SharePoint server. This is demonstrated live by migrating the session to an active Windows process and executing a calculator application remotely, showcasing full command execution capability.

The video closes with a call to action for administrators to patch immediately, recognizing the severity of the vulnerability due to its ease of exploitation and the critical nature of affected organizations. The presenter also briefly reflects on whether languages like Rust could have prevented the vulnerability, concluding that while memory safety is important, this issue is fundamentally about trust boundaries and unsafe deserialization, which are not fully mitigated by language choice alone.

Conclusion

This video provides a thorough and technical explanation of a dangerous SharePoint vulnerability that combines an authentication bypass with unsafe deserialization to enable remote code execution. It underscores the importance of secure session management, proper handling of serialized data, and proactive patching practices. The demonstration using real tools like Metasploit and Kali illustrates how attackers can exploit such vulnerabilities to gain full control over critical systems. In a broader context, it highlights systemic issues in legacy enterprise software, operational complexity, and the ongoing challenges of securing widely deployed platforms in sensitive environments.

Dave's Garage also covers this well: https://www.youtube.com/watch?v=L7EWXnPslA8

summerizer

Summary

The video, presented by Dave Plameumber, a former Microsoft software engineer, delves into a critical cybersecurity threat impacting Microsoft SharePoint on-premises servers globally. The vulnerability, identified as CVE-202553770 with a CVSS score of 9.8 out of 10, allows unauthenticated attackers to execute remote code on unpatched SharePoint servers, jeopardizing business data, intellectual property, and sensitive information. Dave explains the fundamental role of SharePoint in enterprise collaboration and the difference between SharePoint Online, which is managed and patched by Microsoft, and on-premises SharePoint servers, which remain vulnerable and widely used in regulated industries or legacy environments.

He breaks down the technical details of the exploit, which hinges on a deserialization flaw in SharePoint’s tool pane component, combined with an authentication bypass vulnerability. Attackers use crafted HTTP requests to deserialise malicious payloads, gaining full control over the affected servers. The video highlights real-world exploitation by threat groups like Storm 2603, who have been deploying ransomware and stealing confidential data since July 2025. Dave stresses the global scale of the threat, affecting government agencies, enterprises, and critical infrastructure, with the potential for severe economic and operational disruptions.

To mitigate the risk, Dave provides a detailed defense strategy, emphasizing immediate patching with Microsoft’s emergency updates, network segmentation, firewall restrictions, rotating cryptographic keys, enabling anti-malware interfaces, and monitoring for suspicious activity. For unsupported SharePoint versions, he recommends zero-trust network principles and accelerating migration to SharePoint Online. Backup best practices are also underscored to safeguard against ransomware. The video concludes with a call to action for viewers to subscribe for more cybersecurity insights and mentions Dave’s personal book on the autism spectrum.

Highlights

  • 🚨 CVE-202553770 is a critical SharePoint on-premises vulnerability with a CVSS score of 9.8, enabling remote code execution by attackers.
  • 🏢 SharePoint is a core collaboration platform in many organizations, but only on-premises servers are vulnerable, not SharePoint Online.
  • 🌍 Over 20% of on-prem SharePoint servers are internet-facing, making them prime ransomware and data breach targets globally.
  • 🔑 The exploit involves deserialization of untrusted data combined with an authentication bypass, allowing attackers to run arbitrary code.
  • 🛡️ Microsoft released emergency patches on July 21st, 2025, but unsupported versions like SharePoint 2013 remain exposed with no fixes.
  • 🔍 Defensive measures include patching, rotating ASP.NET machine keys, enabling anti-malware scanning, restricting network access, and monitoring for anomalies.
  • 💡 Migrating to SharePoint Online and maintaining tested backups are key long-term strategies to mitigate future risks.

Key Insights

  • 🔥 Severity and Urgency of the Vulnerability: With a CVSS score of 9.8, this vulnerability demands immediate action. The high score reflects both ease of exploitation and the devastating impact of full server compromise, indicating organizations must prioritize patching above almost all other tasks to avoid catastrophic breaches. Ignoring it risks operational paralysis, data theft, and regulatory penalties.

  • 🏢 SharePoint’s Ubiquity and Risk Exposure: SharePoint’s widespread deployment across enterprises as a collaborative backbone means the vulnerability’s impact is vast. The fact that over 20% of on-premises instances are exposed online highlights a widespread oversight in network security configurations, emphasizing a gap in basic cyber hygiene that attackers readily exploit.

  • 🧩 Technical Complexity Masked by Simplicity: The exploit leverages a known deserialization flaw, a common and dangerous programming pitfall, combined with an authentication bypass. This shows how chaining smaller vulnerabilities can lead to full remote code execution, underlining the importance of holistic security practices that consider interactions between components and not just isolated bugs.

  • 🎯 Real-World Exploitation by Sophisticated Threat Actors: The involvement of groups like Storm 2603 deploying ransomware and stealing cryptographic keys reveals the exploit is not just theoretical but weaponized in the wild. This highlights the persistent threat from state-sponsored or highly organized cybercriminal groups targeting critical infrastructure and enterprises, demonstrating the need for threat intelligence integration into security operations.

  • 🔄 Challenges in Securing Legacy Systems: Many organizations still rely on outdated, unsupported SharePoint versions due to compliance, cost, or operational constraints. These legacy systems have no official patches, forcing defenders to rely on network segmentation, zero-trust principles, and isolation strategies. This underscores the broader issue of legacy technology increasing organizational risk and the urgent need for modernization.

  • 🛡️ Comprehensive Defense Requires Multiple Layers: Effective mitigation goes beyond patching to include rotating machine keys to invalidate stolen credentials, enabling runtime malware scanning, restricting network access, and vigilant monitoring for subtle indicators of compromise. This layered approach exemplifies modern cybersecurity best practices where defense in depth is necessary to handle sophisticated threats.

  • 🔮 Future of On-Premises Software and Cloud Migration: The incident illustrates the growing security risks inherent in on-premises software maintenance and the push from vendors like Microsoft for cloud migration. While cloud platforms offer managed security and automatic patching, compliance and legacy constraints slow adoption, creating a transitional risk window. This case exemplifies the strategic imperative for organizations to plan and accelerate cloud adoption to minimize exposure.

Additional Context and Recommendations

Dave’s insights provide a comprehensive picture of how a single critical vulnerability can cascade into systemic risk for organizations. His background as a former Microsoft engineer adds credibility and practical perspective, especially in demystifying the technical mechanics and real-world implications. The video serves as both an educational resource and a call to cybersecurity action, urging organizations to evaluate their SharePoint exposure immediately.

The detailed description of the deserialization attack vector and the authentication bypass vulnerability also serves as a valuable case study for developers and security professionals, reinforcing fundamental secure coding practices such as strict input validation, use of allow-lists, avoiding insecure binary formatters, and maintaining minimal service privileges.

The global impact, underscored by media coverage and government advisories, highlights how interconnected and vulnerable critical infrastructure and enterprises remain. This incident exemplifies the ongoing cyber arms race between defenders patching vulnerabilities and attackers discovering bypasses and chaining exploits.

Ultimately, Dave’s comprehensive defense recommendations—patching, key rotation, enabling anti-malware scanning, network controls, and migration—form a best practice playbook for organizations facing similar zero-day threats in complex enterprise environments. The emphasis on backups and tested restore procedures is particularly prudent given ransomware’s prevalence.

This video is a crucial reminder that cybersecurity is a continuous process requiring vigilance, rapid response, layered defenses, and strategic planning for future resilience. Organizations ignoring these lessons risk becoming the next headline in a breach story.

 

To the Lake (Russian: Эпидемия, romanized: Epidemiya, lit. 'epidemic') is a Russian post-apocalyptic thriller television series launched on the Premier platform on 14 November 2019.[2] Its first season is based on Vongozero, a novel by Russian author Yana Vagner.[3] Netflix acquired the first season and released it internationally on 8 October 2020.

I found this while looking for zombie content, and it's fairly near. Think of a Contagion type of movie but nobody trusts each other.

Typically in these apocalypse films the characters are so terrible that you kind of want them to fail. Here, they came close, but there is enough humanity and futility lumped together that I actually care about these survivors struggles.

If you like thoughtful, dark, and a bit frustrating character studies of adversity in the context of a pandemic - this show is a worthwhile watch.

 

Clashes between Thai and Cambodian troops at their disputed border have killed at least 12 people, Thai authorities say.

The fighting marks an escalation of a dispute between the two South East Asian neighbours that dates back more than a century.

Most of the casualties were civilians from three Thai provinces, according to Thailand's army, which also reported that several people were wounded. Cambodia has yet to confirm whether it suffered any casualties.

Both sides exchanged gunfire early on Thursday, with each claiming the other had triggered the conflict. It escalated quickly, with Thailand accusing Cambodia of firing rockets and Bangkok carrying out air strikes on Cambodian military targets.

Thailand has closed its border with Cambodia, while Cambodia has downgraded its ties with Thailand, accusing its military of using "excessive force".

WTF is going on? Bombing 7-11s now?

 

Despite his famous presence on the $20 bill, he is not, in fact, a dead president.

https://en.wikipedia.org/wiki/Benjamin_Franklin

view more: next ›