roma★
almost home
let's talk about Bridgerton tea, my ask is open
he wasn't even looking at me and he found me
Lint Roller? I Barely Know Her
trying on a metaphor
⁂
Today's Document
DEAR READER
Misplaced Lens Cap
Origami Around
Acquired Stardust
2025 on Tumblr: Trends That Defined the Year
★
Keni
No title available
Xuebing Du
titsay
blake kathryn
we're not kids anymore.
seen from United States
seen from United States
seen from United Kingdom
seen from United States
seen from Canada
seen from Türkiye
seen from Hong Kong SAR China
seen from United States
seen from Maldives
seen from Türkiye
seen from Malaysia
seen from United States
seen from Sweden
seen from Maldives
seen from Türkiye
seen from Türkiye
seen from Romania
seen from Taiwan
seen from United States
seen from Brazil
@dvas0004
Security Intelligence Briefing: NVD Updates & AI-Driven Threats
Security Intelligence Briefing: NVD Updates & AI-Driven Threats Topic: NIST NVD Operations, CVE Management, and AI Discovery The cybersecurity landscape is currently undergoing a structural shift, defined by two converging forces: a massive influx of reported vulnerabilities managed by the NVD, and the rapid acceleration of AI-driven discovery. In April 2026, the National Institute of Standards…
Troubleshooting System Prompts in AI-Powered SIEM Solutions
The last three months have been frantic at Cybersift development – mainly due to the inclusion of generative AI into the SIEM. The backend currently powering the LLM chat interface on our SIEM is based off the excellent PydanticAI library. I like the approach taken by this library – while it helps reduce the boilerplate around building AI Agents (including using MCP and other tools), it’s not so…
View On WordPress
Intercepting Flutter app traffic
Introduction this is an extract and sample of some of the work we do while pentesting in CyberSift Flutter and the underlying dart engine do not respect certificate and proxy system settings. Sometimes, frameworks like reFlutter dont work 😢 The below helps get around this. The idea at a high level is to: Setup a burpsuite transparent proxy Transfer the burpsuite CA to a rooted android…
View On WordPress
Lessons Learned: Golang's GORM FirstOrCreate
Problem GORM is a great Golang Object Relation Mapper and saved us tons of time when developing CyberSift products. However, there were instances when using the FirstOrCreate function where a new record was simply not created Troubleshooting After creating a simple toy Golang program (shown below) we actually see that the new record IS created, but it’s empty import…
View On WordPress
(Slightly) Advanced cache use cases to improve performance
In this article we will explore two related use cases, using caches to improve performance. The use cases are probably very familiar to engineers coming from a front-end background, but I rarely see documentation on the concepts used within a back-end context. The use cases are based off real world scenarios we’ve encountered in CyberSift. I use Java Caffeine here, but the concepts apply to any…
View On WordPress
Lessons Learned: Accepting "any" type of variables in Golang functions
Scenario You would like to define a Golang function which accepts different types (or structs) and take different actions depending on your input. This is very similar to the “visitor design pattern” A good example is marshalling the response of an http.Get call differently depending on your input to this function Method The obvious trick is to use interface{} as the input type to the…
View On WordPress
Writing SQLite Extensions in Rust
Explainer SQLite allows you to create custom virtual tables which allow you to query an external data source using SQL, lowering the bar to entry and homogenizing your data sources In the past we’ve looked at creating virtual tables in golang, and here we do something similar in rust. One notable improvement here is the inclusion of a loadable extension. In most examples I could find (such as…
View On WordPress
Scaling INET queries in POSTGRESQL
A very common requirement in most SOCs is to compare a given IP address against a table to extract contextual information such as originating country, owning organization and so on. At CyberSift we had a similar challenge. Most geo providers will allow you to download data to a table in this format: CREATE TABLE "ip_loc" ( "start_ip" inet, "end_ip" inet, "iso2" varchar(4), "state"…
View On WordPress
Adding Opensearch-Dashboards/Kibana filters to Vega visuals
Opensearch-Dashboards and Kibana allow for the use of the “vega” library, which lets developers build an arbitrarily complex visualization. One of my favorite visuals which is not included in the standard visualization library is the “Sankey Diagram“. Since it’s not part and parcel of the preset charts offered by Opensearch Dashboards, we resort to Vega. Luckily, there is an excellent starting…
View On WordPress
Lessons learned: Custom Opensearch Dashboards Plugin Security
To determine the user that is signed in when making a request to your plugin server, or in more formal words the “authentication context” of a request you have two options Client Side This is not very secure as it is initiated and consumed by the browser, which is under the complete control of the end user – so do not rely on this method to enforce actions depending on the signed in user as it…
View On WordPress
Kibana / Opensearch Dashboards: Error when creating new index pattern (Bad Request)
This article is based on internal documentation from CyberSift, and since this seems to be a problem which others might run into, I’ve posted it here Problem scenario When attempting to (re-)create a new index pattern from Kibana / Opensearch Dashboards, we encounter the error Bad Request: Troubleshooting steps First point of call is the kibana/dashboard logs. Tailing these logs while…
View On WordPress
Sending Influxdb alerts to Google Chat
We recently moved away from Slack as a company and started using Google Chat. The main stumbling block from a tech point of view was that most monitoring services (such as InfluxDB which we use) have easy integration with Slack, but not Google Chat: Easy slack integration… but limited HTTP(S) options Luckily, we can bend the rules in InfluxDB to send our notifications to Google Chat. Once you…
View On WordPress
Converting Active Directory SIDs to names using LDAP + Rust
CyberSift recently had a requirement to be able to convert Active Directory SIDs into user friendly names. SIDs crop up whenever you look at security related Windows Event logs, such as event 4627(S): Group membership information, and would be similar in format to: S-1-5-21-1377283216-344919071-3415362939-1104. This format is obviously not very readable by anyone who looks at it, and…
View On WordPress
When being Lazy pays off: Kotlin Objects and NoClassDefFoundError
One of my favorite concepts in Kotlin is the “Object” class. A quick refresh: A normal “class“: class ExampleClass(arg1: String) An “object” is very similar in syntax as can be seen below, but comes with a crucial difference: it is a singleton. object ExampleObject There’s a lot of debate around Singletons being evil or not… but if you use them, in Kotlin the best way to express them is…
View On WordPress
Nugget Post: "429 Too Many Requests" on Elasticsearch/Opensearch
Nugget Post: “429 Too Many Requests” on Elasticsearch/Opensearch
In high volume environments, you may encounter the following error when ingesting data into your Open/Elasticsearch cluster: Error HTTP 429: Too Many Requests In NiFi, this would crop up as an uncaught exception: Digging into the Opensearch and client logs, you’d see errors along the lines of: Data too large, data for [<http_request>] would be [123mb], which is larger than the limit of…
View On WordPress
Inserting, reading, and updating JSON data in postgres using Golang GORM
Inserting, reading, and updating JSON data in postgres using Golang GORM
This is a “Frankenstein” approach which worked well using a combination of methods found online (see references). On their own, each approach had a limitation, but together they ticked all the boxes. Assuming you have the following table defined as a struct within you Go program: type User struct { Name string Email string Attributes JSONB `gorm:"type:jsonb"` } Note the “attributes” field,…
View On WordPress
Lessons Learned: How to avoid getting asked for tokens in MS Azure console apps
Lessons Learned: How to avoid getting asked for tokens in MS Azure console apps
Microsoft has been migrating most of Azure’s functionality to the “Microsoft Graph API”, which is fantastic as that allows us to automate a bunch of things within the Azure cloud. However, the Graph API is secured behind an OAuth2 flow, and if you’ve ever dealt with OAuth2 you’d know that it revolves around “tokens” which are issued by a central authentication/authorization server for any given…
View On WordPress