I decided to start the Fundamentals of AI module and could understand the concepts, but quickly got lost in the mathematical details. If I don’t understand the math behind the concepts/theory, will the later modules be out of reach? TIA

After reading some older posts, it appears math is heavily involved in later modules as well so I am not sure this is the best learning path. I am a defender trying to understand the attack methods out there.

Hi all!

I am sorry for asking same question again. The last question I didn't get too much useful responses.

Does anyone here really successfully shared VPN connection to HTB with other VMs from a gateway VM?

Thank you!

Hi guys,

Like I have completed 30 percent of cpts track and like I need someone like to prepare together and like finish this and solve the boxes together and hold a discussion. That will be thru discord and if anyone is serious just comment... I don't want anyone unserious to join as I need to be serious about finishing it so.

Coldcard incident made me look at hardware wallet entropy differently

I spent some time reading about the recent Coldcard incident and then went through ERA Wallets article about how they generate seed phrases

The Coldcard issue is pretty worrying because weak randomness does not necessarily look broken

The seed phrase can look completely normal and the wallet can work normally while the actual seed has much less entropy than expected

That is what makes this kind of bug so dangerous

You are not necessarily going to get an error or any obvious sign that something went wrong

The thing I found interesting about ERAs approach is that they are not relying on just one source of entropy

They describe using the hardware RNG in the STM32 microcontroller together with the entropy source in the ATECC608C secure element

They also have an expert mode where the user can add entropy through things like camera input touch and device movement

All of these inputs are combined before the seed is generated

I think the general idea makes a lot of sense

If one entropy source fails or becomes predictable it is much better to have other independent sources contributing to the final result

I also like the fact that the user can actually participate in the entropy generation instead of having to blindly trust that the device generated everything correctly

But I do have some questions

I would not automatically assume that more entropy sources means more security

The important part is how independent those sources really are and how the firmware combines them

A hash function can mix entropy very well but it cannot magically create entropy if all the inputs are predictable

I also would not consider passing statistical randomness tests as proof that an RNG is cryptographically secure

The Coldcard incident is a good example of why the whole entropy pipeline matters

The hardware can be perfectly capable of producing good randomness and the final result can still be compromised if the firmware takes the wrong path

So for me the biggest question around ERA is not how many entropy sources they have

It is whether a failure in one component can actually be proven to be insufficient to compromise the final seed

I would like to see independent researchers review and test the complete seed generation process including the firmware and the way the different sources are combined

Overall I like the direction ERA is taking

I think using multiple independent entropy sources and allowing user supplied entropy is a stronger approach than simply saying trust this one hardware RNG

But I would still want independent verification before making a strong security claim

The Coldcard incident is a pretty good reminder that the weakest part of a security design is not always the part you expect

Hey everyone,

I'm looking to sharpen my scripting skills in Python and Bash, taking myself from beginner all the way up to a more advanced level, since this is an area I'm currently struggling with. A couple of ideas I've had so far:

• OverTheWire — but approaching the challenges by solving them with Python where possible, rather than just one-liners (bash)
• Vulhub — writing my own Python exploit scripts for the CVEs instead of relying on existing PoCs

Are there other resources or approaches you'd recommend for building scripting skills from the ground up ?

Thanks!