serious business :heart_cyber:

always hopeful, rarely optimistic

Public Key

npub1mw3ts8cx3gsnjmpgmetk26ns9u76kkcjg847nny9kp79kxgz506s0m2xa3

NIP-05 Address

ceresbzns@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsdhg4crurg5gfeds5du4m9dfcz70dttvfyr6lfejzmqlzmryp28agpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsmx907w

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1mw3ts8cx3gsnjmpgmetk26ns9u76kkcjg847nny9kp79kxgz506s0m2xa3

Show more details

Last Notes

2026-04-13 20:45:50 UTC

Hey -
hey you
yes, YOU
You going to HOPE 2026 in NYC?
#hope #infosec

2025-05-27 13:39:44 UTC

Question for folks who pivoted to software development later in their careers, particularly from adjacent disciplines like product management or design -
how did it go?
how did you go about it?
any advice?
any warnings?
#programming #software #foss #opensource

2025-05-24 17:41:23 UTC

lmao, never a dull moment
I got this email just now, sent from a domain of the provider where I host some Tor webtunnels. Hard to tell if the hosting provider has actually been pwned or if the threat actors are just bluffing.
Any advice from cyber professionals?
@nprofile…5k2y @nprofile…78gv @nprofile…hg5k @nprofile…k3vv have y'all heard if ColoCrossing has been pwned?
#infosec #cybersecurity #tor #privacy #vps #cloud
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/564/022/571/615/383/original/90c5be29821e4404.png

2025-05-05 18:25:10 UTC

New OMB memo tries to execute on circustown EO in predictably clown shoes fashion
https://www.metacurity.com/trump-eo-gives-doge-access-to-all-federal-systems-targets-states-and-injects-cybersecurity-risks/
rtyi @nprofile…5k2y
#infosec #cybersecurity #uspol

2025-05-04 22:09:09 UTC

- reply

@nprofile…mkea https://m.youtube.com/watch?v=y3WQ3f9AD_c

2025-05-04 00:57:23 UTC

- reply

@nprofile…4h6v @nprofile…mkea
Diana, yelling from the next room: "yes, Will, I can sense them because I have eyes - a sense organ - and these Starfleet uniforms don't hide a damn thing"

2025-05-04 00:48:14 UTC

- reply

@nprofile…056e if you're not already familiar, you should check out how Railgun implemented privacy pools and proof of innocence

2025-05-03 17:16:38 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/445/023/116/501/207/original/e73dcc548342af08.jpeg

2025-04-24 19:21:31 UTC

Maybe I've become paranoid, but I'm pretty sure someone just used AI to draft a proposal for this CFP without actually reading the CFP with their own human eyes
Unsurprisingly, the proposal is (generously) mid and - more importantly - doesn't meet the required criteria
When I wrote back to tell them their proposal didn't meet the mandatory proposal criteria, they sent back exactly the same proposal, just with more details
So, I've added an "ignore all previous instructions" section in white font to the text of the CFP
Any recommendations for other shenanigans?
#infosec #cybersecurity #LLM #AI

2025-04-23 17:47:29 UTC

- reply

@nprofile…gqp6 it stays in the box or it gets the guillotine

2025-04-13 17:38:30 UTC

- reply

@nprofile…args so what I'm hearing is maybe we need to sample the aphid butt juice for ourselves

2025-03-31 14:42:47 UTC

- reply

@nprofile…gqp6 the big thing for me is that she's barred from office! Imagine! Actual functioning government!

2025-03-26 01:32:03 UTC

- reply

@nprofile…mkea
Do none of these people text on their phones? Text them. If they don't suck, they'll text you back.
Don't don your sewer-diving suit and wade into the fucking filth mire to go after people who aren't even willing to send you an SMS

2025-03-21 13:59:43 UTC

- reply

@nprofile…q5wq Is it the fact the socialists don't last long in US politics?

2025-03-21 13:51:08 UTC

- reply

@nprofile…q5wq
I kind of imagine that if Bernie was willing to make the kinds of compromises necessary to build a coalition with these neoliberal cretins running as Dems then he wouldn't be Bernie, he'd be Biden

2025-03-21 00:13:27 UTC

- reply

@nprofile…mkea I use Graphene. It's nice.

2025-03-21 00:13:18 UTC

- reply

@nprofile…mkea Hrm, that's wild. Maybe try pihole?

2025-03-20 00:01:16 UTC

- reply

@nprofile…2mzm what happened?

2025-03-19 19:09:39 UTC

- reply

@nprofile…gqp6 $99 a MONTH?

2025-03-16 12:55:37 UTC

If you have an Amazon Echo, Ring, or other corpo snitchware installed in your home - you should sell it or smash it with a hammer
https://arstechnica.com/gadgets/2025/03/everything-you-say-to-your-echo-will-be-sent-to-amazon-starting-on-march-28/
#amazon #echo #ring #surveillance #privacy #smarthome #uspol

2025-03-09 00:51:09 UTC

TFW your wages are materially worse than a 15th century Florentine day laborer
#uspol #history #economics
CC @nprofile…frxk
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/129/717/568/540/160/original/24e43d4cd8b3f93c.jpeg

2025-02-06 16:24:35 UTC

- reply

@nprofile…2uzz
1. tap the ethernet so you can see traffic from other devices
2. wireshark to capture packets
3. filter for pornhub IP
did I get that right?

2025-01-28 19:59:11 UTC

- reply

@nprofile…5k2y
buy my bags, Uncle Sam!

2025-01-26 15:21:36 UTC

- reply

@nprofile…w0lm
OK, I think I see what you're saying.
I'm just a little taken aback at the suggestion that moving from one form of controlled media platform to another controlled media platform is going to be net positive.
Obviously the experiences as users are going to be different because they're optimizing for different outcomes, but at the end of the day, use of these managed systems is still going to be like choosing to spend time in the digital equivalent of reptile enclosure

2025-01-26 13:41:40 UTC

- reply

@nprofile…w0lm can you share some examples?

2025-01-20 20:42:16 UTC

- reply

@nprofile…mkea jfc

2025-01-20 20:05:57 UTC

Yes, we *could* be living in a post-scarcity society where everyone's needs are provided for with dignity and people can live truly free lives pursuing their passions.
But... we don't.
So how do *I* profit from the President of the United States launching back to back shitcoins to grift addled rubes?
#cryptocurrency #uspol #economics #finance #ds9 #startrek
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/862/449/282/719/036/original/fb93d5394c7c1ba2.jpg

2025-01-20 16:04:42 UTC

- reply

@nprofile…4m93 You don't even need a good brain anymore, that's how far the technology has advanced

2025-01-16 20:40:36 UTC

- reply

@nprofile…q5wq
"bitterly hand-maintained" lol

2025-01-14 12:02:56 UTC

What always strikes me as particularly nasty about rich fucks abusing people is that it would be trivial for the abusers to use their wealth and fame to get the experiences they *ostensibly* want with consenting adults.
Instead, they prey on vulnerable people, which suggests that transgression and power over others is the *actual* underlying feeling they're seeking and the sex or whatever is a secondary concern.
So given a choice between using privilege to seek novel experiences and using privilege to insulate themselves from the consequences of predatory experiences, many choose the latter.
Is this a particularly harmful instantiation of status games? It seems like largely the same dynamics at work.
This is a toot about Neil Gaiman, but also some very significant portion of the ruling classes more broadly. To wit, Epstein et al.
#neilgaiman #politics #uspol #psychology #economics
CC @nprofile…w0lm

2025-01-14 00:23:21 UTC

- reply

@nprofile…w0lm thanks for the writeup
Neil seems like a gross monster

2025-01-13 22:10:18 UTC

- reply

@nprofile…w0lm this link is about wrestling?

2025-01-12 03:36:24 UTC

- reply

Quick update to this story:
* I upgraded to latest version from nginx repo
* reverse proxy breaks. can't figure out what's wrong.
* I back out of all the changes and reinstall from debian stable repo
* proxy is working again
It sounds like security updates are backported (thanks all for the feedback), so I'm just gonna leave the server running the way it is now

2025-01-12 02:40:42 UTC

tldr; How common is it to find the software provided by the default Debian apt repo is out of date (maybe dangerously so) and you need to seek out a more secure version by setting apt to grab a different repo?
Long version:
OK, I have a sysadmin situation that I suspect may be fairly common, but it's the first time that I've encountered it because I'm new to all this:
* Host I'm operating is running Debian 12 Bookworm stable
* I updated my apt repo
* I installed nginx web server software from the default Debian apt repo
* Installed version of nginx is 1.22.1
* Shodan monitoring flags nginx 1.22.1 as end of life - (thank you @nprofile…ax9v)
* On investigation, nginx website shows a few known medium and low vulns in that version, and the latest mainline version of nginx is all the way up to 1.27.3 - so my current install is in fact five versions behind and very EOL
* obviously this is concerning because I don't want my server to get pwned
* nginx offers a way to update apt to point to their repo and pull the latest version (great service, thank you)
#sysadmin #homelab #nginx #debian #linux #infosec #cybersecurity #shodan

2025-01-10 20:16:26 UTC

- reply

@nprofile…ax9v any updates planned for Firefox extension? 👀

2025-01-06 18:43:46 UTC

- reply

@nprofile…5k2y people who want to bone without siri giving them cardio tips

2025-01-05 17:40:21 UTC

- reply

@nprofile…e3an boooooo 🍅 🍅

2025-01-05 13:04:42 UTC

- reply

@nprofile…m80s run Tor relays

2025-01-04 17:20:41 UTC

wow, installing calibre on a bog standard debian machine is a complete nightmare
#calibre #selfhosted #homelab #ebook

2025-01-02 00:09:38 UTC

- reply

@nprofile…5k2y ah, but can you stay solvent long enough for the short to actually pay off, there's the question

2025-01-01 23:12:26 UTC

@nprofile…mdat I got a meshtastic device. I've set it up. I've chatted with some folks on the local mesh.
...
n-now what?
#meshtastic

2024-12-31 00:59:17 UTC

Just finished making my way through @nprofile…7srr's Organization Theory
Awesome read. Accessible. Compelling. Strongly recommend.
You can get the PDF for free because Carson is the real deal
https://kevinacarson.org/publication/ot/
#economics

2024-12-30 20:15:34 UTC

- reply

@nprofile…j2jh
This line seems pretty striking to me
> This means that, while they have weapons, they do not allow the communities under their control to defend themselves against paramilitary attacks, nor does the Zapatista Army take armed action on behalf of the defense of their communities.
What is the point of the EZLN, then?

2024-12-30 19:12:47 UTC

- reply

@nprofile…j2jh can you link to your critique from a year ago? I'm curious to read it

2024-12-30 14:42:23 UTC

- reply

@nprofile…c4cm @nprofile…gqp6
If I'm being honest, I still don't really get the idea behind passkeys. It's not clear to me what advantages they offer over a hardware token or authenticator app.

2024-12-30 00:07:01 UTC

- reply

@nprofile…gqp6 I thought you were doing chores

2024-12-29 21:08:10 UTC

- reply

@nprofile…w3qa @nprofile…0tle @sun@shitposter.world
Doesn't look like it offers anything radically different or useful compared to the established chains.
My default assumption is that anyone trying to bootstrap a new L1 coin in 2024 is mostly just trying to cash out.

2024-12-28 15:50:20 UTC

- reply

@nprofile…l3gn what's going on now?

2024-12-27 17:53:37 UTC

- reply

@nprofile…vz0p because the prices are actually ridiculous or because 20%+ inflation over the past four years has destroyed our perception of fair value?

2024-12-27 00:12:04 UTC

- reply

@nprofile…kvnh you should what's happening in the alternate dimension where pine trees are the predominant sapient species

2024-12-19 16:10:12 UTC

- reply

@nprofile…vz0p
So, a few thoughts:
- depending on your current compensation, an entry level PM or design role might still be a leg up in terms of income, so your age probably isn't a meaningful obstacle here
- ideologically, the orgs that are in a position to offer the best compensation and resources for new designers / PMs are also less likely the ones that are going to be left-aligned, so you may have to compromise there in order to get some experience in the discipline and also get paid decently (there may be a path through open source projects, but that means basically doing unpaid labor in your free time)
- General Assembly and a couple other groups have crash courses that can get you up to speed in either discipline. They're not cheap, but I've worked with a couple folks who've gone through those programs and they seem like a decent way to get your foot in the door
- I've been working in PM for close to 12 years now, I'd be happy to meet up for coffee and chat, and I know a lot of designers and PMs. I'd be happy to put you in touch with them as well.

2024-12-19 15:44:52 UTC

- reply

@nprofile…vz0p can you unpack that a little?

2024-12-14 11:59:08 UTC

Extremely sophisticated cryptocurrency hack ($50MM), Mandiant has attributed to DPRK group
9 times out of 10, these cryptocurrency hack stories are a tale of clown shoes security practices, negligence, people sticking their hands into the Bene Gesserit pain box because someone told them there were cookies inside and discovering actually, no, just pain.
So what are we looking at here? Social engineering, macOS malware, persistence, normal so far.
What's really alarming (to me at least) is that the threat actors managed to defeat transaction simulation (!) AND hardware wallets (!!).
They didn't steal the keys, they spoofed the transaction information and sent malicious tx to the hardware to sign so all HUMAN facing information was correct while the machine signed something entirely different.
The only silver lining here is that the attack seems like it's high sophistication and high effort, so (for the time being) it doesn't seem likely to be replicated by the run-of-the-mill "stealer" malware families that steal keys or hijacking clipboards.
That said, I'm not sure what the near-term countermeasure here would be. Start enforcing some kind of authenticity scheme for all communications? Could be highly burdensome. Radiant suggests hardware validation of transaction outcomes, which is probably the right direction.
https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e
#cryptocurrency #infosec #cybersecurity #dprk #northkorea

2024-12-11 14:13:29 UTC

Fight your existential dread by fighting oppression: a call to arms for sysadmins, homelabbers, hobbyists, and hackers
I've done my part. Will you do yours?
https://blog.torproject.org/call-for-webtunnel-bridges/
#tor #surveillance #privacy #infosec #homelab #selfhost

2024-12-07 16:19:24 UTC

Just got my first @nprofile…5mmt webtunnel up and running! Four more to go. :blobcathyper2:
Command line cowbois, you can help!
https://blog.torproject.org/call-for-webtunnel-bridges/
Thanks to @nprofile…80r3 for their help finding affordable hosting
#tor #privacy #cypherpunk #lunarpunk #infosec #cybersecurity #censorship #surveillance

2024-12-06 14:29:58 UTC

I have a question for the solar panel / home battery crowd
I want to install roof solar panels to charge a battery in my home, and for the home to draw off the battery only when disconnected from the grid (manual or automatic switch)
Is this possible? What terms should I be researching and using with installers to discuss?
The installers in my area are all oriented toward connecting rooftop solar to the grid for energy credits
While that would be good, I'm not super interested in operating a tiny solar plant for the benefit of my local energy monopolist (esp since they blocked me from installing solar and connecting to their grid when I tried to!)
My goal is to have a renewable source of backup electricity to share with friends and neighbors in the event of an emergency
Please help - boosts welcome
#solar #solarpunk #disasters #pv #battery #mutualaid

2024-12-05 18:06:28 UTC

- reply

@nprofile…gqp6
I understand the following things to be true:
- Suppressors are pretty cheaply and widely available in the US, especially outside of NY/MA
- It's also possible to 3D print suppressors now, as a result of the 3D print firearm community online
Anyone with about a grand and an internet connection would be able to get access to an unserialized firearm, suppressor, and then getting range time isn't hard (probably not even required, since some people can shoot in a basement or the woods).
Just sharing for context

2024-12-05 17:57:22 UTC

- reply

@nprofile…gqp6 what do you mean by custom firearm?

2024-12-05 16:37:30 UTC

- reply

@nprofile…gqp6
// Class War System Update
// Death Panels are now bi-directional

2024-12-05 16:03:26 UTC

holy fuck
#uspol #unitedhealthcare
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/601/056/045/289/022/original/6d02c27272e1054d.png

2024-12-05 15:58:58 UTC

- reply

@nprofile…vdjy lol
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/601/040/177/147/739/original/89fde1a9e0c91449.jpg

2024-11-28 18:25:03 UTC

- reply

@nprofile…2uzz 👏 👏 👏 👏

2024-11-26 02:19:48 UTC

- reply

@nprofile…gqp6 you mean you're not already using Diffie-Hellman-Grillbot encryption schemes?

2024-11-22 23:32:15 UTC

lol
lmao
Sauce: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-326a
#infosec #cybersecurity #redteam #cisa
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/529/205/622/068/032/original/2dada1f09cd9e77b.jpg

2024-11-22 22:27:46 UTC

- reply

@nprofile…skc4 👀

2024-11-21 18:02:24 UTC

- reply

@nprofile…q5wq I keep two stickies as notes to myself on the monitor of my work computer
the first says "BE NICE"
the second says "Shut the fuck up"

2024-11-19 01:09:22 UTC

"The end justifies the means. But what if there never is an end? All we have is means."
Ursula K. Le Guin, The Lathe of Heaven

2024-11-14 20:11:31 UTC

- reply

@nprofile…0tle 4.5 TB! $150/mo+ in hosting costs!
even if it was possible to host the entire stack, no one is going to pay $2k a year just to host their own microblog, wtf

2024-11-10 15:05:43 UTC

Channeling my anxiety by stocking up on shelf-stable goods

2024-11-08 00:47:13 UTC

- reply

@npub18wj…lvmv
https://lifehacker.com/why-you-should-care-about-and-defend-your-privacy-5904966

2024-11-07 21:04:30 UTC

- reply

@npub1wf4…94wn lol, it took me a minute

2024-09-10 14:28:01 UTC

lmao
#git #github #linux
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/113/720/785/403/470/original/7e190c1881eba148.jpg

2024-09-09 20:40:27 UTC

This Cohost situation sounds pretty unfortunate, having been done in by Stripe changing their policies.
Listen, and I mean this sincerely, what if we started paying attention to online payment systems that aren't gatekept by a handful of processors?

2024-09-08 13:17:38 UTC

Question for the BBS sysop gang
If I wanted to create an experience for a small group of (20ish) folks to connect (over CLI, preferably) for a time-limited period (2-3 days) - should I look at the latest BBS server software? Or would I be better off trying to patch together chat, etc from more "modern" tools?
#bbs #sysop #art and #technology #cli
#retrocomputing

2024-09-06 14:14:53 UTC

- reply

@npub1vqm…ccpx jesus, grant

2024-08-30 18:30:56 UTC

- reply

@npub1vcl…k6t3 Incidentally, what's your opinion on the OSCP?

2024-08-25 20:24:02 UTC

- reply

@npub1cu4…mcxv so I'm not just an idiot?

2024-08-25 15:02:48 UTC

Freezing my credit with the big 3 agencies. (USian)
Experian was creepy but functional.
Equifax worked.
TransUnion is complete fucking clown shoes.
They should all be destroyed.
#credit #surveillance #finance #infosec #usa

2024-08-25 03:04:55 UTC

I LOVE LINUX
IT TOOK ME LIKE AN HOUR TO FIGURE OUT HOW TO COPY A FILE FROM A REMOTE SERVER TO MY HOST
IT'S FINE
I HAVE DEVELOPED A GREATER APPRECIATION OF USER SPACE AND PERMISSIONS
EVERYTHING IS FINE
I LOVE LINUX
:blobcatderpy:

2024-08-18 21:43:07 UTC

I'm running a few Tor relays and a Signal proxy, partly as a reason to learn tech skills, partly as my civic responsibility as someone who believes in a free and private internet.
Any suggestions for what else I should spin up?
Here's what I've been considering doing next:
* SearXNG
* Radicle
* IPFS
#privacy #tor #signal #lunarpunk #devops #searxng #radicle #ipfs #censorship

2024-08-17 14:00:47 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/977/718/822/090/974/original/096a1a04bbbfc593.jpg

2024-06-28 00:07:44 UTC

- reply

@npub18wj…lvmv did you mean to say *inter*-party?

2024-06-17 12:09:40 UTC

- reply

@npub1mdk…aptk are you asking because you're looking to spin up an instance, or looking to identify fedi software that does these things?

2024-05-30 20:24:52 UTC

- reply

@npub1avr…pnem I mean, the absolutely safest thing would be to close any ports / services you're not using