Daniel Cuthbert

Documentary photographer, old creaky hacker. Co-author of the @OWASP ASVS standard. Blackhat/Brucon Review Board.

Public Key

npub1mxglgd9hl0636h90jlslme5yl66ez0hgzgx3tz5387qd4p3vuhfqd9pnmm

NIP-05 Address

Profile Code

nprofile1qqsdny05xjmlhagatjhe0c0au6z0adv38m5pyrg432gnlqx6sckwt5sppamhxue69uhkummnw3ezumn0wuq3gamnwvaz7tmjv4kxz7fwv3sk6atn9e5k7avn32h

Publishing to

nostr.now

relay.damus.io

nos.lol

Author Public Key

npub1mxglgd9hl0636h90jlslme5yl66ez0hgzgx3tz5387qd4p3vuhfqd9pnmm

Show more details

Last Notes

2026-10-28 22:39:57 UTC

- reply

unprompted will be releasing all slides soon

2026-10-27 23:06:03 UTC

kudos to @npub1nxm…s88r showing the true costs of finding bugs. their recent chrome bug is a great example of modern bug hunting and I've oodles of love for them showing said costs and approaches
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/515/377/372/525/272/original/82717e31bb5b6ddd.jpg

2026-10-27 22:35:05 UTC

- reply

things do change but, and yes I'm biased here being a reviewer, the content is still solid and phrack-like. this edition is a brilliant read I feel and yeah that cover art is sexy af

2026-10-27 16:35:29 UTC

great to see the print version available for all. 40 years of @npub1am3…j6qn and here's to so many more
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/513/840/749/563/578/original/98fef378c843d044.jpg
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/513/841/624/886/555/original/a1e359943c6e5a23.jpg

2026-10-25 19:22:00 UTC

no screen time Sundays...
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/503/171/891/884/554/original/a20fc7938c1017ee.jpg

2026-10-17 10:20:48 UTC

- reply

Yah, and US banking is even more behind then EU banking.
"rogue agents.." pfft

2026-10-17 10:13:47 UTC

Aah yes, "rogue agent" argument whereas lets be honest, this is more about banks shitting themselves over what is fundamentally a panic over the end of the ultimate banking free lunch.
For decades, traditional high-street banks have relied on customer inertia. People leave their cash sitting in a checking account earning a paltry % simply because moving it takes a bit of friction and effort. That cheap liquidity is the bedrock of their lending margins.
The liability and regulatory arguments are valid secondary headaches, but the existential threat is pure margin compression.
https://www.ft.com/content/f49c8e39-f07f-4177-9948-aabe55e5ed91?syn-25a6b1a6=1

2026-09-27 07:25:17 UTC

Proof being a CISO is stressful, Darrin quit and decided to drive his Land Rover all over one of the most spectacular countries I’ve ever been to: Namibia
https://youtu.be/RYGsa9c7PzM?is=oa_UQRAhQWkp6TZs
So if you like the wilderness and stuff, give it a watch and subscribe and help an ex-CISO recover

2026-09-23 09:43:15 UTC

Overheard and can’t un-hear it:
“Kubernetes is this generations writing shit in PHP”

2026-09-22 04:52:10 UTC

- reply

hah good to know. Okay, I will make more.

2026-09-20 17:37:04 UTC

- reply

yessir. She has a fully stocked garden area where she can grow stuff now too. Happy wife, happy life

2026-09-20 16:43:56 UTC

- reply

yeah I’ve seen the adverts and I won’t lie, I’m intrigued

2026-09-20 15:06:04 UTC

- reply

yeah dedicated account, linked into YouTube and then controlled. YT kids they hate.

2026-09-20 15:00:22 UTC

Phase 3 of Mick’s restoration adventure, our 1956 Land Rover series 1 107, has begun. The truck spent 70 years of its life in the Australian outback, and as such whilst there is no serious structural rust, there is a metric shit ton of outback dirt and surface rust, of which we need to remove..
i’m toying with the idea of getting this bead blasted and then powder coated, which should prolong its life far beyond when I have shuffled off this mortal coil and it’s up to my boys to then enjoy it.
It’s that or the boys and I get intimate with some masks and the wire wheel.
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/303/961/038/571/980/original/5d3663e0d226330a.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/303/961/255/370/227/original/7079d2ee80d7862e.png

2026-09-19 19:49:05 UTC

- reply

apologies, grab https://families.google/intl/en-GB_ALL/familylink/

2026-09-19 09:46:51 UTC

By far the best parental control feature ever made: the ability to completely block YouTube Shorts. Whoever on the product team thought Shorts was a good idea genuinely needs to be dragged outside & throttled.
It is ugly, addictive, useless tech that provides zero actual value.
The change in behavior with my dudes is something else. I wish Google made this the default and explained how dangerous shorts are.
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/297/065/247/637/292/original/ac338dc0195099b3.png

2026-09-14 18:25:29 UTC

- reply

oh that would heaven. I’d eat both and then feel sorry for myself but happy and full

2026-09-14 18:06:23 UTC

When your wife enters the baking phase of her life, you are doomed to never be lean again.
Friday chocolate chip cookies
Sunday Oreo crumble cake
Today, banana bread with chocolate
This is impossible

2026-08-30 12:44:13 UTC

RIP HELCH. Huge part of Londons graffiti scene.
Whilst there were many favs, the American carwash for me was the best.
https://drorhadadi.com/en/helch-graffiti-2/
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/184/517/136/049/489/original/d8c57c5272d2eb78.png

2026-08-30 07:46:34 UTC

Last burst of those summer rays...
The Light Lens Lab 50mm F2 Speed Panchro II, designed by Mr. Zhou in China, is possibly one of the characteristic lenses I own.
The original Cooke Speed Panchro II is a beautiful piece of optical history, but rare, expensive and increasingly difficult to find. Unless I turn to cybercrime, this lens is an easier way of shooting that famous “Cooke look”.
What I love most about it is the imperfections. Modern photography is too perfect.
The glow, the softness, the vignetting, the gentle fall-off and the way it renders light. Modern lenses are designed to correct these imperfections. The Speed Panchro embraces them, and somehow, those imperfections are what give the image its character.
Not technically perfect. Just beautifully imperfect with flaws and renderings more how we see stuff.
Modern technology has spent decades trying to remove imperfections: more resolution, better dynamic range, less distortion, less flare, sharper corners, cleaner high ISO, perfect autofocus.
And now there's a cultural reaction to that perfection
https://www.theguardian.com/artanddesign/article/2024/aug/16/the-mistakes-are-romantic-gen-zs-revival-of-point-and-shoot-cameras
People are deliberately choosing older cameras because the limitations create an aesthetic. The blur, grain, harsh flash, colour shifts and blown highlights aren't necessarily defects anymore, they're part of what makes the photograph feel distinctive and human
We dont see perfectly. Our eyes are amazing but modern smartphone and digital camera sensors dont reflect what we process.
https://www.fastcompany.com/91050385/why-gen-z-is-obsessed-with-point-and-shoot-digital-cameras
So here's to more mistakes. More blurs, more harsh colours and not what tech bro's in the valley think we want or need just because their wealth depends on it.
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/183/278/949/081/051/original/08d6d45b50d5c9dd.jpg
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/183/278/949/500/927/original/a1fde1e608636e00.jpg
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/183/278/965/526/743/original/7f849538c614dfd0.jpg
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/183/278/979/305/201/original/3033a503326681ba.jpg

2026-08-28 13:22:55 UTC

Shut up and explore this amazing planet of ours. A mantra I’ve had since I was a teen and it’s so good to see a Norwegian do what I want to do before I shuffle off this mortal coil: ride around Afghanistan on a bike just with my Leica and film
https://youtu.be/OMC7pj-0wQY?is=rWzQMWjQmVhrl701
You go Tom. This is living. Afghanistan looks amazing.

2026-08-28 12:11:15 UTC

- reply

same and the idea of making stuff is just too appealing. I’ve also got a lot of stuff I need to make, currently restoring a 1956 Land Rover series 1, the Lancia delta integrale, 2 x classic Mercedes and a few other things

2026-08-28 08:28:00 UTC

One has to pay respect for the effort that was clearly monumental for this edition of tmpout
https://tmpout.sh/5/
that ASCII art is off da faken scale
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/172/185/509/776/407/original/d4ee350f791cda39.png

2026-08-28 07:43:01 UTC

I’ve entered that phase of my life where a lathe is looking like a solid decision for the workshop.
Shit.

2026-08-26 07:56:14 UTC

- reply

I don’t think so. I look at what Apple has specifically done with proprietary hardware fasteners also the enclave where “allowing unverified third-party components compromises user security.”
Piss off. They’ve allowed imageio to be shit for ages and consistently be abused. This is not about security but control

2026-08-26 07:21:55 UTC

- reply

Designing a product that is almost impossible to repair is a dick move. Apple is the master in this, look at the AirPods and how they make it harder to replace parts with non-Apple components
They aren’t alone. We’ve somehow accepted that when it breaks we need to buy a new one, which is incredibly wasteful.

2026-08-26 07:18:05 UTC

I know it’s easy and cool to dunk on EU red tape but this is actually sexy af: https://commission.europa.eu/news-and-media/news/right-repair-new-consumer-rights-easy-and-attractive-repairs-2026-07-31_en
For the last decade (or maybe more actually) hardware engineering has leaned heavily on proprietary screws, anti-repair software pairing, and literal buckets of industrial adhesive.
This piece treats the EU Directive as a tactical defeat for aggressive silicon anti-features.
Actually I think the right to repair is vital. We’ve got too much e-waste as it is so I welcome such efforts to make and mend.
Silicon Valley won’t like it but honestly, they are the problem in most cases

2026-08-20 18:01:38 UTC

Don’t need a 16mm camera
Don’t need a 16mm
Don’t need a
Don’t need
Don’t
Hmmm. I mean…..
I do love the fact that we are seeing film stock being developed at the moment.
euphoria season 3 is shot on this and I can’t wait to watch it
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/129/137/358/817/409/original/b7e56ae00ed1f9b2.png

2026-08-20 08:08:49 UTC

I'm blown away by what we have today. Take https://huggingface.co/Qwen/Qwen3-Embedding-0.6B which is just brilliant at taking output from RAPTOR and the datasets we create from our /understand (attack path, src, sink, dataflow, threat model etc) and then doing careful extraction, not crystal-ball nonsense. It’s capable enough to understand technical security language and follow a structured schema, but small enough to run properly on an 8GB M1 Mac mini.
I run it with temperature 0, an 8,192-token context and a tightly defined output schema, num_predict = 1400 which bounds the output.
The model has enough room for the structured labels but cannot wander into an enormous response or hallucinate as much in my experience.
Then, I use qwen3-embedding:0.6b to spot semantically related labels
Honestly this is such an exciting period for us, well at least me finding bugs 'n shit.
on the dinosaur front, we set about making a bloody solid sandbox and control/telemetry plane for RAPTOR: https://github.com/gadievron/raptor/issues/889
oh and it works really well from stopping it from eating your face.

2026-08-18 09:25:14 UTC

- reply

ethernet? what's that??? ;p

2026-08-18 09:20:30 UTC

As AI creeps more and more into the creative arts, I love hearing what real artists are coming up with as a result
https://www.youtube.com/watch?v=jEfWTJzlMoY
Andre just builds this so well. You can almost imagine the smoke and the sweat and throbbing bodies dancing to this at 0300 and then it just goes on and on.
Here's to more like this

2026-08-18 07:14:16 UTC

then today is very much a hardware hacking day, bear with me.
Some cool research by fellow Blackhat review board'r, Ben Nassi and Co
https://www.nassiben.com/video-based-crypta
Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED
Then @npub1sqj…2cmf spent time on [@bunnie](https://social.treehouse.systems/@bunnie )'s badge
https://andrewmohawk.com/2026/08/16/dc34-badge-hackin/

2026-08-18 07:12:44 UTC

Now then, it's kinda known that the best watch in the world is a Casio F-91w (god-tier), fact, but surely this is screaming out to be a close hackable contender
https://www.casio.com/uk/watches/casio/product.F-B100W-1A/
Step tracker, Bluetooth sync and no charging cable? Oh hell yes
CR2016 and say no more.
Oh and hackable you bet. At that price point, this seems like a good winter exploration project with the kids here.
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/115/264/616/543/395/original/9696cd85b5fc7bab.jpeg

2026-08-17 07:25:08 UTC

- reply

yeah the swell can be fun sometimes ;)
Been coming here since I was 2, such an amazing set of islands

2026-08-16 09:00:28 UTC

Anyhoo. Los canarias…
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/104/364/169/760/437/original/959acf701cc9308c.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/104/364/675/401/563/original/ca4055d3deaeb279.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/104/364/955/420/789/original/55457b688dde6993.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/104/365/298/763/381/original/b3c738e83281638d.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/104/365/684/909/888/original/8304fab5c8c442cb.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/104/366/103/788/763/original/4e3494896ae565e8.png

2026-08-16 08:48:20 UTC

- reply

same but I’ve this ugly feeling it’s cooked. Bag was inside for longer as they don’t like the brass that the Leica is made of.

2026-08-16 08:44:34 UTC

Finally had a chance to shoot my CineStillFilm 800 and I’ve an ugly feeling it will be fogged TF thanks to minimum wage security idiots at the airport refusing a hand search
The security theatre at airports continues. Shoes off. Oh wait that watch looks dangerous. Oh no this film could be bad!!
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/104/302/772/541/340/original/ffc7800057422701.png

2026-08-07 00:56:12 UTC

This badge. No really, this bloody @npub1dqd…8xy4 badge by the legend that is @bunnie.treehouse.systems is something else.
First up, Bunnie is my hero and his hardware foo is on another level. The Baochip SoC is <insert superlative here>, I mean it builds on his epic Precursor device ethos
“Do you really know what is going on inside the CPU?”
The chip is transparent to infrared light. Take a modified USB microscope and voila, have a look at the transistors
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/051/497/606/703/302/original/eac93b181e9c642f.jpeg

2026-07-25 18:20:51 UTC

- reply

oh it’s wild.
We’ve almost got to the point where you need to do a physical assessment of the cars telemetry systems in order to block them, or at least find out where the hell they are at first
That or we need an EDR or WAF for the cars. Heaven help us all

2026-07-25 10:14:11 UTC

I never thought i'd side with Gen Z in how they think, but when it comes to analogue devices, we are very much in sync.
Vinyl's back. Mechanical watches are back. Gen Z reads more physical books than the algorithm and tech bro's wearing patagonia would like.
I'm here for it.
I remember being with @npub12ts…x422 in London talking about cars and tracking a while ago and it has always been in the back of my mind.
I'm not anti-tech, I'm just anti-tech for techs sake. I own a modern car, it's from 2009 and it's the newest I have and have ever had actually.
It has knobs. It has sliders. There's no stupid ipad in the display. I don't have it snitching on me. I don't have a sub to warm
Turns out I'm not just being sentimental about this. From January 2026, Euro NCAP won't give a car five stars unless it has physical controls for indicators, hazards, the horn, windscreen wipers and such.
physical knobs. wild I tell ya
Their own research found touchscreen tasks can take 20+ seconds, enough to cover half a kilometre at motorway speed without your eyes on the road.
Then there's the data, and this is the part that actually worries me professionally. Mozilla tested every major car brand's privacy practices. Every single one failed. Their conclusion: cars are the worst product category they've ever reviewed for privacy (https://www.bbc.co.uk/future/article/20260513-your-car-is-spying-on-you-its-about-to-get-worse)
None of this is a human underwriter looking at your file anymore. It's a model turning your braking patterns, night trips and cornering speed into a risk score and quietly adjusting your price.
Insurers are moving further into AI-processed pricing and claims, and even within the industry the reasoning behind a given decision is often described as a "black box" that's hard to unpick
So I'm not being precious about buttons for the sake of it. I'm against tech that fails silently, phones home without asking, and quietly builds a profile of me that I'm not allowed to read. Tech for tech sake is what VC's and tech bros want and the reality is, most others dont
And that's the part I can't get past, being on the inside of this stuff. I know exactly where that data goes. It's not sitting in a drawer somewhere. It's a row in a Postgres table, or an embedding in a vector database, waiting for some frontier model to slurp it up
Often with shoddy security engineering processes and "oh crap we got hacked but no honestly, we DO take your security seriously" lines we've all heard to death.
So here's to more analogue, less tracking and less bloody data generation
If you got this far, watch Julia James Davis (she's very cool, I like her series on the death of beauty)
https://www.youtube.com/watch?v=V7GKFmAbTB8&t=1s
Anyway here's to hacker summer camp, tinkering and breaking and hacking.

2026-07-14 06:59:48 UTC

So @npub1j54…42x7 and I are on a mission to find creative artists who want to help design the cover for Phrack #73.
retro sci-fi & chrome futures
▸ cyberpunk / terminal aesthetics
▸ dystopian systems
▸ hacker manuals from an alternate timeline
▸ weird cool stuff and machines
Keen? Fancy helping?
📮 arts@phrack.org
⏰ Deadline: August 15
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/917/034/536/278/421/original/af488f3633fddf4e.png

2026-04-26 06:12:55 UTC

Ever since @npub12ts…x422 mentioned the concept of agency to me, I’ve not stopped thinking about how much modern technology asks us to relinquish control of our data.
I’ve never used music streaming services. I always disliked the idea of not owning my music. For me, the original iPod was the epitome of agency: mine to do with what I wanted, when I wanted.
With the relentless march of frontier models consuming as much of our data as possible, we need more agency today, not less. Control over who has access to our data. Control over when they have it. Control over what they are allowed to do with it.
Silicon Valley has given us some truly amazing inventions, but it has also welcomed some ugly things into our lives. Systems where we have very little control, very little ownership, and very little say.
That needs to change. Really looking forward to @npub1dqd…8xy4 this year
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/469/526/535/253/065/original/b53e56c3bb68aa6c.png

2026-04-24 02:38:47 UTC

Day two of Black Hat and I got a chance to see my friend Ariel Herbert-Voss
do the keynote. It opened a floodgate of thoughts.
Oh and yay, GPT-5.5 is here and it feels like we’re entering another mad period of growth for frontier models and security research.
The big thing I’m seeing is that we need less scaffolding around these models. Give them code, context, a goal and some tools, and they are getting much better at cracking on.
That matters for bug hunting. A lot
But let’s not pretend the machines have solved vuln research. They haven’t.
The biggest gains are still at the shallow end.
Low severity bugs, obvious logic mistakes, unsafe patterns, missing checks, boring-but-real issues, that’s where models are starting to clean up. If the bug class is well documented and the code is clear, they move quickly.
The low-hanging fruit is getting hoovered up at pace. The easy stuff is becoming cheaper to find, well sorta cheaper.
We’re also seeing decent gains on modest bugs. Not deep chains. Not always novel research. But useful findings where the model can read, reason, trace, and join enough dots to help.
Where it still gets spicy is state.
Models can talk about state all day, but they don’t really feel it. They still struggle with temporal bugs, race conditions, lifecycle weirdness, multi-step flows, and those “only happens after you do these seven things in this exact order” bugs.
Spotting something dodgy is not the same as proving it is exploitable.
On the exploit side, validation, exploitability and reliability are improving, but more slowly. This is one of the big areas John and I have been working through with RAPTOR: getting away from “looks interesting, mate” towards “this is real, reachable, and repeatable”.
Because exploit reliability is still a graft. Targeting is still fragile. You still need iterations.
Oh and the human in the loop is still vital.
We all thought fuzzing would solve the bug problem. It didn’t. It changed the economics of bug discovery, but we still needed harnesses, triage, context, exploit dev, judgement, and all the boring engineering bits that make the work useful.
I think frontier models are having a similar moment.
The best results won’t come from throwing a giant model at a repo and hoping it finds magic. They’ll come from layered systems: frontier models for reasoning and code understanding, smaller focused models trained on private data, internal vuln history, remediation patterns, product context, validation loops, and humans who know when the model is chatting crap.
As models get better at writing code, they get better at breaking it. Capability doesn’t scale politely. It compounds.
Better tool use helps validation.
Better context helps reachability.
Better reasoning helps exploit chains.
But it still needs structure.
It still needs evidence.
It still needs humans who know what good looks like.
The shallow bugs are already getting compressed. The interesting bit is what comes next.
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/457/360/180/056/690/original/227b530237aefdb4.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/457/361/041/835/070/original/e50106636246d362.png

2026-04-23 23:31:31 UTC

“We are going to crave more authentic in-person experiences as our online interactions are seemingly less authentic”
@npub12ts…x422 utterly nailing it
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/456/625/571/414/308/original/396c9058bf19d748.png

2026-04-04 06:34:07 UTC

From the “no shit, didn’t see this coming” department:
District Judge Jeremy Daniel in Chicago said drivers in the proposed class action ⁠can try to prove that Allstate violated the Federal Wiretap Act by monitoring their travel locations, trip distances, speed, acceleration, braking, phone usage and attention to the road, and tried to monetize that data to boost profit.
Reminds me of the cool chat @npub12ts…x422 and I had years ago at Blackhat London about the oncoming privacy nightmares of modern cars
https://www.reuters.com/legal/government/allstate-must-face-privacy-lawsuit-over-cellphone-tracking-drivers-2026-03-04/#:~:text=Summary,when%20they%20rode%20as%20passengers.

2025-08-16 08:35:40 UTC

Aaaah yiss, 144mb of Infamy
A few weeks back, I started a bit of a passion project. I wanted to capture the faces of the '90s and early 2000s hacking scene using the tech of the time. We're talking a Sony Mavica camera and a vintage computer for editing.
The first photos are now ready for a look. You can see all the grain and glorious low-res details here: https://dcuthbert.exposure.co/144mb-of-infamy

2024-11-07 10:45:35 UTC

PR merged after 72 hours of mega work, if anyone fancies seeing/commenting, i'd love the insights
https://github.com/OWASP/ASVS/blob/master/5.0/en/0x14-V6-Cryptography.md

2024-11-02 07:13:49 UTC

Very interesting issue with Okta here, especially with the use of bcrypt
https://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username/
As Yan (@bcrypt) said
“reminder that the bcrypt hash function ignores input above a certain length! so if you do bcrypt(username || password) for some reason, a sufficiently long username will make it accept any password. to fix this you can sha256 the input first”

2024-11-01 08:43:24 UTC

It has taken a while but Mark Carney and I have just done a pull request to the OWASP ASVS 5.0 branch introducing major changes to V6 Cryptography
https://github.com/OWASP/ASVS/pull/2212
It builds upon the work we’ve done to hopefully make apps more secure from a cryptographic perspective & we are sure will see a lot of good discourse from all involved
We’d love to hear your thoughts and comments, as it’s a community-driven standard and always has been
https://github.com/OWASP/ASVS/pull/2212