Matt Palmer

Recovering sysadmin, technology lover, crypto(graphy!) nerd, he/him.

Buy me a refreshing beverage!: https://ko-fi.com/tobermorytech

Public Key

npub17zl28lp2qqrcc52fxxk9nkxtg4a9czel47s5qw7tu2dkahprn0rqd8yhxe

NIP-05 Address

womble_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs0p04rls4qqpuv29ynrtzemr9527jupvl6lg2q80979xmwms3eh3spz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds6hpwpw

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub17zl28lp2qqrcc52fxxk9nkxtg4a9czel47s5qw7tu2dkahprn0rqd8yhxe

Show more details

Last Notes

2026-10-21 00:08:59 UTC

- reply

it's one of those "it can't be that simple, I must be missing something, there's no way any human being in a position to make this mistake could possibly have done such a thing" situations. When you realise that actually, yes, it *is* that simple, you die a little inside.

2026-10-20 21:18:52 UTC

- reply

if everything that needs to roll a new release to neuter the bodgy eMudra certs makes their own CVE for it, they're going to have to add another extra digit to the numbering scheme.

2026-10-18 02:34:03 UTC

- reply

no, that's exactly the way I was thinking.

2026-10-18 01:39:46 UTC

- reply

that's pretty much my point: vendors are shitting the bed. The solution is to stop them doing that, which is going to be done through procurement processes and product liability legislation, not "here is a list of things in this product that may or may not matter, and if you as the customer guess wrong then it's your fault sucks to be you."

2026-10-17 23:12:53 UTC

- reply

customers DDoSing vendor support for every CVE does sound like another idea the infosec industry would come up with.

2026-10-17 23:07:11 UTC

- reply

I'm all in favour of asset inventories, because you can't secure what you don't know you have. However, I'm guessing your organisation's physical asset inventory doesn't list the batch number of every part in every vehicle in the fleet, on the off-chance someone discovers that some airbags might go off randomly, even though "batch 12345 of model 67 airbags are prone to premature inflation" is a lot more actionable than "left-pad before 1.42.69 has an out-of-bounds read vulnerability". I'd be getting those airbags replaced post-haste, but before I can do anything about that CVE I need to know so many things, like does the vulnerable code path even get called? If it does, is it ever passed untrusted input in such a way that the bug can be triggered? And so on and so forth.
Requiring every customer to do the hard work of reverse engineering the system to figure out "is this going to bite me?" is such a laughably bad idea that I suppose it was almost inevitable that the current infosec industry would invent it.

2026-10-17 12:42:25 UTC

- reply

I recall that for a fleeting instant there was a push to create "networking bills of materials", listing protocols and peers that a software system would legitimately use. Unfortunately the largely pointless SBoM was popularised instead, presumably because they're a lot easier to generate, despite having extremely limited utility.

2026-10-17 12:38:36 UTC

- reply

this software contains dependencies known to the state of California to cause pwnage.

2026-10-16 21:24:16 UTC

- reply

I think 68 might just a local minima.

2026-10-16 03:02:40 UTC

- reply

if companies put as much effort into product development as they do into PR spin, they wouldn't need the PR spin.

2026-10-06 20:56:35 UTC

- reply

"lately"?

2026-10-01 00:05:12 UTC

- reply

I drive a delivery truck now. Money's not as good, but I'm free to shitpost without fear or favour.

2026-09-30 23:57:50 UTC

- reply

I've taken a kind of Marxist approach to the tech industry (Groucho, not Karl): I don't want to work in an industry that would have all of that (*gestures vaguely at the dregs of LinkedIn, LLM boosterism, etc etc*) as a member.

2026-09-30 21:20:40 UTC

- reply

input sanitization is for cucks and commies.

2026-09-18 21:58:21 UTC

- reply

seems like they should have added a decent JWT library (if one exists) as a second dependency.

2026-09-09 21:17:20 UTC

New paleo diet just dropped.
"Archaeologists find evidence in Indonesia of a human who appeared to use betel nut for its psychoactive properties up to 25,000 years ago."
https://www.abc.net.au/news/science/2026-09-10/earliest-evidence-of-human-drug-use-discovered-in-indonesia/107130656

2026-08-28 08:15:45 UTC

- reply

ooooh, ..\ for a change!

2026-08-26 23:51:49 UTC

- reply

that's the most appropriate role for Kermit and Miss Piggy that I can think of, but I feel like the manic energy of all the castle folk would be diluted by the outsiders also being played by Muppets. I'm thinking of what The Labyrinth would have been like if Sarah had been played by a Muppet, for example -- it just wouldn't have worked, IMO. Of course, I'm undermining my own argument by citing The Labyrinth, because Jareth was played by a human, but mostly I just want to see Gonzo in fishnets.

2026-08-26 22:38:53 UTC

- reply

my mental image of Muppet RHPS is that Brad and Janet are played by humans, and Gonzo is frank-n-furter.

2026-08-24 21:11:44 UTC

- reply

seems a bit too organised to me. The simple explanation, IMO, is that people are easily led and don't like to have to think.

2026-08-13 21:15:12 UTC

- reply

"The root cause: a simple misconfiguration." No, fuck that, the root cause is not and cannot be "oops we made a fucky wucky".

2026-08-12 23:29:59 UTC

- reply

OpenClaw escaping containment.

2026-08-12 22:45:23 UTC

- reply

I'd be entirely unsurprised if evidence came out that meta had deliberately engineered some kind of minimal vision assistance functionality so as to get the support of the vision impaired community specifically to provide air cover for all the entirely predictable harm their creepy pervert glasses inflict on society.

2026-08-12 21:56:03 UTC

- reply

there are vision impaired people who use the pervert glasses to interact with the world. I don't believe that use case justifies the product's existence, but I can empathise with their frustration that capitalism has failed to provide them with any alternatives.

2026-08-03 04:48:02 UTC

- reply

baby steps. today we take them off public IPs, tomorrow... well, in all likelihood we'll find more that have to be taken off public IPs, but the day after *that*... *checks notes* oh... oh no.

2026-07-24 12:16:24 UTC

- reply

ex-trillionaire tears are the only thing more delicious than doritos liquor (h/t @npub1xle…27vc )

2026-07-22 22:56:49 UTC

- reply

because few, if any, dogs cost billions of dollars.

2026-07-22 02:18:11 UTC

- reply

absolutely galaxy brain that it was ever permitted. "Dear customers, we were perfectly okay with the devices you bought in good faith stealing from you, until someone made a big enough ruckus about it."
Anyway, let the whack-a-mole commence!

2026-07-21 22:17:53 UTC

- reply

interestingly your fix highlights the key horror of the LLM age: that it is a near-perfect implement for intent laundering.

2026-07-18 23:21:09 UTC

- reply

the risk is of not enough people buying whatever it is they're selling.

2026-07-14 22:43:41 UTC

- reply

finally, after many years, the manufacturer starts doing the fixes for you, but you still have to drop it off at the dealership for a day every month. Also your bike occasionally comes back with the brake and clutch levers reversed, the paint is a different colour, and every now and then it just straight up refuses to start. All of this is, according to the manufacturer, an improvement.

2026-07-12 03:47:13 UTC

- reply

too heavy, wouldn't get off the ground. Now, if you want to imagine a cockroach that makes a slight buzzing sound and sucks blood...

2026-07-07 23:07:39 UTC

- reply

the following scenario has played out nearly identically with two separate branches of my extended family: I'm visiting, and they desire my computer expertise. A password is required, and they very shyly bring out an unmarked notebook, muttering about how they know it's terrible to write down passwords. I joyfully tell them that, in fact, what they're doing is just about the best possible option for their situation, make sure they know the need for uniqueness and strength, and leave them with the diceware page to help with generating solid passwords. If they're looking interested, I've also got a great spiel on introductory threat modelling.

2026-06-25 22:05:39 UTC

- reply

BECOME UNQUOTABLE

2026-06-17 03:39:53 UTC

- reply

the monkey's paw closes. For some reason, it has seven fingers.

2026-06-16 23:18:16 UTC

- reply

the real hard bit is arguing with the auditors about what constitutes a valid compensating control.

2026-06-13 10:31:12 UTC

- reply

"BigBadCo has lost its way now that I'm fully vested"

2026-05-31 01:02:06 UTC

- reply

but at least their SOC2 report was clean.

2026-05-12 21:39:00 UTC

- reply

"Humans still own the judgment" translates to "when the stochastic parrot we forced you to use screws up, you're the one getting fired, not us".
@npub1xle…27vc

2026-02-16 21:00:56 UTC

- reply

why reward the lowlifes who are squatting the name? It's not entirely dissimilar to paying ransomware. Instead, put up the site on a new domain and do a search and replace in the NVD. It doesn't fix all the other dead links out there, but it's better than paying a rentier.

2026-01-27 21:25:07 UTC

- reply

if there's one thing that the entire history of humanity has taught us, it's that as a species we are great at making nuanced, highly context-specific decisions with incomplete information. I foresee that this is going to turn out great.

2026-01-11 21:34:48 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/878/611/394/406/974/original/252f28fc3e11bbbd.jpg

2026-01-02 22:08:52 UTC

- reply

AI sez, "eew, I wouldn't touch a tasteless slob like that".

2025-12-30 21:41:46 UTC

- reply

that seems like a very difficult claim to prove - CVEs don't usually come with sufficient information to be able to detect exploitation at a distance.
In any event, the vast majority of CVEs don't have this degree of impact and ease of exploitation. The moment that this kind of vuln - pre-auth information disclosure - is known to exist, it's basically inevitable that many actors, for a variety of reasons, will seek to develop an exploit for it.

2025-12-30 20:46:19 UTC

- reply

I feel like there's enough data on what happens as soon as a patch drops, from what has happened every previous time, that the consequences of Mongo dropping a patch on the 23rd were pretty easy to predict.

2025-11-19 19:02:19 UTC

- reply

the cynic in me is confident they'll now sell the records to data brokers, who will then turn around and sell them to the government (and anyone else who is curious).

2025-10-07 21:50:03 UTC

- reply

I recall an old story about journalism (might have been a Mark Twain bit) where the editor said that if you didn't get a death threat now and then, you weren't doing your job. So, congratulations, I guess?

2025-09-30 22:28:49 UTC

- reply

it's fine though, because any day now the god-like intelligence that doesn't know how many Rs there are in "strawberry" will solve cybersecurity and everything will be perfect.

2025-09-21 06:24:21 UTC

- reply

subscribing now to @EilishOnPsyOps

2025-09-01 22:43:10 UTC

- reply

that pro tip would be more useful if accuracy was something that most of the tech press aspired to.

2025-08-19 11:41:49 UTC

- reply

"learning" and "adaptation" seem like things I'd expect from something that is claimed to have "intelligence".

2025-08-15 23:29:42 UTC

- reply

"A well fed Militia, being necessary to the catering of a free State, the right of the people to keep and bear Hoagies, shall not be infringed."

2025-08-10 22:37:45 UTC

- reply

I can imagine the bosses back at Sidewinder HQ, yelling "it had one job!"

2025-08-01 21:30:59 UTC

- reply

Web, AI, and Blockchain: the three genders.
I wonder if they're posing as Japanese on the theory that most westerners couldn't tell the difference between a Japanese and Korean person?

2025-06-25 00:19:00 UTC

- reply

time to take off and nuke the site from orbit.

2025-06-18 23:09:36 UTC

- reply

a lot of people are asking Sergio questions that are answered by his "I wasn't born in Russia!" T-shirt.

2025-05-23 03:03:14 UTC

- reply

so much spam is going to start with "ignore all previous instructions"...

2025-04-22 21:31:09 UTC

- reply

shooting the messenger is a time-honored tactic. This administration isn't doing anything new, they're just doing it a lot more openly.

2025-04-20 01:08:33 UTC

- reply

few things demonstrate that the White House press pool isn't doing journalism, and has no intention of doing journalism, than relying on the entity being reported on to distribute the information being reported.

2025-04-19 21:59:46 UTC

- reply

a dating app is just a/s/l with a marketing budget.

2025-04-19 03:03:49 UTC

- reply

if only someone, *anyone*, could have predicted this would happen...

2025-04-18 06:09:32 UTC

- reply

in, like, the biblical sense?

2025-04-16 01:22:17 UTC

- reply

all of the recipes could have been put on one tablet, if it weren't for the author's insistence on describing their childhood memories of making the broth with their grandmother, and the trip they took to Babylon that introduced them to the secret of making the *perfect* stew.

2025-04-12 22:53:20 UTC

- reply

gravity is a myth. The earth just sucks.

2025-03-21 02:11:37 UTC

- reply

the hacker uprising is already here, it's just not evenly distributed.

2025-03-20 22:44:05 UTC

- reply

"In this country it is found good, from time to time, to kill one federal judge to encourage the others.” -- MAGA Voltaire

2025-03-20 22:33:31 UTC

- reply

if they knew a language other than English, "pour encourager les autres" would sound very familiar to them.

2025-03-15 09:35:02 UTC

- reply

no, because you can't plate anything in cryptocurrency.

2025-03-12 23:15:52 UTC

- reply

there's no koalas in Tasmania, but if you both enjoy camping, come visit and I can introduce you to a whole pile of wild quolls, who are just about the cutest thing on four legs. Wallabies you don't even need to go camping for, they hang out in the backyard.

2025-03-11 20:02:02 UTC

- reply

smart enough to run a giant money laundering op, not smart enough to Google "good holiday destinations that don't have an extradition treaty with the US".

2025-03-04 00:00:07 UTC

- reply

I look forward to getting back to the good old days, when you'd swap royal offspring for a decade or two, as hostages to ensure good behaviour on both sides. That never, ever backfired.

2025-03-01 09:38:25 UTC

- reply

they've been shilling for Antifa since 1942? No wonder they're getting the sack.

2025-02-19 20:51:58 UTC

- reply

I don't read cowardice in that post, as much as full-throated support for fascism, driven more by a lust for power than fear of consequences.

2025-02-15 21:07:45 UTC

- reply

be gay frogs, do frog crime.

2025-02-12 19:57:52 UTC

- reply

reliance on LLMs is my retirement plan. A lack of junior developers today means a lack of senior developers in a decade.

2025-02-11 00:18:55 UTC

- reply

assuming, for a moment, the absurdly unlikely hypothetical that there will be another free and fair US presidential election in my lifetime, I'd suggest that anyone considering taking advantage of this to familiarise themselves with the statute of limitations on the FCPA. Just in case.

2025-02-07 02:41:27 UTC

- reply

although, if you're just deliberately low-balling someone because they are desperate, you are a garbage person, and I hope fire ants take up residence in your colon.

2025-01-14 00:54:47 UTC

- reply

if you truly believe that Facebook automatically deleting posts that link to a competitor was a totally accidental bug, I've got an NFT of a bridge to sell you.
@npub1xw7…r9m5

2025-01-12 05:56:36 UTC

- reply

no, because there's no possibility of recurring revenue.

2024-12-23 23:15:55 UTC

- reply

they don't teach this in school because it would *absolutely* be called the boobs constant.

2024-12-06 22:15:13 UTC

- reply

hot PILF takes a BGF

2024-11-11 20:59:38 UTC

- reply

aah, the good old days, when South African billionaires were merely eccentric.

2024-10-10 22:02:38 UTC

It is extremely on-brand for Australia's mainstream right wing party to refuse to support a statement saying "it'd be good if fewer people were being killed" because it didn't say that it'd be good if fewer people on one side were being killed. #auspol