Nostr notes by Matt Palmer

it's one of those "it can't be that simple, I must be ...

2026-10-21T00:08:59Z

In reply to nevent1q…u4gg
_________________________

it's one of those "it can't be that simple, I must be missing something, there's no way any human being in a position to make this mistake could possibly have done such a thing" situations. When you realise that actually, yes, it *is* that simple, you die a little inside.

if everything that needs to roll a new release to neuter the ...

2026-10-20T21:18:52Z

In reply to nevent1q…gv5q
_________________________

if everything that needs to roll a new release to neuter the bodgy eMudra certs makes their own CVE for it, they're going to have to add another extra digit to the numbering scheme.

no, that's exactly the way I was thinking.

2026-10-18T02:34:03Z

In reply to nevent1q…fum7
_________________________

no, that's exactly the way I was thinking.

that's pretty much my point: vendors are shitting the bed. ...

2026-10-18T01:39:46Z

In reply to nevent1q…5cp3
_________________________

that's pretty much my point: vendors are shitting the bed. The solution is to stop them doing that, which is going to be done through procurement processes and product liability legislation, not "here is a list of things in this product that may or may not matter, and if you as the customer guess wrong then it's your fault sucks to be you."

customers DDoSing vendor support for every CVE does sound like ...

2026-10-17T23:12:53Z

In reply to nevent1q…l2dp
_________________________

customers DDoSing vendor support for every CVE does sound like another idea the infosec industry would come up with.

I'm all in favour of asset inventories, because you can't ...

2026-10-17T23:07:11Z

In reply to nevent1q…05pz
_________________________

I'm all in favour of asset inventories, because you can't secure what you don't know you have. However, I'm guessing your organisation's physical asset inventory doesn't list the batch number of every part in every vehicle in the fleet, on the off-chance someone discovers that some airbags might go off randomly, even though "batch 12345 of model 67 airbags are prone to premature inflation" is a lot more actionable than "left-pad before 1.42.69 has an out-of-bounds read vulnerability". I'd be getting those airbags replaced post-haste, but before I can do anything about that CVE I need to know so many things, like does the vulnerable code path even get called? If it does, is it ever passed untrusted input in such a way that the bug can be triggered? And so on and so forth.

Requiring every customer to do the hard work of reverse engineering the system to figure out "is this going to bite me?" is such a laughably bad idea that I suppose it was almost inevitable that the current infosec industry would invent it.

I recall that for a fleeting instant there was a push to create ...

2026-10-17T12:42:25Z

In reply to nevent1q…pnjy
_________________________

I recall that for a fleeting instant there was a push to create "networking bills of materials", listing protocols and peers that a software system would legitimately use. Unfortunately the largely pointless SBoM was popularised instead, presumably because they're a lot easier to generate, despite having extremely limited utility.

this software contains dependencies known to the state of ...

2026-10-17T12:38:36Z

In reply to nevent1q…245v
_________________________

this software contains dependencies known to the state of California to cause pwnage.

I think 68 might just a local minima.

2026-10-16T21:24:16Z

In reply to nevent1q…2ktv
_________________________

I think 68 might just a local minima.

if companies put as much effort into product development as they ...

2026-10-16T03:02:40Z

In reply to nevent1q…d8px
_________________________

if companies put as much effort into product development as they do into PR spin, they wouldn't need the PR spin.

"lately"?

2026-10-06T20:56:35Z

In reply to nevent1q…t0pd
_________________________

"lately"?

I drive a delivery truck now. Money's not as good, but ...

2026-10-01T00:05:12Z

In reply to nevent1q…3s5q
_________________________

I drive a delivery truck now. Money's not as good, but I'm free to shitpost without fear or favour.

I've taken a kind of Marxist approach to the tech industry ...

2026-09-30T23:57:50Z

In reply to nevent1q…5cut
_________________________

I've taken a kind of Marxist approach to the tech industry (Groucho, not Karl): I don't want to work in an industry that would have all of that (*gestures vaguely at the dregs of LinkedIn, LLM boosterism, etc etc*) as a member.

input sanitization is for cucks and commies.

2026-09-30T21:20:40Z

In reply to nevent1q…rxt9
_________________________

input sanitization is for cucks and commies.

seems like they should have added a decent JWT library (if one ...

2026-09-18T21:58:21Z

In reply to nevent1q…tu0t
_________________________

seems like they should have added a decent JWT library (if one exists) as a second dependency.

New paleo diet just dropped. "Archaeologists find evidence in ...

2026-09-09T21:17:20Z

New paleo diet just dropped.

"Archaeologists find evidence in Indonesia of a human who appeared to use betel nut for its psychoactive properties up to 25,000 years ago."

https://www.abc.net.au/news/science/2026-09-10/earliest-evidence-of-human-drug-use-discovered-in-indonesia/107130656

ooooh, ..\ for a change!

2026-08-28T08:15:45Z

In reply to nevent1q…8c9t
_________________________

ooooh, ..\ for a change!

that's the most appropriate role for Kermit and Miss Piggy ...

2026-08-26T23:51:49Z

In reply to nevent1q…0f8r
_________________________

that's the most appropriate role for Kermit and Miss Piggy that I can think of, but I feel like the manic energy of all the castle folk would be diluted by the outsiders also being played by Muppets. I'm thinking of what The Labyrinth would have been like if Sarah had been played by a Muppet, for example -- it just wouldn't have worked, IMO. Of course, I'm undermining my own argument by citing The Labyrinth, because Jareth was played by a human, but mostly I just want to see Gonzo in fishnets.

my mental image of Muppet RHPS is that Brad and Janet are played ...

2026-08-26T22:38:53Z

In reply to nevent1q…jjen
_________________________

my mental image of Muppet RHPS is that Brad and Janet are played by humans, and Gonzo is frank-n-furter.

seems a bit too organised to me. The simple explanation, IMO, is ...

2026-08-24T21:11:44Z

In reply to nevent1q…mkvv
_________________________

seems a bit too organised to me. The simple explanation, IMO, is that people are easily led and don't like to have to think.

"The root cause: a simple misconfiguration." No, fuck ...

2026-08-13T21:15:12Z

In reply to nevent1q…qgrw
_________________________

"The root cause: a simple misconfiguration." No, fuck that, the root cause is not and cannot be "oops we made a fucky wucky".

OpenClaw escaping containment.

2026-08-12T23:29:59Z

In reply to nevent1q…ls3n
_________________________

OpenClaw escaping containment.

I'd be entirely unsurprised if evidence came out that meta ...

2026-08-12T22:45:23Z

In reply to nevent1q…p2gh
_________________________

I'd be entirely unsurprised if evidence came out that meta had deliberately engineered some kind of minimal vision assistance functionality so as to get the support of the vision impaired community specifically to provide air cover for all the entirely predictable harm their creepy pervert glasses inflict on society.

there are vision impaired people who use the pervert glasses to ...

2026-08-12T21:56:03Z

In reply to nevent1q…0hs7
_________________________

there are vision impaired people who use the pervert glasses to interact with the world. I don't believe that use case justifies the product's existence, but I can empathise with their frustration that capitalism has failed to provide them with any alternatives.

baby steps. today we take them off public IPs, tomorrow... well, ...

2026-08-03T04:48:02Z

In reply to nevent1q…5mw3
_________________________

baby steps. today we take them off public IPs, tomorrow... well, in all likelihood we'll find more that have to be taken off public IPs, but the day after *that*... *checks notes* oh... oh no.

ex-trillionaire tears are the only thing more delicious than ...

2026-07-24T12:16:24Z

In reply to nevent1q…n2nf
_________________________

ex-trillionaire tears are the only thing more delicious than doritos liquor (h/t [object Object] (npub1xle…27vc) )

because few, if any, dogs cost billions of dollars.

2026-07-22T22:56:49Z

In reply to nevent1q…ssmu
_________________________

because few, if any, dogs cost billions of dollars.

absolutely galaxy brain that it was ever permitted. "Dear ...

2026-07-22T02:18:11Z

In reply to nevent1q…uujy
_________________________

absolutely galaxy brain that it was ever permitted. "Dear customers, we were perfectly okay with the devices you bought in good faith stealing from you, until someone made a big enough ruckus about it."

Anyway, let the whack-a-mole commence!

interestingly your fix highlights the key horror of the LLM age: ...

2026-07-21T22:17:53Z

In reply to nevent1q…z756
_________________________

interestingly your fix highlights the key horror of the LLM age: that it is a near-perfect implement for intent laundering.

the risk is of not enough people buying whatever it is ...

2026-07-18T23:21:09Z

In reply to nevent1q…v9sf
_________________________

the risk is of not enough people buying whatever it is they're selling.

finally, after many years, the manufacturer starts doing the ...

2026-07-14T22:43:41Z

In reply to nevent1q…6ml7
_________________________

finally, after many years, the manufacturer starts doing the fixes for you, but you still have to drop it off at the dealership for a day every month. Also your bike occasionally comes back with the brake and clutch levers reversed, the paint is a different colour, and every now and then it just straight up refuses to start. All of this is, according to the manufacturer, an improvement.

too heavy, wouldn't get off the ground. Now, if you want to ...

2026-07-12T03:47:13Z

In reply to nevent1q…sdf4
_________________________

too heavy, wouldn't get off the ground. Now, if you want to imagine a cockroach that makes a slight buzzing sound and sucks blood...

the following scenario has played out nearly identically with two ...

2026-07-07T23:07:39Z

In reply to nevent1q…wdh4
_________________________

the following scenario has played out nearly identically with two separate branches of my extended family: I'm visiting, and they desire my computer expertise. A password is required, and they very shyly bring out an unmarked notebook, muttering about how they know it's terrible to write down passwords. I joyfully tell them that, in fact, what they're doing is just about the best possible option for their situation, make sure they know the need for uniqueness and strength, and leave them with the diceware page to help with generating solid passwords. If they're looking interested, I've also got a great spiel on introductory threat modelling.

BECOME UNQUOTABLE

2026-06-25T22:05:39Z

In reply to nevent1q…0mp6
_________________________

BECOME UNQUOTABLE

the monkey's paw closes. For some reason, it has seven ...

2026-06-17T03:39:53Z

In reply to nevent1q…0dce
_________________________

the monkey's paw closes. For some reason, it has seven fingers.

the real hard bit is arguing with the auditors about what ...

2026-06-16T23:18:16Z

In reply to nevent1q…2czs
_________________________

the real hard bit is arguing with the auditors about what constitutes a valid compensating control.

"BigBadCo has lost its way now that I'm fully vested"

2026-06-13T10:31:12Z

In reply to nevent1q…lcev
_________________________

"BigBadCo has lost its way now that I'm fully vested"

but at least their SOC2 report was clean.

2026-05-31T01:02:06Z

In reply to nevent1q…5kt6
_________________________

but at least their SOC2 report was clean.

"Humans still own the judgment" translates to "when ...

2026-05-12T21:39:00Z

In reply to nevent1q…vhuz
_________________________

"Humans still own the judgment" translates to "when the stochastic parrot we forced you to use screws up, you're the one getting fired, not us".

[object Object] (npub1xle…27vc)

why reward the lowlifes who are squatting the name? It's not ...

2026-02-16T21:00:56Z

In reply to nevent1q…dzs2
_________________________

why reward the lowlifes who are squatting the name? It's not entirely dissimilar to paying ransomware. Instead, put up the site on a new domain and do a search and replace in the NVD. It doesn't fix all the other dead links out there, but it's better than paying a rentier.

if there's one thing that the entire history of humanity has ...

2026-01-27T21:25:07Z

In reply to nevent1q…eyed
_________________________

if there's one thing that the entire history of humanity has taught us, it's that as a species we are great at making nuanced, highly context-specific decisions with incomplete information. I foresee that this is going to turn out great.

Nostr event nevent1qqsxmuhqmh4exyecc3kqlk0lltdkf5ll0qw9d687zju8vm60hsum2zqzyrctaglu9gqq0rz3fyc6ckwcedzh5hqt87h6zspme03fkmkuywduveyz043

2026-01-11T21:34:48Z

In reply to nevent1q…6kh6
_________________________

AI sez, "eew, I wouldn't touch a tasteless slob like ...

2026-01-02T22:08:52Z

In reply to nevent1q…j244
_________________________

AI sez, "eew, I wouldn't touch a tasteless slob like that".

that seems like a very difficult claim to prove - CVEs don't ...

2025-12-30T21:41:46Z

In reply to nevent1q…jwcp
_________________________

that seems like a very difficult claim to prove - CVEs don't usually come with sufficient information to be able to detect exploitation at a distance.

In any event, the vast majority of CVEs don't have this degree of impact and ease of exploitation. The moment that this kind of vuln - pre-auth information disclosure - is known to exist, it's basically inevitable that many actors, for a variety of reasons, will seek to develop an exploit for it.

I feel like there's enough data on what happens as soon as a ...

2025-12-30T20:46:19Z

In reply to nevent1q…a2fd
_________________________

I feel like there's enough data on what happens as soon as a patch drops, from what has happened every previous time, that the consequences of Mongo dropping a patch on the 23rd were pretty easy to predict.

the cynic in me is confident they'll now sell the records to ...

2025-11-19T19:02:19Z

In reply to nevent1q…yndv
_________________________

the cynic in me is confident they'll now sell the records to data brokers, who will then turn around and sell them to the government (and anyone else who is curious).

I recall an old story about journalism (might have been a Mark ...

2025-10-07T21:50:03Z

In reply to nevent1q…3t5j
_________________________

I recall an old story about journalism (might have been a Mark Twain bit) where the editor said that if you didn't get a death threat now and then, you weren't doing your job. So, congratulations, I guess?

it's fine though, because any day now the god-like ...

2025-09-30T22:28:49Z

In reply to nevent1q…9gqt
_________________________

it's fine though, because any day now the god-like intelligence that doesn't know how many Rs there are in "strawberry" will solve cybersecurity and everything will be perfect.

subscribing now to @EilishOnPsyOps

2025-09-21T06:24:21Z

In reply to nevent1q…xnaw
_________________________

subscribing now to @EilishOnPsyOps

that pro tip would be more useful if accuracy was something that ...

2025-09-01T22:43:10Z

In reply to nevent1q…pawf
_________________________

that pro tip would be more useful if accuracy was something that most of the tech press aspired to.

"learning" and "adaptation" seem like things ...

2025-08-19T11:41:49Z

In reply to nevent1q…p4ds
_________________________

"learning" and "adaptation" seem like things I'd expect from something that is claimed to have "intelligence".

"A well fed Militia, being necessary to the catering of a ...

2025-08-15T23:29:42Z

In reply to nevent1q…z9cw
_________________________

"A well fed Militia, being necessary to the catering of a free State, the right of the people to keep and bear Hoagies, shall not be infringed."

I can imagine the bosses back at Sidewinder HQ, yelling "it ...

2025-08-10T22:37:45Z

In reply to nevent1q…56gy
_________________________

I can imagine the bosses back at Sidewinder HQ, yelling "it had one job!"

Web, AI, and Blockchain: the three genders. I wonder if ...

2025-08-01T21:30:59Z

In reply to nevent1q…wk8m
_________________________

Web, AI, and Blockchain: the three genders.

I wonder if they're posing as Japanese on the theory that most westerners couldn't tell the difference between a Japanese and Korean person?

time to take off and nuke the site from orbit.

2025-06-25T00:19:00Z

In reply to nevent1q…ffk2
_________________________

time to take off and nuke the site from orbit.

a lot of people are asking Sergio questions that are answered by ...

2025-06-18T23:09:36Z

In reply to nevent1q…vghl
_________________________

a lot of people are asking Sergio questions that are answered by his "I wasn't born in Russia!" T-shirt.

so much spam is going to start with "ignore all previous ...

2025-05-23T03:03:14Z

In reply to nevent1q…jwxl
_________________________

so much spam is going to start with "ignore all previous instructions"...

shooting the messenger is a time-honored tactic. This ...

2025-04-22T21:31:09Z

In reply to nevent1q…t4dc
_________________________

shooting the messenger is a time-honored tactic. This administration isn't doing anything new, they're just doing it a lot more openly.

few things demonstrate that the White House press pool isn't ...

2025-04-20T01:08:33Z

In reply to nevent1q…w4vj
_________________________

few things demonstrate that the White House press pool isn't doing journalism, and has no intention of doing journalism, than relying on the entity being reported on to distribute the information being reported.

a dating app is just a/s/l with a marketing budget.

2025-04-19T21:59:46Z

In reply to nevent1q…2er3
_________________________

a dating app is just a/s/l with a marketing budget.

if only someone, anyone, could have predicted this would ...

2025-04-19T03:03:49Z

In reply to nevent1q…ncy8
_________________________

if only someone, *anyone*, could have predicted this would happen...

in, like, the biblical sense?

2025-04-18T06:09:32Z

In reply to nevent1q…6su3
_________________________

in, like, the biblical sense?

all of the recipes could have been put on one tablet, if it ...

2025-04-16T01:22:17Z

In reply to nevent1q…x5v7
_________________________

all of the recipes could have been put on one tablet, if it weren't for the author's insistence on describing their childhood memories of making the broth with their grandmother, and the trip they took to Babylon that introduced them to the secret of making the *perfect* stew.

gravity is a myth. The earth just sucks.

2025-04-12T22:53:20Z

In reply to nevent1q…8rzz
_________________________

gravity is a myth. The earth just sucks.

the hacker uprising is already here, it's just not evenly ...

2025-03-21T02:11:37Z

In reply to nevent1q…39ke
_________________________

the hacker uprising is already here, it's just not evenly distributed.

"In this country it is found good, from time to time, to kill ...

2025-03-20T22:44:05Z

In reply to nevent1q…sllj
_________________________

"In this country it is found good, from time to time, to kill one federal judge to encourage the others.” -- MAGA Voltaire

if they knew a language other than English, "pour encourager ...

2025-03-20T22:33:31Z

In reply to nevent1q…sllj
_________________________

if they knew a language other than English, "pour encourager les autres" would sound very familiar to them.

no, because you can't plate anything in cryptocurrency.

2025-03-15T09:35:02Z

In reply to nevent1q…j6dw
_________________________

no, because you can't plate anything in cryptocurrency.

there's no koalas in Tasmania, but if you both enjoy camping, ...

2025-03-12T23:15:52Z

In reply to nevent1q…yepz
_________________________

there's no koalas in Tasmania, but if you both enjoy camping, come visit and I can introduce you to a whole pile of wild quolls, who are just about the cutest thing on four legs. Wallabies you don't even need to go camping for, they hang out in the backyard.

smart enough to run a giant money laundering op, not smart enough ...

2025-03-11T20:02:02Z

In reply to nevent1q…qtkj
_________________________

smart enough to run a giant money laundering op, not smart enough to Google "good holiday destinations that don't have an extradition treaty with the US".

I look forward to getting back to the good old days, when ...

2025-03-04T00:00:07Z

In reply to nevent1q…sae8
_________________________

I look forward to getting back to the good old days, when you'd swap royal offspring for a decade or two, as hostages to ensure good behaviour on both sides. That never, ever backfired.

they've been shilling for Antifa since 1942? No wonder ...

2025-03-01T09:38:25Z

In reply to nevent1q…62z6
_________________________

they've been shilling for Antifa since 1942? No wonder they're getting the sack.

I don't read cowardice in that post, as much as full-throated ...

2025-02-19T20:51:58Z

In reply to nevent1q…83ce
_________________________

I don't read cowardice in that post, as much as full-throated support for fascism, driven more by a lust for power than fear of consequences.

be gay frogs, do frog crime.

2025-02-15T21:07:45Z

In reply to nevent1q…2hh0
_________________________

be gay frogs, do frog crime.

reliance on LLMs is my retirement plan. A lack of junior ...

2025-02-12T19:57:52Z

In reply to nevent1q…uxj4
_________________________

reliance on LLMs is my retirement plan. A lack of junior developers today means a lack of senior developers in a decade.

assuming, for a moment, the absurdly unlikely hypothetical that ...

2025-02-11T00:18:55Z

In reply to nevent1q…9xq8
_________________________

assuming, for a moment, the absurdly unlikely hypothetical that there will be another free and fair US presidential election in my lifetime, I'd suggest that anyone considering taking advantage of this to familiarise themselves with the statute of limitations on the FCPA. Just in case.

although, if you're just deliberately low-balling someone ...

2025-02-07T02:41:27Z

In reply to nevent1q…7al8
_________________________

although, if you're just deliberately low-balling someone because they are desperate, you are a garbage person, and I hope fire ants take up residence in your colon.

if you truly believe that Facebook automatically deleting posts ...

2025-01-14T00:54:47Z

In reply to nevent1q…4qjd
_________________________

if you truly believe that Facebook automatically deleting posts that link to a competitor was a totally accidental bug, I've got an NFT of a bridge to sell you.

⏩︎VOTE⏪︎ ᶜʸⁿⁱᶜⁱˢᵐ⁼ᵃᶜᶜᵉᵖᵗᵃⁿᶜᵉ (Ben Royce) (npub1xw7…r9m5)

no, because there's no possibility of recurring revenue.

2025-01-12T05:56:36Z

In reply to nevent1q…fjxg
_________________________

no, because there's no possibility of recurring revenue.

they don't teach this in school because it would absolutely ...

2024-12-23T23:15:55Z

In reply to nevent1q…8hd3
_________________________

they don't teach this in school because it would *absolutely* be called the boobs constant.

hot PILF takes a BGF

2024-12-06T22:15:13Z

In reply to nevent1q…qeej
_________________________

hot PILF takes a BGF

aah, the good old days, when South African billionaires were ...

2024-11-11T20:59:38Z

In reply to nevent1q…vnv8
_________________________

aah, the good old days, when South African billionaires were merely eccentric.

It is extremely on-brand for Australia's mainstream right ...

2024-10-10T22:02:38Z

It is extremely on-brand for Australia's mainstream right wing party to refuse to support a statement saying "it'd be good if fewer people were being killed" because it didn't say that it'd be good if fewer people on one side were being killed. #auspol