2026-10-22T10:12:28Z https://nostr.now tehfishman https://nostr.now/npub1aazcuajcqlv9xa86t54fv8alfc9650ckp2rcw0ajgaj3t0lakpdshfu4rt https://files.ioc.exchange/iocexchange/accounts/avatars/109/309/947/440/854/499/original/8927931113dede2d.jpg https://files.ioc.exchange/iocexchange/accounts/avatars/109/309/947/440/854/499/original/8927931113dede2d.jpg https://nostr.now/nevent1qqsxa5434dtwz4z3d2lu0gzxdrym22w92us29rwd56cd0dafr7zavygzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kfedvjw In reply to <a href='/nevent1qqs8s8p9n0u9qy4h5un6zsjrkgdftadl7enw3r3dt63qha6czuq3sjc2nx7vj'>nevent1q…x7vj</a><br/>_________________________<br/><br/>through no fault of your own, I might add. 2026-09-30T23:19:05Z https://nostr.now/nevent1qqsz0glrn2qkxfq95yd66w55xs55sh58ttzyg6fwwdrhgntwzdczzngzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kzjtfjq In reply to <a href='/nevent1qqs2zvm357mh5agkryc2tvvaj33l9rh2mva7e7w07sqd90gjd04zahg459vrr'>nevent1q…9vrr</a><br/>_________________________<br/><br/>_very_ hypothetically: it could be a supply chain attack. The systems could already be compromised, and there&#39;s a script waiting in a cron job to execute. That would explain the time window, and why they&#39;re saying there&#39;s no &#34;vulnerability&#34; 2026-09-25T18:19:00Z https://nostr.now/nevent1qqspevglaxfv6axjm6jpdqrxsl9r5ltm06zcv64m7778vxym4ew2dqqzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9k5alj0v In reply to <a href='/nevent1qqsqczygpkr5qgp8nlgydq8s7w7pjyudqdndpuc6u9948ml0vnduc0gz5ekju'>nevent1q…ekju</a><br/>_________________________<br/><br/>did you catte too hard? Is there such a thing? 2026-08-12T01:52:14Z https://nostr.now/nevent1qqsdmgf38j60fv6dyxvjegym3qfslr2cymsc5x39s275cke4sdz373gzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kya2pp2 In reply to <a href='/nevent1qqsdc95ed2yvcww6cpcw3kqy09d2syyfplgh33f3ruuqdvge807yz3gf3ywd7'>nevent1q…ywd7</a><br/>_________________________<br/><br/>This whole process was born out of their own failures too. Customers regularly tripping over land-mines when patching turned into customers demanding assistance with identifying which release they should install without blowing up production. I&#39;m not sure if Palo still does this, but prior to the preferred release process they would tell customers to pay for Professional Services to figure out which release to upgrade to. Because fuck you for wanting your already expensive product to actually work, I guess? <br/>So technically this is better than it was. But only because the bar was in hell and everyone was tripping over it. 2026-07-09T15:12:20Z https://nostr.now/nevent1qqsvvmzse8rzd6ug4c76kk9tgfx4waacapzjuh9cy47f44s79g2nv3czyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9klgfjyx In reply to <a href='/nevent1qqsquavksj9r2q9j6v79vqg35t9qe4xv09q8ffnn5wmlw592w4tyn7s6xw58j'>nevent1q…w58j</a><br/>_________________________<br/><br/>I can&#39;t speak for watchTowr but there are fun side-effects of this process as a customer. If you patch because of vulns (most people), and you call up support with an issue and you&#39;re ahead of the preferred release, sometimes they give you lip about not using the preferred release. Which is extra crazy when considering that customers effectively have to test the releases in production before support declares them &#34;preferred&#34;.<br/>Also they have rolled back preferred release versions a few times. Which would imply that even with this approach of letting less risk-averse customers test in production for them, they still miss major bugs that cause huge negative impact to customers when they tell everyone to move up to a release. 2026-07-09T14:59:08Z https://nostr.now/nevent1qqstl3eru9k7tssehs7zer36suvsz3wemyyc5p44q52s4k6gjw05kjqzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9k95hg0w In reply to <a href='/nevent1qqs9cx7lfs08dsprk3ewfg7nuc8ld98q8mhgmdrqx8vuyxgfq6hp8psnyc46y'>nevent1q…c46y</a><br/>_________________________<br/><br/>yeah but it&#39;s literally just &#34;preferred&#34; and &#34;everything else&#34;. Palo has been doing that for a few years now for PAN-OS. It&#39;s not anything to do with a formal alpha/beta/prod cycle though, or even anything to do with vulns present in a release. The way a Palo person explained it to me is that their support side basically says &#34;we&#39;ve seen enough people using this and our support teams are familiar with troubleshooting its bugs now that we&#39;d like most of our customers to use it to make our lives easier&#34; 2026-07-09T14:29:14Z https://nostr.now/nevent1qqste7d8jxrxnhwfpernuhjkanw2fmmyff72efkugm5zrsfqcarev2qzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9km04ydy In reply to <a href='/nevent1qqs95ckcwltwvw3566fsjv6wmhzx46sk23l4zvuq94gqp70sa9zna3g062gp4'>nevent1q…2gp4</a><br/>_________________________<br/><br/>I think Palo is also huffing their own farts with regards to their skewed vulnerability scoring. The &#34;preferred&#34; release is still 11.2.10-h3, which was released in February like 3 high-severity (by their own metric) vulnerability announcements ago. 2026-07-09T14:14:40Z https://nostr.now/nevent1qqswal9yegp03zjxjq724asc8j5hxx3t8jzdnsuvksl4q2xvt7whzxczyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9k5v0nvj In reply to <a href='/nevent1qqsdyv60nmaf0fjd8rvslqqpvy69lymhc37acmue0z6hqzyszd5sw9s8n2h0x'>nevent1q…2h0x</a><br/>_________________________<br/><br/>I&#39;m not excoriating Andrew personally. I do hope my message doesn&#39;t come across as a personal attack, because it&#39;s not meant as one. As I said, an individuals contributions and feelings are totally valid.<br/><br/>But I&#39;ve seen each of the four examples you provided play out multiple times. So when I see someone inside the Infosec industry making bold claims about saving the world and that the Infosec Industry should be treated as critical infrastructure, my reaction is not immediately positive. This is an Infosec industry problem created by the Infosec industry. 2026-06-18T15:47:38Z https://nostr.now/nevent1qqspeutln3jd0e7w87fsteegtt2nscryuk9vl2jp4gt0plcmcu42szczyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kqxdjpa In reply to <a href='/nevent1qqsdvtwrzlkevt2p90ggr00mt8tnlemap5tlwgqghl65pv4dr26nn2qc6u7wf'>nevent1q…u7wf</a><br/>_________________________<br/><br/>Adding on: an individual security researcher as an employee at a security company can easily have the feeling and view that their contributions are &#34;saving the world&#34;. That feeling is valid. But eventually, the profit motive of the company will get in the way of that goal.<br/>This isn&#39;t a new story, and it isn&#39;t unique to Infosec. But most industries don&#39;t try to found themselves on trust, and the infosec industry keeps taking a hammer to that foundation. An #ISAC won&#39;t fix that core issue, because y&#39;all will be at each other&#39;s throats when a potential customer wants an actionable IoC feed.<br/> <img src="https://files.ioc.exchange/iocexchange/media_attachments/files/116/771/653/978/128/418/original/a36b115e46226978.png"> <br/> 2026-06-18T14:50:39Z https://nostr.now/nevent1qqsx5zw5us8ldp4ayuc5508ey3x3usaafcuevmeetqswqjwhn4masnqzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9k7hwe0p In reply to <a href='/nevent1qqstf6zy46nw4s2wmwykw6grlj5c5famj2ru25wzwstuekjxweppt9qsddd47'>nevent1q…dd47</a><br/>_________________________<br/><br/>I&#39;m going to start a business for people to help solve this solution across the industry. The business model will be for frustrated clients to send their IoC lists to me when crappy vendors do not have reasonably easy ways to consume them. I will then print out the lists on paper, tie them to a brick, and hurl them through a window at the vendor main offices. Round 1 seed funding will finance legal defense funds and the commissioning of a trebuchet mounted on a flatbed truck. 2026-06-11T14:43:07Z https://nostr.now/nevent1qqszsqc8wewnqpvdpahtaxqywpedyqrwqtdl28r8gxwytspna80jncgzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kyv5spf In reply to <a href='/nevent1qqs0d9q2dlwhqatsevug8casfmjn8y7q98p3sezkscxz8jx7nv0f7qglwtkjt'>nevent1q…tkjt</a><br/>_________________________<br/><br/>I&#39;ve had that conversation with them about it and their response was basically &#34;why would you want to do that yourself? We have Talos&#34;. Shocking lack of understanding for why a customer might have reasons for wanting to define _addresses to block on a firewall_ 2026-06-10T19:40:53Z https://nostr.now/nevent1qqs9avpfxdw6ekur020kh8zrun0l3f3fmjf3c9euyz00gr8cgmz8mmszyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kt7f38t In reply to <a href='/nevent1qqsteqyy29tnwhxl6j5eqtnc56cnqla3qr8tjzfcf7k6r4zvndg7essz47e9p'>nevent1q…7e9p</a><br/>_________________________<br/><br/>hell, Cisco doesn&#39;t even support it unless you also own a threat license. I&#39;ve been using hacked up solutions for their firewalls for years now. 2026-06-10T19:35:50Z https://nostr.now/nevent1qqs97gtt6k3txc4qwgf4vkp7ma7wprstz2mrps0xzal40ek5022fytgzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kjvnlmp In reply to <a href='/nevent1qqsdm58nmekdmc93qxhxs6uw8mzmmd4m9edhcavuj4spv39hv2gp68qklzhzc'>nevent1q…zhzc</a><br/>_________________________<br/><br/>wait is that the source for <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub16kg9lwzqksrhasxqtasrey5dhz7dkyur86xtupw08ayxppqkj47smwafn8" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Cat 🐈🥗 (D.Burch)</span> (<span class="italic">npub16kg…afn8</span>)</a></span> &#39;s PFP? 2026-06-04T15:44:24Z https://nostr.now/nevent1qqs8n72tq39svj2ss0uqdleaz8csxlrvehk77ye3qurr6ghafp8t65gzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9ka9memj In reply to <a href='/nevent1qqsp4kcl2ylyzzjklvxctshzvvrepwek7xa8jdncnlsgxq98xlxelyqhlgtlc'>nevent1q…gtlc</a><br/>_________________________<br/><br/>Forcing the two largest mobile network mega corps to share a SIM slot in a device is clearly dom behavior send toot 2026-06-03T18:24:06Z https://nostr.now/nevent1qqs0ztcry87a68prgje7suauwlmcq0a2cal9urgjwggluff2af650pczyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9k65y72u In reply to <a href='/nevent1qqsdjh5j7r8x43tfwfp4tvpfec92yy4avxaq3ltfj9kmv9e5ena7ehqlc9jzv'>nevent1q…9jzv</a><br/>_________________________<br/><br/>it&#39;s fucking crazy. And review sites don&#39;t even talk about it. Like if Honda or whoever gated functionality to a gas generator behind an Internet-requiring authentication prompt they&#39;d get torn apart. But as soon as something is considered *smart tech* and uses an app it gets a pass for all manner of fuckery 2026-05-31T02:11:17Z https://nostr.now/nevent1qqsyh6zagr2x8n8x9ga6p48d2sqh8wnpc33hd9tzzj6lzwkgxah5svqzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kphr9w0 In reply to <a href='/nevent1qqsxvfra77z4s6upe3dasqujd9jx22n43gu0yg3pj7u4zymjg4xurwq9fwhpw'>nevent1q…whpw</a><br/>_________________________<br/><br/>best I can do is an off-center screenshot of text with horrible jpeg artefacts 2026-05-15T16:50:54Z https://nostr.now/nevent1qqs8u2veu9xjms57prsphxyp6ura05k2njry87m4ye8mnszxrs0jqqszyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9k2qc7j4 In reply to <a href='/nevent1qqsyzkpw6c75d9qdaytn4vt9mj5cv2f4cusr7g8859aq9n24xn7m7sszqa4y0'>nevent1q…a4y0</a><br/>_________________________<br/><br/>i am not good at potatochop, but &lt;picture of professor farnsworth with catte head, macro text of &#34;good news, it&#39;s a suppository&#34;, holding up teams icon&gt; 2026-04-22T02:17:28Z https://nostr.now/nevent1qqsxxtcefkkgwm5zr7pfkxe0r3ccp2sf8dp0jenhfkff98633zccy2qzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kmlsve2 In reply to <a href='/nevent1qqs2k3wn8wknm26ravtsztvh7dpfcsk4f0j8qa4jl3npmw3smlye9ssw4qt7a'>nevent1q…qt7a</a><br/>_________________________<br/><br/>teams as document suppository 🤔 2026-04-21T20:31:48Z https://nostr.now/nevent1qqsqpqp2dn74dqvd2lvcgfzhyfa6y4ce3056q6vvmn2827w96en4qggzyrh5trnktqras5m5lfwj49slha8qh23lzc9g0pelkfrk29dllkc9kzg6ex4 In reply to <a href='/nevent1qqsrjjqdc8j4qdkmc4t2xhqp8zlfyw2u4uhczfry6theq8vv6teckjsr6tk59'>nevent1q…tk59</a><br/>_________________________<br/><br/>That&#39;s how I&#39;m reading it. It would be extra funny if the reason for the config file growing &#34;unexpectedly&#34; large was because CF was tracking IP&#39;s in a botnet whose portal is protected by Cloudflare. 2025-11-18T17:07:18Z