Nostr notes by B'ad Samurai :ifin:

Nostr event nevent1qqst667m03pgw4z47fxyqtrte7nw7r54uxz25543j6lvuexs8d62m6szyrpdw6lssqpkhtmyh82ffjest78vx8w74sa4wxtmhneyn28m8euygw4v9gv

2026-10-28T03:30:59Z

#paloalto

https://cyberplace.social/@GossiTheDog/117515798886610105

this reads like a long-winded knock-knock joke. Maybe an effected ...

2026-10-27T23:11:44Z

In reply to nevent1q…k46f
_________________________

this reads like a long-winded knock-knock joke.

Maybe an effected device list could be crowd sourced? We already know Tenda runs it from earlier CVEs.

#tendaMemeCountdown

if the category is Technologies I used in Early 00s: ColdFusion ...

2026-10-22T11:27:47Z

In reply to nevent1q…ywxc
_________________________

if the category is Technologies I used in Early 00s: ColdFusion should be up next.

brb pinging UNC5221 for the SBOM

2026-10-22T04:25:38Z

In reply to nevent1q…cp3e
_________________________

brb pinging UNC5221 for the SBOM

How are we sure @npub1s6e…n008 using Bluetooth isn’t a ...

2026-10-22T00:08:33Z

In reply to nevent1q…rkry
_________________________

How are we sure :rainbowCrow: (npub1s6e…n008) using Bluetooth isn’t a distress signal.

Nostr event nevent1qqsqh3rxj2ldujsketqvwpsw022z696v92sjud2jeudqrjtnwlmyvlgzyrpdw6lssqpkhtmyh82ffjest78vx8w74sa4wxtmhneyn28m8euygpwclam

2026-10-21T00:29:15Z

Nostr event nevent1qqsp9kz062s952nmhenhc5wvswnamte4wr5nk6d5kghl0np4jmfgfqczyrpdw6lssqpkhtmyh82ffjest78vx8w74sa4wxtmhneyn28m8euyglshfdm

2026-10-21T00:23:31Z

#php

Love lists and doing the basics? I really, really do. So I’m ...

2026-10-20T22:41:13Z

Love lists and doing the basics? I really, really do. So I’m speaking about it this Friday at BSidesPDX.

This year’s theme is **genuine human connection** so *Put Community Lists in your Kill Chain* is a celebratory look at the great impact lists can have within your security program.

And there’s not a lick of AI in the talk or derived content.

https://bsidespdx.org/events/2026/speakers.html#session-P9HCXH

#bsides #bsidespdx #blocklist #blueteam

that new `.crt’ TLD will go swimmingly.

2026-10-20T15:18:24Z

In reply to nevent1q…rqzd
_________________________

that new `.crt’ TLD will go swimmingly.

I’m gonna -ep bypass this particular question.

2026-10-20T03:19:04Z

In reply to nevent1q…8gtm
_________________________

I’m gonna -ep bypass this particular question.

wrap a script with a horizontal screen width check and watch how ...

2026-10-16T14:35:28Z

In reply to nevent1q…v6ee
_________________________

wrap a script with a horizontal screen width check and watch how many sandboxes give their approval.

RE: https://infosec.exchange/@mttaggart/117446793859614252 Get an ...

2026-10-16T02:17:15Z

RE: https://infosec.exchange/@mttaggart/117446793859614252

Get an ad blocker.
For you.
Your friends / found family.
Your crazy ass conservative Fox News relatives
Your $dayJob spamming you Cyber Awareness
Your dog
Your cat is likely fine

#adblocker #blueteamsec #blueteam

quoting
note1nxx…qlcg

You have probably seen the excellent reporting CitizenLab about AdFection, the insidious targeting and profiling of journalists (and others) via ad networks. But if not, drop everything and read it now.

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

THEN, read Confiant's companion piece which answers the deep technical questions I had about the infection mechanisms and targeting.

https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming

RE: https://infosec.exchange/@gayint/117448062838069728 This ...

2026-10-16T02:07:50Z

RE: https://infosec.exchange/@gayint/117448062838069728

This means gayint.org is likely in Palo Alto’s EDL hosting service and any category changes could impact customer business. Nice.<code>URL: Gayint.org<br>Categories: Computer-and-Internet-Info<br>Risk Level: Low-Risk<br></code>

quoting
note1tst…7j6j

Apparently some of you are using our block lists in prod. That's amazing. Insane, but amazing. 🫶

Shmeedy-R. How many AS400s you see teens hacking from their ...

2026-10-15T19:50:42Z

In reply to nevent1q…lmuq
_________________________

Shmeedy-R. How many AS400s you see teens hacking from their K-holes lately?

WordPerfect/gs has been updated to work on DOS. ...

2026-10-15T19:45:30Z

In reply to nevent1q…z8tr
_________________________

WordPerfect/gs has been updated to work on DOS.

https://www.callapple.org/vintage-apple-computers/apple-iigs/wordperfect-2-21a-for-the-apple-iigs-updated/

Zeek & Corelight shops would have access to it. But that’s ...

2026-10-15T14:39:34Z

In reply to nevent1q…2prf
_________________________

Zeek & Corelight shops would have access to it. But that’s more D&R where WAF implements them as protect policies (Akamai, Shape/F5, Cloudflare, AWS, etc)

Yes, we don’t want a highly reliable fingerprint detection tech ...

2026-10-15T14:23:44Z

In reply to nevent1q…88sz
_________________________

Yes, we don’t want a highly reliable fingerprint detection tech because we love our LOTS/CSP IP block fidget spinner.

pfffpt, where you planning on using that? Has Palo finished vibe ...

2026-10-15T14:18:37Z

In reply to nevent1q…qrcn
_________________________

pfffpt, where you planning on using that? Has Palo finished vibe coding through their ERs?

What is #355 on the end?

2026-10-15T13:50:04Z

In reply to nevent1q…d2xa
_________________________

What is #355 on the end?

since Cl0p really like to work holiday/ weekends, just turn ...

2026-10-15T13:22:59Z

In reply to nevent1q…4ult
_________________________

since Cl0p really like to work holiday/ weekends, just turn MOVEit off during this time.

#securityInDepth

or is it.. > seems like thats a room temp topic rn

2026-10-14T21:36:53Z

In reply to nevent1q…95sj
_________________________

or is it..

> seems like thats a room temp topic rn

Hello. Is your Internet connected refrigerator running?” > ...

2026-10-14T21:09:14Z

In reply to nevent1q…gauh
_________________________

*Hello. Is your Internet connected refrigerator running?”*

> No.

*You better go and patch it!*

But they smell like old books. https://youtu.be/YTG39pZZfdw

2026-10-14T17:13:17Z

In reply to nevent1q…a9vs
_________________________

But they smell like old books.

https://youtu.be/YTG39pZZfdw

I came across a user mentioning the .irish TLD is owned by ...

2026-10-12T11:35:53Z

I came across a user mentioning the .irish TLD is owned by American capitalists, but that’s only the tip of this iceberg. Since I went down this road of “who *is* my TLD operator” already, here’s a brief introduction to the Identity Digital / Donuts empire.

Using a country, region or populace is a valid objection to ICANN. The outdoor brand Patagonia wanted .patagonia, but Argentina filed an objection and the brand withdrew their application.

I don’t see a single objection to .irish in the 2014 public comments, which is unfortunate. But a lot of sketchy and questionable things snuck through back then—.zip anyone?

**A corporation shouldn’t own a nationality or diaspora TLD.**

Where was the ICANN’s GAC (Governmental Advisory Committee)? Well..

Identity Digital, who now operates .irish, is a mess of companies, ironically originally founded in Ireland in 1999, now “operating” in Bellevue, WA, US. It was acquired by Afilias (who then owned irish) and later Donuts. All backed by American PE, Ethos Capital. If that PE firm sounds familiar, they tried to gain private control of .org for $1B in 2021.

And the CEO of this PE firm? Here’s a screenshot of his own LinkedIn, where he was previously ICANN’s President.

Your TLD owner and operator matter. The political control and financial damage a misaligned corporation can inflict is worrisome. My best recommendation is to pursue well governed and protected ccTLDs. Or a non-profit with an aligned mission statement, like .meow.

#dns #icann #tld

I don’t know what timeline deserved regex block lists, but ...

2026-10-09T23:19:58Z

In reply to nevent1q…m5ut
_________________________

I don’t know what timeline deserved regex block lists, but it’s certainly not ours.

I’d like to believe there’s another timeline where firewall ...

2026-10-09T23:17:31Z

In reply to nevent1q…rx0l
_________________________

I’d like to believe there’s another timeline where firewall vendors care and their customers can block *-adguard.pro*-protect.pro*-defender.pro

I missed .lan, .corp and .mail were also submitted. Corp and mail ...

2026-10-07T23:45:40Z

In reply to nevent1q…7wj6
_________________________

I missed .lan, .corp and .mail were also submitted. Corp and mail were originally rejected by ICANN in 2012 as thought too dangerous. Somehow 2026 is safer?.pdf

and .php are technically backup choices, but still an absurd submissions. As is .csr and .bin.

The inherent trust words have their own issues: .login .auth .account .admin .official .verified. I don't see how these are anything but a ransom against organizations to preempt squatting.

But no one was really paying attention when CRR (Google) acquired ...

2026-10-07T21:43:21Z

In reply to nevent1q…xhq7
_________________________

But no one was really paying attention when CRR (Google) acquired .zip and .mov in 2013.

This round we're going to file those objections (string confusion).

No filenames, no intranet names, no assumed trust names.

So I hope these orgs enjoyed their $227,000 donation to ICANN.

https://newgtlds.icann.org/en/program-status/odr#objection-dispute-resolution

Happy #ICANN Reveal Fresh Hell Day! A company in the Caymans ...

2026-10-07T21:27:10Z

Happy #ICANN Reveal Fresh Hell Day! A company in the Caymans would like the TLD .pdf

And these other spectacular submissions that surely won't end poorly: .sys .key .duo .lab .private .state .auth .conf .config .loc .log .php .url .vpn

#DNS #RevealDay #blueTeam #tld

we need to get it updated with #FuckCloudflare memes.

2026-10-07T13:55:26Z

In reply to nevent1q…9qvl
_________________________

we need to get it updated with #FuckCloudflare memes.

“psexec’d” by RF. Nice.

2026-10-07T13:42:04Z

In reply to nevent1q…fuu4
_________________________

“psexec’d” by RF. Nice.

but did you add AI? ...

2026-10-05T16:41:49Z

In reply to nevent1q…92ns
_________________________

but did you add AI?

💯 if inspection if off, you’ll be limited to domain lists ...

2026-10-05T16:36:43Z

In reply to nevent1q…syd6
_________________________

💯 if inspection if off, you’ll be limited to domain lists instead of URL for that traffic. Firewalls without/limited inspect are a huge capability gap I don’t think enough organizations are addressing.

Maybe if we call it *Advanced Agentic GEO DPI +A2A/MAS Ready over MCP*

not useless, but could be such an easy win. I don’t have a ...

2026-10-05T15:54:45Z

In reply to nevent1q…867v
_________________________

not useless, but could be such an easy win. I don’t have a historical need for *-reports-* or reports-*.* or that format with sso, mfa and passkey.

It also depends on your list type!

For Palos:
DNS List: *.domain.test
URL List: domain.test AND *.domain.test

The URL lists on Palos need BOTH entries and this is missed a lot. Seriously. CHECK YOUR EDLs!

URL list formatting on Palos are more capable than DNS: you can block mail.*.* if you’re feeling frisky. But you can’t do mail-* because that would include two tokens in one space, “mail-“ and “*”.

Fortinet is kind of opposite. URL “threat feeds” (EDLs) don’t allow mid string wildcards, only beginning and end, but their domain type does. You can in-fact enter sso-*.* into a Forti.

> Yet another perfect 10 this morning. This one from a company ...

2026-10-05T13:43:43Z

In reply to nevent1q…77j0
_________________________

> Yet another perfect 10 this morning. This one from a company that…

Me out loud: It’s Progress.

Human response? Probably just workday timing out the application.

2026-10-05T13:24:56Z

In reply to nevent1q…r87d
_________________________

Human response? Probably just workday timing out the application.

haha I see some password resets in the near future

2026-10-01T18:08:48Z

In reply to nevent1q…89vk
_________________________

haha I see some password resets in the near future

When I can no longer tell AI trolls and sycophants apart I’m ...

2026-09-30T23:42:21Z

In reply to nevent1q…k8vs
_________________________

When I can no longer tell AI trolls and sycophants apart I’m reminded of this classic acting performance:

Right before LLMs blew up, it felt like there was a good cadence ...

2026-09-30T15:38:35Z

In reply to nevent1q…q2j7
_________________________

Right before LLMs blew up, it felt like there was a good cadence across orgs with devs referring to OWASP, building threat models (I was a big threagile in the CI/CD fan) and participating in XSS CTFs like Juice Box.

Then the 10x conscription and gas lighting came via a horse-shaped LLM.

OWASP CAPEC-79 was first published in 2014, and last updated ...

2026-09-30T15:21:34Z

In reply to nevent1q…erh9
_________________________

OWASP CAPEC-79 was first published in 2014, and last updated 2018. OWASP has % pretty well covered at this point; none of the CVEs have been novel.

https://capec.mitre.org/data/definitions/79.html

Nostr event nevent1qqsqahn6x3ce3lqh72m3x622pftvup45kl8n202s74pz8v9v26fmmvqzyrpdw6lssqpkhtmyh82ffjest78vx8w74sa4wxtmhneyn28m8euyg7xfsrw

2026-09-30T14:47:02Z

In reply to nevent1q…vd4l
_________________________

.live is $2 so hopefully many have already blocked it after ...

2026-09-30T13:20:34Z

In reply to nevent1q…pss3
_________________________

.live is $2 so hopefully many have already blocked it after reviewing legitimate traffic..xyz

seems to be the only low-cost TLD admin responding to take downs and abuse reports.

.online totally was, at 1.1% for this list. Been thinking of a ...

2026-09-29T23:13:55Z

In reply to nevent1q…psrk
_________________________

.online totally was, at 1.1% for this list. Been thinking of a script to parse and make this assessment work a little more automatic.

I was just doing a break down of a public “block list” into ...

2026-09-29T22:03:58Z

In reply to nevent1q…zsm4
_________________________

I was just doing a break down of a public “block list” into higher tier categories for realistic blocks:

.top 4.0%
.ru. 2.7%
.site 1.5%
.pro. 1.3%
.shop 1.3%
.click 1.1%
.vip 1.1%
.online 1.1%

duckdns 20.4%
portmap host/io 14.5%
trycloudflare 3.6%

By category:
DynamicDNS 52%
Tunnels: 28%

So a list of 88,700 domain entries can be trimmed to 17,750 with just two categories. Then trim further with TLD blocks and ensure the most abusive platforms are *actually* categorized by $vendor.

that only happens during job interviews when some crusty dude, ...

2026-09-23T22:02:24Z

In reply to nevent1q…kfky
_________________________

that only happens during job interviews when some crusty dude, always a dude, asks you esoteric B-tree and sorting questions they just asked ChatGPT for only 10 minutes before your interview.

that’s the other sec vendor deferred enhancement, claiming ...

2026-09-23T21:44:01Z

In reply to nevent1q…j55e
_________________________

that’s the *other* sec vendor deferred enhancement, claiming regex and improved wild carding would use to much resources (a few vendors do!)

Of course this reasoning has a lot of holes in 2026.

Mmm, unspent fuel, burnt oil, hot turbos, and Acqua Di Gio.

2026-09-19T23:01:56Z

In reply to nevent1q…ttts
_________________________

Mmm, unspent fuel, burnt oil, hot turbos, and Acqua Di Gio.

Feels like DSM and 300ZX bros fighting on Division in Spokane.

2026-09-19T22:52:12Z

In reply to nevent1q…su9a
_________________________

Feels like DSM and 300ZX bros fighting on Division in Spokane.

Shh. Let’s let them believe they’re clever a little longer.

2026-09-18T14:34:05Z

In reply to nevent1q…d07v
_________________________

Shh. Let’s let them believe they’re clever a little longer.

RE: https://infosec.exchange/@BleepingComputer/117292401812041866 ...

2026-09-18T14:32:12Z

RE: https://infosec.exchange/@BleepingComputer/117292401812041866

I’ll take any good news about Teams. A subset of these lists for SEGs should help here:

https://github.com/BadSamuraiDev/bs-lists/blob/main/email-file-extensions.txt

https://github.com/BadSamuraiDev/bs-lists/blob/main/sensitive-file-extensions.txt

#microsoftTeams #blocklist #microsoft #fileExtensions

quoting
note15sd…x83l

Microsoft Teams will soon let administrators tweak the list of file extensions commonly associated with security threats to meet their company's security requirements.

https://www.bleepingcomputer.com/news/security/microsoft-teams-will-let-admins-block-custom-file-extensions/

do you get the Palo content update emails? If there is a ...

2026-09-18T14:21:27Z

In reply to nevent1q…rd00
_________________________

do you get the Palo content update emails? If there is a suspiciously blank entry under a new thread ID, that’s usually their pre-cursor to an announcement.

to be clear I don’t have any TLP related info for a Palo ...

2026-09-18T14:18:32Z

In reply to nevent1q…hywx
_________________________

to be clear I don’t have any TLP related info for a Palo *thing.* I’m on PTO and shit posting.

What a week in netsec. Let’s see what happens at 4pm pacific ...

2026-09-18T10:06:04Z

What a week in netsec. Let’s see what happens at 4pm pacific today.

And remember to push to prod.

RE: https://mastodon.social/@hugovalters/117284225659702318 DNS ...

2026-09-17T03:29:15Z

RE: https://mastodon.social/@hugovalters/117284225659702318

DNS over HTTPS is cute as beans. But in case Wu Tang Mad Libs over DNS wasn’t clear:

**Organizations / enterprises should block cloudflare-dns.com and similar ilk.**

And *that’s* a hint at my next block list :)

I could have sworn I saw something, but it appears I only ...

2026-09-15T23:23:58Z

In reply to nevent1q…afjh
_________________________

I could have sworn I saw something, but it appears I only imagined it. Plenty of CISA and FBI docs call out and explain the technique but none explicitly recommend a blocking mitigation for run or windows keys.

I found a Michigan State Police doc recommending disabling windows shortcut keys specifically. Still a far cry from the pheds.

https://www.michigan.gov/msp/divisions/intel-ops/cyber/mc3/cyber-snapshot---fake-recaptcha-attacks

What started as a project out of vendor frustration and spite, ...

2026-09-14T16:27:43Z

What started as a project out of vendor frustration and spite, became a plucky git repo to nerf cyber crime riding *trusted* services. I'm so happy when defenders tell me how BS Lists helped them in their $job.

Similar to LOLRMM, LOTT, and ClickGrab, it's a passion project maintained by a single individual. [ xkcd.gif ] And this model puts these projects at-risk long-term.

Because the author of BS Lists apparently can't be bothered to wear his helmet during rock and icefall danger, new lists will be published on IFIN, a 501(c)(3) cyber intel non-profit. Older lists will be migrated where appropriate.

With this announcement, there is a 2050 domain-strong RPC Node list to combat #Etherhiding I encourage defenders to check out.

https://lists.ifin.network/lists/rpc-nodes/

I also have 3 more lists in queue.

#cybersecurity #blocklist #blueteam

liar, we know security vendors can’t be bothered blocking ...

2026-09-11T17:30:06Z

In reply to nevent1q…2ek3
_________________________

liar, we know security vendors can’t be bothered blocking special characters or mid-strings.

it looks so calm before big wave season starts soon.

2026-09-10T13:56:03Z

In reply to nevent1q…lkqa
_________________________

it looks so calm before big wave season starts soon.

Totally not related. ...

2026-09-10T01:04:15Z

Totally not related.

We’ll get to see next month..dot isn’t out of sunrise yet, ...

2026-09-08T20:34:43Z

In reply to nevent1q…swhs
_________________________

We’ll get to see next month..dot

isn’t out of sunrise yet, but I’m not expecting a lot of abuse at their current price point.

But who knows, they could pull a .bond on us.

And it’s completely plausible .slash will be announced next month as a GNR owned TLD.

Come camp with me before #PAX..I said. ...

2026-09-06T07:55:44Z

Come camp with me before #PAX..I said.

I do this with a JavaScript .html calling DNS records and filter ...

2026-09-05T15:39:06Z

In reply to nevent1q…20ah
_________________________

I do this with a JavaScript .html calling DNS records and filter on my desired format and domain list.

I keep lists of Fortune 500, most common corporate IT SaaS/tech and other fun domains for this very reason.

They (Noisy Creek) have the Stranger and Portland Merc on ...

2026-09-03T22:59:11Z

In reply to nevent1q…ej9z
_________________________

They (Noisy Creek) have the Stranger and Portland Merc on Bluesky, if that counts as *fedi*

if you’re going for training and certifications I guess it ...

2026-09-01T20:02:17Z

In reply to nevent1q…pnev
_________________________

if you’re going for training and certifications I guess it makes sense to go for a specific vendor. It’s cheaper to go to Zscaler’s con for the free workshops and certs instead of buying training credits.

Or make learning your platform free and not gatekeep.

Splunk .conf used to host vendor agnostic sessions, but their last conference felt dominated by employees and partners instead of customers, which is a bummer.

TIL: Block all Marvel themed ASNs.

2026-08-31T18:35:08Z

In reply to nevent1q…0r7e
_________________________

TIL: Block all Marvel themed ASNs.

broken toots never looked so good.

2026-08-31T02:37:47Z

In reply to nevent1q…3qdq
_________________________

broken toots never looked so good.

Leak of Form 4 and tax stamps could get interesting in a real ...

2026-08-26T13:10:33Z

In reply to nevent1q…avre
_________________________

Leak of Form 4 and tax stamps could get interesting in a real hurry.

Nostr event nevent1qqsxk4kwcl5euw0rkdf68wh6tzk0d4p0apr6z7qy4f8k008dt3wfekqzyrpdw6lssqpkhtmyh82ffjest78vx8w74sa4wxtmhneyn28m8euygt3ausx

2026-08-25T21:22:17Z

In reply to nevent1q…62l7
_________________________

Nostr event nevent1qqs2vk4ptwx2ltn3y2mx9emetd90zn4e8mz6pf9ldcjvarwagh3dyugzyrpdw6lssqpkhtmyh82ffjest78vx8w74sa4wxtmhneyn28m8euygt9yr2u

2026-08-25T18:15:34Z

If a common mechanism has continued security flaws, but does not ...

2026-08-24T15:35:28Z

In reply to nevent1q…vl69
_________________________

If a common mechanism has continued security flaws, but does not have a shared vendor, library or project, I tend to believe it’s vibe-coded unicorns. OTP is not novel and there are mature FOSS projects. Rolling your own MFA with vibe coding *is certainly a choice.*

Today was bath day. And I too would like that to be the hardest ...

2026-08-24T00:05:15Z

In reply to nevent1q…knwt
_________________________

Today was bath day. And I too would like that to be the hardest part of my week.

It’s a good idea to block outbound Microsoft telemetry. And ...

2026-08-23T22:29:51Z

In reply to nevent1q…spky
_________________________

It’s a good idea to block outbound Microsoft telemetry. And most organizations spit-tunnel Microsoft to save on bandwidth and infra costs. So a home network may effectively block $dayjob telemetry.

I’ve wondered if it’s the same people that named over ...

2026-08-23T18:30:35Z

In reply to nevent1q…ufde
_________________________

I’ve wondered if it’s the same people that named over pressure ammunition +P+

A DNS Nerd’s Open Letter to ICANN and 2026 Applicants: ...

2026-08-23T00:36:05Z

**A DNS Nerd’s Open Letter to ICANN and 2026 Applicants:**

Congratulations to the 1600 applicants on your TLD submissions. And wishing the $227,000 non-refundable fee will be worth it.

But this time we’re paying attention. This isn’t 2013, when **no one** cared CRR/Google purchased .mov and .zip.

We’re not going to be silent as Sponsors/Operators scheme with round-about *mission/purpose* statements to make-a-quick buck while pretending they aren’t enabling crime.

We’ll meet you with public objections and have you clarify your exact purpose on record. Anything sus and your bullshit will be blocked before you get your first name server.

Once again, congratulations! I truly look forward to good stewards of DNS.

Extra love for .meow! :heart_rainbow: You deserve a safe space.

#icann #dns #gtld

I really appreciate the BMS callout. ...

2026-08-22T23:43:42Z

In reply to nevent1q…d3kx
_________________________

I really appreciate the BMS callout.

Awesome. I’m a sucker for a city full of bridges, like ...

2026-08-20T12:44:23Z

In reply to nevent1q…vsyy
_________________________

Awesome. I’m a sucker for a city full of bridges, like Portland, OR and Copenhagen.

.xyz has gotten a lot better. Jocyln is awesome and they care ...

2026-08-19T17:07:48Z

In reply to nevent1q…vdek
_________________________

.xyz has gotten a lot better. Jocyln is awesome and they care about abuse reports. We're so used to bulletproofs, shrugging is our default, but I do recommend forwarding malicious domains to their abuse team.

TLD may lie dormant as well. Most notably was .bond owned, and ...

2026-08-19T14:49:39Z

In reply to nevent1q…wz95
_________________________

TLD may lie dormant as well. Most notably was .bond owned, and never used, by Bond University AUS. It was purchased privately, they made a PR push that it'll be ~$7 and directed at Bail Bonds and Bond financial markets.

They made a quick buck on 007 and james premium domains.

And as we now know, it runs in the 99.99% malicious rate and is for sale under $2..zip

and .mov sat for 9 years before Charlston Road Registry (Google) released them, imo, it was a pump-and-dump 30ish days before the public sale to Square.

And do we trust .accenture to manage their TLD appropriately or could we see a novel registration?

All in all, many TLDs are a "low regret" block. While others may be difficult depending on the org and user.

I block .app and .me at home and have to allow list something every couple weeks.

I can’t wait to block EVERYTHING ShortDot SA files for. ...

2026-08-19T14:38:35Z

In reply to nevent1q…e38e
_________________________

I can’t wait to block EVERYTHING ShortDot SA files for. #precrime

Time to tip off the Meta lawyers about a concern of brand ...

2026-08-19T14:31:28Z

In reply to nevent1q…3d05
_________________________

Time to tip off the Meta lawyers about a concern of brand collision.

Watch me block .gram rn. Fuck off Telegram. ...

2026-08-19T14:22:13Z

Watch me block .gram rn. Fuck off Telegram.

https://socradar.io/blog/telegram-applied-for-gram/

#gtld #icann #dns

Happy #blackCatAppreciationDay to my car work buddy. ...

2026-08-18T00:35:28Z

Happy #blackCatAppreciationDay to my car work buddy.

the local utility struggled in 2016 to find a home for the ...

2026-08-17T15:23:06Z

In reply to nevent1q…u0nr
_________________________

the local utility struggled in 2016 to find a home for the battery project and ultimately deployed it in Glacier, WA (tiny community on the road to Mt. Baker Ski area)

The resistance *is* super weird. I’d be happy to have one near me. I’m in a small rural farm and river/lake-side bedroom community, so we’re the very last in any large-scale restoration.

https://www.pse.com/en/pages/grid-modernization/glacier-demo-project

Grendel is sand crabbing. #dogsofmastodon #oregoncoast ...

2026-08-14T19:21:31Z

Grendel is sand crabbing.

#dogsofmastodon #oregoncoast

RE: https://infosec.exchange/@robpomeroy/117094270483761714 *Taps ...

2026-08-14T14:54:23Z

RE: https://infosec.exchange/@robpomeroy/117094270483761714

*Taps the sign*

https://ifin-intel.org/blog/ad-blocker/

quoting
note1sjm…4a57

Can't quite believe what I'm reading. (Another great Brian Krebs article.)

https://krebsonsecurity.com/2026/08/whos-tracking-you-use-this-new-service-to-find-out/
ESPN appears to work with a Russian advertising agency
The bank (Alfa) for that agency (Between Digital) is sanctioned
Data brokers use the advertising networks to harvest sensitive personal information
Top military news sites host adverts from the above agency and others (e.g. from the UAE) and allow user tracking
Opera's majority owner is Chinese and is partnered with Chinese and Russian data brokers
Badly behaved advertisers are rarely held to account

Krebs says, "The only sane reaction ... is to block all online ads outright." Bear in mind that he does run (light) advertising on his own site.

#advertising #malvertising #privacy #safety

This late Winter I let an LLM have a whack at a couple of my ...

2026-08-13T14:39:06Z

In reply to nevent1q…f4d8
_________________________

This late Winter I let an LLM have a whack at a couple of my projects. Caught some bugs—cool, but adding a couple features refactored my code in such truly awful ways. And because I want to maintain it long-term, I now need to un-fuck it before public release. Now I’m slow to fix it because it’s **so much less fun** than original programming. So what did I actually save?

no goats were harmed in the making of this meme. ...

2026-08-11T03:22:01Z

In reply to nevent1q…lmvj
_________________________

no goats were harmed in the making of this meme.

you attractin’ TAs with dumpster chicken again?

2026-08-11T03:09:59Z

In reply to nevent1q…9205
_________________________

you attractin’ TAs with dumpster chicken again?

This certainly won't end in a ClickFix variant. #clickfix ...

2026-08-10T16:20:28Z

This certainly won't end in a ClickFix variant.

#clickfix #blueteam #copilot

I count myself lucky I have svg stripped.

2026-08-10T13:32:21Z

In reply to nevent1q…syup
_________________________

I count myself lucky I have svg stripped.

try searching blank subjects in ProofPoint—oh wait, you ...

2026-08-10T13:14:02Z

In reply to nevent1q…wu2z
_________________________

try searching blank subjects in ProofPoint—oh wait, you can’t. Build a custom rule to see blank subjects.

Surely, no business traffic..

Spoiler: Don’t block blank subjects.

I wish conf badges were edible. If anyone can, @npub14c3…56tv ...

2026-08-07T21:50:17Z

In reply to nevent1q…rc4g
_________________________

I wish conf badges were edible. If anyone can, BSides Zurich (npub14c3…56tv) could make a chocolate badge happen.

you would be vercel.

2026-08-07T05:26:12Z

In reply to nevent1q…mqaf
_________________________

you *would* be vercel.

Ugh, just go get a workers[.]dev already!

2026-08-07T05:22:12Z

In reply to nevent1q…6asp
_________________________

Ugh, just go get a workers[.]dev already!

The days of black hoodie hackers are over. Long live Hot ...

2026-08-07T04:57:40Z

In reply to nevent1q…affr
_________________________

The days of black hoodie hackers are over. Long live Hot Cryptgirl Summer!

Whale watching always makes me so happy. I highly recommend ...

2026-08-06T17:27:09Z

Whale watching always makes me *so* happy. I highly recommend this for a team activity.

#seattle #orca

A few orgs maintain lists of troublesome ASNs The ...

2026-08-04T21:21:07Z

In reply to nevent1q…swyc
_________________________

A few orgs maintain lists of troublesome ASNs

The GAYINT :yassquatch: (npub1ezn…nyq3) team maintains this list: https://gayint.org/blocklists/numbers.txt

And The Spamhaus Project (npub14ax…ujmc) maintain this list: https://www.spamhaus.org/drop/asndrop.json

For a good intro about ASNs, poor governance, lack of support for blocking, John Kristoff (npub1hrh…jqnu) gave this excellent talk at FIRSTCON25:

https://youtu.be/PiNP9EDPE-I?si=h4bmMqntAgiFHqCB

If your devices support it, Geo-based IP blocks can get you reasonably far on a home network, but it's not enough for even a mid-enterprise today.

#asn

Palo: "Almost Half of Malware Samples Communicate Direct to ...

2026-08-04T15:35:37Z

Palo: "Almost Half of Malware Samples Communicate Direct to IP"

Also Palo: "We don't understand why you want to Block-by-ASN."

https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/

#blueteam #asn #paloaltonetworks #unit42

I love someone included the Mk2

2026-08-04T15:29:12Z

In reply to nevent1q…x0h0
_________________________

I love someone included the Mk2

RE: https://infosec.exchange/@bobdahacker/117037360462544912 ...

2026-08-04T13:38:29Z

RE: https://infosec.exchange/@bobdahacker/117037360462544912

Block and monitor these absurdly high-risks. Here’s a list to get you started.

https://github.com/BadSamuraiDev/bs-lists/blob/main/ai-meeting-notetakers.md

quoting
note1dlp…vn58

🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.

What's exposed:
Creator emails, conference IDs, recording status, timestamps
Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
Government meetings from 23 countries
Corporate meetings from thousands of companies

Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.

Full writeup: https://bobdahacker.com/blog/tldv-hack

#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy