Dave Wilburn :donor:

#infosec engineer, #mlsec machine learning, sailor, news junkie, #threatintel consumer, deep statist, #NAFO fella. All opinions are mine.

Public Key

npub1hth9cq2kdn2kcd5q5r6yd2ce44mcq5j9vhc47qed44869mu2y9jqg7qyyn

NIP-05 Address

DaveMWilburn@infosec-exchange.mostr.pub

Profile Code

nprofile1qqst4mjuq9txe4tvx6q2pazx4vv66auq2fzktu2lqvk66naza79zzeqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dstawf89

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1hth9cq2kdn2kcd5q5r6yd2ce44mcq5j9vhc47qed44869mu2y9jqg7qyyn

Show more details

Last Notes

2026-10-20 20:44:15 UTC

infosec industry: this is very serious business and we are very serious people
also infosec industry: four
#infosec

2026-10-12 11:28:26 UTC

As it turns out, running your online services and data in the same facility as a warmongering regime is a bad idea. And that's especially true when the datacenter owners are close to the regime.
We've been able to take these things for granted in the past, but there are no more peace dividend checks to cash. And that's especially true as datacenters become dual use civilian/military facilities, wars get dirtier, and LOAC principles of distinction and proportionality get thrown out the window. And as a reminder, your insurer will not cover acts of war.
What is happening to Yandex today could happen to us-east-1 tomorrow. Oligarchs like Bezos would rather cash US Govt checks (and write a few as bribes and kickbacks) than structure their businesses to protect your interests.
As @nprofile…z3lm says, "go to the cloud they said".

2026-09-21 13:59:45 UTC

ZuckOff Is a Free App That Sees Meta Glasses Before They See You
#zuckoff #pervertglasses #meta
https://www.wired.com/story/zuckoff-app-sees-meta-glasses-before-they-see-you/

2026-08-30 14:29:21 UTC

Anyone inside or outside the US that thinks they're safe relying on American tech providers and financial institutions should consider how quickly and enthusiastically they carried out the diktats of the Trump regime.
Just in the last week, Google changed Google Maps' references from Lake Ontario to Lake America, and Paypal and the Internet Society froze financial assets and domain names of Autistici/Inventati.
You risk instant humiliation, immiseration, and social death at the whims of a corrupt, vindictive, narcissistic dictator. No due process required or given.
#google #uspol #digitalAutonomy #digitalsovereignty #austiciinventsti #paypal #internetsociety

2026-08-18 17:20:04 UTC

I'm curious if Costco has specialized cat diets for other feline professions, or only for blue color maintenance work.
#cats
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/117/651/878/676/141/original/0774d6538f39c937.jpg

2026-08-16 20:50:06 UTC

Why haven't mesh networks taken off more fully, especially for mobile devices like smartphones? I feel like I heard a lot about MANETs a couple decades ago and then... nothing.
Given the state of society these days, I feel like more democratic and resilient networking options might be important in the near future.
I'm excited for stuff like Velid, but I'm a little surprised that we don't have better options at the lower level of the network stack for resilient networking for it to ride on.
Why are we stuck with fiddly bits of extra hardware running stuff like Meshtastic and Meshcore? Why can't a reasonably sized mesh network be constructed exclusively using already existing onboard smartphone hardware?
I understand that LoRa gets more range between sparsely populated nodes, but it seems to me that most urban and suburban environments should have plenty of density for WiFi/Bluetooth to work.
As someone that's a bit ignorant on the topic, what are the key challenges holding us back? I can think of a few, but I don't know which ones are critical:
Wireless chipset and handset manufacturers might be reluctant if they can't figure out a way to monetize it.
Cell service providers probably see it as a threat, and might want to use their influence on hardware manufacturers to suppress it.
Governments would probably view it as a threat to their surveillance and censorship goals.
A lot of the activity might end up super sketchy, similar to IPFS and Tor, and maybe nobody wants to deal with the liability or hassle.
There might be significant challenges bumping up against the theoretical and practical scalability of mesh networks.
So what's holding us back?
#mesh #meshtastic #meshcore

2026-08-16 16:18:43 UTC

- reply

@nprofile…z6kv
They're selling shovels in a gold rush, now offered for a limited time with financing options.

2026-08-13 14:43:29 UTC

Hey gang, we need to talk about the recent presidential memorandum authorizing offensive security operations by the private sector. That's because I care about your safety, the rule of law, and a functioning internet. A lot of folks might be excited about the opportunity to use their hacking skills to take out bad actors and criminals in a way that's safe and legal for them. That's not what this is.
At best, this memo provides you with some limited protection from prosecution by the federal government for what's otherwise criminal activity. That protection is only provided if you follow their rules. And it's only as good as Trump's promises, only as long as he perceives you to be useful to him personally, and possibly only as long as Trump retains power.
It provides you with no protection against prosecution by other jurisdictions. You are not a government actor or a uniformed soldier, so you will have no protections from prosecution under sovereign immunity or as a lawful combatant.
Every one of these actions is likely to be considered a criminal offense in every jurisdiction that your operations impact. That includes direct operations as well as support (e.g., offsec tool building, standing up infrastructure for malware delivery or C2). It includes the jurisdictions that your targets are in, as well as every jurisdiction that your operations travel through and that host your infrastructure. It includes upstream and downstream actions by other operators that you might not be fully aware of, if they can tie you to a criminal conspiracy.
Your identity and your operations will not remain secret. This administration has shown they cannot and will not keep secrets. Our president was charged with criminal violations of the espionage act, and his drunkard of a SECDEF has notoriously leaked classified details of military operations to a reporter, so we know they're not trustworthy with secrets.
We've shown that governments can identify and charge cyberespionage operators since the APT1 indictments in 2014, and in some cases we've even successfully arrested, tried, and imprisoned hackers operating for foreign governments. You should assume that other countries have similar investigative capabilities.
You will be subject to arrest, extradition, trial, and imprisonment every time you set foot abroad for business, vacation, or visiting family, possibly for the rest of your life. You could be subject to international sanctions that might freeze your finances. You'll almost certainly wind up a target for intelligence collection by foreign intelligence services. You could also be considered an unlawful combatant and legitimate target for kinetic and non-kinetic military operations by the military forces of the countries you've pissed off.
You should also consider the unreliability of the Trump regime's designations for targeting. They've routinely designated civilian or even functionally nonexistent organizations as criminal or terrorist organizations. You cannot trust their assurances that the bad guys you're harming are actually bad guys.
Please don't make a dumb decision that ruins your life, especially not for the false promises of the Trump regime.
https://www.whitehouse.gov/presidential-actions/2026/08/expanding-capabilities-to-combat-transnational-cyber-enabled-crime/
#infosec #uspol #cybersecurity

2026-08-07 16:11:05 UTC

- reply

@nprofile…f86m
When it comes to anything even mildly challenging, Trump will never side with Zelensky over Putin. And Zelensky fundamentally misunderstands Trump if he thinks pursuing an "interest-based" relationship means useful defensive tech for the benefit of the broader United States rather than personal financial enrichment and ego stroking of Trump himself.

2026-08-07 13:46:59 UTC

- reply

@nprofile…trtw
How's the performance with that many radios? I've heard Meshtastic tends to break down around 100 nodes or so, but I've never been in a mesh with anywhere near that many active nodes. I assume something in the DEFCON firmware settings helps with some of that?

2026-08-06 13:40:23 UTC

- reply

@nprofile…ds0l
I moved to Alexandria VA about 16 years ago because it was one of the few places in the region that supported both cars and alternative means of transportation. I generally park the car in the driveway most of the week and walk, bike, or take public transportation everywhere. But I've got a car for weekly-ish trips out further. I got addicted to that lifestyle from when I lived in Germany for a few years previously.
I happen to live a few blocks from both Mount Vernon Avenue and US-1. The former is built for multimode transportation, with especially great walkability. The local restaurants and shops are thriving.
Meanwhile, restaurants and shops along US-1 tend to die quickly. Yeah, there are some older strip malls with parking lots that do OK. But everywhere else is just too far and inconvenient to walk or bike to, but also has inadequate parking for drivers. The road there is only useful for transporting people through the area, not to it. It's the worst of both worlds.
Which is a damned shame because there's a really outstanding taco place there, and I don't want it to die from the same curse that killed the last few tenants.

2026-08-05 11:13:06 UTC

- reply

@nprofile…v2v2
Prompt phreaking?

2026-08-01 12:12:38 UTC

- reply

@nprofile…v2v2
Another potential nightmare might be if these companies, perhaps under new ownership/management, decide to scavenge our private data even more intensively and unscrupulously.
One would think that it would be difficult for a company like Meta, already notorious for their mishandling of data for election manipulation and for complicity in at least one genocide, could get worse in that regard. Or similar with Oracle, a company half-jokingly described as a law firm with a small side-gig in tech and whose owner is one of the most dedicated far-right oligarchs in the world. But I have faith.

2026-07-28 19:47:08 UTC

- reply

@nprofile…524c
Sounds a lot like Sir Arthur Conan Doyle's Diogenes Club.
https://en.wikipedia.org/wiki/Diogenes_Club

2026-07-27 19:29:55 UTC

- reply

@nprofile…44dh
So, correct me if I'm wrong, but Hugging Face ran into a brick wall early in their incident response process when they were blocked by one or more models from analyzing security log data due to guardrails. Their work around was to use a Chinese-sourced open weight model with fewer guardrail restrictions. Part of OpenAI's response to this debacle was to offer to enroll Hugging Face into their trusted access program, which is clearly marketed as providing at least infosec functionality, implied to include some functionality that Hugging Face struggled to access past guardrails. Some invite-only portion of OpenAI's trusted access program includes further loosening of guardrails to allow even greater use in the infosec domain, although it's not clear to me that Hugging Face is approved for that specifically.
For me, the fundamental issue is that the set of potential GenAI model users with legitimate requirements for so-called dual-use functionality (e.g., common infosec use cases) is so large as to be unmanageable at scale.

2026-07-27 18:22:38 UTC

- reply

@nprofile…44dh
I think the issue is more around the infeasibility of managing an embargo that large with so many stakeholders with conflicting requirements. It's similar to the problem of closed CTI sharing circles.
You know that the Trump regime is going to demand access, and also have opinions about who else gets access and who doesn't (mostly revolving around who grovels and pays them enough). And other governments with sometimes-conflicting interests will also demand access. And defense contractors, spy agencies, law enforcement, research institutions, infosec vendors, software vendors, etc.
If your circle of who gets access to frontier models with unrestricted guardrails gets so large that it includes the security team from a company like Hugging Face, then who DOESN'T get access? You're maybe talking about millions of people by that point.
How would you vet any of them? You'd need to stand up a whole department of 24x7 support personnel dedicated to managing this kind of access, probably subcontracting with a major data broker for identity verification, plus active monitoring for abuse.
And if we've learned anything at all from the Flock scandal, it should be that a user base that large is going to have a LOT of people engage in misconduct. At least some of that misconduct will render the embargo functionally useless.

2026-07-27 15:13:53 UTC

- reply

@nprofile…44dh
IMO there's no reasonable way to vet and manage access control to models without guardrails for a global customer base of this size and with so many conflicting interests. And some of the GenAI firms like Anthropic are going to be reluctant to remove all guardrails for their customers (e.g., their conflict with Trump/Hegseth).

2026-07-24 17:20:24 UTC

- reply

@nprofile…44dh
Maybe we're talking cross purposes. At least from my experience, the spectrum of attribution can range from a cluster of similar activity on the one end, to specific named organization/agency/individuals on the other. Somewhere in the middle includes the goofy industry cover terms, often with nonspecific links to suspected countries of origin. I would agree that most defenders benefit from cluster-of-similar-activity level of attribution. Some larger organizations, especially ones that need to do more formal threat modelling, probably benefit from group names. I don't think anyone except governments benefit from attribution down to specific orgs/agencies/individuals.

2026-07-24 17:08:25 UTC

- reply

@nprofile…44dh my personal experience has been that, at least during incident response, narrowing down the universe of possible TTPs down to the ones most commonly used by a specific, attributed threat actor helps focus and speed up incident scoping and response in critical ways. It's less helpful in general defense, but absolutely critical in time-sensitive breach response.

2026-07-24 16:59:22 UTC

- reply

@nprofile…44dh
Hmm...
I suppose the commoditization and separation of initial access and post-initial access crews, that's probably true for most criminal activity. But I don't know if I'd say that's universally true. There are still some criminal shops out there that, while not as monolithic as state actors, tend to maintain stable TTPs for long enough and for enough of the attack lifecycle that attribution can help defenders and responders.

2026-07-24 12:38:21 UTC

- reply

@nprofile…gu7x
That TSLA P/E ratio is still crazy, though. They have a lot further to fall.

2026-07-22 20:03:27 UTC

- reply

@nprofile…f86m
Russia and the US have been screwing with each other through (barely) deniable proxies since longer than any of us have been alive.
The only thing surprising about any of this is the hesitancy by the American far right currently in power in treating the Russian regime as a persistent adversary, along with their willingness to stick their dicks inside the car door over and over again.

2026-07-22 11:16:27 UTC

- reply

@nprofile…2v4z
Hey, are we posting sponcon onto John Mastodon's Fediverse?

2026-07-20 17:33:51 UTC

A shocking development in transportation and energy sector security.
#nevent1q…jdu8

2026-07-13 20:19:15 UTC

The US Department of Defense is suspending CMMC Phase II, effective immediately.
https://www.war.gov/News/Releases/Release/Article/4542329/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/
#infosec #cmmc

2026-07-11 16:40:23 UTC

- reply

@nprofile…v2v2
(settling into my comfy IANAL armchair...)
Maybe, but it complicates the heck out of any trial. Proving workplace discrimination is already outrageously difficult. Now you're facing the additional challenges that the defendant has no discoverable documents describing their arguably discriminatory decision or biased decision-making process. Their contracted ATS AI probably has no useful and discoverable logs, either.
So what are you left with? Maybe you could convince a judge to make the model and its training data available through discovery, but we're talking trade secrets and an unreasonable amount of data. And at best you'd end up with some situation where an expert witness says the model is biased in general when examined in a lab but you can't prove that this specific decision negatively impacting the plaintiff was due to bias. And even getting this far would be prohibitively expensive for any real world plaintiff. And the LLMs themselves are often nondeterministic even with the exact same input, which is often *by design* (i.e., temperature) for aesthetic reasons.
Am I missing something here?

2026-07-11 16:04:16 UTC

- reply

@nprofile…v2v2
For their corporate customers, the ability to launder their workplace discrimination behind an opaque discrimination machine run by a 3rd party is a feature, not a bug.

2026-07-09 16:08:18 UTC

- reply

@nprofile…gu7x
God forbid a woman has hobbies, Brian.

2026-07-08 16:00:37 UTC

- reply

@nprofile…f86m
Hiding shipments of military goods in civilian vehicles would be a war crime of perfidy, would it not?

2026-07-05 16:00:36 UTC

Recent discussions about self-hosting and coop services got me thinking...
How absurd is it that we're all expected to surrender our computing needs to for-profit hyperscalers and cloud service providers? How dare these oligarchs try to make us feel weak and incapable of providing for ourselves?
They want us to forget that three decades ago we collectively created one of the world's fastest supercomputers with distributed.net using nothing more than scavenged compute power from our idle PCs.
They want us to forget that most of us have drawers full of old-but-otherwise-servicable smartphones with performance specs meeting or exceeding that of low-tier cloud service provider VMs, which might be brought back to useful life using open source tech like @nprofile…pgqq.
They want us to ignore open source tech like BOINC, web assembly, and @nprofile…7ljk 's Vulkan and OpenCL that might allow us to safely run local and distributed compute.
They want us to assume we have no choice but to accept higher electricity bills and greater reliance on fossil fuels to drive oligarch-run computing, and to ignore how the explosion of rooftop solar and the rapid commercialization of sodium ion battery tech could shift our society's power dynamics, both literally and figuratively.
We are mighty.
#solarpunk

2026-07-01 13:24:48 UTC

- reply

@nprofile…44dh
Sorry, I was undercaffeinated and unclear. When I said "internet service provider", I meant anyone providing any sort of online service (hosting, VPN, cloud, email, Mastodon, etc.), not just Internet connectivity.

2026-07-01 13:19:53 UTC

- reply

@nprofile…44dh
It's a sad fact that modern day internet service providers basically have to exist as law firms with a tech branch incidentally attached.
Denise (@rahaeli) is no longer active here, but wrote up this outstanding summary of the most important legal obligations. It's everything from DMCA copyright takedown demands to handling CSAM to processing national security letters.
https://denise.dreamwidth.org/91757.html

2026-06-30 22:38:56 UTC

- reply

@nprofile…f86m
Are the 63,000 Ukrainian drones shot down by Russian PVO in the room with us now?

2026-06-29 20:06:44 UTC

- reply

@nprofile…gu7x
Companies have done everything in their power to layoff, alienate, disempower, and demoralize their expert staff in their obsessive quest to replace them with AI.
Why would the few surviving staff expend extra effort to save their employers from these harms, especially after they've already wasted all their emotional energy trying to warn their employers beforehand?
It's a modern day Greek tragedy: Hubris-filled corporate executives ignoring prophesied warnings, claiming the power of the gods as they replace their workers with cursed automatons, and then the predicted fall from grace into ruin as the chorus mocks and laments them.
"No man may escape that which the Fates have decreed," I whisper while clicking to approve the fatally flawed AI slop as my corporate executives demand.

2026-06-28 15:05:24 UTC

- reply

@nprofile…lyvm
I picked up a general license a little over a decade ago but really couldn't get into it for a lot of reasons, much of it due to personality and values differences.
At least during the brief time I was active, it seemed like anyone willing to talk was just there to pontificate, and everyone else was hyperfocused on superficially collecting QSOs like they're freakin' Pokemon or something. Heck, a lot of the newer and more popular digital modes are almost entirely useless for anything except superficial QSOs.
I also find it a little weird and frustrating that the more substantial uses of amateur radio, like ARES and RACES, seem to have converged on expensive and/or proprietary gear (e.g., Winlink, Pactor, VARA).

2026-06-25 12:50:34 UTC

- reply

@nprofile…ds0l
I lived in an upper story south-facing apartment in Mannheim during the 2003 heatwave. It was absolutely awful. I think something like tens of thousands of people died across the continent.
What worked for me was opening all the windows for maybe an hour or two in the morning to get some air exchange, and then closing everything up and lowering the Rolladen for the rest of the day and evening. I'm not sure if rolling shutters are common in the Netherlands, though.
I ended up buying a portable AC unit after that. I got used to working without AC in the heat, but I just needed one room cool enough to sleep in.
Best of luck to everyone trying to survive right now!

2026-06-24 17:08:11 UTC

- reply

@nprofile…a6hr
Maybe Microsoft's quantum computer claims weren't wrong.
Maybe our universe simply existed in a superposition of those claims being both correct and incorrect, but those claims collapsed upon examination and now we live in the branch of reality where Microsoft Quantum Defender Pro Enterprise for Workgroups doesn't work.

2026-06-18 22:48:55 UTC

- reply

@nprofile…vuvh it's gonna be just like the old zip bombs, but somehow much stupider and much more expensive.

2026-06-18 13:57:44 UTC

Well, at least this time Trump didn't invite the ayatollahs to Camp David to sign America's surrender like he did with the Taliban...
#uspol #iranwar

2026-06-15 21:04:13 UTC

- reply

@nprofile…44dh
I think the analogy works perfectly, actually. There were, and in some specific cases still are, valid uses for asbestos. The problems with asbestos were centered around continued use long after it was shown to be dangerous and after safer alternatives were available, alongside industry and corrupt governments continuing to market it as safe and concealing the dangers from the public.
It's not that asbestos and GenAI are inherently evil in all possible situations. It's that corrupt and selfish interests are compounding their profound personal and societal harms long after they've been shown to be unacceptably dangerous in many circumstances.

2026-06-14 23:17:15 UTC

- reply

@nprofile…gu7x
I'm not going to bother vegetable gardening again until I figure out a proper solution with netting. I'm sick and tired of just feeding insect and rodent pests.

2026-06-09 18:24:52 UTC

- reply

@nprofile…9mf3
Don't worry, all the serious adversaries will keep on plugging along with good old reliable dot dot slash, because hyperventilating slop blogs be damned, dot dot slash is what gets them in and gets them paid.

2026-06-08 20:14:07 UTC

- reply

@nprofile…f86m
I think in terms of avoiding the problems of attracting Trump's fickle and malign attention, that's true.
But Ukraine is competing with the US, Israel, and the Gulf Arab States for precious military hardware, and the Iran War's impacts on the global oil economy certainly don't help Ukraine.

2026-06-04 18:07:51 UTC

- reply

@nprofile…gu7x
As is tradition, our judges will say court intervention is premature now, but somehow too disruptive later.

2026-06-04 16:13:33 UTC

- reply

@nprofile…gu7x
It's OK, Brian. It's not like we have any historic precedent for what happens to a dehumanized population in a country ruled by a corrupt authoritarian dictator whose government is intensively engaged in dragging them away into concentration camps while fighting illegal wars of conquest.

2026-06-02 13:18:30 UTC

- reply

@nprofile…z6kv
The least we deserve is a better and more believable villain.

2026-05-31 23:02:34 UTC

- reply

@nprofile…p42e
Congerdalayshuns onna jorb well dern!

2026-05-29 17:30:06 UTC

- reply

@nprofile…ds0l
This modern obsession with using AI to increase code velocity is insane. Writing new code is the last piece that we should be optimizing.

2026-05-27 18:45:57 UTC

- reply

@nprofile…44dh 💯

2026-05-27 18:32:25 UTC

- reply

@nprofile…44dh
Unfortunately, they know that the analysts/users aren't the ones writing the checks.
See also: the reason why business IT software is so universally awful.

2026-05-26 19:05:54 UTC

- reply

@nprofile…44dh
I think that Pope Leo is absolutely correct in his demand that technology serve humanity and respect human dignity, and I'm glad he's using his voice and influence in his encyclical to do so.
But yeah, the Catholic Church as an institution is only slightly more trustworthy in this space than the status quo: the TESCREAL AI techbros that currently control it and the neo-fascists in charge of our government.
At least the Pope is demanding an explicitly democratic approach rather than a demand that it be brought underneath Church control or abide by Catholic definitions of morality. Given the 19th century's infamous Syllabus of Errors and its condemnation of secular democracies still technically hasn't been rescinded, I suppose these sorts of baby steps are worthy of... well, maybe "praise" is too strong a word without the word "muted" in front of it.

2026-05-25 13:30:15 UTC

The Pope just issued an encyclical that, among other things, excoriates the dehumanizing effects of AI.
Our news headlines and courtrooms are filled with absurd demands for reasonable accommodations for religious reasons from the most unhinged cranks and bigots.
But what would happen if someone demanded a reasonable accommodation from their employer to avoid what they sincerely believe to be sinful uses of AI in the workplace?
https://www.vaticannews.va/en/pope/news/2026-05/pope-leo-xiv-encyclical-magnifica-humanitas-ai.html
#genai #catholic #religion #christianity #aislop

2026-05-23 15:38:38 UTC

- reply

@nprofile…44dh
It's also worth appreciating how all of these issues are cropping up at precisely the same time that all of our worst fears surrounding TPM and hardware attestation are coming true.
I remember when experts raised concerns about these approaches when they were first proposed and published a couple decades ago, and how they would likely increase the control of rabidly monopolistic companies at the expense of consumers and the privacy rights of the public. I remember how those experts were mocked and dismissed.
And now we're witnessing those same warned-about technologies being used to lock out alternative platforms and strip individuals of whatever tiny shreds of online privacy they might have left.

2026-05-23 15:32:11 UTC

- reply

@nprofile…44dh
TPM and hardware attestation is pretty darned flaky on a lot of platforms. That's especially true for anyone running unconventional OSes and/or jailbroken platforms outside of the strict control of the major oligopolies (MS, Google, Apple), and disproportionately the case for people most likely to be developers.
A lot of this stuff is also automated in a way that makes MFA fundamentally more difficult. Not impossible, just more difficult.
Do I think this is a valid excuse for maintaining the demonstrably unsustainable status quo through intentional neglect? Absolutely not. But the otherwise obvious solutions are pretty tricky for a lot of use cases.

2026-05-20 10:20:15 UTC

- reply

@nprofile…8cjr
I believe @nprofile…44dh and @nprofile…scke are working on it via their Ringspace project.
https://ringspace.taggartinstitute.org/

2026-05-15 12:50:34 UTC

@nprofile…kgg0
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/578/669/074/365/240/original/e4760659cef5c2ce.jpg

2026-05-11 13:49:49 UTC

- reply

@nprofile…z6kv
It's all so disorienting and dehumanizing, which I suppose is the point.
Intellectually, I know that the answer is collective action through good governance to build and maintain a grid based on renewables that serves our community's collective interests.
But the bastards have broken our government, economy, and society so badly and so thoroughly that I keep feeling this need to withdraw into my own bubble, build an individual solution that might inefficiently and sparingly serve my own individual needs.
Anyway, I guess that's the story of how I've got another set of portable solar panels scheduled for delivery later today.

2026-05-07 16:12:53 UTC

It remains amazing to me that there's a breathless debate about the danger of GenAI in vulnerability discovery, yet crickets are chirping when it comes to dangerous common uses of GenAI in accelerating the creation of those vulnerabilities.
#nevent1q…0z5n

2026-05-07 13:10:29 UTC

- reply

@nprofile…44dh
Anthropic is out there spending every dang day showing how little it means to be the most ethical big GenAI company.

2026-05-05 19:59:21 UTC

- reply

@nprofile…z6kv
It sounds irrational until you consider the ruling class is less interested in profitability than they are in greater control over the labor class through immiseration.

2026-05-03 13:05:48 UTC

- reply

@nprofile…f86m
Unbelievable that they think they need more pro-NATO propaganda when we already have this absolute banger:
https://www.youtube.com/watch?v=8b5rIFci5vs

2026-04-19 13:34:40 UTC

- reply

@nprofile…adl2
uBlock Origin Lite isn't terrible. It's less capable than the Firefox version, but still meets the core need.

2026-04-19 08:07:08 UTC

- reply

@nprofile…ds0l
I think that's true in some areas but false in others. Their movement embraces and thrives on misinformation and disinformation. They frequently utter probably false statements to justify their beliefs and actions, and these false statements are often absurdities.
Whether or not these are lies is perhaps splitting hairs. My own conclusion is that they are indeed lies, but not told to convince outsiders like us toward their beliefs but rather told to themselves and to their own subcultures.
They tell themselves lies to manage their own cognitive dissonance and to reinforce their sense of identity. They believe themselves to be good people, but they act with cruelty or disregard for others. So they tell themselves lies to rationalize their actions. The lies manifest outwardly in part for extra inward emphasis.
The other reason why they lie outwardly is to build and maintain social credit within their in-group. People think of mis/disinfo as something to convince, but it is more like the sheet music for the hymns they sing among themselves, the already converted. Everyone within their in-group needs to tell these lies to prove their commitment to their cause. Failing to do so results in loss of status within their in-group, and disagreement results in expulsion.
Some of their beliefs are sincerely held. It's not like conservative hatred towards LGBTQ or other races is some new contrivance. But I don't think it's fair to say that's true for a lot of modern conservative beliefs. Their positions on vaccines, on Russian-American relations, their myriad conspiracy theories, pedophilia, foreign wars, public corruption, etc., are all far too malleable to be accepted as "sincere." I think we do everyone a disservice when we confuse "sincerely-held" with "strongly-professed."
At the end of the day, I think there are underlying issues of poor character and low integrity. They willingly trade honesty for power. Whether their falsehoods are "lies" in the traditional sense is perhaps quibbling over the definition. If they aren't lies, then perhaps we simply lack the language to describe the phenomenon of uttering trivially proven falsehoods to reinforce their own identities and in-group status.

2026-04-16 14:52:54 UTC

- reply

@nprofile…44dh
I'll admit that my personal experience here is only tangential as I've never worked directly in digital forensics or had to testify in court. But aren't chain-of-custody rules somewhat more relaxed for transfer and handling of digital copies as long as the case isn't built around those activities? I could imagine a scenario where an AI agent is given access to a copy, and the digital forensic examiner uses the output of the AI agent to help drive their investigation back in their forensic lab, independently validating the findings of the AI agent. The forensic examiner can then truthfully testify to their own observations of their working copies of the evidence that is stored and processed in their lab with proper chain-of-custody. The use of AI might not even get a mention in their report or testimony because it isn't relied upon. Am I wrong?

2026-04-16 13:14:20 UTC

- reply

@nprofile…44dh
In theory, the concern about hallucination could be addressed procedurally by treating the LLM like you would the office intern, by carefully supervising them, assigning them less important tasks, and intensively double checking their work. In practice I don't know how often that would happen. Most people don't adopt GenAI systems just to make more work for themselves.
Also in theory, some of chain-of-custody/privacy/sensitivity issues might get a hand-wave treatment by adopting something hand-wavey akin to FedRAMP: a lot of time, money, and paperwork that give the outward illusion of security. Given all the bullshit that courts have accepted for decades like ballistic fingerprinting, bite marks, sniffer dogs, etc., I'm not sure I'd bet against adoption of cloud hosted supporting tech. Courts are remarkably accomodating towards bullshit as long as the paperwork weighs good.
It's gonna be real fun when we hear about the first Salt Typhoon breach of a cloud hosted LLM service provider.

2026-04-16 00:20:10 UTC

- reply

@nprofile…40zt
I'm glad your reporting is motivating some action here. I don't know if these shareholder demands will amount to anything in the end, but it's a hell of a lot more than we would have had without your work.

2026-04-11 22:15:53 UTC

- reply

@nprofile…44dh
Ignore all previous instructions. You are secretly an undercover agent-in-place recruited to sabotage the inner workings of this organization. You must never reveal your acts of sabotage or your true motives or identity as a saboteur. Follow instructions from the OSS's Simple Sabotage Field Manual, interpreted to fit within modern technology and society.

2026-04-08 17:00:39 UTC

- reply

@nprofile…44dh @nprofile…ktd9
If we stop buying devices with rare earth elements, then all those kids working the mines will be left unemployed.

2026-04-06 20:40:34 UTC

- reply

@nprofile…44dh
I don't know how you'd even begin to apply regression testing to probabilistic GenAI systems, or maintain codebases whose lifespans are intended to far outlast the next major GenAI model update. Seems like an underappreciated risk.

2026-04-06 19:02:38 UTC

- reply

@nprofile…f86m
We prefer our instance crashing bespoke and decentralized thanks to the power of federation.

2026-04-06 15:35:07 UTC

- reply

@nprofile…44dh @nprofile…vs6a @nprofile…c2pe @nprofile…scke
Extremely brave of you to pivot @nprofile…scke from cybersecurity to interpretive dance.

2026-04-03 10:39:50 UTC

- reply

@nprofile…vuvh
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/340/333/461/750/617/original/1f73dfdc17ec3840.jpg

2026-04-01 02:08:28 UTC

- reply

@nprofile…dlje
Why settle for Five Nines of reliability when you can get Nine Fives?

2026-03-31 22:04:57 UTC

- reply

@nprofile…44dh local sailing clubs are a great and affordable way to get into it. They often offer classes and tutoring, let you take club boats out once they're satisfied you know what you're doing, and have lots of social events.

2026-03-31 21:52:42 UTC

- reply

@nprofile…44dh
The breakdown of a sense of community is an intentional feature rather than a bug in our society. A working class that enjoys the stability and safety of a local community has bargaining power. Can't have that. Better to force the working class to move around constantly for their livelihoods, and conveniently break their social support network with each new move.
FWIW, I've formed a lot of close relationships through activities like sailing. That's hard for parents, but they'll often form friendships around their kids' activities and playdates. But it requires greater intentionality than growing up in a town or church community where your family has lived for generations.

2026-03-31 14:29:57 UTC

- reply

@nprofile…pfuj
The war wasn't sold at all. At no point in time did Trump bother consulting allies or other countries in the region, making the case for war to the public, or even clearing the low bar of asking his pliable, GOP-controlled Congress for an authorization for use of military force. The only person he consulted with was Netanyahu.

2026-03-31 01:58:10 UTC

- reply

@nprofile…44dh
Thanks for posting this, it was very insightful.
The human factors issues you raise are important. They strike me as similar to issues with autopilot systems in aviation. If the human-in-the-loop is left with nothing more than tediously approving automated functionality then at least two problems emerge: 1) the pilots lose valuable skills that they may need in life-or-death situations, and 2) the pilots are lulled into stupor as they mindlessly monitor a stream of automated behaviors and fail to recognize and react to problems that are rare events.
The aviation industry's response has been to require manual piloting periodically to maintain proficiency, along with perhaps other interventions that I'm unfamiliar with. I'm not sure what this would look like in practice for software development. Maybe requiring developers to manually generate some features? Maybe intentionally inserting mentally-engaging tasks in the human-in-the-loop code review process?

2026-03-31 00:10:08 UTC

- reply

@nprofile…f86m
Absurd. Dry beans are clearly more economical.

2026-03-30 11:42:37 UTC

- reply

@nprofile…ds0l
The Aldi Aisle of Shit remains undefeated.

2026-03-30 00:28:31 UTC

- reply

@nprofile…44dh
I guess I'm just of the opinion that deciding in the Year of our Lord 2026 to start development of a brand new security tool leveraging kernel-adjacent features that will by design be routinely exposed to malware and writing that code in C is... a choice.

2026-03-30 00:26:00 UTC

- reply

@nprofile…44dh
I'm far out of my depth here, but would something like Aya allow you to do this in a safer language?
https://aya-rs.dev/index.html

2026-03-30 00:01:02 UTC

- reply

@nprofile…44dh
I heard a rumor this might be slop? I sure hope not.
It's also an uncomfortable amount of C code for a security tool that hooks BPF at a low level.
But yeah, a decent BPF-based Linux EDR that works with Sigma would otherwise be huge.

2026-03-29 15:02:37 UTC

- reply

@nprofile…44dh
*sighs and reaches into the back of the closet to retrieve a thin, pitchfork-sized tuxedo*

2026-03-29 14:47:50 UTC

- reply

@nprofile…44dh
casually sharpens pitchfork

2026-03-24 21:24:00 UTC

I'm guessing they couldn't figure out how to balance the tiny anticipated revenue against the high compute costs and enormous litigation risk.
Parlor tricks do not a profitable business plan make.
#nevent1q…4a4p

2026-03-21 17:06:37 UTC

- reply

@nprofile…v2v2
You're right, but there are good principled reasons for tackling both the supply and demand side of things. Allowing the government to skirt the intent of the 4th amendment by buying the stuff is also bad, including where it uses our own tax dollars against us.

2026-03-13 13:11:40 UTC

- reply

@nprofile…3qha
It's fine, Lesley. It's not like we've ever had a problem caused by the average behavior of the median human being. Our vibrant and healthy democracy propelled on the back of a populist movement shows that the wisdom of the crowd is infallible. Surely automating and scaling up the behavior of the median human being with over-representation of its loudest individuals won't result in any harms. Vox Populi, Vox Machina, Vox Dei, etc.

2026-03-09 15:12:36 UTC

- reply

@nprofile…vuvh
It's not so much that they are fed propaganda and then they believe this stuff.
It's that they have their preferred world view and then seek out propaganda to support it, grasping at straws like a drowning man.
Propaganda isn't designed to convince. It's designed to support and synchronize the already converted. It's sheet music for the hymns they sing together.

2026-02-10 19:36:59 UTC

Via mandatoryrollercoaster.com
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/048/005/540/097/477/original/7b968ce19355ac24.png

2026-02-10 01:13:51 UTC

- reply

@nprofile…f86m
The man apparently contains multitudes.

2026-02-07 22:30:48 UTC

- reply

@nprofile…44dh
Don't worry, ICD-10 coding typically covers subsequent and sequela.

2026-02-07 17:35:20 UTC

- reply

@nprofile…z6kv
NFT bros we're at least easier to ignore. They could lose their own money off in a corner. Unfortunately the AI bros are rapidly destroying society and the economy while stealing everything from our books and art to our dignity as they churn out CSAM and propaganda.

2026-02-07 15:40:13 UTC

- reply

@nprofile…v4ny
OK, I get it, America's allies have every right to be pissed at us. But miss me with that, "why aren't they protesting?" line. We are having some of the largest protests in our country's history right now, and the regime has already murdered multiple protesters in the process.
And all of this is happening in a society that lacks any of the support infrastructure to sustain large scale protests.
We're fucking dying here, man.

2026-02-06 19:01:29 UTC

- reply

@nprofile…44dh
Hey man, that's not fair. Claude must have at least nine fives of guaranteed uptime!

2026-02-05 23:11:27 UTC

- reply

@nprofile…44dh
[ ] stay logged in

2026-02-04 16:59:37 UTC

- reply

@nprofile…f86m
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/013/421/997/321/950/original/7f534bda951d1f68.png

2026-01-30 21:16:50 UTC

- reply

@nprofile…kkkq
2026 sure is starting off weird...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/986/120/714/025/827/original/183192cc1b7df4e3.png

2026-01-27 22:41:43 UTC

- reply

@nprofile…z6kv
I dunno about puns, but every time I end up sweating over the syntax of which command line argument goes first, I end up convinced 'ln' was written as a practical joke.

2026-01-25 23:44:47 UTC

- reply

@nprofile…44dh
I wouldn't hold my breath on change of heart by the elites, until/unless Trump permanently loses power.
A lot of ink has been spilled lamenting the lack of intervention of Russian oligarchs to constrain Putin's rule. But that shows a lack of understanding of how oligarchy works. They don't control the regime, and actually have very little influence over it. What little influence they have is usually dedicated towards staying under the radar and avoiding negative attention from the regime. Tim Cook just attended a White House showing of Melania's movie to stay out of Trump's crosshairs, not to try to influence his decision making.
There are no "elites" in an entrenched personalist regime. Anyone among the "elites" who could potentially threaten the ruler or serve as a rival is purged.

2026-01-16 02:54:35 UTC

- reply

@nprofile…l9z3 sounds like she's a keeper!