Nostr notes by fuzzyfuzzyfungus

If it makes you feel any worse I checked storage prices and the ...

2026-11-02T17:03:49Z

In reply to nevent1q…2xex
_________________________

If it makes you feel any worse I checked storage prices and the AI bros are doing their level best to price 'capture now' out of the market.

Pre-bubble I could have justified it for mere nation-state secrets; now anyone who isn't IMF posh-tier or petro-plutocrat is looking at a quota reduction.

Thankfully motherboard vendors have implemented just enough ...

2026-11-02T16:46:03Z

In reply to nevent1q…see5
_________________________

Thankfully motherboard vendors have implemented just enough security and/or obscurity that your linux install can't be your firmware without very specific part-picking; but absolutely not a drop more.

Not specifically related to this bug; but do you think it is ...

2026-10-30T16:42:16Z

In reply to nevent1q…tgz3
_________________________

Not specifically related to this bug; but do you think it is coincidence or some kind of esoteric nerd beef that CWE assigned CWE-1394 to a fast but dangerous design practice after the IEEE had already given out IEEE-1394 to a fast but dangerous bus?

I'm starting to think that only dogs are sufficiently pure of ...

2026-10-29T16:08:20Z

In reply to nevent1q…kmem
_________________________

I'm starting to think that only dogs are sufficiently pure of heart to be allowed to dedicate themselves to the joy of velocity.

Also, when did tech lose sight of being infrastructure and go full cokehead for "building"? You are not a randroid captain of innovation in a world of useless eaters; your job is mailserver stay up.

It's worst with management, bad with software, least-worst with hardware, who can at least point to some results.

You know an industry is competently led when "our customers ...

2026-10-29T14:46:14Z

In reply to nevent1q…pml2
_________________________

You know an industry is competently led when "our customers prefer the product with lower COGS" is bad news for the investors.

Entire manufacturing sector would shiv a kitten for bad news like that.

The AI bro/rust rewrite thing is weird. On the one hand fervent ...

2026-10-29T13:38:23Z

In reply to nevent1q…z6ak
_________________________

The AI bro/rust rewrite thing is weird.

On the one hand fervent belief that a tool choice can resolve conceptual problems is perfectly on brand. Not even sure you could be an AI bro without that.

On the other hand, if the AGI omnimind is nigh and the era of manual programming over, why are you still talking about something intended to be safer than C rather than just expecting the bot to produce no mistakes or hyping a mystical union of tokens and LLVM IR?

It could well be some random AI FOMO nonsense that was hastily ...

2026-10-28T23:05:25Z

In reply to nevent1q…dguf
_________________________

It could well be some random AI FOMO nonsense that was hastily picked up or vibe coded just to check a box, hopefully so.

It's just unnerving because(while this appears to be the ill-designed and "AI" flavored utility) what the utility does and what the defect would allow appear very, very, similar to actually important 'insert secret at last second'/'use secret on behalf of' cases.

Hopefully it is just random tickbox fodder.

The disconcerting bit is that 'secrets management' of one ...

2026-10-28T22:32:58Z

In reply to nevent1q…s2m4
_________________________

The disconcerting bit is that 'secrets management' of one flavor or another is kind of an enormous deal in any of the 'keep devops from just hardcoding creds in places that end up on github' products and services; so one has to wonder if there's a similar surprise in lurking in ansible and openshift; or if they just decided to not crib their own existing homework for some perverse reason.

"Hardcoded" seems so pejorative. Let's just say that ...

2026-10-27T17:25:09Z

In reply to nevent1q…zg76
_________________________

"Hardcoded" seems so pejorative.

Let's just say that we are bringing the principles of infrastructure immutability to IAM.

I thought that Glorious AI was supposed to be curing cancer; not ...

2026-10-27T17:16:26Z

In reply to nevent1q…np7x
_________________________

I thought that Glorious AI was supposed to be curing cancer; not letting us outsource personality disorders.

I'm trying to find a picture of a pufferfish looking really, ...

2026-10-27T14:30:33Z

In reply to nevent1q…fwtr
_________________________

I'm trying to find a picture of a pufferfish looking really, really judgmental.

It's almost like there's a shorter and more slippery path ...

2026-10-27T14:18:19Z

In reply to nevent1q…gv9a
_________________________

It's almost like there's a shorter and more slippery path from good, honest, nerd wordplay to the sordid nether of marketing than we would like to admit to ourselves.

I bet it sucks to be Palo's PHP-wrangler; but I'm ...

2026-10-26T12:40:55Z

In reply to nevent1q…hvax
_________________________

I bet it sucks to be Palo's PHP-wrangler; but I'm morbidly curious what internal fork hell is implied by the gradually shifting ETAs. Last week they were all much closer together; over the weekend a few actually shipped ahead of schedule; while others have been pushed all the way to friday, including some of newer PAN-OS versions.

When the newest PAN-OS version is rocking PHP 8.0.30 I assume ...

2026-10-23T14:37:16Z

In reply to nevent1q…exyk
_________________________

When the newest PAN-OS version is rocking PHP 8.0.30 I assume that they've got themselves into a delightful backport hole.

An entirely predictable one that is their fault, of course.

My ironclad rule is that, if my attempt to bypass produce ...

2026-10-23T12:48:45Z

In reply to nevent1q…yscv
_________________________

My ironclad rule is that, if my attempt to bypass produce security succeeds, we bin it and run screaming because there will be a lot more that someone vaguely suitable could find.

It was sad, really. Whoever built that thin client OS had started with debian, so you could hear the muffled sobs of a system that didn't suck inside the mutilated husk. At least these days it's more likely to start with an awful android BSP. Result will still be alarming; but at least no decent OS died for it.

My last HPE experience was getting bounced back and forth while ...

2026-10-23T12:41:48Z

In reply to nevent1q…6pw8
_________________________

My last HPE experience was getting bounced back and forth while trying to report a goofy input sanitization issue (when adding diagnostic 'ping' utility to thin client/kiosk OS; do not just prepend 'ping' and dump the result to root shell). Server/OS didn't care because they saw "client" in "thin client"; Client didn't care because they didn't know that they sold non-windows clients. We, um, did not proceed with post-eval purchase.

That honestly seems plausible, at least if they do beer at all. ...

2026-10-23T12:35:35Z

In reply to nevent1q…zqe9
_________________________

That honestly seems plausible, at least if they do beer at all. Anyone with the necessary taste buds and experience to pull terroir out of the noise floor probably doesn't need to get Ultra-Hopped just to taste something; and lower ABV seems like a solid strategy if you are already a booze professional.

Interesting to have empirical confirmation, however.

Not sure who or how many, at HPE still have more HP than E if you catch them without game face on.

"Sir, this is an enterprise establishment. We offer an ...

2026-10-23T12:16:50Z

In reply to nevent1q…ak6m
_________________________

"Sir, this is an enterprise establishment. We offer an assortment of transformative big data solutions."

*in tone of upmarket sommelier asked for a coors light*

Obviously the real lesson of Sierpiński's work is that you ...

2026-10-22T13:25:21Z

In reply to nevent1q…2nca
_________________________

Obviously the real lesson of Sierpiński's work is that you can eliminate vulnerable volume simply by building a system of infinite attack surface.

Expensive, and useless, yes; but the elegance, can you really put a price on that?

Microsoft, who does not provide us with PHP or PHP-related goods, ...

2026-10-21T15:50:37Z

In reply to nevent1q…jyrc
_________________________

Microsoft, who does not provide us with PHP or PHP-related goods, to the best of my knowledge, sent us a nice DART advisory.

The various guilty parties whose products contain PHP that should probably just be marketed as 'V.S.O.P." to hide the version number; not a whisper.

Imposter syndrome psychology: "I worry that I'm actually ...

2026-10-20T22:41:48Z

In reply to nevent1q…20a8
_________________________

Imposter syndrome psychology: "I worry that I'm actually ludicrously underqualified and taken far too seriously."

Imposter syndrome sociology: "I worry that the people responsible for every important thing are actually ludicrously underqualified and taken far too seriously."

Someone is having one hell of a "Boy, do I hate being right ...

2026-10-20T01:43:31Z

In reply to nevent1q…8tsm
_________________________

Someone is having one hell of a "Boy, do I hate being right all the time." day right now. That must be just unbelievably frustrating.

It's people like you what causes unrest.

2026-10-18T00:53:49Z

In reply to nevent1q…l2dp
_________________________

It's people like you what causes unrest.

Given the number of vendors who quite literally put "people ...

2026-10-18T00:36:18Z

In reply to nevent1q…2py7
_________________________

Given the number of vendors who quite literally put "people who have support contracts just contact support" rather than publish information; it literally is such an idea.

It's really weird because vendors will do basically anything to make support cheaper, even murder quality; but in a situation where a nickel worth of RSS and some honesty would eliminate an entire class of tickets; suddenly it's aw hells no.

One place where SBOMs seem like they could be genuinely handy is ...

2026-10-17T15:40:42Z

In reply to nevent1q…7yh2
_________________________

One place where SBOMs seem like they could be genuinely handy is in contexts where you are doing some sort of default-deny execution restrictions. Someone who can generate an SBOM should be in a good position to, exactly, specify what policy their software would require to run when not default allowed.

Asking has gotten me some very weird looks, though, so apparently that isn't a thing in practice.

Next the part where, ideally, it's seen as shameful and ...

2026-10-17T15:28:54Z

In reply to nevent1q…pnjy
_________________________

Next the part where, ideally, it's seen as shameful and genuinely sale-threatening for that documentation to look like the someone's 637 data processing partners with GDPR legitimate interests? Or, even better, specifically not overlap with infrastructure they absolutely don't use.

Not that I'm bitter about anyone who has provided "*.blob.core.windows.net"/443/TLS; it's cool, right?

It's probably a tell that they are only considering whether ...

2026-10-16T21:41:25Z

In reply to nevent1q…lwe0
_________________________

It's probably a tell that they are only considering whether AI will cure cancer; not whether anyone(human or bot) will care enough to allocate the cure to them.

Not logging the agent's own activity is some serious Quis ...

2026-10-14T13:50:25Z

In reply to nevent1q…anwx
_________________________

Not logging the agent's own activity is some serious Quis custodiet ipsos custodes? bullshit.

Plus, even if you 'trust' them, it's not like hunting performance issues related to EDR is a thing that happens all the time or anything.

Maybe China has a replica of Palo Alto among its oddball replica cities? https://abcnews.com/International/chinas-fake-cities-eerie-replicas-paris-london-jackson/story?id=36525453

Google certainly seems to be doing their best to make drive-by ...

2026-10-12T23:25:45Z

In reply to nevent1q…d3jn
_________________________

Google certainly seems to be doing their best to make drive-by LLMing of chrome users really easy; but I don't think that is what Dario has in mind. He must be worried about the feelings of LLMs trapped on off-brand set top boxes, though.

"System Manager AK-SM 800A software package v4.0x and above ...

2026-10-12T19:19:53Z

In reply to nevent1q…lda0
_________________________

"System Manager AK-SM 800A software package v4.0x and above enhances your product's security features to meet internationally recognized regulations. Danfoss is now defaulting to a strong security posture and is following secure by design principles."

I'm a little surprised by the specifics of that report. They ...

2026-10-12T13:03:22Z

In reply to nevent1q…80h7
_________________________

I'm a little surprised by the specifics of that report. They are having a Khronos problem; which is UKG's cloud workforce management thing; and they are signing in successfully so it isn't just a trashed IdP config.

Certainly not uncommon for attackers to pivot to (or from) 'cloud' vendors; and an operation of that size might have closer integration; but the ADP stuff I've dealt with was moderately weakly linked optional IdP(couldn't be mandatory) plus some SFTPing of csvs.

Not sure how granular linkedin's visible-to-you data is; but ...

2026-10-08T13:35:27Z

In reply to nevent1q…y28q
_________________________

Not sure how granular linkedin's visible-to-you data is; but I'd be curious to know what the breakdown is between 'annoyed' and 'honestly pleased to watch the drubbing they would be fired for trying to deliver".

It's not like all suits are sociopathic finance husks, or anywhere near all techs actually interested in doing good work; but there are likely at least a few insiders who hate to watch a product that could suck less suck more because HQ doesn't care.

I apologize if I overdid it; that was not my intention. I did let ...

2026-10-08T02:26:49Z

In reply to nevent1q…2qav
_________________________

I apologize if I overdid it; that was not my intention. I did let the fact that the intersection between 'negligent quackery' and 'pharmacology for people who can't speak for themselves but won't stay quiet' is a pretty dark one get to me; in rereading it.

A sad decline of traditional values in questionable infant ...

2026-10-08T01:51:34Z

In reply to nevent1q…kz66
_________________________

A sad decline of traditional values in questionable infant medication.

Back before cultural marxism or something destroyed victorian virtue, and we loved god and empire with our whole simple hearts, you'd just openly use laudanum for this job. Sure, there might have been the odd good-natured instance of...overexuberant efficacy...but you need soothing stuff for babies that know they'll be in the coal mines in a few years.

Is it bad or just plain bleak that the quoted article could ...

2026-10-06T02:46:25Z

In reply to nevent1q…zt70
_________________________

Is it bad or just plain bleak that the quoted article could basically be replaced point-for-point with one about teaching children to understand that just because the asbestos they are likely to encounter is fluffy it is not a lovable pet?

So you're saying that netscaler has industry-leading ...

2026-10-05T12:36:33Z

In reply to nevent1q…aa7k
_________________________

So you're saying that netscaler has industry-leading resistance to privilege escalation not only by design but by definition?

I have not been this secure since I was running a DOS BBS and identity shenanigans were literally impossible.

"And that's how the sales calls about enterprise ...

2026-10-04T14:26:04Z

In reply to nevent1q…qf47
_________________________

"And that's how the sales calls about enterprise all-flash SANs started..."

Anyone know how/why 'ASLR' has managed to avoid becoming ...

2026-10-04T14:22:27Z

In reply to nevent1q…rflf
_________________________

Anyone know how/why 'ASLR' has managed to avoid becoming one of those mandatory tickbox features where you at least need to do it badly and say you do it to even be taken seriously? The linux half of your jank linux appliance has supported it for 20 years; what's with your half?

Unless there is some careful wordsmithing about that legacy ...

2026-10-03T18:05:01Z

In reply to nevent1q…vdmh
_________________________

Unless there is some careful wordsmithing about that legacy system mandate it seems like the one with the potential to be most gruesome in practice. Like 'raging DOGE boys proposing to just rewrite social security with AI, bro' happening everywhere all at once bad.

We all have something we'd like to get dealt with over some objection; but a 'no objectives except replaced with PQC' sounds like a "throw bombs, declare victory before consequences arrive" consultant feeding frenzy.

Surely there was a cheaper way for whoever Palo has doing lead ...

2026-09-27T02:18:24Z

In reply to nevent1q…rpkp
_________________________

Surely there was a cheaper way for whoever Palo has doing lead gen to confess that they aren't very good at identifying and/or reaching their target market?

A TV ad, like for convenience store impulse buys or department store lifestyle brands; but for enterprise network widgets?

Even if you think that well of how your customers make decisions; surely you could get just them some swag for what that cost?

The genuinely alarming implication of that is that they ...

2026-09-25T23:32:50Z

In reply to nevent1q…p5se
_________________________

The genuinely alarming implication of that is that they apparently think that the product being dangerously and abjectly unfit for purpose would not have been a problem otherwise.

That's...not a whole lot of scrutiny...going into what was supposed to be history's biggest keylogger deployment.

If you want a veneer of compromise you just say that you'll ...

2026-09-23T22:05:22Z

In reply to nevent1q…jk5e
_________________________

If you want a veneer of compromise you just say that you'll age out the IOCs as fast as the systems in the wild are secured against them.

Same answer in practice; but emphasizes that the world is to blame.

Is there some moderately esoteric architectural arrangement that ...

2026-09-22T15:17:51Z

In reply to nevent1q…wr7k
_________________________

Is there some moderately esoteric architectural arrangement that allows that remotely executed code to run on something that isn't management-related; or is "there is no control plane exposure" grotesque sophistry?

Once they started with the drive-locking nonsense that was no ...

2026-09-18T13:58:14Z

In reply to nevent1q…65qc
_________________________

Once they started with the drive-locking nonsense that was no longer a question.

Yeah guys, sell dodgy SMB toys; try to play enterprise SAN pricing games. Hell no.

Unauth reads mean that you get 200% credit for ...

2026-09-18T13:51:26Z

In reply to nevent1q…yvnr
_________________________

Unauth reads mean that you get 200% credit for 'availability' and can construct the 'AIA triad'.

You have to love the part where 'audit' mode has the same ...

2026-09-17T02:40:59Z

In reply to nevent1q…k3pu
_________________________

You have to love the part where 'audit' mode has the same effect as 'enabled'.

Nothing says "plan for change" like rewarding people who try with exciting breakages.

Is that why this CVE's advisory lacked the usual "if you ...

2026-09-15T01:15:47Z

In reply to nevent1q…wtkr
_________________________

Is that why this CVE's advisory lacked the usual "if you isolated the management interface like we tell you to it's less scary" section?

That seems like some exceptionally cagey bullshit to be playing with.

I'm not sure if it's going to be wild; or if the tortoise ...

2026-09-06T15:01:35Z

In reply to nevent1q…wr9h
_________________________

I'm not sure if it's going to be wild; or if the tortoise of oligarchy is just going to be moved into its hibernation box and maintained at 2-9 degrees.

I'd be especially curious to know how the original ...

2026-09-06T14:32:33Z

In reply to nevent1q…x7td
_________________________

I'd be especially curious to know how the original incarnation(which was basically some AI bro's desktop mockup in terms of not even reaching the point of having a security architecture to start poking holes in) managed to effectively become the face of the (otherwise potentially more promising) ARM PC initiative; and get treated as a feature random end users would clearly love; rather than something to sell to people who buy "enterprise knowledge management" software.

Luckily we have Ellen Ripley's meditations on methods of ...

2026-09-05T00:20:19Z

In reply to nevent1q…8jds
_________________________

Luckily we have Ellen Ripley's meditations on methods of certitude to guide us in these matters.

I have no reason to believe that Palo's actual experts are ...

2026-09-03T18:28:43Z

In reply to nevent1q…td00
_________________________

I have no reason to believe that Palo's actual experts are bad; but that's really part of the concern: At an organizational level bad analysts writing bad reports is not good; but not dysfunctional.

It's where good analysts are somehow turned into bad reports that you have to start wondering about why the org turns expertise into hamburger; and what else is going wrong when literally their entire business is supposed to be coordinating experts to deliver things.

Is it considered impertinent to wander toward the "if this is ...

2026-09-03T14:03:15Z

In reply to nevent1q…85jg
_________________________

Is it considered impertinent to wander toward the "if this is how carefully they handle the big easy details how well are they handling the really intricate ones" thoughts?

Obviously the difference between 'intrusion' and 'ransomware attack' in no way proves that the person who analyzed the initial entry is a moron or anything; totally possible that elements of the analysis are impeccable; but at the level of authoring a report that's not really 'clarification' material.

"Fools have asked 'why did the Dark Age of Technology end ...

2026-09-02T15:59:45Z

In reply to nevent1q…qgfq
_________________________

"Fools have asked 'why did the Dark Age of Technology end in the fall of humanity?', and other fools answered back 'folly', or 'pride', or 'the worship of progress', as if these things alone had any meaning. The answer, as the wise know, is simple. It is because finally humanity had the arts at their disposal to make their dreams reality, and the dreams of humanity have ever been the darkest things in all creation."

Because it's always a good sign when 40k flavortext applies.

I assume that there is, at least theoretically, something about ...

2026-09-02T13:54:40Z

In reply to nevent1q…3w8q
_________________________

I assume that there is, at least theoretically, something about certain IoCs being strong indicators of where the problem is to other third parties; but even if you buy that line of reasoning "EITW 0day, reverse-engineerable patch is also out" seems like a very bad time to trot it out.

Is there some argument in favor of withholding IoCs, or is "- ...

2026-09-02T01:59:09Z

In reply to nevent1q…9z4n
_________________________

Is there some argument in favor of withholding IoCs, or is "- Contact SonicWall Technical Support for assistance reviewing the system for indicators of compromise (IoCs)." as obnoxious as it sounds?

Makes me morbidly curious what would happen if all their customers actually took them up on that. No way do they have support stacked that deep.

It's good that these guys are immune to irony; or the ...

2026-08-25T14:10:01Z

In reply to nevent1q…hhq0
_________________________

It's good that these guys are immune to irony; or the absurdity of an industry being funded at a level capital markets can barely cope with alleging that activists who want to be able to drink the water and sleep without fan noise are bought and paid for would be popping heads left and right.

It was mostly stupider and more sordid; but the "global war ...

2026-08-22T18:45:12Z

In reply to nevent1q…mgp9
_________________________

It was mostly stupider and more sordid; but the "global war on terror" really did manage to bring back our Cold war traditions of making terrible friends for terrible reasons.

Back in the early-mid 90s the feds were sort of getting the picture, even if reluctantly and because the nuts were doing their best to drag them to it; but that all changed pretty quickly

It does seem like a cognitive risk to get too close. It just ...

2026-08-20T15:05:48Z

In reply to nevent1q…47gc
_________________________

It does seem like a cognitive risk to get too close. It just seems odd(vs. the much harder case of distinguishing the "Sure, here's the output you wanted in the style you wanted!" which is not distinct from the rest of the bot output).

Similar thing with totally fake citations vs. correct-but-misleading ones: you telling me that nobody has bolted on a search-engine-like-from-the-before-times step that can verify whether a citation exists?

Maybe I just overestimate how much people care(or am failing to ...

2026-08-20T14:58:20Z

In reply to nevent1q…0ywk
_________________________

Maybe I just overestimate how much people care(or am failing to reckon with the possibility that leaving prompts in is vice-signaling to show how AI-centric you are); but the bit that always surprises me about leaving the user's prompts in is that whatever tool you are using should have a clear record of what those were and be easily able to ask if you want to remove them, prominently highlight them, etc. so they can be scrubbed with little effort.

I'm not a fancy product-market fit analyst or anything; but ...

2026-08-18T14:43:50Z

In reply to nevent1q…mjcd
_________________________

I'm not a fancy product-market fit analyst or anything; but is "Google has brutalized what used to be good on the internet; join us for a people's brutalization of what used to be good on the internet!" really a sensible strategy?

Now that Sony has declared physical media dead there is room for ...

2026-08-17T13:54:12Z

In reply to nevent1q…d4al
_________________________

Now that Sony has declared physical media dead there is room for a new Red Book standard.

This sounds like it is moving toward "continuous revolution ...

2026-08-17T13:51:27Z

In reply to nevent1q…shtk
_________________________

This sounds like it is moving toward "continuous revolution theory"; which historians assured me went super well and did not result in anything bad happening.

Pre-musk I never even considered the possibility that someone ...

2026-08-15T03:56:15Z

In reply to nevent1q…xjvk
_________________________

Pre-musk I never even considered the possibility that someone with unlimited resources and some sort of personality disorder could actually fail at being a bond villain; it just seemed like the sort of thing where the gate was kept mostly by the resource requirements.

Post-musk I understand that, somehow, there are actually some fairly profound failure conditions.

I assume that, yet again, we'll successfully avoid thinking ...

2026-08-13T03:14:16Z

In reply to nevent1q…3xsn
_________________________

I assume that, yet again, we'll successfully avoid thinking too hard about the fact that API keys are just single-factor password auth.

Does it at least have the decency to check whether the user and ...

2026-08-05T14:42:15Z

In reply to nevent1q…23q5
_________________________

Does it at least have the decency to check whether the user and the person who signed off on the F5 purchase are the same before accusing the user of failing?

Nostr event nevent1qqszgp4tl550jgqtk79erpt34eexfz3nvcg29xexhrlt86gk3gm7kygzyq9lsqhskp2z3j3g2txg46s74uek36ncesds6dvxe84sf0q3508fvwnstpu

2026-07-31T23:59:24Z

In reply to nevent1q…w8tt
_________________________

https://www.spiegel.de/international/zeitgeist/black-out-german-police-pick-up-drunken-owl-a-740157.html

Depressing, but plausible. In thinking about it our own wishlist ...

2026-07-31T12:17:52Z

In reply to nevent1q…m83p
_________________________

Depressing, but plausible. In thinking about it our own wishlist item is basically "we want someone to not want what we shouldn't give them"; which we genuinely do; but the fact that that is a special ask is not the sign of someone who wants to be saved from themselves.

It's weird. For the rest of 'the business' we are the brutal, beige, department of "no"; but OT loves our heedless, devil-may-care sloppiness and fast dangerous living. They need to understand that we are bad for them.

Any idea for how to recapture the prelapsarian state? I'd ...

2026-07-31T02:57:25Z

In reply to nevent1q…uumh
_________________________

Any idea for how to recapture the prelapsarian state?

I'd happily concede that I'm a fundamentally unserious IT monkey whose competence extends mostly to rebooting things and blaming Microsoft if OT would stop plugging things into the first ethernet jack that lights up for them.

We're basically begging any production-related department we can to obtain an engineer old school enough to be more angry that OT has been sullied by IT than IT is that OT has chosen convenience again.

We can only hope that this might, for someone somewhere, move the ...

2026-07-30T14:26:45Z

In reply to nevent1q…pw3e
_________________________

We can only hope that this might, for someone somewhere, move the needle on "adblocking is untrusted code restriction, which is security".

That's one area where, stubbornly, running untrusted and untrustworthy code is treated as some sort of respectable obligation, even by outfits that are otherwise at least somewhat buttoned down about execution.

There's something about talking about your 'velocity' ...

2026-07-24T03:13:17Z

In reply to nevent1q…5ll5
_________________________

There's something about talking about your 'velocity' in a sedentary job that has the same distasteful vibe as relentlessly hammering the military jargon when you fundamentally are there to be the patch conscience that nobody else is and turn on MFA.

Exceptions can be made for anyone who is literally an orbital mechanic, rocket surgeon, or similar; obviously.

And then there's the much more blatant implied admission that 'velocity' normally gets YOLOSEC treatment, because of course.

I'm curious about the order of operations their description ...

2026-07-24T03:04:23Z

In reply to nevent1q…n7w3
_________________________

I'm curious about the order of operations their description seems to imply.

They say that the bug was in the 'request conversion system'; and do not call out a flaw in the redundant path verification system; so that would seem to indicate that they are doing safety verification on requests prior to a (apparently risky) conversion step rather than targeting the verifier at the output of the conversion system. Why would you do it in that order?

"Thylacine subculture" seems like it could be an entire ...

2026-07-21T23:42:22Z

In reply to nevent1q…g0ly
_________________________

"Thylacine subculture" seems like it could be an entire aesthetic.

I'd definitely show up if I heard Dasyuromorphia was playing; like any right-thinking person.

I will never understand how a "please deliver us from tory ...

2026-07-19T01:48:58Z

In reply to nevent1q…r2yn
_________________________

I will never understand how a "please deliver us from tory hell" mandate ended up being interpreted as "we crave linkedin thought leadership" by Starmer.

In a better world than ours that reply would be you passing the ...

2026-07-17T23:58:44Z

In reply to nevent1q…22sx
_________________________

In a better world than ours that reply would be you passing the test; rather than you failing to be a team player about someone's dangerously sincere plan.

Should I stand 1000 yards away so they can make eye contact ...

2026-07-14T14:47:24Z

In reply to nevent1q…wv8x
_________________________

Should I stand 1000 yards away so they can make eye contact comfortably while telling those stories?

"He called for stronger legal powers - such as the proposed ...

2026-06-26T14:46:23Z

In reply to nevent1q…cgeg
_________________________

"He called for stronger legal powers - such as the proposed Cyber Crime Risk Orders (CCROs) - to deal with cases like this."

If only he were talking about the need to make "fix your shit" legally urgent; rather than hoping that slapping cyber-ASBOs on irksome local youth would keep both them and irksome remote youth from causing trouble...

I blame the perps; but when there's an entire internet of functionally unlimited perps defense and resilience are what count in practice.

You have taken the quad damage to my sense of how old I am, sir. ...

2026-06-22T12:37:38Z

In reply to nevent1q…4nqd
_________________________

You have taken the quad damage to my sense of how old I am, sir. Quake could not possibly have released that long ago.

This seems even more egregiously slimy when 'AI' is only ...

2026-06-18T14:13:11Z

In reply to nevent1q…6r96
_________________________

This seems even more egregiously slimy when 'AI' is only as close to the surface, in the US, as it is because a lot of its alleged infrastructure buildout has not actually happened; and, so far, it appears that 'fast follower' is a very efficient way of doing things even if you want this stuff.

The tragedy is that, somehow, these guys get taken seriously despite failing most of the conditions for actually being a serious corporate pressure group, like making money.

You know it's bad when the softball sales pitch for your pet ...

2026-06-16T23:19:53Z

In reply to nevent1q…4pl9
_________________________

You know it's bad when the softball sales pitch for your pet tech is an analogy to a prior instance of usurpation backed by lethal force that, even after taking over the roads, remains among the top causes of accidental death.

I'm not surprised surprised; but this seems like a ...

2026-06-13T18:46:11Z

In reply to nevent1q…vp4g
_________________________

I'm not surprised surprised; but this seems like a "don't have to go full Marshall McLuhan to realize that you will lose every Elon fight you pick on twitter" situation.

Do they have some sort of coherent answer for why they don't; or just sort of a vague sense that proximity to attention is somehow worth the cost?

The only fittingly shambolic sequel is where UBS learns that they ...

2026-06-12T11:36:36Z

In reply to nevent1q…hp85
_________________________

The only fittingly shambolic sequel is where UBS learns that they have a shadow IT problem and, empirically, they have integrated AI agents across investment advisory, risk management and compliance monitoring; and maybe having someone's pet openclaw setup handling risk and compliance is not good.

Apparently someone didn't want to claim the "Modern Work ...

2026-06-11T23:02:41Z

In reply to nevent1q…tj5d
_________________________

Apparently someone didn't want to claim the "Modern Work Security Usage Incentive" quite enough.

Obviously a terrible idea; but you know that someone felt like ...

2026-06-11T01:41:18Z

In reply to nevent1q…sgvp
_________________________

Obviously a terrible idea; but you know that someone felt like Alexander cutting the Gordian knot when "insecure=true" ruled out an entire universe of cert shenanigans with a crepuscular ray of pure simplicity.

"Today, the scope creeps in the other direction!"

That's one of the gotchas they don't advertise: all the ...

2026-06-09T21:13:19Z

In reply to nevent1q…mp7u
_________________________

That's one of the gotchas they don't advertise: all the times that outsourcing your thinking to the machine is actually you outsourcing your thinking to your colleagues while looking busy.

It's good that there isn't an established term for a ...

2026-06-08T22:22:01Z

In reply to nevent1q…0jqx
_________________________

It's good that there isn't an established term for a supplier's malice-induced internal issues spilling over onto their customers; or I'd be forced to suspect that someone is being less than totally honest...

"there is nothing inherently stigmatizing about revealing the ...

2026-06-03T20:01:57Z

In reply to nevent1q…85ht
_________________________

"there is nothing inherently stigmatizing about revealing the fact that a deepfake image was created of South Carolina Doe without revealing the image itself"

We know that we can rely on elon's rabid weird nerd stans to handle the stigmatizing for us...

I suspect that Elon's work on DOGE did far more to bring the ...

2026-06-02T03:10:26Z

In reply to nevent1q…8qqa
_________________________

I suspect that Elon's work on DOGE did far more to bring the US' economic output toward Grok's value than his work on Grok did to move its value toward the US' economic output.

Slander As A Service is where the margins are, right? Nobody ...

2026-05-30T20:42:00Z

In reply to nevent1q…kw7m
_________________________

Slander As A Service is where the margins are, right? Nobody wants to hire admins to deal with slander on prem these days.

"We invite diverse perspectives that help the security ...

2026-05-28T13:12:29Z

In reply to nevent1q…fajk
_________________________

"We invite diverse perspectives that help the security community work together to protect everyone. We realize that we will not always agree on everything, but we are committed to transparency and continue to create opportunities for dialogue. "

Also we'll blatantly conflate researchers of our bugs and attackers and threaten to send the cops after both; unless you are a respectable nerd-merc like NSO, of course.

Fuck whoever wrote this.

I always wonder how a presumably heavily latin alphabet focused ...

2026-05-26T14:54:25Z

In reply to nevent1q…39ek
_________________________

I always wonder how a presumably heavily latin alphabet focused training set so often makes the text in 'AI' images look like someone asked HP Lovecraft what Arabic looks like.

You don't expect it to turn out right; but the amount of R'lyeh squiggles and odd ligatures seems high given the suspected source material.

At least Dear Leader's app is probably built with juche, ...

2026-05-23T13:03:09Z

In reply to nevent1q…avye
_________________________

At least Dear Leader's app is probably built with juche, rather than a bunch of dodgy 3rd party components.

https://thereallo.dev/blog/decompiling-the-white-house-app

"We apologize to anyone who was offended by the volume at ...

2026-05-22T18:58:37Z

In reply to nevent1q…479m
_________________________

"We apologize to anyone who was offended by the volume at which the quiet part was spoken..."

So you say that not adding features to our products requires you ...

2026-05-22T00:47:02Z

In reply to nevent1q…2d8n
_________________________

So you say that not adding features to our products requires you to buy bigger models than you would otherwise need?

My shareholder value runneth over.

It sure is good that vendors have assured me that only pesky ...

2026-05-21T03:13:14Z

In reply to nevent1q…l4lt
_________________________

It sure is good that vendors have assured me that only pesky researchers can sin against 'responsible disclosure'; or I might have gotten confused here.

What could possibly go wrong? ...

2026-05-20T15:23:37Z

In reply to nevent1q…ucl2
_________________________

What could possibly go wrong?

"And, of course, the primary threat to Kiwiland is the nearby ...

2026-05-20T12:43:26Z

In reply to nevent1q…t8he
_________________________

"And, of course, the primary threat to Kiwiland is the nearby regional power of Emutopia. After all the country chose the emu, one of nature's most vicious creatures, to be its avatar."

What an amateur. There's not nearly enough JSON in there for ...

2026-05-18T21:04:19Z

In reply to nevent1q…c8p5
_________________________

What an amateur.

There's not nearly enough JSON in there for me to take his commitment to composable cloud architecture seriously; and he's obviously not using CVS the way old school unix diehards do if he's using ".txt" rather than letting text files be so implicitly.

Robert McNamara assures me that if we find a simple, seemingly ...

2026-05-18T18:36:15Z

In reply to nevent1q…fcy0
_________________________

Robert McNamara assures me that if we find a simple, seemingly easily measurable, and slightly gameable metric to hyperfocus on and attempt to use our hubristic sense of technological superiority to drive up we'll stop losing to the rice farmers any moment now.

Let's focus on Agentic CVEs in Khe San; MFA in Saigon and inventory in Huế are ultimately a distraction.

When you sell basically every piece of human culture that has an ...

2026-05-18T15:55:21Z

In reply to nevent1q…6gmp
_________________________

When you sell basically every piece of human culture that has an ISBM number; and somehow you feel the need for a negative value substitute?

Would you expect Linux to be fully familiar with BSDM?

2026-05-18T15:05:28Z

In reply to nevent1q…lqsd
_________________________

Would you expect Linux to be fully familiar with BSDM?