<unnamed>

Public Key

npub1rfth0en0ft89gc2p35m8mvpkk2twmvun3j2ahj0e5f5j3yfmtd4sxst8qa

Profile Code

nprofile1qqsp54mhueh54nj5v9qc6dnakqmt99hdkwfce9wme8u6y6fgjya4k6cpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsu7mue4

Publishing to

relay.damus.io

nos.lol

Last Notes

2026-10-26 09:09:19 UTC

I am tired of watching (and dealing with the fallout of) progressives/the center left/"liberals" across the west giving up on the idea of universal human rights and instead fighting to throw people to the fascists to save their own skin.
It never works. Fight where you stand or die where you kneel.

2026-10-20 17:22:33 UTC

In today's news, "4" is not an appropriate private key for your root CA cert, no matter what XKCD tells you.

2026-10-09 20:35:59 UTC

Are we the baddies
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/412/866/247/716/355/original/0f289eb63d6f7bfa.jpg

2026-10-08 08:55:11 UTC

Abstraction is the original sin of technology. It's essential to do anything and we have taught two generations to treat abstractions as real, but not what's beneath the ones they use nor the implications of this lie, and we wonder why no one can see the impact the lie has on their work and world.

2026-10-06 22:46:52 UTC

I just finished James C. Scott's last book, In Praise of Floods. It's a delightful, gentle book. I first read his Seeing Like a State something like fifteen years ago, and the way he sees the world has been a constant companion in my head and has shaped my thinking ever since. It seems weird that I'll never again get to read a new book of his, but this was also a fitting close.

2026-10-05 10:48:35 UTC

Given that the device linking channel has been used for attacks against @nprofile…kyv9 users, should a user linking a new device be treated as a soft compromise, e.g. not something that undoes safety number verification, but still something that the user is notified about, possibly including the modal when they first send a message after the change?

2026-10-03 19:20:48 UTC

It's a pity they weren't in a position to extend that analysis to the business and enterprise tiers. I'm assuming they would see differences, especially at enterprise. If they don't, uh, boy do I have some auditor questions.
#nevent1q…rl7g

2026-08-25 06:44:09 UTC

This is both brilliant and absolutely cursed: https://fzakaria.com/2026/08/23/your-executable-is-a-sqlite-database

2026-08-21 00:16:21 UTC

- reply

@nprofile…p9u9
It's like there was a reason for the secure attention key

2026-07-24 16:51:16 UTC

Availability and office hours!
I've currently got room for an additional client. If you're a startup looking to build a security program or an for outside review or course correction for your existing efforts, this is your chance to get the help you need to do it right.
I'm also re-opening my office hours for folks who'd like to pick my brain on security strategy for SMEs, or on specific technical problems. If you're a CTO/VP Eng/etc. of an existing org, you can grab an hour of my time for free. No sales pitches — it's fun to meet new folks and chat about problems. I'll shut this down when I get busy again. Here's the link:
https://calendar.app.google/P4auoGeXDRhLdRzbA
If you're seeing this from a repost and don't already know me, I run Systems Structure Ltd., a boutique consultancy providing fractional CISO services to tech-centric startups. Over the past nine years I've helped nineteen companies start their security journeys or validate their strategy. Before starting SSL, I spent a decade with other consultancies, focued on application security, threat modeling (including methodology research), and security architecure. I took five years off from the commercial world to help news organizations and NGOs targeted by nation states, doing both direct security support and tool development. I went back to industry as the security architect for Etsy, and then decided it was time to go back to consulting.

2026-05-16 11:28:06 UTC

Can someone commission Chuck Tingle to write "Pounded in the Ass by my Own Inability to Not Build the Torment Nexus"?

2026-05-09 12:20:57 UTC

Changing phones, and my god it's fucking annoying what a walked garden chrome and firebox both are. Like Jesus fuck, absolutely zero possibilities to move bookmarks if you're not using their fucking desktop sync protocols? Like, it's bad enough that you have to use sync in the first place, but there's literally no phone to phone option? Not to mention no option to, you know, just use a fucking json file.
[If you want to suggest an alternate browser, please spare me instablocking you]

2026-04-15 06:38:57 UTC

- reply

@nprofile…3qha
It's excellent! I'm curious how a non-security group will do with it, though — I feel like it might get tricky

2026-04-05 10:52:04 UTC

- reply

@nprofile…ynf4
I look forward to watching them speedrun the invention of foreign policy, diplomacy, and international law

2026-03-20 08:58:27 UTC

- reply

@nprofile…3qha
Not a Delta Mike Zulu?

2026-03-20 08:48:52 UTC

- reply

@nprofile…3qha
At least we know where to aim.

2026-03-19 20:34:34 UTC

- reply

@nprofile…v2v2
Fuck this fascist collaborationist bullshit. You know full well this isn't going to end here.

2026-03-02 08:20:29 UTC

- reply

@nprofile…3qha
There was definitely a broad base of support then for military action and security — one which was viciously abused in ways that we are still now seeing the fallout from domestically, let alone internationally.
That's said, as others have, I cannot let that statement that everyone was all in go unchallenged — tens of millions of us were dead set against it and in the streets trying to stop what was in the end as predicted — another round of pointless warfare that left the country and the world a much worse place.

2026-02-26 21:31:00 UTC

Today I've been told that C is memory safe if you're just very neat, that code is documentation, and that expecting protocol specs is a form of bias?
I didn't realize it was 90s week; I'll go get a flannel.

2026-02-26 17:46:42 UTC

- reply

@nprofile…ezqw
@nprofile…2aqy @nprofile…sut4 @nprofile…rhuz and like, sure, building on convenient stacks with no properly documented security model is fast if your system will also have no documented security model and no security validation. But then you don't have a secure messaging tool, you have a vibes messaging tool.

2026-02-26 17:28:53 UTC

- reply

@nprofile…ezqw
@nprofile…2aqy @nprofile…sut4 @nprofile…rhuz and why would bittorrent not have threat model? Certainly, I'd expect that a safety critical app using it as a transport layer would need to take the time to figure what threat model it de facto implemented and make sure that was suitable for how they were using it. That's much more expensive than doing it the other way around, though, and leads to dangerous cases where the upstream does not know what security properties of their system downstream users are depending on them, leading to nasty and hard to fix vulnerabilities when they're broken without notice. Which is why folks building systems where security matters usually build on tools with a proper security engineering foundation.

2026-02-26 17:20:16 UTC

- reply

@nprofile…ezqw
@nprofile…2aqy @nprofile…sut4 @nprofile…rhuz Yes, that actually is a red flag, very literally. Especially if folks are suggesting it's the right stack to replace tools where a breach may result in many many deaths.

2026-02-26 11:16:48 UTC

Many, many years ago, at school for CS and before that interning at NASA Ames, I learned to take programming seriously as engineering work, and also the level of rigor that engineering work requires. In the intervening thirty years, I have had to come to terms with the degree to which this attitude is rare in theory and vanishingly rare in practice again and again. Tooling has gotten better, but the rigor applied to the average line of code has gotten worse.
I would hope that safety-critical systems would be different, and in some cases they really are. However, the number of people who want to build secure communications systems that they want to be safety critical and who expect thousands of people to literally use in a case where a breach of the threat model means the users will die and who as developers cannot bother to meet the basic design rigor requirement of 2006 — have a fucking threat model that is accurate and up to date — will never cease to shock me.

2026-02-26 08:30:04 UTC

- reply

@nprofile…ezqw
@nprofile…2aqy @nprofile…sut4 @nprofile…rhuz Not having a baseline way of explaining what the set of threat models and security guarantees it's designed to be able to meet is a red flag, especially on a complex, reconfigurable protocol stack. It means that if someone wants to use it for something real, they have to start from scratch in analyzing the security properties of each element in the configurations they might use, then analyze how those elements interact, etc. The same thing applies with trying to figure out if this protocol stack is or can be appropriate to solve a given particular problem.
In a lot of cases, it's going to be easier to start from scratch and build simpler, smaller components designed directly around the security guarantees and architecture your specific project needs. The expensive part of a piece of software is not the code, it's the team that has a living, detailed model of the code in their heads — a technical model, a user experience model, a security model, and a performance model, at a minimum. To be worth seriously adopting, a protocol stack should at the very least attempt to make this legible to developers.

2026-02-26 00:40:31 UTC

Probably mostly not my audience here, but I'm currently looking for a business-side/CEO cofounder for an encrypted radio startup. There are solid funding options, but while I can build the team to make the product happen, I'm not the person to navigate the money side of things. I'm looking for a cofounder with previous startup CEO experience and executive-level experience (although not necessarily CEO) in a hardware startup specifically. EU citizen and resident, although it'll be a remote team, so where is less important.

2026-02-25 23:22:29 UTC

- reply

@nprofile…ezqw
@nprofile…sut4 right, after digging around for a while I see no threat model or even vague notions of what "secure" means to them. Also, it looks like this is some more cryptocurrency-led bullshit?

2026-02-25 10:40:42 UTC

- reply

@nprofile…ezqw
@nprofile…sut4 while I am extremely supportive of p2p secure messaging, getting it working to a tenth the reliability of signal with a user experience where they were a decade ago is the very definition of nontrivial.

2026-02-22 09:22:19 UTC

So, uh, are other hacker conferences also banning Epstein's buddies, or are they waiting to see if someone notices when they register?

2026-02-20 09:06:51 UTC

- reply

@nprofile…8atu
403

2026-02-09 10:29:53 UTC

At a certain point, one must look at well-funded mainstream 'activist' organizations that have a lot of reach and never support anything so radical that it might actually cause a meaningful change in the causes they claim to support and wonder why.

2026-02-03 20:18:18 UTC

- reply

@nprofile…3qha
Oh, of course fucking Pablos knew him. That tracks.

2026-02-01 10:53:41 UTC

- reply

@nprofile…3qha
In twenty years of interviewing, I've never looked at the number of LinkedIn connections someone had during an interview process, nor had someone even suggest I look at their portfolio for a technical position.

2026-01-30 21:56:51 UTC

Huh. So Ronald Lauder, the billionaire who owns Estee Lauder, is apparently the guy who convinced Trump that he should destroy NATO by invading Greenland.
Maybe don't buy shit from them? Here's a convenient list of their brands: https://www.elcompanies.com/en/our-brands
And sources:
https://en.wikipedia.org/wiki/Ronald_Lauder
http://web.archive.org/web/20251107131250/https://www.nytimes.com/2022/09/14/us/politics/trump-greenland.html
https://www.theguardian.com/us-news/2026/jan/15/ronald-lauder-billionaire-donor-donald-trump-ukraine-greenland

2026-01-27 10:28:31 UTC

The funny thing about this piece is that it strongly places exploits in the category of spam messages — they don't have to be correct, robust, or legible, they just have to generate the desired result enough of the time. Given that, I'll say that I do actually see a serious use for AI code generation in the development process for the first time: as a fuzzing tool to run against human-written code that does need to be correct, robust, and legible.
Amusingly, I predict that this use case is, in a decade or two if these tools are still used, significantly slow progress in the art of exploitation. You don't get brilliant exploit writers without a large pool of folks spending years honing their craft, not at the highest tiers but at the lowest. Sure, we have a bunch of folks already at the top of the field who will keep working for another twenty years, but no one will be coming up after them. Eventually, stagnation and likely with it, a resurgence in poorly thought out mitigations just complex enough that the reasoning work required to create novel exploitation techniques will be forever out of reach of LLM-category models.
That said, there's a useful lesson and incentive structure shift for development teams here too, coming from the new assumption that all exploitable vulnerabilities will have readily available exploits, regardless of whether or not creating them would otherwise be economically viable. That should, hopefully, push teams toward development styles that prioritize affordable guarantees of functional correctness — memory- and type-safety, use of parser and state machine generators and type-based functional correctness checks, and strong test suites.
Sadly, the appeal of much lower-effort generated code of unknowable correctness will likely steer most development teams in the opposite direction; hopefully strict liability regulations for commercial software can correct this pressure.
#nevent1q…y55v

2026-01-25 11:33:38 UTC

Americans, if you have not done first aid training in the last five years, I strongly recommend getting a refresher now, and starting to carry a trauma kit with you when you leave the house.
It looks like most of the US Red Cross first aid courses are very superficial, so you'll have to go digging for local resources. The syllabus I recommend is the one offered by the UK and most EU Red Cross groups, including their optimal mental health response unit, and ideally something on using Narcan and Epi pens. You can find it here: https://www.redcrossfirstaidtraining.co.uk/courses/first-aid-training/first-aid-at-work/
If you're piecing together a course from other offerings, you definitely want to make sure that you're doing CPR basics, massive hemorrhage/bleed stop, and shock/stroke at least. If you can find a trainer who can also add to the UK curriculum a treatment protocol for tear gas and pepper spray, that's great. You're going to receive a ton of information in these courses, so please take good notes (and hopefully you'll get the training slides to take home). Make up your own cheat sheets for the core diagnostic procedures — ADCDE/MARCH, AVPU etc. and keep them in your kit. Better yet, also go with some friends — it's always more fun that way and you'll retain more when you're comfortable and having fun — and then spend an evening every month or so going through some basic drills to keep each other fresh.

2026-01-08 13:33:26 UTC

Some decade, we will collectively learn that watching traumatic video doesn't teach people things about the world or effectively inspire them to work to change it, and in fact is likely to leave them less capable of action.
Not this year, though, apparently.

2025-12-29 18:51:01 UTC

Yet another big decades-long environmental ad campaign revealed to mostly be about reducing risks to corporate profits by turning it into an individual responsibility — just like consumer recycling and carbon footprints: https://www.currentaffairs.org/news/the-sinister-origins-of-americas-anti-litter-movement

2025-12-26 16:48:48 UTC

The documentation for this image processing library is one of the most interesting things I've read in weeks:
https://github.com/celoyd/potato/blob/main/docs/personal.md
https://github.com/celoyd/potato/blob/main/README.md
https://github.com/celoyd/potato/blob/main/docs/concepts.md
Philosophical discussion of the nature of seeing and what am image is vs a map, fascinating technical details about how satellite imaging works and why it looks as bad as it often does, a lot of really thoughtful conversation about engineering and aesthetic process, and even an amusing unit of measurement — grams per terrapixel.

2025-12-19 14:03:06 UTC

- reply

@nprofile…2y2x
I keep meaning to bring cash for tipping to the queer bar and keep forgetting because I only use it when I go to Germany. Also, I hate that I look like an American tourist instead of an EU-resident American tourist in Germany because I can't remember the coins.

2025-12-07 20:34:18 UTC

Still really genuinely angry at how much the passkey rollout has fucked up the flows for anyone using a security key.
Fuck forcing people to set pins on hardware tokens. Fuck defaulting to allowing a hardware token to log in without the password. Fuck making every mobile device you own a first class token and making login attempt spam a thing again.
I get that passwords are broken. I don't have a problem with the idea behind passkeys as such for less-technical users (although fuck vendor lock-in and non-portable credentials), but do not fuck over technical users trying to protect critical systems by breaking their workflows or destroying basic security primitives.

2025-11-28 08:49:49 UTC

- reply

@nprofile…p6nk
Couldn't they like, set up a telegram group or something to make it easier to get involved?

2025-11-27 14:28:48 UTC

Companies, don't try to stiff your consultants for work they've already done. It's a terrible look and it's likely to cost you more than you think you're going to save. Also usually illegal and always immoral, should shame be a feeling you experience.
Consultants, I strongly recommend having language requiring changes to the contract to be put in writing to your non-client email address, having at least a 10% late fee for delayed payments (with no exception in cases where the customer disputes the bill but not the work), and being very particular about how contracts may be terminated, especially if you work on long, open-ended engagements.

2025-11-24 10:44:38 UTC

- reply

And no, fixing your roadmapping system will not save you if you don't have backups. Please have backups. But if you don't have backups, you also don't have a lot of other stuff and you almost certainly have engineers who, if they've had any time to think, are aware of it.
If the only way for those engineers to get fundamental engineering work prioritized is for an outsider like me to come in and declare it a massive emergency and make a bunch of C-level noise about it, you are not going to achieve an appropriate level of security exposure.

2025-11-24 10:34:41 UTC

While I'm thinking about work, a piece of advice for startups thinking about security: fix your project management and roadmapping process before/at the same time as bringing someone in to help with security, especially if that person is not getting put in as a peer to the CTO with the swing to force stuff onto the roadmap.
When I come in as a fractional CISO, I am almost always the first stakeholder with significant engineering requirements that are not coming from the product roadmap. In most cases, there is not yet a clear way for the organization to make decisions about what to do with competing priorities that lives outside of the head of the product owner. This means that even generally agreed high priority work — on the level of "perhaps we should consider backing up the production data without which the entire business is gone" — struggles to get done in the face of this quarter's feature plan.
Talking about this in my kickoff meetings and getting very explicit commitments from the executive team early on as to how they want me to proceed with decision-making helps a little. The only places I've seen where it hasn't been a problem are all companies that have been able to hire their way out of it. "Wow, doing that security infrastructure work would take like 20% of our entire engineer team for two years. I guess we better grow the engineering team by 20% and dedicate those people to security work." While great for me when I get to work with those teams, this is not a general solution to the problem.

2025-11-24 10:18:25 UTC

I've been instituting exactly this kind of cooldown/delay on dependency updates at all of my clients for four or so years and I'm glad to see more people talking about it: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

2025-10-22 10:21:57 UTC

Hilarious side effect of the OpenAI pivot to porn plus the Swedish ban on online pornography purchases: Paying for ChatGPT in Sweden may be a criminal act soon.

2025-10-15 07:23:16 UTC

- reply

Finland, for historical reasons, is a country where most (white) people (with Finnish passports) trust the police, despite most of the police belonging to the fascist party. There is no organized digital rights work happening in this country (Effi technically exists and is for all purposes completely useless; if you're reading this and from Effi, prove me wrong). While Finland has historically had a strong reputation for freedom of the press, but this is only because the press have never wanted to publish anything the state doesn't like. When they do (a few years ago with a piece about a military research center), the police just show up without warrants, steal hard drives, and charge all the individual journalists with treason, despite none of them being e.g. party to an official secrets act.

2025-10-15 07:22:55 UTC

So last night I just found out that the far right Finnish government is planning on gutting limits to police use of malware, wiretaps, undercover infiltration, and police/military intelligence data sharing, and eliminating some or all of the constitutional protections around personal communication and the safety of the home and allowing tools now only used in the context of treason and terrorism investigations to be used much more widely. This will include investigations where not only has no crime happened yet, but no crime is expected to happen in the future.

2025-10-07 13:04:18 UTC

Delighted to see China getting ahead of the game and banning scraping that circumvents technical restrictions and some kinds of deceptive advertising and monopolistic platform practices. Them claiming global enforcement scope (enforced by among other things market access bans) is also an interesting move; curious to see how it plays out in practice.

2025-06-19 07:19:55 UTC

- reply

@nprofile…dwme
Where is this in settings? I've spent about 20 minutes looking through all the settings menus a half dozen times. Autofetch missing messages and autoload remote media are both off.

2025-06-18 17:15:29 UTC

@nprofile…dwme
The per-message dotted menu is no longer present in thread view, so I can't e.g. edit replies without re-finding them in my account view.

2025-06-17 14:18:54 UTC

- reply

@nprofile…gu7x
I'll definitely say it's an oversimplification, yes. But the contexts where I've heard it quoted have used it to suggest that eliminating fascism in the US is mostly a numbers game, without a need for a political program or structural organizing.

2025-06-17 12:12:39 UTC

- reply

Fwiw, I was not impressed with the source I've seen most often quoted for, Chenoweth and Stephan's Why Civil Resistance Works. Their case was built primarily on a piece of very high level statistical analysis showing that the conflicts they deemed to have been nonviolent were more likely to have been successful in some way, without examining the causes or initial conditions of the conflict or if the success or failure. The analysis is ahistorical in at least the case of the US Civil Rights movement, which was many things and nonviolent only in some places, and likely in many of the others, too. While I wouldn't say their work is entirely without merit, I also would not use it as a guide for resistance strategy in any way.
I worry about this 3.5% number giving folks in the US false hope and convincing liberals that the situation is not as immediately dire as it is, and that they should push back against others using a diversity of tactics, or simply ignore the whole thing and hope it never touches them.

2025-06-17 11:14:37 UTC

- reply

Broadly speaking, the 3.5% number is a metric for the collective organizing capacity needed to get those kinds of numbers without the internet, when you're working with phone trees and paper phonebooks at best — and even then, it's 3.5% in the streets for a week straight. Without the internet, getting those numbers generally implied a meaningful political program, a lot of community political education work, and an actual plan.
One of the lessons of the protests of the last decade was that the internet lets you get those numbers way more easily, but does not help at all when it comes to getting those people to have a unified belief in what happens next. You may be able to take a government down, but all you've done is create a power vacuum, and you do not necessarily have any say in what fills it.

2025-06-17 11:01:04 UTC

I wish US folks talking about the magical 3.5% number would read some of the more recent history and studies there. Bevin's "If We Burn" is a good place to start.

2025-05-25 13:24:13 UTC

A long thread/short story; the old internet says hello: https://bsky.app/profile/blackle.bsky.social/post/3lpmnsdic722n

2025-05-24 16:31:32 UTC

- reply

@nprofile…gu7x
Seven! Finland, Estonia, Sweden, Denmark, Norway, the Netherlands, and Ireland. And really, calling Greenland Denmark is iffy, but I don't know if they actually looked at it separately.

2025-05-23 23:53:58 UTC

- reply

@nprofile…fa4k
I can't imagine a model fed all the fanfic in the world would possibly match a trope like that as being salient in a scenario blatantly constructed to evoke such a response. My god, the matrix multiplication must be self-aware and emotionally intelligent.

2025-05-22 21:28:47 UTC

This reboot of robocop sucks
https://hachyderm.io/@molly0xfff/114553477045951004

2025-05-18 21:37:55 UTC

When I say that I can't recommend third-party forks of either Firefox or Chrome for real world use, this kind of thing is why. *This* is the bar for what the security team for a browser needs to be able to do. A fork where the entire technical team is ten people that can't even keep up with upstream patches is sadly not in the running.
https://blog.mozilla.org/security/2025/05/17/firefox-security-response-to-pwn2own-2025/

2025-05-17 08:29:32 UTC

- reply

@nprofile…d2rl
Because I really properly internalized Celsius in a colder country, I still kind of think about hot weather in Fahrenheit, but cold weather in Celsius
@nprofile…rka7

2025-05-17 08:27:43 UTC

- reply

@nprofile…d2rl
The dream!

2025-05-15 18:52:36 UTC

Does anyone know if Apple changed how iOS stores notification content after iOS 16?

2025-05-14 07:27:09 UTC

- reply

@nprofile…5lc3
Do you know how security works at scale? This isn't news and among the majors, MS was mostly late to the party. That said, "spies" is doing a lot of work here. If you mean "collaborates specifically around threat intelligence", sure. If you mean "provides the US with general purpose intelligence outside the digital security space above and beyond the cooperation that the US can compel with statutory powers", no, we have no reason to believe that.
Also, with CISA dead, it's unclear that anyone on the USG side is still listening.

2025-05-09 10:49:54 UTC

- reply

@nprofile…d2rl
Congratulations!

2025-05-01 17:07:33 UTC

- reply

@nprofile…rg89
I've got a boox note max, for the same reason of wanting real Android apps. It's not terrible.

2025-04-29 18:23:57 UTC

- reply

@nprofile…d2rl
I'm feeling pretty comfortable on that side.
You know, also wildly aware that nothing I can ever possibly do will be enough, and terrified that it will be too little, too late, or the wrong focus or threat model in the places inside my scope of potential control.

2025-04-18 09:10:26 UTC

- reply

@nprofile…rg89
That is a much much better term than threat modeling for what the discipline has turned into.
Signed, someone who does actual modeling

2025-04-15 19:31:16 UTC

- reply

@nprofile…2uzz
A network so resilient that it can survive the only thing even more destructive than nuclear war: capitalism

2025-04-10 09:59:34 UTC

- reply

@nprofile…mhl7
I see we're getting toward acceptance

2025-04-09 19:38:20 UTC

- reply

@nprofile…d2rl
I would like to be fucking wrong more often. I am very tired of being right

2025-04-07 11:06:23 UTC

It would be nice if signal would let users import and export lists of users, complete with nicknames and verified keys.
It would also be nice if, like on mastodon, we could leave notes about users to remember the context for them.
It would be even nicer if the notes could include some kind of structured data — hashtags would be fine — and the group system would let you set a hashtag filter that would soft-stop you from adding people without the hashtag to that group. Bonus points for integrating the chat folder system with hashtags as well.
This would go a long way toward helping the system scale for organizations.

2025-04-04 05:51:58 UTC

- reply

@nprofile…d2rl
The last time I was hiring for a directly security role, it was shocking to see just how far the hyperspecialization had gone. I live very much in blue team, and trying to find blue team appsec people was effectively impossible. I ended up grabbing a security-interested juniorish dev and mentoring her into the role instead. For most of the small (<150 engineers) firms I work with, it's always going to make more sense to outsource audit, including more serious code audits — the work is bursty and irregular — but we still need in-house folks helping devs with SAST, doing internal training, and working with engineers on vuln fixes. It's not sexy enough, though, not red team, so finding folks is a nightmare.

2025-03-14 12:04:35 UTC

- reply

This guy appears to be the sole original source; one can only assume a misinformation operation, at this point: https://www.linkedin.com/posts/serhii-demediuk-a383521aa_signal-activity-7303700457040809984-5dWZ

2025-03-14 09:52:24 UTC

Anyone have any meaningful additional detail on this? It's widely enough reported that it seems to be real, but it does not make any particular sense and the implications are profound.
https://therecord.media/signal-no-longer-cooperating-with-ukraine

2025-03-12 08:17:32 UTC

- reply

@nprofile…d2rl
Hopefully it'll help the culture shock a bit to learn that there are also some really big positives.

2025-03-12 07:20:08 UTC

By extension, this means that we also have a name for folks who work on design and development in these spaces: kleptographers!
https://antarian.social/@nsgeek/114139645751032693

2025-02-28 07:01:53 UTC

- reply

@nprofile…d2rl
Ah, damn, I knew I forgot the last step

2025-02-27 09:54:34 UTC

- reply

@nprofile…d2rl I can recommend getting a voip.ms account with a US number for calls like that — it's going to be cheaper than either a AU sim from the US or (once you move) a US sim from AU.
Also sympthy on that whole thing — Finns have a lovely thing where they just won't answer at all until they have a complete answer even if it takes, but also sometimes will choose to just ignore stuff in English or if they don't want to deal with it instead of telling you, and figuring out which is which is impossible. Much stress.

2025-02-10 18:09:45 UTC

- reply

@nprofile…d2rl
What, you can't propagate an exploit across a DC-only connection?!

2025-02-05 01:51:34 UTC

I kind of wonder if one of the goals isn't to inspire really large street protests, to justify a state of emergency and bringing in the army.

2025-02-05 00:29:06 UTC

With the "shutdown" of USAID, the State department has ordered an emergency evacuation of all staff from over a hundred countries by Saturday. In their wake they will leave massive chaos. USAID feeds 53 million people a year, among other things. Many, many people are dying because of this, and many countries will never trust the US again.
USAID is a major part of American international soft power. The damage that this is causing can only be described as treasonous, even ignoring the human cost.
To be clear, this evacuation is impossible. Doing it from one country is very hard. Doing it everywhere all at once, even with all available military airlift assets, cannot happen. Regardless, on whatever schedule they do do this, this is not a normal international move. They are telling staff who in some cases have been in country for decades or who expected to be their for the rest of their careers that they have 48 hours to pack suitcases and leave everything else they own behind, to return to a country where they have no where to live and no job.
But then, that's the point.

2025-02-01 18:16:26 UTC

So, how long is it going to take any of the (likely non-US) mainstream media to start talking about this as a coup?

2025-01-30 22:07:53 UTC

- reply

@nprofile…d2rl
I'm assuming that was a GRANTED, in which case fuck yes!

2025-01-30 18:23:12 UTC

- reply

@nprofile…d2rl
Honestly, I'm not going to believe someone when they say they do it. If they say they try and then want to talk about the ways in which they know they fail and the places where they probably have blind spots? Yeah, maybe. But I've seen too many "progressive" employers where the pipeline ends in a dumpster of broken glass.
Like, to the point where I'm genuinely unsure about the ethics of working to improve the pipeline when even most of the best folks are forced out of the industry by 35.

2025-01-30 10:45:36 UTC

- reply

@nprofile…mhl7
Ugh, I'm gonna have to read all this, aren't I
@nprofile…s6ja

2025-01-29 08:34:04 UTC

- reply

@nprofile…36ju
Normally when I see tilt/shift used, it's for lenses that can both tilt and shift? And when stuff can only shift, they're marked as perspective correcting? But it's been a while since I've been looking at new glass

2025-01-21 17:00:40 UTC

- reply

If you at all can, this is a really great time to donate or otherwise assist with https://transrescue.org/

2025-01-21 10:12:15 UTC

So, cis Americans, you're now living through the first day of a federal genocide against trans people, as defined by the Lemkin Institute for the Prevention of Genocide. As happens almost without exception unless stopped, it is both likely to proceed to mass murder and to expand to include additional social groups, possibly including you.
What are you going to do about this? Are you going to take up arms and fight to prevent your friends and neighbors from being murdered by the state? Are you going to harbor fugitives, get them medical care, and help them leave the country? Are you going to disrupt the function of state offices and destroy records to make their work impossible?
Or are you just going to hunker down and go along with what's asked of you, in hopes they don't get around to killing people like you? Are you, in other words, going to be a good Nazi?
If you think you're going to maybe go on a few big nonviolent protests and be angry on social media, like you did last time, but you know money is tight and you just started a new job and... congrats on failing to understand the situation and choosing to be a good Nazi.
History is unfortunately quite clear here. There are no other options left. Either you literally, physically fight this, or you collaborate.
If you think this is extreme, well, you've made your choice. See you in hell.

2025-01-15 11:30:28 UTC

Could people just stop trying to "improve" things they don't understand?
https://soatok.blog/2025/01/14/dont-use-session-signal-fork/

2025-01-10 00:17:49 UTC

- reply

@nprofile…7nxw
To be fair, wireless printing is a black art
@nprofile…0y73

2025-01-08 01:13:28 UTC

- reply

@nprofile…7nxw
State censorship works

2025-01-07 18:25:29 UTC

Having just read a bit about the impact of the "business as usual" bias among German Jews in the runup to WW2 and the lack of meaningful resistance that it led to, is pretty terrifying watching the same bias today.

2025-01-06 09:14:23 UTC

- reply

@nprofile…d2rl
Fuck yes!

2025-01-03 09:24:56 UTC

- reply

@nprofile…d2rl So, the way I'd guess they would like this to play out:
1. Successful state porn ID requirements are a model for a federal requirement passed later this month.
2. The federal requirement is a global requirement on US companies, meaning that if you want to host porn, you can't have a US company in the stack.
3. The definition of porn is expanded to include all material that discussed queer and trans people, probably in stages, as well as abortion and contraception, at a minimum.
4. It's made clear that the same standard must be met for personal and non-commercial sites, including offline and paper storage, providing an easy avenue for targeted prosecution, especially of queer folks with kids.
5. A requirement is added that all logs must be forwarded to the government for compliance checks, which then provides reasonable for device searches during any other routine interactions with authority, like traffic stops and border crossings.
6. The definition of obscenity (which is what this is — bringing back Comstock is a stated goal) is expanded to include seditious materials, aka left-of-center political material, "critical theory", "DEI", etc., again with the onus placed on companies to positively prove they are not hosting it illegally — again, globally, regardless if the content is legal in the country the company operates in.
It's another looming disaster even if the database is never breached and malware groups never take advantage of it (which they will, obviously).

2025-01-02 21:15:13 UTC

- reply

@nprofile…p8tg
I'm not sure if that was original to @nprofile…gu7x , but that's certainly who I heard say that first, maybe fifteen years ago

2024-12-28 23:57:49 UTC

- reply

@nprofile…d2rl
But at the last consultancy I worked for, I do remember a colleague uttering the line, "yes, but he's *our* School of the Americas guy"

2024-12-28 23:56:27 UTC

- reply

Benefits of being a sole proprietor — they're all clients.

2024-12-28 23:46:26 UTC

- reply

@nprofile…d2rl
I genuinely don't; I refuse to speak to them unless they're paying me.
My career would probably be a lot better if I did, but ugh, so not worth it.

2024-12-28 19:26:53 UTC

- reply

@nprofile…rg89
The zero knowledge space probably has some actually useful things to offer here vs TEEs for other kinds of computation one might want to perform, but they're computational infeasible even for things like perceptual hash matching, let alone ml training.