Ian Campbell

Security ops engineer, former congressional sysadmin, writer, voracious reader. he/him. Opinions here mine only. No LLM content from me, all flaws detected are human-generated. Autistic/depressed/anxious/hungry.

#infosec #cybersecurity #privacy #actuallyautistic #neurodivergent


nostr:npub16v82nr4xt62nlydtj0mtxr49r6enc5r0sl2f7cq2zwdw7q92j5gs8meqha pretty much the angle I'm looking at it from, wondering (as usual) if I missed something


Anyone give weight to the concerns lawmakers are advancing about TP-Link routers?

https://www.reuters.com/world/us/us-lawmakers-urge-probe-wifi-router-maker-tp-link-over-fears-chinese-cyber-2024-08-15/?mod=djemCybersecruityPro&tpl=cs

#infosec


Any user-friendly antivirus for linux?

(no, clamav doesn't count)

If not, why are you recommending regular folks use linux? I'm concerned by this trend.


i have a confession

i found a fresh ecig while cleaning the other day and i've been vaping nicotine lightly but regularly since and it has been sooooooo fucking nice.

pleasure has been fleeting for me (thanks depression) and nicotine lights up my brain like little else.

but a week or so in, another problem flared, and so i sat down (gingerly) to research. And...

...did anyone else know that nicotine aggravates hemorrhoids? 🙃

i share this story as a warning.


nostr:npub1vcl9kcqwwsk536z8s4h6k48qrfkm7mahzrk5mz0v04j94507d20s6hk6t3 Gotcha. Thanks!


nostr:npub1vcl9kcqwwsk536z8s4h6k48qrfkm7mahzrk5mz0v04j94507d20s6hk6t3 I've been vaguely thinking about LinkedIn Premium just to see how it benefits me platform-wise, but I'm not on the job hunt.

If you're willing to share, how are you finding it?


Why is it so hard to keep eyeglasses clean, and furthermore why is this an attack on me, personally, on this grim Monday morning?


One of the things that continues to give me hope - and this may be silly to some - is just how actively nostr:npub1wjwj5r9ytyhgg7nwmy75t8xrhphw6c8kq94fuv0qdjg6g0fruffq02ue5t continues to improve and expand in organic ways.

I moved from GMail to Proton and haven't had a second of doubt. They respond quickly and clearly to support requests and provide multiple avenues to usability that emphasize user privacy.

(I have no connection to Proton AG other than as a happy paying customer.)

https://mastodon.social/@protonmail/111726406129916106


After a month or so of working with it, had my first significant grapheneOS issue: Google Play Store repeatedly crashing.

Device reboot fixed it.

I do kind of worry about Graphene's longevity as Google moves more and more of Play/etc into core Android services (but it's entirely viable for now).

#TurnItOffAndOnAgain #grapheneOS


nostr:npub1ku76q8e9442z0jtm7e8h8p83ugx6wpuet97uxcklc9hr59txdqtqvastrj Totally fair points! Just wanted to make sure it had reached your radar at some point.


Curious if this is Okta's LastPass moment.


nostr:npub1ku76q8e9442z0jtm7e8h8p83ugx6wpuet97uxcklc9hr59txdqtqvastrj Suggest you check out Obsidian - it's an incredibly powerful markdown platform but you don't need to know markdown.

Lots of community plugins that make it amazing, privacy-centric, and versatile.


Gettin a very pronounced vibe of "We're sick of your shit, Okta" from many directions this fine Friday evening.

https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/


(That was a gourd joke if I do say so myself.)


nostr:npub1c2853ar99ygy5fx6u75xynkq2tyrs4s7d0ldv09w2x9mlg6xkx5ssxw7yc Samsung is even more info-grabby than Google; otherwise, I love Samsung phones.


After a few weeks and a work trip with the Google Pixel Fold:

-It's a solid folding phone so far in a consumptive/tablet sense

-It's actually kinda neat to read kindle books in a two-column format with the phone a bit creased like a small book.

-I've tried half a dozen different stylus types on it and none worked really well, and the handling on it for trying to write/do much besides read/watch things is awkward.

-It's nice to not have Samsung bloatware, but jesus h christ the amount of weird Google stuff that needs network permissions is annoying.


Any good books out there that provide a good intro to (FDM) 3D Printing for someone with zero background or applicable skills?


it is so cool out and i love it so much.


Random Maker question: if I want to make enclosures, in the context of creating cyberdeck/custom laptop kinds of things, am I looking at a particular 3D printer, or a CNC, or am I better off getting the materials and grinding/altering/constructing more conventionally?


nostr:npub1dajyn80symwyrgq4lg726s6qs9gydgk02a8s6g6v2qk803whucdqlarxmk Thanks very much for that info - I don't have the brain to carve out cryptography nuance at the moment, so it is very appreciated.


nostr:npub19k3pk9vk756mwctkefkylyqk5p2v6076tpvecmt55e96qey4cxssxjmtnl yeah I don't buy their explanation either, really


nostr:npub1akz7ttaqv3y4m7eu3n56d8lcchpx0w5fa56nzf4vrshv5h8npnrs8qfcqj i'm speechless


"He said that the person who developed the water treatment process for Real Water bought the titanium tubes "from some Russian guy in the 80s" and spent four to five months making alkaline waters in his garage, working until he had a formula that didn't make him vomit or have diarrhea."


wtaf

"In the trial, Issam Najm, an environmental engineer who specializes in water chemistry and testing, testified that the hydrazine likely formed in the "ionizer," which was just titanium tubes electrified with what looked like jumper cables used to charge a car battery."

https://arstechnica.com/health/2023/10/jury-awards-229m-to-victims-of-real-water-tainted-with-rocket-fuel-chemical/


23andMe: "Oh it's everyone else's fault, it's credential stuffing."

But that's worse, right? You get how not having credential stuffing mitigations in your fucking gene registry is worse?


Had to warn my boss,

"So... this next blog post I wrote for GTM is... a little unique. Maybe a little unhinged. So if Marketing comes to you and asks 'Is Ian okay?!' that's probably why."


nostr:npub16752f8gz0njqcl2vvsf7x7qfpgvhzjlu0kar2n80z8xkaq6j06ysvsnd5w appreciate the boost, friend.


i hate feeling like i'm not doing my best work. covid brain suuuuuucks.


nostr:npub16752f8gz0njqcl2vvsf7x7qfpgvhzjlu0kar2n80z8xkaq6j06ysvsnd5w if anyone i know has ideas here, you might: https://tech.lgbt/@hpux735/111184192554424272


nostr:npub1hyp0snlqyw66uwuep7tnkwqhgpg7qspvf928v0mm8d9penuwee0srvaehm negative, upgraded to Sonoma earlier this week with no LittleSnitch issue. I did see there's an update pending to LS yesterday on my macbook, but have not installed it yet.


Gmail tab on chrome, just sitting there: memory usage of 700+ MB.

what the hell, people


nostr:npub13682vvdyly5jvpkr7z23hp4n3lqf75wn4sju0c6z6fcmn5ny3q3qu96s7z this is awesome


nostr:npub1wjxk2pp5cdkn8vd2sspp4nx6mqfans6nfwjhnrhq4wrh9kr4960sysxsqn given that they're sort of complex pokey wire, I'd be surprised if these were used as hair ties.


nostr:npub13ed0zwt0z6fga7tg6q7p4crvy3eyfm3y83j3xcz4l3g3y0emkr0sl8s5sm Can you provide a link to the NYT article, please?

Searching, but NYT doesn't make it particularly easy.


Note for neurodivergents/etc with strong sensory components: one of the items I've found most useful are these spiky "sensory rings" that easily roll on and off any finger, producing unique pressure and sensation.

They've been a great, subtle stim, including a good distraction from other sensory problems and sensory-related covid symptoms. And they're quite cheap.

#neurodivergent #ActuallyAutistic

https://www.amazon.com/gp/product/B08D3VSRFV/

https://masto.deoan.org/system/media_attachments/files/111/182/814/800/661/395/original/1783f28783c92956.png


For folks headed to BSides Orlando, my bud Dan Fernandez will be speaking on machine learning security issues.

Details here: https://www.linkedin.com/posts/dafdz_bsidesorlando-cybersecurity-machinelearning-activity-7113591646797094914-Bat5?utm_source=share&utm_medium=member_desktop


I think it's fundamentally unfair that I have rebound covid when I don't even play basketball.


aw son of a bitch, i just tested positive for covid again. finished paxlovid on saturday, negative tests on sunday and tuesday.

(this is not unheard of; see term post-paxlovid covid rebound - it just sucks)


oh man, Permission Slip is the ultimate mobile game.

Once set up each request takes three taps and gives me a little dopamine hit for fucking with data brokers.

All it needs is a satisfying slot machine type sound effect.


*slow clap*

Well played, Permission Slip.

https://masto.deoan.org/system/media_attachments/files/111/178/675/056/758/599/original/3c5ddb86eff7585d.png


Wondering how many dummies brought phones into SCIFs and other clean areas only to have them go off today.

"Smith... is that your phone?"

"No, uh, that's my Emotional Support FEMA Alert..."


too relatable, from a private IRC channel:

<redacted> hahahaha, i just went to file a bug report on an instance of the issue i detected

<redacted> THE GOD DAMN BUG REPORT TICKET FEATURE ON THE GOD DAMN WEB SITE THREW A 400 BAD REQUEST


Just finished interviewing on an infosec podcast, pushing da neurodivergent propaganda as i do

feelsgoodyall.jpg

I'll link it when it comes out.


Ah, this'll go well.

TorchServe, a production server for machine learning framework PyTorch, exposes its management console to the world in default config with what looks like multiple paths to remote command execution.

https://www.oligo.security/blog/shelltorch-torchserve-ssrf-vulnerability-cve-2023-43654


Anyone else ever see the RJ45 inputs of rack-mounted switches as rows of teeth with tentacles, or is this another one of those things I should keep to therapy?

#spooktober


Split this one off from fb.

https://masto.deoan.org/system/media_attachments/files/111/173/221/313/704/448/original/fe1efdc08332b255.jpg


Aaaaaahaahahhahahahahahahahahaha aaaaaaaaaaaaaaaaahahahahahahhaa fuck you McCarthy


nostr:npub182hu34knzuf4nu74hqqfmgfrk5zlj6v0xrztrurgrft7tsyk2jsqvu5jgc i do not. Should be fun!


aw crap

https://masto.deoan.org/system/media_attachments/files/111/172/754/251/719/715/original/bcd5540efee74554.png


nostr:npub17zc5272ryl68m7gnstwn0596xg5ajuta2lkzpk5nlavqssnfgrns47kpjv

googleads100[.]ru
googleads100kms[.]agency
googleads100kms[.]buzz
googleads100kms[.]club
googleads100kms[.]co
googleads100kms[.]info
googleads100kms[.]live
googleads100kms[.]online
googleads100kms[.]shop
googleads100kms[.]site
googleads100kms[.]space
googleads100kms[.]store
googleads100kms[.]website
googleads100kms[.]work
googleads100kms[.]xyz
track100googleads[.]blog
track100googleads[.]buzz
track100googleads[.]com
track100googleads[.]fun
track100googleads[.]info
track100googleads[.]live
track100googleads[.]shop
track100googleads[.]solutions
track100googleads[.]space
track100googleads[.]top
track100googleads[.]website
track100googleads[.]xyz


Just delivered a spooky October blogpost to Marketing that will likely leave folk with one overriding reaction:

"da fuq did I just read?!"

We'll see if they dig it... ;)


nostr:npub1dgsrtum45we57dd9zs6r9967fxxheqvruy86c2z0gy0ftv4ll6jq60nfw8 About a decade after they disappeared, my dad came up to me with a zipdisk marked "My Documents" all excited.

"Can you get anything off this?! It looks like it has a bunch of my old writings!"

As the dutiful techie son, I snagged a cheap zipdrive and popped in the disk. Then began to laugh sadly.

Instead of copying the contents, Dad had just dragged-and-dropped Windows' "My Documents" - which was just a symlink to the actual folder.

He had faithfully copied a shortcut.


How do you say "Happy Cybersecurity Awareness Month" in Elvish?

(filched from elsewhere.)

https://masto.deoan.org/system/media_attachments/files/111/171/042/558/365/606/original/fba69ef7e58c56f9.jpg


Ohhhh, Michael Lewis' book on Sam Bankman-Fried, Going Infinite, is out today.

This promises many lulz.


nostr:npub182hu34knzuf4nu74hqqfmgfrk5zlj6v0xrztrurgrft7tsyk2jsqvu5jgc nightmare fuel, right?


Monday vibes.

(filched from elsewhere)

https://masto.deoan.org/system/media_attachments/files/111/165/347/400/845/422/original/a58a4159c485a4da.png


Well I *WAS* gonna go all white knight and help Captain No Luck take down the Crimson Fleet but then he decided to get all high and mighty about me wasting a few generic corporate security guards,

so I guess it's a pirate's life for me.


so, nostr:npub1x9kwqz5hv9m47f8e75elfzxwvywfsca62j7kh2qff34survgjqys9tgp0g for the win - just sent this relevant reddit thread my way, and the wording is exactly what I saw.

https://www.reddit.com/r/Scams/comments/16wnr2l/important_information_about_your_gift_card_order/


nostr:npub1x9kwqz5hv9m47f8e75elfzxwvywfsca62j7kh2qff34survgjqys9tgp0g Oh geeez, thanks nak! Very much appreciate you digging it up and sending it my way.


nostr:npub1yz8jkqzt88wh8qh6vl84jujnqsy9xqswrq833fsp02e9hvdjan0q4uy56j Weird. Thanks for confirming.


Did anyone else get a weird email from Amazon about the danger of their Google Play Gift Card order despite never having done so, and nothing appearing in order history?


nostr:npub13cc0d3r3nqgzapsw3sfrua58vmkzlqzjy0x4n29qcq6694u3q0vska8nxu Thanks man!


Which is not to say I'm jumping back into everything full speed.

Still easily winded/tired, but getting better each day.


Well that's one negative covid test on the books.

Continuing with same precautions (indoor masking, isolation, good airflow, surface cleaning) till at least Tuesday, when I will test again.

We've been careful, but feeling real lucky dad seemingly hasn't caught it yet.


nostr:npub14c2jy9c70eqnujf88em9wukdd0mnfaz5ypk5ka74hu5aal8wuz6snnjduw I used to record all my fucks given on the blockchain.

Somehow they all ended up in North Korea.


And so it begins.

https://masto.deoan.org/system/media_attachments/files/111/158/161/404/318/222/original/a09c5096f14883ee.jpg


Oh this gives me serious pause about Framework laptops.

https://octodon.social/@jalefkowit/111156703105077035


Random service note: I've been happy enough that I'm upgrading my Proton Mail/etc subscription from Unlimited ($10/mo) to Proton Family ($30/mo if monthly; $20/mo if paid ahead).

The latter ups Proton Drive space from 500GB to 3TB so I can move any cloud storage needs there; it also allows for 6 separate users, 90 addresses,  3 custom domains, and a bunch of other stuff.

That's how well Proton is doing service-wise for me, with an emphasis on privacy.

And as a reminder, I have no ties to Proton AG other than as a happy paying customer.

#privacy #security


nostr:npub1hz9nt3mh37pjqk3mtezhpaurzdtw00u7skwk62qrv9tgnkyaylgs9l6rsm where'd ya source the bodies from this year?


nostr:npub1xvsj84n3am5spjf5kfksg9mz6f0z2u85ja9v7y6alc7awzlsq53q0263pp Frameworks are looking more and more interesting...


nostr:npub1epzq7rsqvmdhed0v5wjh7gvu9t8rerlzyth3exj6a2yvl34n25ssttsd27 First was probably ebooks for me; going from carrying around 4-6 books at once (because ATTENTION SPAN) in my bag to a little reader? heeeeeck yeah. I had so much knowledge at my fingertips, still do.


it always amazes me when i look at some corporate attempt to be mildly creative, that has cross-neuronal possibilities, and my synesthesia exhibits absolutely no response.

https://unstable.systems/@AmyZenunim/111155060958943493


nostr:npub12sfdkkrl30qm59s77w29gwgz24lu5d6hgt2saslmnttlkz4cpfnqsd9a3n hm, all good points, thank you.

It's mostly personal, but I do worry that not engaging with some of this tech more deeply puts me at a familiarity disadvantage, whereas being an enthusiastic early-adopter has served me well pretty much my entire life.

But either I know the price of early adoption better now, or there are new prices in place for it, as far as data goes. So I go back and forth quite a bit.

Will have to think some more on what you said, thank you.


Quite a good, ground-level/accessible and realistic post by nostr:npub1ahqj3ek7s7lrt4ygsthymx0j0vqunam8vc6ejhn9qn7037prm0pq83wjwd on one-week impressions of the iPhone 15 and new watch.

https://mastodon.social/@WarnerCrocker/111155120602730736


nostr:npub1ahqj3ek7s7lrt4ygsthymx0j0vqunam8vc6ejhn9qn7037prm0pq83wjwd sounds like an expensive tie


at this point i'm both developing some fomo and worrying that I am losing out on important experience that will inform my security work


Anyone else struggle with this and come to a conclusion that provides them some kind of closure?


i can't tell at this point whether i am just an old man shaking my fists at clouds and should engage with the discords and the AIs and other conveniences of privacy death or whether the principles and slight amounts of privacy i continue to eke out from it are worth it.


nostr:npub1sn5ywg2y6rxk7jh2ndha6a30t5886sps8twtyulprrdjcvpvdhvqzh969e A lawyer! whodathunkit


(i am excellent at carrying grudges, and "helping normalize the acceptance of jeffrey epstein into important circles" is not one that will fade)


huh, larry lessig defending another dishonest harm-causing academic

will wonders never cease

https://www.newyorker.com/magazine/2023/10/09/they-studied-dishonesty-was-their-work-a-lie


nostr:npub1xsjfpl3xmlkna2mpucejtjqpkvy04d2gp0p2v4xlw4ff90s857csm6svn5 got cheated out of cake :(


Ok facebook just served me an ad for plus sized ass pillows and frankly i don't know whether to be offended or impressed by the targeting


right on the cusp of this news cycle, lastpass gonna be like "we just wanted to update you..."


as a third-party House tech contractor to offices, during the lapse in appropriations when I was there they held us offsite for about half a day, and then sent us back in.

but there were also entire agencies who ended up having expired passwords thanks to 90 day rolls that largely occurred during the lapse, causing all sorts of chaos.

Appropriations lapses create all sorts of havoc and security strains across the gov. Do not assume that if it's crucial, it stays resourced.


"It's sad when a centrist dies. There's always so much left to not do."

(via https://twitter.com/Cpin42/status/1707753889129246781 )


feeling a bit better and ordered a bunch of food to stuff my face and THEY FORGOT THE FUCKING CAKE.

I WANTED THAT TIRAMISU SO BAD.


nostr:npub1j0rcfvgkm54tsyw9sl3ae49hnjcayqpsxunqqce00qllldlhrrls4eqfwc oh.

well.

cool cool cool cool cool.


nostr:npub1a5zyapgn57j8d9ddyugfa6rdh98gc7vxsazduuy4arsyxt5q7r4sq8hcww but on the bright side, it's almost Friday


I swear a bunch of the more careful folks I know are getting hit by covid lately.


nostr:npub1ydqz9kudwzremaucqnkdmwwk6lukye75tpqk00c0td8f7rc279jsaqczs0 i had a bag of starburst jelly beans that is helping but may try that too, thanks.

how are you faring?


nostr:npub1hrug0vp87p28u9z8hzsan2ncrfp748jf7svm2kd5usn700wm735sppcu5h oh this book is gonna make me mad, isn't it?

*instantly adds to reading list*


nostr:npub17gdmxp5ruhjuax47d59av3f53huxhkq6rnhq8uym7ntcqzfwynhq92vsfm Much appreciated


spent 20 minutes troubleshooting why my laptop wouldn't charge.

swapped out cables, adapters, ports.

but what helps most if you hit the power switch on the surge protector/power tree first.


No external fever but sweated through my sheets despite it being 65f in my bedroom. Covid is fuckin wild yall.

Also, paxlovid carries some kind of awful aftertaste with it. Worth it of course, but blech.


I felt a disturbance in the force, as if... as if some effing dweeb leaked docs on Warthunder again

https://nichegamer.com/war-thunder-user-leaks-restricted-military-documents-for-ah-64d-apache-longbow/


nostr:npub12vvx0ah05hrpknzphsgt4sgumuau2ha22zy88j3a8k45d0aucakqfuf0yx Years ago Microsoft had a neat research project turning data flows into sound and trying to determine if compromised servers sounded reliably different from healthy ones


(think that one was the fever talkin)


given the staccato consistency of packet traffic, at some level all computers are drum machines


nostr:npub14c2jy9c70eqnujf88em9wukdd0mnfaz5ypk5ka74hu5aal8wuz6snnjduw oh you in GEORGIA georgia


nostr:npub19g7908egtawavcwgyv6f7yu7rudgxuu8djqt2a96n5hj0379gduqvutg6p nostr:npub1ydqz9kudwzremaucqnkdmwwk6lukye75tpqk00c0td8f7rc279jsaqczs0 Thanks. And yeah - I was not as careful as I should have been on this last business trip (obviously) but it does seem like this one is particularly insidious.


nostr:npub1ydqz9kudwzremaucqnkdmwwk6lukye75tpqk00c0td8f7rc279jsaqczs0 oh god no, that'll just make me sick *and* ragey, but thank you


nostr:npub1ydqz9kudwzremaucqnkdmwwk6lukye75tpqk00c0td8f7rc279jsaqczs0 yeah same, i'm very bored and there was already too much that I needed to do before this


nostr:npub1ydqz9kudwzremaucqnkdmwwk6lukye75tpqk00c0td8f7rc279jsaqczs0 *wobbly, tired fistbump back* you kno it


nostr:npub1ydqz9kudwzremaucqnkdmwwk6lukye75tpqk00c0td8f7rc279jsaqczs0 fuuuuuuuck i'm sorry


i can't pun right now, and that is the worst symptom i'm experiencing of all


nostr:npub14c2ym0xv2wjdaq3su2gl8eu6zhjcv77x2ycac3kcxha2t54lz8rq78umaq i am suddenly wondering what a Tactical CISO would look like

Ballistic-rated blue light raybans?

Kydex quick-draw holster for their cellphone?

Would their compliance document briefcase have Molle straps?


nostr:npub18yl523aft0stkww4vr3dqxxafwjve6x3vrvsfa4hla698zp8gdqqy0pegw So it won't fit *all* your needs but nostr:npub1n9xhyf4et0wagfe8kgt2mxruzw8agxlruay3as5jexyh3gmtxtasuswqtl and I wrote up a thing a few months ago on being ND at work, including a section specifically for managers/coworkers as well as a section about the ND person's own needs.

Hope it helps at least a little.

https://www.domaintools.com/resources/blog/removing-the-mask-how-neurodiversity-strengthens-cybersecurity/


cc nostr:npub15kwp2pavvan7wsvk2f7egwl9ph6szx868y0c2fad9jfh2amp6yyqtrmun3


I would like to be asleep but sure, covid, I'll just toss and turn and then memescroll.

Symptoms are mild to moderate but goddamn it has been a while since I hurt this much all over.

(Paxlovid already rollin)


I still stand with Ukraine.


nostr:npub1642u08rjepplavqe2umf7lltdm5kp8j2tejh7zteyfwu9ggh390q4m776r it was a good one, i wouldnt fault you for a replay


Funny thing about being an operational-focused person most of my adult life: I get wretchedly sick and spend the morning making sure all angles are covered (household protocol, family obligations, work projects, etc) before letting myself collapse back in bed.

But, am now back in bed.


Welp, guess its my turn

https://masto.deoan.org/system/media_attachments/files/111/131/686/188/887/068/original/fe3c5a7ea5632cf2.jpg


nostr:npub1vcl9kcqwwsk536z8s4h6k48qrfkm7mahzrk5mz0v04j94507d20s6hk6t3 i knew there was a reason I hated those. well, another reason. no, a reason other than that. no, keep going...


nostr:npub1vcl9kcqwwsk536z8s4h6k48qrfkm7mahzrk5mz0v04j94507d20s6hk6t3 ah shit


I wonder if I set up meditation-level binaural beats and meditate through this fever whether I will get superpowers


nostr:npub190ymzlxr2r85e5upqzc706ps3p3338tcczsq9665t56ecyug92hsmm03mz My fear is that it's the other side of capitalism's "growth at any cost" pathology - "agitation at any cost."


man, it has been *years* since I've knowingly had a fever

most everything else is mild (light dry cough, scratchy throat, stuffy nose, moderate aches, a little dizzyness) but this fever shit is not fun

(covid negative as of this morning, continuing to test.)


nostr:npub1wghkf239prxvny40pd5t8v5ad9239fpd5v2d8zhd6r2p0rc8mqgqg70xff nostr:npub1avhc7xvkfujc44sp5stxr3umwjast0gz0zjmg54n5ntuq6xlxfdslhxckt sigh.

I wish you well, RG.


nostr:npub1wghkf239prxvny40pd5t8v5ad9239fpd5v2d8zhd6r2p0rc8mqgqg70xff nostr:npub1avhc7xvkfujc44sp5stxr3umwjast0gz0zjmg54n5ntuq6xlxfdslhxckt story's a bit more complicated than that.

https://www.independent.co.uk/news/world/europe/zelensky-justin-trudeau-canada-nazi-b2418001.html


Got to guest on nostr:npub1urwfmn3ekjp6x0ftvddm5sge8txtleavurf0c6cpu7fg6uld2lhsfgnztw again and was pleased with the number and quality of meme references between nostr:npub1a62amv65ck2ycnzytst53gs2zet669y9yr4mkgzkh4fn99tzxlzqtz2puv, nostr:npub1e4l4c8j3mp5hwnlpl3qx80ecwugcxuv9xjxal0kd5smrtvtvcg0swagdgq, and I.

Think I messed up a basketball one, though, which is par for the course for me really. Episode comes out later this week.


Listening to this nostr:npub1urwfmn3ekjp6x0ftvddm5sge8txtleavurf0c6cpu7fg6uld2lhsfgnztw episode with nostr:npub1a8e7nzyyx7wvw5yyj0lgfyp92u6gcjw39nyvgd6agxydq2qhtpxqdtywga and it's such a great episode not just about technicals or emerging threats but also the importance of community and good guidelines as well. Really great conversation with Kali and Tim.

Also hearing the origin story of da's handle was awesome, as I had no idea and it's great.

My only disappointment was the lack of Xcom memes.

https://infosec.exchange/@BreakingBadness/111098812097850420


Fear not, I have returned.


Oooops, our masto instance was borked for a bit.


not enough coffee in my coffee

need more coffee


"What's it like being in security, Ian?"

I like to fall back to ol' Carl Jung for this one:

"After the cursing comes laughter, so that the soul is saved from the dead."


nostr:npub1mtv3plu9l6xg2q6k2ezmzg9728pq0yn8q7cpjnn4tah9j2g7cfcs6knasn

Support me for I stagger, drunk with fire.

Carl Jung - Red Book


Starfield:

No spoilers, but the UC Vanguard quest line is *great* - just a stellar scenario.

If the rest of the game had this kind of quality, it would be legendary.


nostr:npub1srqm8es67qcfgatjxltjwdkgfnk23mkq075zvd29n0cmnnwckcksax6dk8 I am reminded of, iirc, a midwestern town comptroller who embezzled something like $50M from the budget solely to fund her dressage sidegig.


nostr:npub16752f8gz0njqcl2vvsf7x7qfpgvhzjlu0kar2n80z8xkaq6j06ysvsnd5w Oh godddd yeah, did you see the recent reports on cars/car companies and privacy?

i'm about to take a screwdriver to mine


at least 30% of my stuff, I just stare at and think of the nonconsenual tracking possibilities now.

like my airpods.

even if I only pair them with Android? they're still pinging on Apple's Find My network wherever I am.


nostr:npub1q2u2afqm22e4k9kt4rxvl205pks6zmxuwq5dkuzgc6g8rp3x6cqqevtv7q ahhhhhhh shit


nostr:npub1llk25g23gz8730t2qk49y36yyttl5t284mshej0ylmdptuvv4mssjmztah Same! I'm hoping it blows us all away and CDPR gets some redemption out of it.


nostr:npub1llk25g23gz8730t2qk49y36yyttl5t284mshej0ylmdptuvv4mssjmztah Mostly as a sandbox, but yeah, it's enjoyable - not great, but a good sandbox. 55hrs in.


Starfield update: I was gonna become an Aurora-selling drug lord but it turns out all the *legal* but still addictive drugs are easier to make, easier to sell, and provide more profit.

So we'll see how it goes being Space Purdue Pharma.


nostr:npub1dvjfylpclftc7p06ns7lcc29kuazadg47dcpjx024g9mry975cyq3vvdle Oh geez I bet, sorry you have to deal with that!


As said elsewhere,

"Still punk as fuck," I whisper as I fill my pill containers for the month and make sure to email my Mom with where I'm staying on an upcoming work trip.


nostr:npub1q9pa3upvsufvxpst9xc60e9cxk7lznhaqq9sevvy6s9wdsymhscq2aendx that's a Monday feel if ever I've seen one


nostr:npub1q9pa3upvsufvxpst9xc60e9cxk7lznhaqq9sevvy6s9wdsymhscq2aendx sadly can't see it


nostr:npub1q9pa3upvsufvxpst9xc60e9cxk7lznhaqq9sevvy6s9wdsymhscq2aendx I suppose I should stop poking fun at Space Force now, eh?


nostr:npub1f9ze9e5z4mk9w7zw9wjmvu99v5r5qx9xaqsm4lf98td7aclppnfq4w5dr7 I saw a lot of malfeasance during a brief look at the Indonesian online gambling space, but I reckon that's different from casinos proper.


nostr:npub14c2ym0xv2wjdaq3su2gl8eu6zhjcv77x2ycac3kcxha2t54lz8rq78umaq You're a joy and a pleasure to have on my timeline as-is, and I'm grateful for you.


Does organized crime still try to launder money through casino gambling?

Because I'm suddenly enamored with the idea of mafias and triads etc stomping up to ALPHV and going "What the fuck, dude?"


Stuff like this is why I'm still single.

Filched from FB.

https://masto.deoan.org/system/media_attachments/files/111/071/895/690/617/640/original/cad21be9cb4e44cf.jpg


nostr:npub1hz9nt3mh37pjqk3mtezhpaurzdtw00u7skwk62qrv9tgnkyaylgs9l6rsm oh now THIS is interesting, wonder if he had his tea


nostr:npub1ej68dzernetvgqh3gpk006eh509jnmyzptwqcsr7y772vtf3j2dqpxpvaa Helllllll yes. Warren's one of my favorite people, and I'm so glad she represents my state.


nostr:npub1ej68dzernetvgqh3gpk006eh509jnmyzptwqcsr7y772vtf3j2dqpxpvaa yep, FTC definitely needs even bigger teeth. Biden gave Khan a pretty clear consumer info protection mandate though, and she's been usin' it.

I'm always in favor of bigger regulatory teeth, though. ;)


nostr:npub1ej68dzernetvgqh3gpk006eh509jnmyzptwqcsr7y772vtf3j2dqpxpvaa Khan's been taking some pretty good steps during her tenure - personal consent decrees for CEOs, among other things.

I have mad respect for her but also she merits several slides in one of my recent internal training sessions.


nostr:npub1ej68dzernetvgqh3gpk006eh509jnmyzptwqcsr7y772vtf3j2dqpxpvaa fair, but also, with both Caesars and MGM borked, you're looking at an off-strip motel if you want a last-minute Vegas room.

Can you imagine the exec's faces when they realized they checked Lina Khan in through this process, though?


there can be no clearer sign that the universe despises you than having Lina Khan engage with your business as a customer as your security is trashed and your consumer-facing information handling has been reduced to a shrug emoji.


Oh my holy god.

FTC Chair Lina Khan checked into the MGM Grand as their systems were down and they were having guests, including Khan, handwrite their credit card numbers on paper.

https://www.bloomberg.com/news/articles/2023-09-15/mgm-was-hacked-and-lina-khan-had-to-write-her-credit-card-number-down-on-paper


So the State Department was the first to alert on the Microsoft key compromise thanks to canaries they instituted in their email system.

This is, frankly, a huge win for State - for a good few years around DC, State's email was considered constantly compromised.

Really nice to see that they upped their game and it paid off.

https://www.politico.com/news/2023/09/15/digital-tripwire-helped-state-uncover-chinese-hack-00115973


last boost: the distressed jeans of the future.


Therapy appointment this afternoon - and not only do I recommend psychotherapy for folks that aren't in crisis, I ESPECIALLY recommend it for folks who aren't in crisis.

Therapy can not only help you avoid crises but build internal tools and increase quality of life regardless of where you're at right now.

If you are in a place where you can access therapy, maybe try it out!


Random observation: a handful of new IDN homograph whois entries possibly emulating Vietnamese blockchain firm bingx[.]vn

I'm kinda hoping these are just preemptive/prophylactic registrations by BingX because otherwise it looks like campaign infra spinning up.

xn--bngx-vpa.com[.]vn

xn--bngx-5w5a[.]vn

xn--bngx-5w5a.com[.]vn

xn--bngx-qpa[.]vn

xn--bngx-vpa[.]vn


nostr:npub1dvjfylpclftc7p06ns7lcc29kuazadg47dcpjx024g9mry975cyq3vvdle salted rim maybe? coffee grounds?


these threat actor group names need to go, though. "Peach Sandstorm" sounds like something cold and refreshing that I should be enjoying on a beach somewhere.


Microsoft Threat Intelligence with a good post on an Iranian nation-state actor executing password sprays across industries.

Some good TTPs and other details here. If you've had a password spray attack lately, worth running the 4 IPs they provide through your auth logs.

https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/


nostr:npub10xkmp6gr7qut33f7asv2fwcncamnxecmj7ac79n7g7n9jdlq6mksm6snef I am pretty cloud averse, especially Google averse, but Obsidian's on-device encryption had me singing their praises. Works as it should as far as I can tell, but no frills


nostr:npub10xkmp6gr7qut33f7asv2fwcncamnxecmj7ac79n7g7n9jdlq6mksm6snef not off the top of my head, sorry. I keep a pretty rigid folder hierarchy. But I wouldn't be surprised if a community plugin exists to solve this problem, or a plugin that enables scripting in order to automate your way out of it.


I fell in love with notetaking app Obsidian months ago but can understand some folk not taking to it.

This post highlights what looks like a good alternative!

https://mstdn.social/@redcrew/111058914522409440


little known fact, webp is short for "we be patchin"


nostr:npub1psdfxfpxz2cwmmnsk60y3nqpn2tqh9n24h4hstvfkwvr6eaek9js499sr7 instead of the batsignal, you reach him on the punchline


nostr:npub182hu34knzuf4nu74hqqfmgfrk5zlj6v0xrztrurgrft7tsyk2jsqvu5jgc Thanks much! Checking it out.


Anyone have a recommendation for an Android-friendly smartwatch that isn't just corpo tracking augmentation?

I honestly don't care about steps or ekg or any of that stuff, really just want notifications on my wrist.


nostr:npub1hyp0snlqyw66uwuep7tnkwqhgpg7qspvf928v0mm8d9penuwee0srvaehm I am no fan of Google but Google Authenticator requires user interaction to upload OTPs to the cloud and the interaction is surprisingly clear.


nostr:npub1fd047nr820z79gyyaeuhv0dmtwzw7nuagh7s9swttc4rk2p58mas63rh2a Luckily my dad doesn't engage with the app store much at all, but yeah I can 100% see that being a larger problem that needs addressing.


New work blogpost is up - recently went through a situation where my aging father lost his cellphone.

I took the moment to review what we did ahead of time that helped, and what we could've done better.

If you're in a position of responsibility for aging loved ones, I hope this gives you some good pointers.

https://www.domaintools.com/resources/blog/smartphone-security-and-aging-parents/


nostr:npub1dvjfylpclftc7p06ns7lcc29kuazadg47dcpjx024g9mry975cyq3vvdle Always appreciate the second set of eyes - you're not wrong about not keeping all eggs in one basket.


Riot Games bounces security@, help@, and info@, so I guess they don't wanna know.

If you know someone at Riot, maybe give them a heads-up.


nostr:npub1dvjfylpclftc7p06ns7lcc29kuazadg47dcpjx024g9mry975cyq3vvdle When it's either got a typo homograph (like the CGS one) or has an MX record not pointing to the primary domain (like the riot games one) it raises my suspicion much, much higher.


yourokta[.]com - IONOS SE playing a supporting role

and let's take a peek at cgslnc-okta[.]com - that's an L - as software company CGS at cgsinc.com is probably a juicy target, with pivots to IBM, Microsoft, Dell, MasterCard, and more.

Registrars are the problem, people.


testokta[.]com brought to you from the fine folks at Google's registrar and hosting.

oktaDOD.com from Namesilo/Aws

Oh, oh, oh, someone go thank the discerning folks at Namecheap and Amazon for okta-riotgames.com (primary domain uses markmonitor/akamai)


okta365dev[.]cloud is legit, i'm sure. Thanks Godaddy/Google.

okta-route[.]com, route-okta[.]com, outreach-okta[.]com look super great for everyone, thanks Amazon/Network Solutions.


well i guess it's time to go through  my Okta domain monitors again

Let's start with premera-okta[.]com, which differs from the primary domain across just about every profile factor.

Premera's a Blue Cross provider with 2.8M members.


nostr:npub16nf3kapgx9uhw3dhhrhsz9xf39agncyw4ws0k49kq92qmphy2nrqw2nhcp No clue, sorry!


Random vouch:

Dad's in the kitchen making pancakes, using a high-power mixer to mix the batter. Because my auditory processing is screwed, I get misophonic shivers from it ("brain says bad noise, must rage!").

With "Calmer" ear inserts, no shivers, no rage, but can still hear. I don't *like* the sound of the mixer but it doesn't make me hate everything.

#neurodivergent #actuallyautistic


In a private convo, a friend just astutely observed that slap bracelets were an early fidget toy of our generation.

Mind. Blown.


UPS Dispatch: "Yeah I know the driver was there at the address last night but I don't know what happened."

Me: "Guy, I'm not trying to jam anyone up, but I was sitting 10 feet from the front door until ten minutes after the delivery attempt was logged, my outside light was on, my driveway camera was on, and my doorbell records video locally when pressed. Nada. Zilch. Zero."


"In a first, spyware is found on phone of prominent Russian journalist"

(pegasus - gift link below)

https://wapo.st/3LnltAF


okay, FAR too relatable.

(stolen elsewhere from nostr:npub1n9xhyf4et0wagfe8kgt2mxruzw8agxlruay3as5jexyh3gmtxtasuswqtl )
#neurodivergent

https://masto.deoan.org/system/media_attachments/files/111/058/538/131/405/278/original/9fbf86f376351915.png


Delivery attempted my hairy ass, UPS.


Now when Starlink has an outage my first thought is "Hmm, is Elon providing material assistance to Putin's forces again?"


nostr:npub12lxtr540euchz3wpu4l745spze9fesue5lcentzceegq04ftzzxsajjvjy #courage


Today I learned about "the Dutch Reach" which sounds like something particularly scandalous but is in fact much more wholesome than that.

https://flipping.rocks/@colinpurrington/111041944797648010


nostr:npub1q2u2afqm22e4k9kt4rxvl205pks6zmxuwq5dkuzgc6g8rp3x6cqqevtv7q Fair!

In this case, Google TAG found a cross-platform DPRK actor targeting security folk

https://blog.google/threat-analysis-group/active-north-korean-campaign-targeting-security-researchers/


i wish i had the self-discipline to sinkhole slack at the firewall during weekend hours


Reminded of this comment from Trump, as relayed by nostr:npub1aq2wqds7uk7g9tfv6gmm2qk0t6cmqmpzh5n9hkdghgx3d0x75syspa4nfw five years ago today.

https://masto.deoan.org/system/media_attachments/files/111/026/280/188/791/207/original/061c53d6ffe539d8.png


Was ordering Taco Bell smart for my health? Well, no.

But was it satisfying? Also, absolutely not.

don't know why I do this, my eyes insist on cursing my stomach and brain...


WHY is it

ONLY

THURSDAY?


nostr:npub1hp0z35atfkt7qtn3rpcvl50ykskvav0gz5mcugp29v5h5daw8cyqgxmh7v TOOT through the ditches

net WORK through the switches

SYN/ACK from the back of my DRAGULA


nostr:npub1psdfxfpxz2cwmmnsk60y3nqpn2tqh9n24h4hstvfkwvr6eaek9js499sr7 Back when Hale-Bopp was around the local police log of my sheltered hometown had the following entry:

"Comet-watchers mistaken for buddha worshippers."

Of course, why someone was calling the police about Buddha-worshippers is anyone's guess.


nostr:npub1a8e7nzyyx7wvw5yyj0lgfyp92u6gcjw39nyvgd6agxydq2qhtpxqdtywga when bullet knives won't do

https://masto.deoan.org/system/media_attachments/files/111/025/198/980/726/724/original/14361c799c8e8d3e.png


nostr:npub16mzsp9vtc8h6e986507sw88q3xzq5pfjaff30r5wcgfprksnf03s65uzxf oh jeez, they implemented it?!?!

i thought that was still just a draft proposal.


nostr:npub1ue9gnvtnpy7h46w8a24en6u9puk24au6qap65q3xqx5pz3agj7tqrp67f9 Your thesis already sounds awesome.


nostr:npub1ztnrjmh66cck37da0cf7haj96rrexrjncld4hu06y9pzaknpmvzsd59xd5 great to know, thanks!


nostr:npub1c632cnrn6ey0xel8laru3zp7j8l5q3u83za0k75kxvm0rsesmz6s2tep4f Good to know! Thanks very much for the info.


nostr:npub1c632cnrn6ey0xel8laru3zp7j8l5q3u83za0k75kxvm0rsesmz6s2tep4f Likely so - do you have experience with it? I've heard more about other options, less about CalyxOS though it's been on my radar.


nostr:npub1nj3n3jejt789gqesar4dmgw2g3tmqtdc9nr6rn8hjh7z4hmdmnxqynt65g good to know, thank you! i'll have to check out grapheneos again, been a while.


"oh for your convenience we're just going to make the wifi button disconnect for a day, because fuck you"

i want a mobile device with an electromagnetic shotgun duct-taped to its forehead at this point, and it's all the ad industry's fault.


if anyone has suggestions for de-googled/foss/reputable tinfoil phones they have direct experience with, hit me up.


i really am gonna be one of those nutters with a stripped-down foss phone soon aren't i

all purely on the basis of not wanting every move fed into databroker stuff.


the msrc blog and the lastpass vault-crack worries are givin me the agita


nostr:npub1vcl9kcqwwsk536z8s4h6k48qrfkm7mahzrk5mz0v04j94507d20s6hk6t3 Consider, if you will, a tech "review" channel with the sophistication of Axe Body Spray, and that leaves the aftertaste of Mountain Dew Baja Blast after watching videos.

But also demands it be taken seriously.