Harry Sintonen

I, for one, hail our EU overlords for staying their ground and not bending over to Apple.
This EU regulation did not come as a surprise to anyone, and definitely not to Apple. Yet they decided to go all knee-jerky about it.
Food for thought: If you cannot implement an AI feature in an interoperable and safe manner, it likely should not be implemented at all.

2026-04-13 15:30:18 CEST

- reply

Agreed. Currently only 37% of payments use national systems (and it's unclear how much dependencies on US systems those might have). https://www.ecb.europa.eu/press/pr/date/2025/html/ecb.pr250228_1~7f0697af45.en.html

2026-04-13 14:10:46 CEST

Finland, Denmark, Norway, Sweden, and Estonia are soon enabling offline debit card payments for at least seven days without network connectivity. The change covers payments for essential goods in physical trade, such as food, medicine, and fuel. Each country has made - or is in the process of making - the required changes to their related regulations to enable it.
The motivation for this change is to enable payments even in exceptional situations such as network disruptions due to sabotage or conflict. TL;DR: You can pay for essentials even if Russia cuts the cables.
Plans for this change were announced in May 2025: https://www.reuters.com/business/finance/nordics-estonia-plan-offline-card-payment-back-up-if-internet-cut-2025-05-07/
#resilience #preparedness #infrastructure #payments #banking

2026-01-29 01:03:21 CET

- reply

> but where do you register your domain?
From myself since I'm a registrar.
This is possible with Finnish Transport and Communications Agency, so I'm opting for this.
> Even if you point it at your nameservers, it sits with someone.
I host my own nameservers, too.

2026-01-28 18:01:29 CET

- reply

This, among some other factors, is the reason my I've self-hosted for a long time now.
https://infosec.exchange/@harrysintonen/115916299816297773
#note1y4l…g7gj

2026-01-18 14:19:27 CET

I've self-hosted for decades. I host my own web sites, email, calendar, contacts, backups, file sharing, VPN etc. Kind of personal #digitalsovereignty.
Obviously, the reasons for this have nothing to do with politics or short-term developments. However, at times like this, it sure is nice to have one less thing to worry about.

2026-01-07 08:51:27 CET

#curl 8.18.0 has been released. This release fixes 1 medium and 5 low level vulnerabilities:
- CVE-2025-14017: broken TLS options for threaded LDAPS https://curl.se/docs/CVE-2025-14017.html
- CVE-2025-14524: bearer token leak on cross-protocol redirect https://curl.se/docs/CVE-2025-14524.html
- CVE-2025-14819: OpenSSL partial chain store policy bypass https://curl.se/docs/CVE-2025-14819.html
- CVE-2025-15079: libssh global knownhost override https://curl.se/docs/CVE-2025-15079.html
- CVE-2025-15224: libssh key passphrase bypass without agent set https://curl.se/docs/CVE-2025-15224.html
I discovered the last 2 vulnerabilities.
Download curl 8.18.0 from https://curl.se/download.html
#vulnerabilityresearch #vulnerability #cybersecurity #infosec

2025-11-01 15:55:09 CET

#Microsoft is clearly becoming desperate due to low adoption rates of #Copilot.
Apparently, Microsoft is now pushing Copilot to all #Microsoft365 personal subscribers and calling it a "subscription price increase". Only when you decide to cancel your subscription are you presented with the option to switch to "Microsoft 365 Personal Classic" without Copilot (and nearly the old price). The classic plan is not presented as an option unless you try to cancel your subscription.
This is a classic scammy trick: Modify the existing plan and add the feature no one wants and hide the old plan from view. Presto, now you have an insane adoption rate you can present to investors as a great success.
I personally don't use Microsoft subscription services, so I don't know if they tried this bullshit in the EU, but if they did, they're asking for trouble. They got sued in Australia over this already: https://www.accc.gov.au/media-release/microsoft-in-court-for-allegedly-misleading-millions-of-australians-over-microsoft-365-subscriptions "Microsoft in court for allegedly misleading millions of Australians over Microsoft 365 subscriptions"

2025-06-22 14:29:18 CEST

Insecure defaults can lead to surprises. When creating FIFO sockets with systemd, be sure to note that SocketMode defaults to 0666 - that is world readable and writable. That is: any local user can communicate with the FIFO. If your FIFO is used to perform privileged operations you must ensure that either the FIFO file itself is located in secured location or set SocketMode to stricter value.
I spotted one such insecure use in cloud-init: the hotplug FIFO was world writable. This is CVE-2024-11584 and fixed in cloud-init 25.1.3.
The commit fixing this is in https://github.com/canonical/cloud-init/pull/6265
#CVE_2024_11584 #ubuntu #systemd #infosec #cybersecurity

2025-05-14 11:26:41 CEST

Russian citizens and dual nationals are not permitted to operate unmanned aircraft (such as #drones) in Finland. While the updated EU #sanctions regulation (EU) No. 833/2014 gives member states the option to grant exceptions, Finnish authorities have not deemed it necessary to do so.
source: https://www.traficom.fi/en/news/russian-citizens-and-dual-nationals-not-allowed-fly-unmanned (in english)

2025-04-16 23:59:29 CEST

Update your #Apple devices ASAP. Two vulnerabilities, CVE-2025-31200 and CVE-2025-31201, have been fixed: https://support.apple.com/en-us/122282
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS."
While iOS has been known to be targeted, the fixes are available for all Apple devices and should be installed as soon as possible.
#activeexploitation #CVE_2025_31200 #CVE_2025_31201

2025-04-14 19:12:05 CEST

I can't recommend
https://www.privacyguides.org/ enough. Excellent curated information on how to protect your #privacy.

2025-02-11 13:53:24 CET

Finnish Broadcasting Company YLE is misquoting the #Nordnet Finland country manager Suvi Tuppurainen:
"There is a technical problem behind this, so according to the information we have at this moment this is a cyber attack," said Tuppurainen.
This is not what she said. She said:
"There is a technical problem behind this, so according to the information we have at this moment this is not a cyber attack"
This completely reverses the meaning. You'd think YLE journalists would be more careful.
https://yle.fi/a/74-20143032
#YleNews #yle #journalism
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/985/342/921/870/587/original/298a08c946f4ee49.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/985/343/446/178/928/original/17c42440f6be00a9.png

2025-01-25 16:14:36 CET

Easy prediction: Lesser #NVIDIA 5000 series graphics cards will suck since multi frame generation won't really help due to increased latency (not to mention the added artifacting). Unfortunately it's likely that many non-experts will drink the NVIDIA "RTX5070 better than RTX4090" kool-aid.
https://youtu.be/B_fGlVqKs1k "Hardware Unboxed - Is DLSS 4 Multi Frame Generation Worth It?"
#gaming #dlss #framegeneration

2025-01-18 01:52:37 CET

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/846/617/616/599/911/original/226b8eec9019551c.jpg

2025-01-17 20:58:08 CET

Apparently #macOS now considers #Docker malware.
#infosec #cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/845/453/942/319/611/original/266e3488305c5508.png

2024-12-15 15:09:39 CET

- reply

Apparent origin of the 9.1 base score: https://github.com/cisagov/vulnrichment/blob/develop/2024/11xxx/CVE-2024-11053.json

2024-12-15 12:21:43 CET

Apparently #CISA has rated #curl #vulnerability #CVE_2024_11053 as #CVSS v3 Base Score 9.1 "critical". This is wrong, and will lead to automation triggering unnecessary warnings and blocking use of perfectly fine systems until an update is installed (which can take months). https://nvd.nist.gov/vuln/detail/CVE-2024-11053
Edit: In case you wonder my credentials for judging this: I found this vulnerability.
Edit2: This appears to be originating from CISA: https://www.cve.org/Media/News/item/blog/2024/06/04/CISA-Added-as-CVE-Authorized-Data-Publisher
Edit3: The score has now been fixed. Commit: https://github.com/cisagov/vulnrichment/commit/91fadb2bf6b461638c8155978b9f20cf17e51fe3

2024-12-11 08:12:24 CET

#curl 8.11.1 has been released. It includes a fix to #CVE_2024_11053 - a #vulnerability I discovered.
It is a logic flaw in the way curl parses .netrc file. In certain situations, the configured password can be sent to a incorrect host. Luckily the affected configurations should be quite rare and thus the situation is unlikely to occur often.
The issue has existed in the curl source code for almost twenty-five years.
• https://curl.se/docs/CVE-2024-11053.html
• https://hackerone.com/reports/2829063
No AI tools were used in discovering or reporting the vulnerability.
#noai #handcrafted #infosec #cybersecurity