Daniel J. Summers ~ East TN, USA

Christian, software developer, USAF Retired, Tennessee/Colorado State football fan, and all-around nice guy. Sir Fatigued Coder of No Agenda.

Personal Site: https://daniel.summershome.org
Business Site: https://bitbadger.solutions
Twitter: https://x.com/@DanJSum

Last Notes

2025-10-30 21:21:15 CET

- reply

anymore, it seems. It used to be about freeing up time used by busywork, or providing a wider view of things. The computer works for you; now, we work for the computer.

2025-07-06 02:50:50 CEST

- reply

Yeah - that's the rub. One of the things that I've done throughout my time in tech is adjust details up and down (in a 100-foot view vs. 50,000-foot view) to help folks understand things at their level. The risk of SMS second factors - i.e., the entire process is only as strong as its weakest factor - is something for which I currently don't have a good answer. I feel like one has to be out there - I just haven't found it yet.

2025-07-06 02:38:23 CEST

- reply

I guess this is the distinction. I completely agree with "highly spoofable" - I'd even go so far as to call it eminently spoofable. But, if risk = vulnerability * (threat / likelihood - as a decimal number no greater than 1) - any number times 0 is 0.
SMS spoofing/cloning are non-zero risk, even for folks who celebrated a holiday yesterday - but, how do we communicate that to the average user in a way that gets their attention, but isn't so catastrophic that it fades into the background noise of "everything is going to get you eventually"?
This is a genuine question I've had, as a security-conscious developer, for several years. The vulnerabilities are real - security professionals can provide chapter-and-verse for that. Communicating the threat, though, is where the industry comes up short. "This is like bathroom graffiti!" doesn't land with most folks. IOW - if the given is "these ignorant users believe their data is not at risk" - do you have ideas of how we can convince them that they're wrong?
What I've done, up to this point in my career, is make my stuff as secure as possible. I'd love an out-of-the-box take, though, that breaks through the tech-bubble noise and convinces people not to panic, but to actually consider their risk and adjust their behavior. :)

2025-07-05 17:31:03 CEST

- reply

I'd forgotten about SIM swapping (and cloning). That's definitely a more likely scenario, depending on where you are!

2025-07-05 17:13:44 CEST

Thinking about SMS security @npub10us…p5pu @npub142a…ccwa @npub1d85…p88k - it's my understanding that SMS is unencrypted w/in the network where it's sent (so phone-company secure), and that the biggest risk is rogue connection points that may trick the phone into connecting to it. People may underestimate how likely they are to encounter one of those ("who would want MY data?" LOL), but has that threat model changed?
I agree on the levels of security by content, but it also needs to be the highest level of security that content would need; otherwise, the presence of a certain level of security implies the value of the content being secured. I agree that should be baked in at the design level, not layers bolted on afterwards; but, do you not see some of those as pragmatic steps to save the uninformed masses from themselves"?

2024-11-22 03:21:15 CET

A while back, @npub108h…p7er asked if anyone could write an RSS reader that could be used on an internal network, using vanilla PHP and SQLite. I thought that sounded like fun, and 5 months ago, the first beta was done. Long story short - v1 was released today!
https://git.bitbadger.solutions/bit-badger/feed-reader-central/releases/tag/v1.0.0
It's designed for self-hosting, and will work with PHP 8.2+.

2024-08-13 21:05:52 CEST

- reply

LOL... well, if you're going to phrase it that way, I'm not going to disagree with you.
As Jonah Goldberg likes to say, "Trump isn't Hitler; Hitler could have repealed Obamacare."