Bill

Current post Easter dinner movie selection.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/354/890/836/614/040/original/9d575d83c86f6c39.jpg

2026-04-02 15:31:39 UTC

- reply

@nprofile…40zt Let me guess. It was vibe coded, right?

2026-04-01 19:18:07 UTC

- reply

@nprofile…gu7x @nprofile…r6fk All you can do now is share the joy.

2026-03-31 15:45:53 UTC

- reply

@nprofile…44dh Yeah you have a valid point. Back in the day leaked Android source was a big deal for a bit until everyone realized it's just a zip file.

2026-03-31 15:41:32 UTC

- reply

@nprofile…44dh But how many times has it been cloned?

2026-03-30 18:54:31 UTC

- reply

@nprofile…3d77 @nprofile…uq8k Was he any good at the banjo? At least he wouldn't have to wear finger picks.

2026-03-30 18:28:46 UTC

- reply

@nprofile…u76z I have lost count of the conflicting emails I have received from them. It's ... tiring. Just send me the money, I'll dole it out.

2026-03-22 04:04:36 UTC

They would know. They fell for all of them.
https://thehackernews.com/2026/03/fbi-warns-russian-hackers-target-signal.html
#phishing #signal

2026-03-20 17:54:57 UTC

- reply

@nprofile…44dh Oh man, Adobe has become such a dumpster fire. Remember when they were the gold standard?

2026-03-20 03:56:12 UTC

CATO has a nice teardown of the latest AI Bullshittery being considered by the wanna-bes on Capital Hill.
https://www.cato.org/blog/latest-ai-bills-5-biggest-flaws
#ai #policy

2026-03-19 21:27:52 UTC

What's the hot new #android game?
My brains need rotted.

2026-03-19 03:45:17 UTC

As was largely obvious, AI tooling isn't making the attackers much better, just faster. Like, significantly faster.
https://www.infosecurity-magazine.com/news/exploitation-accelerates-in-2025/
#cybercrime #agenticai

2026-03-16 17:34:15 UTC

- reply

@nprofile…44dh With the contorted network configs everyone is using these days this will probably become even more common, I imagine.

2026-03-16 17:29:17 UTC

- reply

@nprofile…44dh All yall havin fun but it works here. Just got off a meeting.

2026-03-09 17:53:47 UTC

- reply

@nprofile…44dh Oh good. I was hoping someone smarter than me had come to that conclusion too.

2026-03-09 17:50:55 UTC

- reply

@nprofile…44dh I am telling clients to, until guardrails are solved, treat OpenClaw as malware. Especially in larger shops where individual devs have more autonomy with less oversight.

2026-03-09 17:45:05 UTC

- reply

@nprofile…ds0l That is kinda awesome. Dachshunds are so cool.

2026-03-09 17:21:53 UTC

- reply

@nprofile…ds0l I wonder if Milo the dachshund feels really really small or if the dog brain just sets in and Milo thinks he's just as tough as Odin.

2026-03-09 17:20:45 UTC

- reply

@nprofile…44dh And make reasonable decisions about what to do next. That's what terrifies me.

2026-03-08 19:16:52 UTC

- reply

@nprofile…44dh Do not let perfect stand in the way of good.

2026-03-07 17:42:00 UTC

Tank, I need an exit.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/189/104/742/344/321/original/30b29b100bbb7e5c.jpg

2026-03-06 04:26:34 UTC

- reply

@nprofile…4xpq I like Gemini too. It really handles search better than anyone else, and while that seems small, it really isn't.

2026-03-06 04:24:57 UTC

- reply

@nprofile…4xpq WHo do you like instead? Or just no one?

2026-03-04 13:41:08 UTC

- reply

@nprofile…z6kv See, that's a teaching moment (well, sometimes) but "it's just secure!" Is not.

2026-03-04 04:48:25 UTC

When cloud computing was The Thing™️ I gave a talk at dozens of venues called Looks Like Rain Again where I showed folks that uploading insecure software to Azure would not make it secure.
Guess what?
Using an LLM will not make the software you use to run it more secure.
https://www.securityweek.com/vulnerability-in-ms-agent-ai-framework-can-allow-full-system-compromise/
#agenticai #appsec

2026-03-04 04:43:26 UTC

This research by Microsoft is:
1) timely and actionable vulnerability analysis
2) the most Microsoft vulnerability chain I've ever seen, I swear to holy hell.
https://thehackernews.com/2026/03/microsoft-warns-oauth-redirect-abuse.html?m=1
#microsoft #oauth

2026-03-03 17:10:58 UTC

- reply

@nprofile…44dh Do you think the DoD is fucking with them just because Kegstand is a drunk asshole? Outages like this seem not normal.

2026-03-03 03:43:09 UTC

- reply

@nprofile…3qha Not in most adversary's scope of capability, admittedly. But if you got it flaunt it I guess.

2026-03-03 03:41:27 UTC

- reply

@nprofile…3qha Two Amazon data centers are already down. I doubt "hecking missiles" was on many folks disaster recovery plan.

2026-02-27 13:29:28 UTC

- reply

@nprofile…vuvh Oh for fuck's sake. Who do I recommend now? I have to change my remediation template language for 'lacking MFA'. Shit. Why does everything have to suck?

2026-02-25 21:55:04 UTC

Can we all just come to an arrangement right here and right now that if we're going to publish things online, we put a datetime stamp on them, especially with regards to AI, which changes on an hourly basis?
I requested this a long time ago for cloud. No one did it then; then it only changed on a daily basis. Those were the days. I remember that. These days, sometimes things written in the morning are wrong by the afternoon.
I'd really like a date/time stamp on any articles that are written. Thank you in advance!

2026-02-25 13:29:31 UTC

- reply

@nprofile…4xpq It doesn't have the energy.

2026-02-25 10:35:34 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/130/817/730/790/610/original/67cc22bf84b0b428.jpg

2026-02-24 20:39:40 UTC

- reply

@nprofile…0hde I'm working on it, Em. I'm working on it.

2026-02-23 16:54:00 UTC

- reply

@nprofile…44dh Seeing as how OpenClaw is doing nothing except expressly, in its mind anyway, performing the requests of a user under that user's permissions using that user's tools, how exactly would you recommend we prevent it on enterprise networks?
That reads kind of snarky, and it isn't. It's an honest question. I just got it from a customer.

2026-02-07 00:42:27 UTC

- reply

@nprofile…4xpq Ok, that's something else.

2026-02-06 04:35:22 UTC

- reply

@nprofile…4xpq And my axe! Oh wait wrong movie.

2026-02-05 04:40:31 UTC

"Product says we need to have this up tomorrow!"
"There are 184 outstanding critical and high security issues!"
"Meh, it's AI, it'll figure it out."
https://www.theregister.com/2026/02/04/cloud_hosted_openclaw/
#agenticai #security

2026-02-03 13:29:29 UTC

- reply

@nprofile…z6kv Deep thoughts. I spend the same amount of time on each OS, so I should get that, but I'll include it in today's meditation instead.

2026-02-03 01:39:55 UTC

- reply

@nprofile…4xpq @nprofile…tryn Jesus this is impossibly sophisticated. They put a lot of work into this.

2026-02-03 01:34:38 UTC

- reply

@nprofile…4xpq Oh no, everyone stay off the sidewalks.

2026-02-03 01:29:57 UTC

Hey y'all I think @nprofile…tryn stumbled on a real life active disinformation campaign. If anyone is advising someone who is looking at a move to Canada, you should know this bullshit is out there.
And WILD, huh? "Hey, we need people to be scared of leaving, so can we start making shit up?"
There's a lot of them, too.
https://youtu.be/0rwL5XIQD2Y?si=zKOEDUbGvvdkXSsF
https://youtu.be/OHMhUVaK-qc?si=RApOAeM_g2epbWgO
#uspol #disinformation

2026-02-02 14:23:24 UTC

- reply

@nprofile…vuvh hell, my daughter wears a onesie PJs. She seems to get by okay. However none of these people are me.

2026-02-02 13:06:56 UTC

- reply

@nprofile…vuvh Gotta get nekked to poo. Sounds cold.

2026-02-02 00:49:07 UTC

- reply

@nprofile…4xpq h/t @nprofile…tryn
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/998/281/755/021/248/original/050ecf8073703969.mp4

2026-01-25 23:47:39 UTC

- reply

@nprofile…l9z3 Wild. SOP around here Ohio way.

2026-01-25 22:35:43 UTC

- reply

@nprofile…l9z3 Where is you wife from? It's a Midwestern thing.

2026-01-21 21:23:43 UTC

- reply

@nprofile…4xpq there's a war room there with a hundred inch TV with your Mastodon feed on it. I just know there is.

2026-01-21 15:28:55 UTC

- reply

@nprofile…4xpq When are you speaking there this year?

2026-01-10 03:01:52 UTC

🏈 Indiana is giving Oregon a good old fashioned Midwestern ass whoopin. Didn't expect that. #cfb

2026-01-07 11:32:53 UTC

- reply

@nprofile…44dh No. No it doesn't.

2026-01-07 03:43:17 UTC

- reply

@nprofile…44dh Better than a private equity firm.

2025-12-29 15:18:05 UTC

Heckin wimdy.

2025-12-29 03:55:50 UTC

Huh. I think I might dump this proxmox idea and just install ubuntu server and run a hardcore docker. Everything I want to do with this box can run in that environment, an it reduces overall complexity.

2025-12-25 01:42:29 UTC

- reply

@nprofile…va3u https://youtu.be/uMoql_RYVBQ?si=Z2B_eG4Gso0Fmdgi

2025-12-24 01:00:07 UTC

- reply

@nprofile…2y2x Will the interview be about what you are cooking?

2025-12-22 02:23:05 UTC

- reply

@nprofile…4unj @nprofile…g7vv Alton Brown's is my go to.

2025-12-22 02:22:31 UTC

- reply

@nprofile…4unj I have many times. It is awesome, but this is unspeakably good.

2025-12-22 02:02:19 UTC

The only egg nog that has ever mattered.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/760/750/947/748/912/original/93eec32e92a84b63.jpg

2025-12-17 03:27:01 UTC

- reply

@nprofile…59g0 Tracks from my viewpoint.

2025-12-15 14:03:44 UTC

- reply

@nprofile…p7lw Ooh, me likey. Probably a bit of a trip for you to come give it at Columbus OWASP huh?

2025-12-15 04:33:12 UTC

This follows what I am seeing in tests. Far fewer injection vulnerabilities, far more aurh issues. The apps didn't change, the attackers got better.
https://stateofsecurity.com/identity-security-is-now-the-1-attack-vector-and-most-organizations-are-not-architected-for-it/
#auth #vector

2025-12-12 20:42:57 UTC

- reply

@nprofile…s3c6 @nprofile…p7lw Those two organizations seem broadly at odds with each other.

2025-12-12 19:39:42 UTC

- reply

@nprofile…pkdd @nprofile…y2w2 @nprofile…ppe2 Remember back in the day when places started emailing site owners to ask if they could put a link to their site on your site, and everyone had their own page of cross-links? It was like SEO before we knew that SEO was bad. That was my job every Saturday morning at the first internet place I worked in '96 was to go through all the emails from people asking to exchange links and add them to our sites.

2025-12-12 19:37:08 UTC

- reply

@nprofile…mrzh No knowing is OK. Not learning is bad. Glad he learns! They are pretty smart pups, I am not surprised.

2025-12-12 18:51:57 UTC

- reply

@nprofile…mrzh He knows he's not supposed to touch that laptop. It landed on there, and you could hear his thoughts all the way over here.

2025-12-11 14:41:38 UTC

- reply

@nprofile…59g0 Wait, wait wait. You haven't met @nprofile…x2kl? He's my threat maven. I have no idea how he knows what he knows, but when something gets popped, I get it first here, from him.

2025-12-11 03:58:42 UTC

- reply

@nprofile…59g0 @nprofile…pqg8 I'm not sure I'd go to bed in the same house after seeing that.

2025-12-08 13:00:27 UTC

- reply

@nprofile…ppe2 Sorry, slow morning.

2025-12-04 00:10:14 UTC

- reply

@nprofile…p6mx @nprofile…4unj I've heard that! Yeah, once we made up our minds, it was three hours in and out.

2025-12-03 23:52:15 UTC

- reply

@nprofile…4unj We have a Limited. Good car. We have the one with the 3.6 litre engine too, got some balls.

2025-12-03 22:29:15 UTC

- reply

For the record, got a crosstrek. I'm sure I'll post a picture eventually.

2025-12-03 22:24:46 UTC

Ok, bought a car. Our long national tragedy has finally come to an end.

2025-12-01 17:32:30 UTC

- reply

@nprofile…p7lw I probably should just recommend that and be done with it. If they want something cheap, they can find it themselves.

2025-12-01 17:31:14 UTC

Who have we been recommending as a decent multi-factor authentication service that I can put in my remediation advice for a just normal web application that's floating out there in AWS?

2025-11-30 13:50:34 UTC

- reply

@nprofile…4unj Yeah, me too. Gonna do the necessary I guess.

2025-11-30 13:29:56 UTC

- reply

@nprofile…4unj I don't know if anything will come of it, but I'm going to fill out the form just out of principal. It looks like only this stuff I wrote from maybe 2010 and on are part of the database that was downloaded. Your mileage may vary.

2025-11-29 04:54:23 UTC

Wait wait wait wait wait. These formatter sites SAVE the stuff they are sent? I've never used one but I thought they were client side! Why would you DO that!?!?!
https://securityaffairs.com/185150/security/thousands-of-sensitive-secrets-published-on-jsonformatter-and-codebeautify.html
#leak #stupid

2025-11-28 19:43:50 UTC

I found my first ever exploitable race condition in a web application. I don't think I have ever really tested for that before quite so intently, and dayhm. I thought web servers were just handling this properly by default, since I dunno, IIS4 or something?

2025-11-25 14:16:03 UTC

Any good Java devs looking for a gig? I got a client who is looking. Shoot me a linkedin.

2025-11-25 12:59:40 UTC

- reply

@nprofile…w47d I really need to spin my GOG account back up.

2025-11-25 04:30:38 UTC

I'm playing a 20 year old tower defense grid game and having a blast so hush it.

2025-11-25 00:59:41 UTC

- reply

@nprofile…59g0 Isn't it always?

2025-11-24 21:54:19 UTC

- reply

@nprofile…r3k9 she'd like to be snoozing thank you

2025-11-24 19:25:47 UTC

- reply

@nprofile…ppe2 Saw that. I don't even know what we are going to do.

2025-11-24 19:24:17 UTC

- reply

@nprofile…ppe2
My father in law has one of those. I'll go sniff traffic and report back.
Can we not catch a break ANYWHERE?

2025-11-24 13:07:55 UTC

- reply

@nprofile…59g0 Musta been user error. Bread is a good idea.

2025-11-24 00:18:27 UTC

- reply

@nprofile…59g0 But I can't get to that post.

2025-11-23 18:55:25 UTC

- reply

@nprofile…59g0 So? What was the recipe?

2025-11-18 14:20:55 UTC

- reply

@nprofile…dllf I thought we did that like 7 years ago. They still haven't fixed that?

2025-11-16 23:55:29 UTC

No Mr. Bond, I expect you to die!

2025-11-13 18:20:00 UTC

- reply

@nprofile…mjzj No, that's about right.

2025-11-13 15:42:28 UTC

- reply

@nprofile…59g0 @nprofile…ppe2 Aah, that is an email that is still on my list to write. Good timing, Brian.

2025-11-13 15:34:26 UTC

- reply

@nprofile…59g0 Oh I can double that. Not the point.

2025-11-13 15:33:46 UTC

Man, I really need to get out from under Google.
Do you have any idea how HARD that will be? I bought in DEEP. Was sold by "Don't be evil." I'm a sucker.