Nostr notes by Dominic White

first I’ve seen that. My code is open source at ...

2026-06-13T15:39:11Z

In reply to nevent1q…ntgq
_________________________

first I’ve seen that. My code is open source at https://github.com/singe/QuantumHello and I can’t see theirs to check overlap. But it’s a pretty simple idea that’s basically just a variation on:
`openssl s_client -connect example.com:443 -servername example.com \
-tls1_3 -groups X25519MLKEM768`

Oh, and the code is at https://github.com/singe/QuantumHello if ...

2026-06-13T10:05:56Z

In reply to nevent1q…9w68
_________________________

Oh, and the code is at https://github.com/singe/QuantumHello if you’d just like a little go cmd for checking yourself.

You'll no doubt enjoy the irony that this site does not in ...

2026-06-13T10:04:44Z

In reply to nevent1q…rqpv
_________________________

You'll no doubt enjoy the irony that this site does not in fact support PQ. But I'd be interest in hearing what real risk that presents.

Check whether a site supports post quantum crypto* ...

2026-06-13T10:00:17Z

Check whether a site supports post quantum crypto* https://quantumhello.xyz

* Well hybrid PQ key exchange in the form of TLS 1.3 with X25519MLKEM768

that’s a really nice summary of the convo.

2026-01-23T05:10:40Z

In reply to nevent1q…ggxc
_________________________

that’s a really nice summary of the convo.

I hear ya. My knee jerk agreement with you was “don’t rewrite ...

2026-01-19T16:39:27Z

In reply to nevent1q…g7q6
_________________________

I hear ya. My knee jerk agreement with you was “don’t rewrite grep” but honestly if it’s learning you want rewriting grep is probably a better approach. If it’s speed you want and a brief search didn’t turn up something close then why not. For context my recent exp was the Burp App Store which didn’t have a simple global sed-like tool. Perhaps an argument for unix philosophy in tooling too.

that’s if your goal is to make something globally useful. If ...

2026-01-19T16:27:46Z

In reply to nevent1q…v3zk
_________________________

that’s if your goal is to make something globally useful. If your goal is to solve your current problem it’s a different set of incentives.

We’ve crossed the rubicon where for many simple tech use cases ...

2026-01-19T16:18:05Z

We’ve crossed the rubicon where for many simple tech use cases it’s easier to vibe code exactly what you want than it is to research several existing solutions and test them.

I’ll need to look closer but it feels like they would be more ...

2026-01-19T15:11:34Z

In reply to nevent1q…lvv6
_________________________

I’ll need to look closer but it feels like they would be more work than what I needed.

In Portswigger's Burp I needed a way to do Match & ...

2026-01-19T15:02:11Z

In Portswigger's Burp I needed a way to do Match & Replace globally across all utilities, not just the proxy so I wrote an extension https://github.com/singe/burp_global_match_replace

We (Orange Cyberdefense) are attempting to become a CVE CNA & ...

2025-12-24T12:01:06Z

We (Orange Cyberdefense) are attempting to become a CVE CNA & in prep for that collected the various vulns we had reported over the years that had corresponding public information. 108 of them! It’s mostly a vanity list but will be where we publish new vulns in future. https://advisories.orangecyberdefense.com/advisories

Here’s a free scanner for that FortiWeb CVE-2025-64446 I made ...

2025-11-18T17:07:36Z

Here’s a free scanner for that FortiWeb CVE-2025-64446 I made for you. https://github.com/sensepost/CVE-2025-64446

@npub12ts…x422 Hello and welcome back to ZA. Looking forward to ...

2025-05-28T07:29:21Z

Jeff Moss (npub12ts…x422) Hello and welcome back to ZA. Looking forward to your talk today.

Something pandoc can do?

2025-05-26T16:50:13Z

In reply to nevent1q…dhxw
_________________________

Something pandoc can do?

Its always been like that. Early twitter, late twitter too.

2025-05-11T08:03:11Z

In reply to nevent1q…spsp
_________________________

Its always been like that. Early twitter, late twitter too.

Working with s/mime on macOS has first class support with the ...

2025-04-28T09:55:23Z

Working with s/mime on macOS has first class support with the "security cms" command and keychain. Here's how to replace openssl with it, with the mutt mail client being the specific use case https://github.com/singe/smutt

Microsoft Outlook is pants at usability and running a fat GUI ...

2025-04-26T21:43:14Z

Microsoft Outlook is pants at usability and running a fat GUI isn’t great for security. About a year ago I went on a mission to make mutt (the CLI mail client) work in a sandbox so I could read my work Microsoft365 mail nicely and more securely. Here’s how https://github.com/singe/muttpack

Amazing that despite numerous C2 comms to this IP from malware, ...

2025-04-14T12:24:31Z

Amazing that despite numerous C2 comms to this IP from malware, it's still clean as a whistle on VT. So much for all that vaunted threat intel helping us clean up malicious comms.

https://www.virustotal.com/gui/ip-address/45.144.53.145/relations

I’m increasingly convinced that AI is less likely to replace ...

2025-04-06T18:11:07Z

I’m increasingly convinced that AI is less likely to replace junior hackers & more likely to replace the seniors who refuse to use it.

Juniors are more open to experimenting with it, & are … cheaper. The wave of layoffs in security in 2023 targeted a lot of seniors due to cost.

Prompt engineering made sense in the early days of diffusion ...

2025-03-05T10:53:26Z

Prompt engineering made sense in the early days of diffusion models where you knew the training set and could weight certain styles more heavily. But I’m finding it increasingly less important with LLMs. Instead, dumping the system prompt and knowing what tools it has available is way more useful.

and no weird looks?

2024-12-02T09:17:03Z

In reply to nevent1q…d7cn
_________________________

and no weird looks?

Is it just me that struggles with greeting people at work? My ...

2024-12-02T09:11:28Z

Is it just me that struggles with greeting people at work? My preferred approach is to just shake everyone’s hand, or if the person is from a “no touching” culture a slight head bow with no difference across genders. But I regularly get puzzled looks or awkward expressions. What am I missing?

absolutely, and the disinformation is so tightly wound into that ...

2024-11-08T06:11:57Z

In reply to nevent1q…ctx2
_________________________

absolutely, and the disinformation is so tightly wound into that nobody can differentiate. I’m interested in the idea of https://ground.news/ and its blind spot feed as a potential counter to it.

I’m genuinely worried about a Trump presidency at a time where ...

2024-11-08T04:48:17Z

I’m genuinely worried about a Trump presidency at a time where we have a proxy war in Eastern Europe with N Korea allied with Russia against “the west”. A proxy war in the Middle East with “the west” vs Iran & proxies. China ready to move on Taiwan. Weak & divided European leadership …

2/2 believe in and want to see. Made possible by Trump’s lack ...

2024-11-08T04:36:12Z

2/2 believe in and want to see. Made possible by Trump’s lack of firm policy objectives & capricious ever-shifting statements. It’s hard to accuse someone of flip flopping when they’ll doing it in the same sentence. It somehow raises the noise floor allowing a blank canvas for a voter to project to.

I’m doing Movember this year with a focus on raising awareness ...

2024-10-29T19:47:42Z

I’m doing Movember this year with a focus on raising awareness about colon cancer, since it typically kills more men than prostate & testicular cancer & it took my Dad. I’d appreciate it if you shared my page, joined me, or donated for cancer research. https://ex.movember.com/mospace/15243648

call me vain - but that there’s no reference to the original ...

2024-10-25T06:35:15Z

In reply to nevent1q…70kq
_________________________

call me vain - but that there’s no reference to the original research behind the field work makes me sad. https://m.youtube.com/watch?v=3HFiv7NvWrM & https://github.com/sensepost/birp

Soldier of FORTRAN :ReBoot: (npub1d86…jwwp) is involved though and is the OG progenitor of so much of it, who’s still working on it and mentoring new peeps like Michelle.

If you had to recommend one place for a user to report phishing ...

2024-10-21T18:25:26Z

If you had to recommend one place for a user to report phishing URLs that would lead to the widest dissemination to list that would actually block it, and/or encourage someone to investigate it - what would it be? Virustotal, safe browsing, somewhere else?

Microsoft on mitigating Kerberoasting ...

2024-10-12T16:05:22Z

Microsoft on mitigating Kerberoasting https://www.microsoft.com/en-us/security/blog/2024/10/11/microsofts-guidance-to-help-mitigate-kerberoasting/

I’d love to stop seeing this vuln in so many reports.

In January 2020 a Raspberry Pi4 B 2G cost R720 it now costs R950. ...

2024-09-11T04:53:38Z

In January 2020 a Raspberry Pi4 B 2G cost R720 it now costs R950. I was shocked at the 32% price increase. A quick calc showed that was only* 6.12% annual average inflation - and I was once again reminded how bad humans** are at understanding compounding effects.

* that’s not bad for South Africa
** I may be generalising too much - at least me

This was a keynote I gave to our first BSides in Johannesburg ...

2024-08-26T18:47:29Z

This was a keynote I gave to our first BSides in Johannesburg recently. It covers what I think a community needs to do to create great hackers and warns of the dangers of racing to the bottom. While it focuses on South Africa - it’s, I think, more widely useful.

https://youtube.com/watch?v=Ri5DoRRnGWs (or on invidious https://yewtu.be/watch?v=Ri5DoRRnGWs)

Something in @npub1fdr…lvhs’s @npub1dqd…8xy4 talk has been ...

2024-08-11T00:41:14Z

Something in Cory Doctorow (npub1fdr…lvhs)’s DEF CON (npub1dqd…8xy4) talk has been sitting with me all day. To summarise badly:

Tech workers were looked after when it was a scarce skill. The layoffs make it clear it isn’t as scarce anymore.

As the saying goes - the future is here just not evenly distributed.

Abused amazon delivery/warehouse workers are the tech worker future.

The only defense is to unionise.

CAPTCHA The Republic ...

2024-06-19T07:03:48Z

CAPTCHA The Republic

The MK party’s rejecting of the election results in South ...

2024-06-02T06:23:00Z

The MK party’s rejecting of the election results in South Africa is another early indication of the chaos & corruption they will help entrench in our political system. Calling for a recount when their objection is actually about transmission of the voting tally, not counting, is either stupid or malicious.

Mechanisms exist for objecting to a mistransmission (which are also independently audited) and we’ve had fewer objections this election that last (32 vs 56). No recount needed.