Nostr notes by da_667

if we're talking about our favorite type of pizza, it has ...

2026-05-01T13:59:15Z

In reply to nevent1q…g57k
_________________________

if we're talking about our favorite type of pizza, it *has* to be woodfired for me.

found a sub-10 dollar game that features mechs, tanks, and tank ...

2026-04-29T00:58:50Z

found a sub-10 dollar game that features mechs, tanks, and tank controls.

wouldn't touch openAI even if they were offering half a mil. ...

2026-04-24T13:14:20Z

wouldn't touch openAI even if they were offering half a mil. Get fucked, and I hope you drown in debt.

welp, you got my attention. ...

2026-04-24T01:05:26Z

In reply to nevent1q…vdq0
_________________________

welp, you got my attention.

Added a post to the IFIN discourse about GopherWhisper. Just ...

2026-04-23T18:28:22Z

Added a post to the IFIN discourse about GopherWhisper. Just summarized the report, and added NSM-related insights where I could.

https://discourse.ifin.network/t/gopherwhisper-a-burrow-full-of-malware/306

I'll probably be posting most of my Intel and NSM work on here to better serve the community, and have something resembling a permanent, searchable, indexable archive.

#ThreatIntel #GopherWhisper #IFIN

confession: I can't find it in me to give a flying fuck about ...

2026-04-22T13:46:16Z

confession: I can't find it in me to give a flying fuck about vulns in AI products and MCPs.

"Everything is up to spec, so we don't need fault ...

2026-04-20T13:18:27Z

"Everything is up to spec, so we don't need fault tolerance" in a nutshell

Nostr event nevent1qqsfucwuyq7nmzhmmfuhprt0e9rkxjjzuqk6n7wd9xartlmc27km6aczypnrhtfd4kxj680qcpr53hjgz0uzqexwpsrlvwzdyy86puyk0573zaa3m8h

2026-04-19T15:52:35Z

I don't know shit. That's why I have to read so many ...

2026-04-18T22:52:43Z

In reply to nevent1q…klnt
_________________________

I don't know shit. That's why I have to read so many vulnerability reports.

6,000 followers. Why are you here? ...

2026-04-17T20:16:38Z

6,000 followers.

Why are you here?

Nostr event nevent1qqspss0ldhpqy2c2pnejkxxktvmad5pnr8nxrn09dzuz5s0sx9qc3vczypnrhtfd4kxj680qcpr53hjgz0uzqexwpsrlvwzdyy86puyk0573zl6me3k

2026-04-17T15:54:44Z

In reply to nevent1q…eu9v
_________________________

Nostr event nevent1qqsdn6g0566jawgs7cm9340nfhtw4eae96pl3tjp6kqqduuqjk5zjngzypnrhtfd4kxj680qcpr53hjgz0uzqexwpsrlvwzdyy86puyk0573z0umnlw

2026-04-16T00:53:44Z

In reply to nevent1q…ncv0
_________________________

2000.00 for a shitpost. I've done worse.

2026-04-16T00:52:28Z

In reply to nevent1q…8958
_________________________

2000.00 for a shitpost. I've done worse.

I'm so fucking tired of websites that just take the slop ...

2026-04-15T18:45:21Z

In reply to nevent1q…98yg
_________________________

I'm so fucking tired of websites that just take the slop generated from the NVD and regurgitate it like the worthless slop they are. But shit like this? where they just fucking make up a proof of concept? Nah. Get absolutely fucked.

yeah, use an automated cron job to kill the robots instead.

2026-04-15T15:00:54Z

In reply to nevent1q…gsxn
_________________________

yeah, use an automated cron job to kill the robots instead.

the instructors are generally knowledgeable, but its not worth ...

2026-04-15T13:46:10Z

In reply to nevent1q…rwzc
_________________________

the instructors are generally knowledgeable, but its not worth that price tag. Not when there are many cons out there with week-long on-site trainings that cost a fraction of that.

8k is probably an acceptable used miata, or like about 1/5th of a ...

2026-04-15T13:33:26Z

In reply to nevent1q…mzj5
_________________________

8k is probably an acceptable used miata, or like about 1/5th of a brand new one.

dear Sans: it was one course, over 10 years ago, back when the ...

2026-04-15T12:50:32Z

dear Sans: it was one course, over 10 years ago, back when the government paid for it for me.

Please stop asking me if I'd like to buy an 8,000.00+ one-week class.

in reality: ...

2026-04-15T00:52:52Z

In reply to nevent1q…rc60
_________________________

in reality:

whoever is resposible for rexie the cat must be wondering why ...

2026-04-14T17:06:01Z

whoever is resposible for rexie the cat must be wondering why there are so many pictures of him shared by cybersecurity professionals.

in a post quantum-world, does that mean that my shitposts both ...

2026-04-13T16:25:14Z

in a post quantum-world, does that mean that my shitposts both exist and don't exist as the same time?

for all the good it'll do ...

2026-04-13T12:17:58Z

In reply to nevent1q…uqmg
_________________________

for all the good it'll do

I'm up. ...

2026-04-13T12:17:45Z

I'm up.

such as the living we make. ...

2026-04-13T03:55:10Z

In reply to nevent1q…25s0
_________________________

such as the living we make.

don't get me wrong, I'm celebrating a triump of us ...

2026-04-11T02:19:45Z

In reply to nevent1q…q0qf
_________________________

don't get me wrong, I'm celebrating a triump of us returning to the moon after 50+ years but god damn am I disappointed in modern software.

if we count the 70s and the mainframe era is the genesis of ...

2026-04-11T02:18:03Z

In reply to nevent1q…s075
_________________________

if we count the 70s and the mainframe era is the genesis of modern computing, we've had somewhere in the neighborhood of 60 years to improve. Meanwhile in that era, we got to space on fucking hardware the equivalent of the TI-83 calculator.

Nostr event nevent1qqsxjy74e45pv9ppj7kynr9vxj3625h7nzvu2nm5dawugc3dn2gpm2gzypnrhtfd4kxj680qcpr53hjgz0uzqexwpsrlvwzdyy86puyk0573z9kywjy

2026-04-10T16:49:06Z

In reply to nevent1q…szjv
_________________________

Nostr event nevent1qqswccy9ew6ryy4kc7xw6km6kczhvydyfz2wr2r4cu35vu6u3fst0sqzypnrhtfd4kxj680qcpr53hjgz0uzqexwpsrlvwzdyy86puyk0573z3jr4ce

2026-04-10T16:36:25Z

jokes on you, I'm getting double immortality

am I have more potassium in one sitting than in the last two days ...

2026-04-09T17:07:26Z

In reply to nevent1q…t0yy
_________________________

am I have more potassium in one sitting than in the last two days combined? also, yes.

writing macros for the day am I about to eat 3 cups of mini ...

2026-04-09T17:05:46Z

*writing macros for the day*

am I about to eat 3 cups of mini potatoes for dinner with 12oz of steak? yup.

regrets? none.

RE: https://mastodon.social/@eff/116375694963358260 bout ...

2026-04-09T16:52:17Z

RE: https://mastodon.social/@eff/116375694963358260

bout fuckin' time.

quoting
note1yl7…8v9r

After almost twenty years on the platform, EFF is logging off of X.

This isn’t a decision we made lightly, but it might be overdue. 🧵 (1/5)
https://www.eff.org/deeplinks/2026/04/eff-leaving-x

that's just me, groaning out loud over here for no reason. ...

2026-04-09T02:13:19Z

In reply to nevent1q…3u38
_________________________

that's just me, groaning out loud over here for no reason. Just groaning into the void.

> hey, if you don't wanna use aws CLI, you can use ...

2025-12-03T23:23:57Z

In reply to nevent1q…7lra
_________________________

> hey, if you don't wanna use aws CLI, you can use cloudshell!

It's literally a shell account with aws cli preinstalled. Also with no command completion or returned output

twitter update to show where accounts were based out of is ...

2025-11-25T19:23:42Z

twitter update to show where accounts were based out of is actually hilarious which is why they'll be removing the feature in about a week.

Or.
OR.

Because we all know Elon is a gigantic fuckstick. They'll introduce a pay system to anonymize where the account is based out of. Like WHOIS registration.

for whatever its worth, I have never seen the HTTP SUBSCRIBE ...

2025-11-24T16:56:50Z

In reply to nevent1q…tmcm
_________________________

for whatever its worth, I have never seen the HTTP SUBSCRIBE method before.

thank u ...

2025-11-24T15:58:00Z

In reply to nevent1q…l8ff
_________________________

thank u

Nostr event nevent1qqs8y9jsa3pyzuanhcekhjzwsmux22yfjkpgauck6sl3hkq9eapdknszypnrhtfd4kxj680qcpr53hjgz0uzqexwpsrlvwzdyy86puyk0573zv2pt55

2025-11-22T02:16:35Z

finally, MTG can stand for magic: the gathering again.

I like how the devs for this game release a patch - the ...

2025-09-13T02:18:53Z

In reply to nevent1q…856q
_________________________

I like how the devs for this game release a patch - the "mesa" update, like a week before silksong came out, and had enough gallows humor to be like "Yeah, we spent an excruciating amount of time on this patch. Have fun, we know you fuckers are leaving for silksong next week."

Honorable mention: Landfall a co-publisher for this game, published and developed haste, and I don't need to tell you how much I adore the main character Zoe.

sniper elite though. I keep thinking about it because in no other ...

2025-09-13T01:23:58Z

In reply to nevent1q…a47s
_________________________

sniper elite though. I keep thinking about it because in no other game can you shoot Hitler in the testicles to kill him.. And also, there is point to using subsonic ammunition. Maybe for the steam winter sale.

Hey everyone, I spent a few hours cleaning up some notes I put ...

2025-08-02T01:30:25Z

Hey everyone, I spent a few hours cleaning up some notes I put together for our newly appointed intern to show him how I go about turning github repos with proof of concept code/screencaps into detection for both Snort and Suricata.

In this post, I covered: <li>Where to find official documentation for both Snort and Suricata</li><li>How to properly archive proof of concept code so that the code isn't deleted on a whim and lost forever</li><li>The exploits themselves </li><li>What the rule looks like in Suricata, including a break-down of the rule structure, keywords used, why we use them</li><li>An identical break-down for Snort that shows how we achieve feature parity between two vastly different IDS engines.</li>

https://www.totes-legit-notmalware.site/home/detection-exercise-d-link-dir-513-cves-2025-8184-8169-and-8168

as always, happy hunting.

Nostr event nevent1qqsdgwddvmdyuhuvx6a4xqf4jexhpucnacx4mk3ny6cp06faz0heysgzypnrhtfd4kxj680qcpr53hjgz0uzqexwpsrlvwzdyy86puyk0573zu7e8e0

2025-07-22T03:37:41Z

I await the day we can continue to see NTLM relay and file URI ...

2025-04-16T02:20:40Z

In reply to nevent1q…m8t3
_________________________

I await the day we can continue to see NTLM relay and file URI hash passing over quic.

honestly, I can't fucking believe how tremendously broken SMB ...

2025-04-16T01:58:06Z

In reply to nevent1q…5ssx
_________________________

honestly, I can't fucking believe how tremendously broken SMB is as a protocol, and how MS refuses to fucking fix it. Like, pass the hash has been a scourge for decades now. Its amazing that its basically SSO, but with zero authorization whatsofucking ever to where anyone can just spoof the fucking hash and that's it. GG.

imagine your org had repeated logins from a russian IP where ...

2025-04-15T18:44:07Z

imagine your org had repeated logins from a russian IP where there had NEVER BEFORE BEEN. EVER.

Normally, this is a cause for alarm, but for the fuckfaces at doge, this is just fine. also, turn off the firewalls, turn off the security. Just trust us. it's fine. Buncha fuckers.

I'm sorry. Fucking what. ...

2025-03-10T22:41:21Z

I'm sorry. Fucking what.

Nostr event nevent1qqs9qzrlan0js892pr069py7ws6hwmsvey2cwz7c2gkrkd2j4rj8xjszypnrhtfd4kxj680qcpr53hjgz0uzqexwpsrlvwzdyy86puyk0573zreq659

2025-03-10T21:34:23Z

Not quite sure how I missed your POC the first time around, but I ...

2025-03-07T17:48:30Z

In reply to nevent1q…96xu
_________________________

Not quite sure how I missed your POC the first time around, but I just added coverage in the ET ruleset for both Snort and Suricata. Rules will be out this evening in our daily rule release. Cheers and thank you.

Suricata:alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Cisco ASA/FTD Memory Leak Attempt (CVE-2020-3259)"; flow:established,to_server; http.method; content:"GET"; http.uri; bsize:>800; content:"|2b|CSCOE|2b|/sdesktop/webstart.xml|3f|"; fast_pattern; content:"|25|p"; endswith; reference:url,github.com/GossiTheDog/Exploits/blob/main/Cisco-CVE-2020-3259.sh; reference:cve,2020-3259; classtype:attempted-admin; sid:1; rev:1;)

Snort:alert tcp any any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Cisco ASA/FTD Memory Leak Attempt (CVE-2020-3259)"; flow:established,to_server; content:"GET"; http_method; urilen:>800; content:"|2b|CSCOE|2b|/sdesktop/webstart.xml|3f|"; fast_pattern:0,20; content:"|25|p"; distance:0; reference:url,github.com/GossiTheDog/Exploits/blob/main/Cisco-CVE-2020-3259.sh; reference:cve,2020-3259; classtype:attempted-admin; sid:1; rev:1;)

Been beating this drum for years. Infostealers are a huge threat ...

2025-03-07T02:47:43Z

In reply to nevent1q…fj2r
_________________________

Been beating this drum for years. Infostealers are a huge threat because of crossing the streams. whether its byod, or wfh with a company asset, and your kid decides that downloading and running free_robux.toteslegit.exe on your work laptop with saved passwords in the browser is totally fine.

Tik-Tok ban upheld? Good, now do X for election interference and ...

2025-01-17T15:13:53Z

Tik-Tok ban upheld? Good, now do X for election interference and facebook reels because its just as shit as tik-tok ever was.

Oh, you won't do that because Mark and Elon are puppeteering the government so hard, their hands are literally up the president's ass? who would've guessed.