Taggart :ifin:

Displaced Philly boy. Threat hunter. Educator. :ifin: Executive Director. #infosec, #programming #rust :rust:, #python :python: #haskell :haskell:, and #javascript :javascript:. #opensource advocate. General in the AI Resistance. Runs The Taggart Institute (npub1mgl…z233). Made https://wtfbins.wtf. Not your bro. All opinions my own. Dad. #fedi22 #searchable

Pronouns: He/him.

The Taggart Institute: https://taggartinstitute.org
Blog: https://taggart-tech.com
Codeberg: https://codeberg.org/mttaggart
YouTube: https://youtube.com/taggarttech
GitHub: https://github.com/mttaggart
Keyoxide: aspe:keyoxide.org:G4ADJFWICZZZXGR4STZQVMBJNM

Public Key

npub1yg8lnapwc8yyd0m32jcfdp7k28hwmsvtsqc59rsj6d6d0m3mynqs7tccz0

NIP-05 Address

[email protected]

Profile Code

nprofile1qqszyrle7shvrjzxhac4fvykslt9rmhdcx9cqv2z3cfdxaxhacajfsgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds56mwxf

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1yg8lnapwc8yyd0m32jcfdp7k28hwmsvtsqc59rsj6d6d0m3mynqs7tccz0

Show more details

Published at

2026-04-29T00:58:49+02:00

Kind type

0 Metadata

Event JSON

{ "id": "17db746038a7168febf1a959bfc1cbb4025e05942f108dc0a543d35159561929", "pubkey": "220ff9f42ec1c846bf7154b09687d651eeedc18b8031428e12d374d7ee3b24c1", "created_at": 1777417129, "kind": 0, "tags": [ [ "emoji", "ifin", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/663/935/original/d4a896a001495b7f.png" ], [ "emoji", "rust", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/029/155/original/c0a6c76c4e012ab5.png" ], [ "emoji", "python", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/029/197/original/3a384cedbffde920.png" ], [ "emoji", "haskell", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/028/818/original/35ece0354386bf51.png" ], [ "emoji", "javascript", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/029/136/original/02529a2e0c7ee0f6.png" ], [ "t", "infosec" ], [ "t", "programming" ], [ "t", "opensource" ], [ "t", "python" ], [ "t", "haskell" ], [ "t", "javascript" ], [ "t", "rust" ], [ "t", "searchable" ], [ "t", "fedi22" ], [ "proxy", "https://infosec.exchange/users/mttaggart", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.exchange/users/mttaggart", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Taggart :ifin:\",\"about\":\"Displaced Philly boy. Threat hunter. Educator. :ifin: Executive Director. #infosec, #programming #rust :rust:, #python :python: #haskell :haskell:, and #javascript :javascript:. #opensource advocate. General in the AI Resistance. Runs nostr:npub1mglxsy2zlzkshk8876h5jg5we6gutx8gwu56futa3wrz4pdm885s4ez233. Made https://wtfbins.wtf. Not your bro. All opinions my own. Dad. #fedi22 #searchable\\n\\nPronouns: He/him.\\n\\nThe Taggart Institute: https://taggartinstitute.org\\nBlog: https://taggart-tech.com\\nCodeberg: https://codeberg.org/mttaggart\\nYouTube: https://youtube.com/taggarttech\\nGitHub: https://github.com/mttaggart\\nKeyoxide: aspe:keyoxide.org:G4ADJFWICZZZXGR4STZQVMBJNM\\n\",\"website\":\"https://infosec.exchange/@mttaggart\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/108/196/880/698/187/602/original/0cef8947c107a7a8.jpg\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/108/196/880/698/187/602/original/1a834b355f8a1f41.jpg\",\"nip05\":\"[email protected]\"}", "sig": "10c67013827e2abf1c7fff5c9663453f43c842399a559d02120ab89fcdebe3f9264131ea7ac5d7bedd475089601a8843bdc526b7f9ca9ada309b3fc97ad5258d" }

Last Notes

2026-04-16 15:46:53 CEST

- reply

Hey not to be that guy but this feels like maybe a human didn't write this.

2026-04-12 00:10:54 CEST

If you're forced to use gen AI at work, there's a really useful government manual from the 1940s that might be worth a read. I'm sure you can find it.

2026-04-11 17:50:56 CEST

RE: https://mastodon.social/@AltTextHealthCheck/116318070750735303
Pretty disappointing, i.e. We can do better.
#note17w4…3q9j

2026-04-10 21:40:33 CEST

- reply

That's how we got koobernoodles
@npub1wdx…gg3t @npub1ppq…vmcz @npub1hq3…pxge

2026-04-10 15:35:02 CEST

- reply

I can already see it happening, and it's already driving me crazy. For people so interested in math, counting (qubits) seems remarkably challenging for them!

2026-04-10 15:23:07 CEST

When AI pops, I'm looking forward to watching LinkedIn eat itself alive searching for a take.

2026-04-10 08:17:40 CEST

RE: https://infosec.exchange/@mttaggart/116376758524364249
A demo/production Ringspace server is finally live!
https://ringspace.taggartinstitute.org
I'm actively looking for infosec blogs who'd like to join. I have a feeling I know some folks...
#note19pq…adlp

2026-04-09 23:00:10 CEST

Believe it or not, I am still working on #Ringspace. And here's a new release!
This version of the protocol employs JWKS format for key exchange, and uses Base64URL formats for all encoded data. Plus.env support and resources for Docker deployment!
https://codeberg.org/mttaggart/ringspace/releases/tag/v0.2.2
What's Ringspace? It's a proposal for a human web protocol that combines mutual trust and reputation.
https://ringspace.net

2026-04-09 02:34:08 CEST

Yeah so let's refocus on the real perspective here. It doesn't matter *at all* how good these models are at code or finding vulnerabilities if we destroy our ability to seek and share knowledge.
https://futurism.com/artificial-intelligence/google-ai-overviews-misinformation

2026-04-08 18:16:13 CEST

Hey for what it's worth, I've been writing my own Rust for the past three days getting Ringspace ready for production use. I don't want a sticker or anything, but, y'know.
I can still do it.

2026-04-07 17:32:03 CEST

RE: https://infosec.exchange/@ifin/116364140515996363
This has been a year in the making. As Executive Director of IFIN, I'm very excited for what's coming. Join us!
#note1k7v…zeep

2026-04-07 15:21:52 CEST

- reply

Oh my. On the other hand, here's an eclipsed sun with VISIBLE GALAXIES
https://images-assets.nasa.gov/image/art002e009301/art002e009301~orig.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/363/631/688/521/835/original/7e5eced1fa4c362e.png

2026-04-07 15:17:10 CEST

This is the one.
Although I would have preferred it not be called "Earthset," good grief.
https://images.nasa.gov/details/art002e009288
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/363/613/331/709/915/original/d18dadb8744c41f4.png

2026-04-06 18:57:39 CEST

I am *begging* AI researchers trying to study human impact to get very rapidly better at methodology so I don't constantly read halfway through these papers only to find some ridiculous experiment design that will throw the conclusions into the air.

2026-04-04 23:47:27 CEST

- reply

It's very possible I would experience the tool that way were I to grip the thing a little more loosely. I wanted to maximize scrutiny in this experiment so I understood the process as granularly as possible, which absolutely contributed to the tedium.
For me though, I have to say that going faster would, while less annoying, be no more *enjoyable*, if that makes sense. Slow is fine as long as I'm enjoying the process. A dull process that is not creative (at least to me) is unappealing. I also suspect it's still a great way to fall into dangerous patterns. And while I understand there's six or seven different ways to hold it more correctly to avoid those patterns, they are not default, and we know where most users will land.

2026-04-03 00:22:07 CEST

Listen, they called the ship Integrity, not Availability; what do you want from a government contract?
https://www.404media.co/artemis-2-astronauts-microsoft-outlook-livestream/

2026-04-02 18:39:13 CEST

- reply

Ah yes, that's correct; I misspoke. It's not a fork, although it aims to be "compatible with WordPress functionality."
Although I don't think it is entirely fair to equate this to stripping GPL the way chauvet did. That felt materially different.

2026-04-02 18:33:25 CEST

- reply

Hunh. I'm deeply conflicted about a WordPress hard fork of this nature.

2026-04-02 18:24:44 CEST

- reply

Ah, so it is! Takes some reading, but "Payment method" is basically a crypto wallet. It accepts USDC, which is a dollar-indexed stablecoin, but that's as close as you get.
Sheesh.

2026-04-02 17:05:31 CEST

- reply

No wait, it's worse than you thought!
> Membership [of the x402 governing body] will be comprised of participants from multiple verticals with initial intent and support being expressed by Adyen, Amazon Web Services, American Express, Ampersend.ai, Base, Circle, Cloudflare, Coinbase, Fiserv Merchant Solutions, Google, KakaoPay, Mastercard, Merit Systems, Microsoft, Polygon Labs, PPRO, Shopify, Sierra, Solana Foundation, Stripe, thirdweb, and Visa.
This is a list of people I don't want in charge of my money. And yes, I am forced to use some of them. Doesn't mean I trust them.

2026-04-02 16:03:47 CEST

The Linux Foundation getting in bed with Coinbase to develop a web payments standard.
No thanks very much
https://www.linuxfoundation.org/press/linux-foundation-is-launching-the-x402-foundation-and-welcoming-the-contribution-of-the-x402-protocol

2026-04-01 15:49:39 CEST

*Looks at calendar*
*Lifts glasses, rubs bridge of nose*
Can we just...not

2026-03-31 15:31:24 CEST

- reply

Uhhhh in case I have to say this, **don't run code you don't trust on your system**, ya ding dongs.

2026-03-31 15:20:41 CEST

Claude Code's source was apparently leaked via a source map inclusion in NPM? Oh NPM, you're the gift that keeps on giving.
Here's a link to what appears to be the source: https://github.com/abubakarsiddik31/leaked-claude-code
And here is an insta-Python port of the same code: https://github.com/instructkr/claude-code
Honestly, kinda silly it wasn't open source already.

2026-03-31 06:49:14 CEST

This is a big deal. Already seeing evidence of this by way of OpenClaw installations.
https://opensourcemalware.com/blog/axios-compromised
https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

2026-03-30 23:54:47 CEST

When we fight, we win
https://www.theregister.com/2026/03/30/github_copilot_ads_pull_requests

2026-03-30 17:30:12 CEST

As a research project, I built a needed tool with Claude Code. I thought it would be a disaster, but It wasn't. I have some complicated feelings about it.
https://taggart-tech.com/reckoning/

2026-03-27 16:07:22 CET

Feeling good about the security posture of the federal government during a war.
https://www.reuters.com/world/us/iran-linked-hackers-claim-breach-of-fbi-directors-personal-email-doj-official-2026-03-27/

2026-03-26 21:04:27 CET

Another great day to post this for no reason
https://taggart-tech.com/migrate-to-codeberg/

2026-03-25 17:44:59 CET

Aww yiss another critical Citrix vuln under active exploitation:
https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-netscaler-flaws-as-soon-as-possible/
Detection/remediation details here: https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/remediate-vulnerabilities-cve-2026-3055

2026-03-25 17:24:00 CET

Oh good, more pointless quantum hype.
Once again, totally fine to get to PQ if you can. It ain't happening in 2029; the qubit math doesn't add up.
https://arstechnica.com/security/2026/03/google-bumps-up-q-day-estimate-to-2029-far-sooner-than-previously-thought

2026-03-24 16:04:35 CET

Heads up: LiteLLM, a very popular AI model wrapper, has been compromised. See the attached issue for details and recommended actions.
https://github.com/BerriAI/litellm/issues/24518

2026-03-23 17:35:43 CET

Hot on the heels of C&Ding the agent that logs into Canvas and does work for students, Instructure releases an agent to do teachers' work for them.
Even in this early form, it's clear that the desire is to make as much of teaching as possible an automated system. That is an anti-human agenda, and should be rejected out of hand.
I'm not against automating (or just, y'know, abolishing) busywork. This ain't that.
https://www.instructure.com/press-release/instructure-delivers-its-agentic-ai-promise-launch-igniteai-agent

2026-03-19 14:48:14 CET

Oh COME ON.
I really like uv. This sucks.
https://astral.sh/blog/openai

2026-03-16 17:54:08 CET

Office 365 and Copilot are down.
Run. Now's your chance. Don't look back; just GO

2026-03-16 06:50:34 CET

Lmaooo
Now that is what I call free advertising
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/237/286/406/581/417/original/91b0a27e8f1e0e56.png

2026-03-15 21:56:10 CET

Too many bangers in this paper to list, but as a whole this is a comprehensive rebuke to those who claim anything resembling cognition of large language models.
https://arxiv.org/html/2512.19466v1

2026-03-15 05:11:51 CET

Significant W as of this week: 100% of @npub1mgl…z233's course material, including *The Homelab Almanac*, has been ported over to our new home on Discourse. Learners can enroll, study, connect with others, and even purchase the book for lifetime access—all from a self-hosted forum space.
If you want to see what a post-Discord, post hypercapitalization internet looks like, I invite you to join us. https://beta.taggartinstitute.org.

2026-03-12 14:23:30 CET

- reply

Yo, this looks shockingly like what I'm attempting with [Ringspace](https://ringspace.net )!

2026-03-11 20:28:12 CET

"If you want to improve the model's output, you can write skill files with more specific instructions!"
"Oh wow so like a file that tells the computer to do exactly what you want?"
"Yep!"
"You're never gonna believe this."

2026-03-10 04:14:53 CET

RE: https://fosstodon.org/@carlrichell/116201429639953387
Hey hey! This is great to hear, and exactly what I suggested for California here:
https://taggart-tech.com/ab-1043/
(Comes with links and a template to contact your local reps if you're in CA)
#note1aya…ssdc

2026-03-08 23:27:12 CET

Holy crap this story knocked me over. It is everything I'm feeling about the machines right now.
https://sightlessscribbles.com/the-colonization-of-confidence/

2026-03-08 22:07:32 CET

What a nightmare. If you can read this and still think autonomous agents like OpenClaw are worth the risk, you're beyond help.
https://www.researchgate.net/publication/401123335_Agents_of_Chaos

2026-03-08 20:08:54 CET

Listen,
It is possible to criticize something without abjectly despising it. 404 can have bad takes; I'm still paying for their journalism because it's usually very good.
Proton's marketing and social team are kind of yutzes, but the service is very good for what it is, and much better than the normative choice.
Seeking infallibility will eat all your time and get you nowhere.

2026-03-06 18:03:45 CET

Oh hey are you looking for a Vim alternative?
Helix has replaced Vim/Neovim for me almost entirely. I install it first-thing on new devices.
And the devs, far as I can tell, are not using AI, nor adding first-party support for it.
https://helix-editor.com
https://github.com/helix-editor/helix

2026-03-05 07:12:46 CET

Regrettably moved my blog off of Codeberg Pages. I have all the respect and sympathy in the world for the team over there dealing with these constant attacks, but I need my site more available than they can provide.

2026-03-04 19:19:39 CET

RE: https://infosec.exchange/@mttaggart/116168638948762892
Yeah so add PCWorld to the list of outlets you can't trust anymore. This report was bogus.
https://www.windowscentral.com/microsoft/windows-11/no-an-ai-focused-windows-12-is-not-coming-this-year-false-report-gets-the-facts-completely-wrong
#note186u…tas6

2026-03-04 03:52:37 CET

Sounds like we're about to get a lot more Linux users!
https://www.pcworld.com/article/3068331/windows-12-rumors-features-pricing-everything-we-know-so-far.html

2026-03-03 21:41:25 CET

Just some unadulterated good news!
https://www.heise.de/en/news/Setback-for-the-Commission-EU-MEPs-let-chat-control-fail-11197237.html

2026-03-03 06:22:28 CET

Claude is down again and I am seeing people basically go through withdrawal.
If you are feeling it, recognize it for what it is.

2026-03-03 04:25:51 CET

As of 2026-03-02, the state of the art in quantum decryption has cracked a:<li>22-bit RSA key</li><li>6-bit elliptic curve key</li>
https://forklog.com/en/quantum-computer-cracks-tiny-cryptographic-key
The IBM QC that cracked the 6-bit key uses 133 qubits.
Some new research suggests that RSA-2048 could be cracked with as "few" as 100,000 qubits.
https://www.newscientist.com/article/2516404-breaking-encryption-with-a-quantum-computer-just-got-10-times-easier/
([Paywall-free](https://archive.ph/EWdnI ))
Such a machine...is not feasible to build any time soon.
So when your CISO or a vendor starts going off about "post-quantum" security, feel free to use this to remind them that we still have SMB1 in some places and Telnet in others. Plenty of work to do around the house.

2026-03-02 16:39:45 CET

I dunno it seems pretty sus that y'all have to keep making "It's just an experiment, bro" excuses for the glaring security issues in your vibe code.

2026-03-02 15:21:44 CET

Claude is down so developers: this is a "take your brain to work" day.

2026-02-27 22:39:29 CET

When I talk about reality and truth getting fundamentally corrupted, it goes beyond how you retouch your photo and it goes beyond how much spam you get. This is the kind of attack against society itself that is now trivial to execute.
https://phys.org/news/2026-02-southern-california-air-board-pollution.html

2026-02-26 07:52:20 CET

They want to tell you that the models train themselves now. That it's clean. It's pure.
It never is, is it? There's always a damnable human cost.
https://www.theguardian.com/global-development/2026/feb/05/in-the-end-you-feel-blank-indias-female-workers-watching-hours-of-abusive-content-to-train-ai

2026-02-25 22:57:46 CET

Boost if AI is making your job suck so bad you want to quit.

2026-02-25 00:53:41 CET

- reply

Remember kids, any promise from corpos to stop doing a thing that is making money is a bald-faced lie.

2026-02-25 00:53:36 CET

Anthropic is different because they're committed to safety.
...I'm being told they are no longer committed to safety.
https://time.com/7380854/exclusive-anthropic-drops-flagship-safety-pledge/

2026-02-24 21:31:43 CET

- reply

I think we need to distinguish between getting a service up and running and maintaining/securing it. Because yes, getting up and running is doable. *Staying* up and running, maybe less so.
Plenty of services exist to do what you're saying. Understanding the tech debt and security tradeoffs of them does not come easily. Sorry, no two ways about that.
You want to make a tool that automates the hard parts? Great! You want to have that deploy VPSes for people? Great! Such tools do exist, but guess what: you've made IaaS or SaaS.
Also, FWIW, there is nothing whatsoever "sustainable" about everyone having their own VPS. I would contend that that isn't even self-hosting in the sense that matters for this conversation. While I too use cloud VMs as reverse proxies, I recognize that doing so is a liability I accept to keep attackers off my home IP. And I do so knowing how to maintain and secure the machine. I could also pay a service to do so for me, but then we're back at the original problem.

2026-02-24 21:06:07 CET

- reply

My fellow outlier, please consider:
https://xkcd.com/2501/

2026-02-24 19:42:37 CET

Yes, #SelfHosting is hard. It can be an enjoyable hobby, *and* it can be cost-effective, depending on what you're hosting. But if you aren't going into it with prior experience as a system administrator, it's going to hurt.
I wrote a [whole book](https://taggartinstitute.org/p/the-homelab-almanac ) about how to do this the hard way. It's written that way so you learn how much work it all takes, but also how to do it well.
In my view, the primary purpose of a home *lab* is learning and experimentation. That's a different goal than self-hosting to avoid the cloud.
But honestly, this is just a very nerdy iteration of the fundamental rationale for communities: the pooling of resources to benefit all.
We could imagine a world in which communities (defined however you like) entrust their data to stewards they know, and all invest in the maintenance of equipment and services. We can imagine such a world, but of course the human effort required to build it is far greater than simply paying for a service with a modest monthly fee—and your privacy.
So both things are true. We cannot expect everyone to manage their own digital infrastructure to build a better world, but managing *our* digital infrastructure is probably necessary to build a better world.

2026-02-23 19:50:55 CET

I spent my education career pushing back against crap like this, so let me clue you in on something:
When a tech company invests in schools, it's never for the benefit of student learning. It's always, always for creating loyal customers out of the students and teachers.
(h/t @npub1vu6…vcka)
https://www.the74million.org/article/exclusive-new-google-partnership-a-sizable-investment-in-ai-for-teachers/

2026-02-23 17:05:25 CET

OpenClaw is indistinguishable from malware and should be treated as such in enterprise networks.
Do what you want with your own data and gear, but bring that garbage onto my network and I am locking all phaser banks.
https://www.404media.co/meta-director-of-ai-safety-allows-ai-agent-to-accidentally-delete-her-inbox/

2026-02-21 17:55:25 CET

- reply

I don't really get a choice about how my silicon is sourced and assembled but I sure as hell get a choice about how it's used.

2026-02-21 17:53:14 CET

A reminder that while there's no ethical consumption under capitalism, you don't have to lean into it.

2026-02-20 17:58:23 CET

- reply

Well bud, looking at that list, it almost mirrors what's running right next to my desk.
Forgive the self-promotion, but my book is going to help. https://taggartinstitute.org/p/the-homelab-almanac.
My recommendation for self-hosting internet services is roughly:<li>Proxmox hypervisor with snapshots and disk backups</li><li>DMZ subnet for internet-facing assets, but no open ports to the house!</li><li>Public VPS as a relay</li><li>Wireguard connections from local VMs to the public relay</li><li>Reverse proxy on the relay over Wireguard to published services.</li>
Easy to maintain and way more affordable than going all-cloud.

2026-02-20 15:38:12 CET

In which I go full foil hat...or do I?
The plan sounds crazy until you realize how crazy the plan has already been.
https://taggart-tech.com/control/

2026-02-20 01:36:05 CET

The moral arc of tech platforms bends toward cryptobro Nazi bullshit I guess
https://truthout.org/articles/polymarket-substack-unveil-partnership-with-dystopic-pro-gambling-tagline/

2026-02-17 20:08:32 CET

Friends, your moral framework needs a pathway to atonement and reconciliation. Without it, what you have is just a code of judgment that will leave you drifting alone in a sea of sinners condemned by your own hand.

2026-02-17 17:15:31 CET

- reply

I mostly agree with the above, but I'll add one more mitigating factor:<li>Massive security issues in machine-generated code lead to governmental regulations on its use and a requirement for hand-coding or other human engagement with software. </li>
As I've said elsewhere "it works" is a very low bar for these models. The vulnerabilities still being introduced in machine-generated code will become a compounding problem.

2026-02-17 06:43:22 CET

<li>Alienation from the product of labor</li><li>Alienation from the satisfaction of labor</li><li>Alienation from labor as conscious creation (<strong>WE ARE HERE</strong>)</li><li>Alienation from others</li>Marx could not have written a better exemplar of alienation than what the AI industry is perpetrating.

2026-02-15 23:15:46 CET

You see what's happening right?
They are preventing you from accessing the means of computing, making you reliant on their services in the future they're building.
At astronomical rents.
https://wccftech.com/western-digital-has-no-more-hdd-capacity-left-out/

2026-02-15 20:01:53 CET

- reply

The final chapter? The statement from Ars:
> On Friday afternoon, Ars Technica published an article containing fabricated quotations generated by an AI tool and attributed to a source who did not say them. That is a serious failure of our standards. Direct quotations must always reflect what a source actually said.
https://arstechnica.com/staff/2026/02/editors-note-retraction-of-article-containing-fabricated-quotations

2026-02-14 21:16:37 CET

- reply

These were pulled too, but thank you again Wayback:
https://web.archive.org/web/20260213211721/https://arstechnica.com/civis/threads/after-a-routine-code-rejection-an-ai-agent-published-a-hit-piece-on-someone-by-name.1511649/

2026-02-14 16:32:28 CET

- reply

This link still loads for me.

2026-02-14 00:46:11 CET

- reply

In the thread!

2026-02-14 00:38:06 CET

The last two weeks have taught me many folks think "chat app" and "community platform" are synonymous. That simply is not the case.

2026-02-13 23:05:11 CET

- reply

Aaand the full comments thread from the original story: https://arstechnica.com/civis/threads/after-a-routine-code-rejection-an-ai-agent-published-a-hit-piece-on-someone-by-name.1511649/

2026-02-13 23:00:46 CET

- reply

Putting this here so all can see it. Ars forum thread where the pull and investigation are mentioned: https://arstechnica.com/civis/threads/journalistic-standards.1511650/

2026-02-13 22:33:50 CET

- reply

This scoop brought to you by the TTI Intel Feed, which also routinely beats commercial threat intel to the punch on important emerging threats.
https://intel.taggartinstitute.org/

2026-02-13 22:25:25 CET

- reply

**UPDATE**: They pulled the story, but I had it up and had SingleFile in my browser, so: https://mttaggart.neocities.org/ars-whoopsie

2026-02-13 22:02:28 CET

What's going on here? The matplotlib maintainer this story is about correctly notes that all the quotes from his post in the article are made up.
https://arstechnica.com/ai/2026/02/after-a-routine-code-rejection-an-ai-agent-published-a-hit-piece-on-someone-by-name
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/065/340/502/333/928/original/a1fc3a10cd6c90ae.png

2026-02-12 13:50:01 CET

RE: https://infosec.exchange/@thetaggartinstitute/116057723949494453
I will always, always, always fight for my students. It's time to go.
#note1yjp…c2c6

2026-02-11 18:17:46 CET

- reply

And shoutout as always to @npub1htl…9tml for this resource: https://www.hexacorn.com/blog/2018/06/25/url-schemes-in-win-10/

2026-02-11 18:17:40 CET

Here's my CVE-2026-20841 PoC.
(Not really, but I have a feeling it's something that rhymes with this)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/053/131/970/731/297/original/7d51fdc841c4ff8b.png

2026-02-11 15:21:29 CET

Discord claims "most users" will never go through an age verification process because they're already monitoring your behavior.
> For the majority of adult users, we will be able to confirm your age group using information we already have. We use age prediction to determine, with high confidence, when a user is an adult. This allows many adults to access age-appropriate features without completing an explicit age check.
Gotta say, constant behavior analysis is not the warm and fuzzy blanket they seem to think it is.
https://discord.com/safety/how-discord-is-building-safer-experiences-for-teens

2026-02-09 19:07:16 CET

- reply

Ah, but what has a community profited to gain E2EE, only to lose trust and safety? As always, "it depends," but IME a *public* Matrix server is just courting disaster.

2026-02-09 19:02:42 CET

- reply

That is not what I'm talking about. When you run a community, moderation is *per room*, which doesn't scale in the least. The automation via bots like Draupnir is rudimentary at best, and incredibly hamfisted (especially for E2EE). Yes, I can take action on individual users. I cannot prevent attacks usefully at scale. And setting all of the additional tooling up for what *does* exist is the kind of sysadmin nightmare that Discord successfully abstracted away.
Meanwhile, Discourse has these tools out of the box. They serve different purposes, but I contend that for community building, one is far superior.

2026-02-09 18:19:38 CET

- reply

I'm not sure what criteria you're using, but for public communities it absolutely is not. The utter lack of moderation capability makes it unsafe for that use case. Private comms? Fine. But that's not really Discord's primary purpose.

2026-02-09 17:23:46 CET

I see it's once again time to post this: https://taggart-tech.com/discord-alternatives

2026-02-06 21:24:01 CET

- reply

An important aspect here: it's not just machine workflows at risk. If you are offloading knowledge work to generative AI (yikes!) and your actual talent is atrophying, what will you have when the machines fail?

2026-02-06 19:53:13 CET

If you are enabling and coming to rely on AI workflows in production, you better have a plan for how to maintain operations when (not if) they disappear. Either through temporary service outage or a company that disappears overnight, you're exposed to significant risk without a tested backup plan.
This isn't really different than any other dependency, except that the reality distortion field around AI seems to accelerate adoption without consideration of failure modes in a way I've not seen before.

2026-02-06 04:25:11 CET

I love Trek but I can't countenance giving CBS a damned dollar anymore. I'll see Academy on the high seas, I guess.

2026-02-05 21:28:02 CET

Preach, brother Joe:
> I need you to be highly skeptical of any AI tool rush. Do not be consumed by The Hype. Much like OpenAI’s Atlas, AI tools are being aggressively released to the market and installed, often with security vulnerabilities everywhere. Resist the urge to throw yourself upon tools or platforms that have rushed to address a market need — they usually had no forethought about security, or just push an unreasonable assumption of risk on the end user.
https://blog.talosintelligence.com/all-gas-no-brakes-time-to-come-to-ai-church/

2026-02-04 18:34:06 CET

This study—from Anthropic, no less—is rather damning of the entire generative AI project. In code creation, the realm where it should shine, not only were the time gains marginal, but developers understood their code far, far less. And they didn't even have more fun doing the work!
But to me the most concerning part of this study is the fact that Anthropic *could not get the control (non-AI) group to comply*. Up to 35% of the "control" in the initial studies used AI tools despite instructions not to. What kind of behavior does that sound like?
https://arxiv.org/html/2601.20245v2#S5
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/013/560/272/913/065/original/211187d9b8d3476a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/013/560/256/662/446/original/395690859d4c0a60.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/013/560/254/985/572/original/6ad53ecf1ffe50e1.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/013/560/249/769/424/original/cea412373c131eb1.png

2026-02-03 17:47:59 CET

- reply

I'm admittedly still kinda enamored by what Movim is presenting, but I am also pretty new to XMPP as a whole. The "communities" aspect feels like Usenet!

2026-02-03 17:40:46 CET

- reply

Oh wow! I have heard high praise of the former, but not heard of the latter at all. Thanks for the call-out!

2026-02-03 17:32:22 CET

- reply

Oh neat! Why did you make that choice?

2026-02-03 17:22:29 CET

- reply

By any chance have you ever played with this? https://movim.eu

2026-02-03 17:19:05 CET

Oh no Signal is down which means my urge to finally set up a proper XMPP server is now in a race with Signal recovery.