threatactor.club

Sysdig out with a report on zomg supply chain attacks and #SBOM in dockerhub images.

Dead me doing a talk on it in 2015 citing other people’s research on it with different buzzwords of the day.
https://speakerdeck.com/barnbarn/security-for-non-unicorns-2?slide=59

#InfoSec #ThreatyThreats

#HiP22
Second chance for time travelers & "Verpeilte"
We have extended the CfP until 04.12.2022 23:42:00 and the second round of ticket sales will start on 06.12.2022 at 12 noon

https://events.ccc.de/2022/11/28/dezentral-2022/

I am amused that SignalApp joined mastodon.

The fediverse is everything they stand against.

- federation instead of centralization
- open, community driven protocol
- using pseudonyms
- multiple implementations of client and server software

Not sure what I mean, check out their blog post on these topics: https://signal.org/blog/the-ecosystem-is-moving/

As for the multiple implementations, Signal denied a request to have a 100% open source fork of their app in F-droid. See for yourself:
https://github.com/signalapp/Signal-Android/issues/9966#issuecomment-681943985

Want to be more #mindful? Drop meditation and buy a #moonlander keyboard instead, and every single key press will be an extremely conscious action in the Now. 🧘

Google has now migrated maps.google.com to www.google.com/maps thus if you grant Geoloc permission in your browser, every G-service on www.google.com can track your location.

https://garrit.xyz/posts/2022-11-24-smart-move-google

Hey folks in #Berlin & #infosec

I'll be speaking at BSides Berlin THIS Saturday. Consider joining us: the tickets are crazy cheap at 15€ and the people are nice (at least those that I bring along).

More at https://bsides.berlin/

Oh, and I'll be talking about HTML Sanitizers again.

habe ein Ticket für die #BSidesBerlin übrig #cbase einfach melden

stopped visiting the bird site 2 days ago and so far, no regrets.

powerful datavis can be simple and non-graphical.

here's a project of mine from a good while ago: "autocomplete" for passwords, based on all passwords extracted from the "collection leaks".

https://passwords.yetzt.me/

One of the more difficult challenges of hunting for bugs in CI/CD environments is working out if code execution is a feature or a bug 😑​

So I've unfollowed everyone on the bird space and removed all DMs. I was mainly following #infosec and #hacker folk with a smattering of #homelab #solar and #space related accounts, which I am slowly finding here. Leaving my bird followers in place so if they migrate here they can use one of the automated processes that finds who they are following there, and potentially find me. Feels good.

Ever wondered why VGA cables have screws to affix it to a PC?

Hey #InfoSec, are people still rolling out osquery for things? I’ve seen a couple of projects for deploying it at/on kubernininis, but nothing has really convinced me they’re super well matched? #OSQuery #HashTags

Hot Take: we should stop putting those "for educational purposes only" disclaimers on offensive security software. They are not legally binding and probably provide no real protection. Plus every OSS license already has a no-liability clause. Continuing to put those disclaimer on software has the same energy as those "confidential email, do not distribute" disclaimers people put on their outgoing emails; which are also not legally binding because reading a disclaimer is not the same as signing a legal document.

we pwned @tailscale ❤️
ft. @jamie
https://emily.id.au/tailscale

#Tailscale

Mastodon in a week has gone from “I can read all posts in 15 minutes” to “i can’t keep up”. Well done.

the Berkeley Packet Filter (BPF) is a subsystem of many Unix operating systems wherein all packets are sent to a server in Berkeley, California, which has the firewall rules on it.