Michał "rysiek" Woźniak · 🇺🇦

Hacker, activist, free-softie ◈ techie luddite ◈ formerly information security and infrastructure at https://isnic.is/ and https://occrp.org/ ◈ my opinions are my own etc.

(he/him)

profile image: drawing of a head and shoulders of a cat-person, in a space suit.

banner image: long-exposure photo of a large tent, brightly illuminated from inside, looking as if it is made of lava

#foss #libre #privacy #infosec #fedi22

(public toots CC By-SA 4.0 if applicable)

🇪🇺 🇵🇱 · 🇧🇦 🇮🇸 · 🇺🇦

blog: https://rys.io
Black Lives: Matter
Trans Rights: are Human Rights
ancient me: [@[email protected]](https://mastodon.social/@rysiek )

Public Key

npub1afml2kzwamqxppl50207sf5jwgl3l6ugn6hnuwugtxt7ctnhdtkqjq5gp4

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsw5al4tp8wasrqsl6848lgy6f8y0clawyfate78wy9n9lv9emk4mqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsc9mgvw

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1afml2kzwamqxppl50207sf5jwgl3l6ugn6hnuwugtxt7ctnhdtkqjq5gp4

Show more details

Last Notes

2024-09-03 22:09:11

- reply

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

2024-09-03 22:07:35

Oh ffs, we're now going to have to deal with a deluge of "YuBiKeYs ArE nOt sAfe" bullcrap, aren't we.
#InfoSec

2024-08-28 12:29:23

- reply

https://media.mstdn.social/media_attachments/files/113/039/173/377/423/511/original/38271a9a78aa91d7.jpg

2024-08-27 16:35:52

- reply

oh what now

2024-08-27 16:21:21

- reply

Yesterday I shared my own write-up on Telegram's failings, today I came across Matthew Green's stellar blogpost:
https://blog.cryptographyengineering.com/2024/08/25/telegram-is-not-really-an-encrypted-messaging-app/
And this blogpost *starts* with calling the media out on this.
Fantastic.
At this point it's clear Telegram has no interest in fixing their stuff. We should not be talking to them, we should be talking about them to the media so that they stop promoting it.
Because as I said yesterday: that constitutes journalistic malpractice.
#Telegram #Media #InfoSec

2024-08-27 16:08:42

I am liking how this time around a lot of people are outright calling the media out on their parroting Telegram's PR bullshit about how "encrypted, secure, private" the service is.
(it is not.)
As in, not just writing about how Telegram is neither of these things, but very clearly pointing a finger at the media and going: "stop spreading this misinformation, you are putting people in danger."
Keep this pressure on!
#Telegram #Media

2024-08-22 11:10:28

- reply

it is, if they insist to control the (effectively) DRM that makes or breaks the boot process of independent operating systems that the owner of the device might want to install on the machine.

2024-08-22 01:44:04

> Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.”
https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/
But hey can't expect Microsoft to test things against lesser-known distros like *checks notes* Debian, Ubuntu, Linux Mint, Zorin OS, and Puppy Linux.
Honest mistake, really!
#Microsoft #Linux

2024-08-19 22:28:34

- reply

:oof: What a blast from the past!
I should probably write this all up in a blogpost, with some more lessons-learned (for example: remember to microcache your 4xx/5xx errors as well).
Thanks for joining me for this ride down the memory lane!
I will now take your questions. :blobcatcoffee:

2024-08-19 22:21:56

- reply

The time we really went down hard was when our dedi provider (which was otherwise great!) overeagerly blackholed DDoS traffic…
…blackholing also our production back-end server.
Took us 45min to deal with this, mainly because I was out at lunch and for *once* I did not take my phone with me. While a certain @npub1yef…md7z happened to be on vacation literally on the other side of the globe.
Dealing with this meant pushing a quick config change to the fasadas to switch to the warm spare back-end.

2024-08-19 22:13:03

- reply

See, when you're DDoSing someone, you don't want to waste your bandwidth on checking DNS records, now do you? You want to put everything you've got into these malicious packets.
And when you do, and the target just moves on to a different set of IP addresses, you're DDoSing something that does not matter. Have at it! :blobcatcoffee:
Now, I am not saying *all* DDoSes work this way.
I *am* saying that all the DDoSes I have seen against OCCRP's infra when I was there worked this way.

2024-08-19 22:10:28

- reply

From my experience, what brings a site down really rarely is an *actual* DDoS. Most of the time it is organic traffic spike hitting a slow back-end.
Hence:
1. microcaching
2. my exasperation with CloudFlare calling everything a DDoS 🙄
But I digress!
We did get honest-to-Dog DDoSes, some pretty substantial. When that happened we just… swapped out *all* active fasadas.
The DDoS would happily continue against the 4 to 6 old IP addresses… While new visitors would get served from other nodes. 😸

2024-08-19 22:03:57

- reply

We had about 2 dozen fasadas configured, deployed, and ready to serve production traffic at any given time.
But we only kept 4-6 actually active for `occrp.org` (and some others for other sites we hosted).
The other ones were an "emergency stash".
If an active fasada did go under, we'd swap its IP address out of occrp.org A records, and add one of the currently healthy standbys instead.
If we started getting way more traffic than the current active fasada set could handle, we'd add more.

2024-08-19 22:00:18

- reply

IP addresses of active fasadas (that is, ones that were supposed to handle production traffic) were simply added as A records for `occrp.org`.
This was Good Enough™, as browsers were already smart about selecting an endpoint IP address and sticking to it across requests related to the same domain.
This also meant that if an active fasada went under for whatever reason, visitors would mostly not notice – their browsers would retry against one of the remaining IPs.

2024-08-19 21:50:39

- reply

Each fasada (i.e. reverse proxy on the edge) was configured to use *both* of these nginx instances on the currently-production back-end server.
Because everything was in docker containers, we could upgrade each nginx instance separately.
Whenever we were deploying nginx config changes or were upgrading nginx itself, we would do that one instance at a time. If it got b0rked, fasadas would just stop using the b0rked back-end nginx instance and switch to the other one.
No downtime. No stress.

2024-08-19 21:46:43

- reply

getting there 😉

2024-08-19 21:32:19

- reply

The production / warm standby back-end servers were automagically synced every hour. Yes, including the database.
This meant that:
1. we had a close-to-production testing server always available;
2. we had a way of quickly switching to almost completely up-to-date backup back-end server in case anything went down with the production.
The set-up on these back-ends included *two* nginx instances running parallel on different ports but with same config, serving same content.
Yes, on each.

2024-08-19 21:25:22

- reply

For those curious, the infra was mostly:
- a pair of back-end servers (the main site was an ancient Joomla install…), in a production / warm standby configuration;
- a couple dozen very thin VPSes acting as (micro-) caching reverse proxies; we called them "fasadas" (from Bosnian word for a façade);
- a bunch of scripts that tied it all together.
The stripped down and simplified nginx config for the fasadas lives as a FLOSS project here:
https://0xacab.org/rysiek/fasada

2024-08-19 21:15:15

My former employer, @npub1nzy…qns5 , just went live with their new website, and it is pretty slick!
https://www.occrp.org/en
This is bitter-sweet for me.
On one hand, so glad to see them have a new site, finally! The old site was a mess.
On the other: I had designed and built the infra that hosted their site through Panama Papers (arguably OCCRP's big break). Infra that did not rely on external CDNs or "DDoS-protection" providers.
That infra is no longer in use as of today. Replaced by Google. 🥲

2024-08-18 22:25:43

Sigh. Mozilla decides it is time to change the perfectly serviceable, and pretty damn good, logo.
https://www.omgubuntu.co.uk/2024/08/mozilla-new-logo

2024-07-31 12:39:39

- reply

wait are you saying the market did not solve it? :blobcatscared:

2024-07-25 19:35:14

- reply

would you happen to have any links on this? It's really difficult to document this stuff, searching "windows update failure" is understandably useless. :blobcatsweats:

2024-07-25 14:40:42

Hey #SysAdmin #InfoSec fedi, let's have some fun. 🥳
Microsoft claims that the CrowdStrike thing is EU's fault, acktschually, because years ago EU forced Microsoft to stop abusing their privileged Windows access to have an edge over competitors in the antivirus market. 🤨
Seems only fair to have a thread on our favorite examples of a Microsoft's utter failures, ideally related to completely botched updates.
Know of such a failure? Share it below! :blobcateyes:
#Microsoft #CrowdStrike #EU

2024-07-23 02:27:38

- reply

> An Endpoint Security solution should never be able to kill people. If it does, the person/organisation in charge of putting it in place failed to provide reasonable safety mechanisms.
The person/organization in charge is often *forced*, sometimes against their own strong preference, to install an EDR due to compliance reasons.
A company that offers an EDR solution is responsible for its product. Just as a contractor is responsible for the quality of steel they provide.

2024-07-23 02:20:00

- reply

plus, it's not just about the laws and regulations that already exist.
It's also about laws and regulations we could push for, now that there is a clear cut case to build that push upon.
I'd start with considering if the whole "no warranty, even implied warranty of fitness for a particular purpose" should be even legal in a ToS/EULA of software that is being *sold* clearly for a specific purpose.
Never waste a good crisis!

2024-07-23 01:57:45

- reply

I do believe the directors and managers at CrowdStrike need to be held personally liable for anything to change, really.
And maybe the auditors who'd been pushing it.
It's risk laundering, that's what it is, and it needs to stop.

2024-07-20 06:07:45

- reply

> Your sole and exclusive remedy and the entire liability of CrowdStrike for its breach of this warranty will be for CrowdStrike, at its own expense to do at least one of the following: (a) use commercially reasonable efforts to provide a work-around or correct such Error; or (b) terminate your license to access and use the applicable non-conforming Product and refund the prepaid fee prorated for the unused period of the Subscription/Order Term.
https://www.crowdstrike.com/terms-conditions/
🤡
#CrowdStrike

2024-07-20 03:41:21

- reply

> "Not one time have I regretted firing someone too fast," Kurtz told a lunchtime crowd at the first day of the Montgomery Summit in Santa Monica. "It's that I waited too long."
https://dot.la/crowdstrike-ceo-george-kurtz-2645385654.html
(March 2020)
Pretty rich, coming from a guy who now has had two global b0rked-update-related outages on his watch (McAffee 2010, CrowdStrike 2024).
#CrowdStrike

2024-07-20 02:49:04

- reply

Be the information security threat you want to see in the world!
#CrowdStrike

2024-07-20 01:20:46

- reply

It is looking more and more like the whole thing happened due to malformed data files and a parser that crapped its pants trying to parse them. 🤦‍♀️
With that in mind, I'd like to suggest we all spend some time reminding ourselves of, or learning about, #LangSec:
https://langsec.org/
✨ LangSec® ✨
Don't pull a CrowdStrike!™
#InfoSec #CrowdStrike

2024-07-20 00:14:49

- reply

Anybody has a better understanding of how such updates are signed (or not) on Windows?
This was a kernel driver update, right? Apparently it was not signed:
https://cyberplace.social/@GossiTheDog/112812317243841396
Wired claims that as a kernel driver update, it should have been signed by Microsoft:
https://www.wired.com/story/crowdstrike-outage-update-windows/
> [T]hey require that Microsoft also vet the code and cryptographically sign it, suggesting that Microsoft, too, may well have missed whatever bug in CrowdStrike’s Falcon driver triggered this outage.
🤔

2024-07-19 23:51:37

- reply

So, does anyone have any reasonably reliable info on what actually happened?
Hearing things from "the CDN CrowdStrike uses done goofed" to "someone at CrowdStrike decided to push a quickfix outside of the standard testing-staging-QA pipeline."
I'm sure I am not the only one who would really appreciate something solid on this.
Also, how did this get installed on the end systems? Aren't CrowdStrike's updates signed? :blobcateyes:
#CrowdStrike #InfoSec #SysAdmin

2024-07-19 21:49:10

- reply

huge oops → #hugops

2024-07-19 21:40:37

- reply

CrowdStrike is a small, local, struggling, resource-constrained mom-and-pop infosec shop which should not be regulated because that would kill it, and also is a globally-recognized security vendor of advanced AI-based EDR tools that you should definitely use because the company is massive and has all the resources in the world that they can put to making their tools top-of-the-line, not like those FLOSS amateurs.
Obviously.
#CrowdStrike

2024-07-19 20:13:46

- reply

Wait, CrowdStrike's CEO's name is Kurtz?
Is he, perchance, a colonel?
https://media.mstdn.social/media_attachments/files/112/814/508/912/896/349/original/d739749c70f5b509.jpeg

2024-07-19 20:05:39

- reply

A gentle reminder that very recently the broader FLOSS community avoided a potentially massively problematic security issue with an attempted sneaky xz back-door affecting OpenSSH, because a Microsoft developer was curious about a weird slowdown.
I mean, screw Big Tech and all that ecosystem, but we might want to take this opportunity to consider our own potential failure modes.
#InfoSec

2024-07-19 19:10:08

- reply

"The buck stops with me!" – tech CEO says, head held high, pocketing the profit while firing Steve the intern, whose name happened to be on the commit message.

2024-07-19 16:59:17

- reply

thank you!
Just to be clear, I dabble in writing for media in Poland, so this might end up in a piece (with attribution). Hope that's also okay!

2024-07-19 16:56:16

- reply

this is spot-on. Can I quote you on that?

2024-07-19 16:41:14

- reply

Crowdstrike:
> The fix is to delete C-00000291*.sys
Google:
> quick, we need to call ICANN and get .sys gTLD registered, stat!

2024-07-19 16:29:46

- reply

This kind of failure is *systemic*, but of course it will get blamed on some lowly techie somewhere whose name is on the commit message.
> It was all Steve.
> We have now fired Steve, thus solving the problem once and for all.
> Bonuses to all management for a job well done!
Yet another example why techies might want to consider unionizing. :blobcateyesblush:

2024-07-19 16:03:23

- reply

Cannot wait for the first tech media galaxy-brained piece that finds a way to blame this on "hackers", somehow.
Because obviously: computer go bad? Hackers!

2024-07-19 14:32:22

- reply

Crowd Strike thing is basically an "Ever Given stuck in Suez Canal" of IT industry.
All the techies losing hair, sleep, and family time trying to get this un-stuck are the excavator operator trying to get things un-fucked.
#CrowdStrike #InfoSec

2024-07-19 14:13:45

- reply

"All software has bugs 🤷" is the "boys will be boys 🤷" of the IT industry.
#InfoSec

2024-07-19 14:05:51

- reply

so, microsoft windows crowd is on strike, huh

2024-07-19 13:52:35

- reply

Maximizing shareholder value by using tried-and-true industry-standard systems services is going just great.
Let's see if "nobody ever got fired for choosing Windows" still holds a week from now. :blobcatpopcornnom:
#InfoSec #CrowdStrike

2024-07-19 13:41:21

ClownStrike

2024-07-17 22:01:21

Is "AI"-generated content covered by copyright?
Is it a derivative work of the work the model was trained on?
What if it is really really similar to that original, copyrighted work?
What about a derivative work based on "AI"-generated content, can that be covered by copyright?
One could say we're dealing with Copyright Troll-ey Problem. :blobcateyesblush:
#AI #copyright

2024-07-14 19:26:19

Ask not for whom the bell curves.
It curves for thee.

2024-06-29 13:52:55

> Meta has caved to European regulators, and agreed to pause its plans to train AI models on EU users' Facebook and Instagram users' posts — a move that the social media giant said will delay its plans to launch Meta AI in the economic zone.
https://www.theregister.com/2024/06/14/meta_eu_privacy/
And nothing of value was lost for the people in the EU.
#Meta #AI

2024-06-29 11:56:11

- reply

image description:
A small cartoon robot sitting in the corner.
Text:
I don't want to read words no one cared enough to write.

2024-06-26 00:15:15

- reply

As #Mozilla is busy adding AI crap to #Firefox, I would like to point out that it's about 13 years since they removed the #RSS button from default Firefox GUI, and six years since RSS support was completely dropped from Firefox.
Thus making feeds invisible and impossible to discover for most web users.
RSS/Atom/JSON feeds are an immensely useful and important tech that can help solve the content discovery problem *without* going through gatekeepers. 👀
But obviously not a priority for Mozilla.

2024-06-25 23:35:55

And what would these standards be, pray tell, @npub1rvd…m6kr ?
Keeping in mind that you are including services that told people to eat rocks or put glue on a pizza?
> Our initial offering will include ChatGPT, Google Gemini, HuggingChat, and Le Chat Mistral, but we will continue adding AI services that meet our standards for quality and user experience.
https://blog.mozilla.org/en/products/firefox/firefox-news/ai-services-on-firefox/
🤡
/via @npub1hk4…3udt
#AI

2024-06-20 13:04:30

Control over replies on fedi when. 👀
https://mas.to/@kissane/112641036624409139
I can only boost a post once, so this is my way of boosting it more. seriously, go read that thread.
fedi has a gigantic reply-guy problem, which is pushing wonderful people off of it.
implementing controls on who gets to reply to a post would help a lot.
#Fediverse #Mastodon

2024-06-17 14:44:18

#WizzAir charges a "Service Surcharge Fee", 10EUR per person per flight.
It's silently added just before the payment screen when booking in their their app or on their website.
They claim it's "applicable to bookings made by automated systems." 👀
What does this mean in practice?
Based on some poking: you will get hit by it if you have an adblocker, use Firefox, or if you are not allowing WizzAir app to gather data from your phone (for example, because you use a privacy-enabled Android fork).

2024-06-16 19:15:10

> “If Kyiv and West refuse, they will take full responsibility for further bloodshed,” Putin said.
Ah yes, the good old "why are you hitting yourself, stop hitting yourself" bully tactic.

2024-06-11 00:27:08

Capitalists: we make the big bucks because we take the big risks!
Risk: <materializes>
Capitalists: Wait no not like that.

2024-06-08 02:19:14

While #Adobe is doing an absolute stupid with their new licensing terms, and (now Canva-owned) #Affinity slashes prices by half in a "flash sale", I am once again asking people to consider supporting #FLOSS tools instead.
Yes, they are far from perfect.
But with a small fraction of what these closed source vendors are raking in, these tools could be made immeasurably better.
And they won't end up bought up and enshittified, as experience with past attempts at doing that to FLOSS tools shows.

2024-06-07 15:19:17

- reply

Also, shout-out to @npub19zc…jfcm for dramatically changing the security landscape of the Web for the better over the years.
Rarely is there an example of a project so effective and so directly improving everyone's lives, while at the same time keeping the original engineering mindset and just Doing Stuff Right™ humbly in the background.
Next November it will have been exactly a decade since LE started. We all owe them a huge 10th birthday party.
#InfoSec

2024-06-07 15:09:12

- reply

Actually, downgraded that take to "lukewarm", it should really not be controversial at all these days. It's been a hot minute since LetsEncrypt changed the HTTPS landscape!
What is beyond me is that such "security advice" still gets pushed. :blobcat0_0:

2024-06-07 15:07:21

- reply

browsers are starting to enforce this in a bunch of ways already.
And you are almost certainly not logging into that local barber's site or the local restaurant's one to review that menu. So, no credentials on the wire.
Yes, Malware-in-the-Middle, etc, but that'd be a pretty sophisticated, targeted, active attack, compared to indiscriminate, passive credential harvesting, which the WiFi and VPN thing was about in the first place.

2024-06-07 14:59:14

Lukewarm take:
When I see general* "security advice" that mentions "do not use public WiFi" or "use a VPN", I am immediately suspicious about all other advice offered.
Yes, a decade ago that was a consideration, because most sites were not using HTTPS. Credentials were flying cleartext on the wire.
Today, almost all sites use HTTPS.
*) "general" meaning "without a very specific threat model in mind", meant for general public, etc.
#InfoSec

2024-05-29 21:42:31

- reply

oh damn now I really wish I had gone!
@npub1sl7…lnx3 @npub1yyz…a6kf

2024-05-25 00:44:03

- reply

Telegram[1]:
> Q: Do you process data requests?
>
> (lots of hand waving)
>
> To this day, we have disclosed 0 bytes of user data to third parties, including governments.
Indian court[2]:
> Telegram has filed an affidavit dated 6th October, 2022, deposed by Major Lakshmiraj Rathore, as Authorized Representative, confirming that the data as directed by the Court has been filed
🤡
[1] https://telegram.org/faq?setln=en#q-do-you-process-data-requests
[2] https://web.archive.org/web/20240314185143/http://164.100.60.183/writereaddata/orderSan_Pdf/pms/2022/1669618366215_31241_2022.pdf
#Telegram

2024-05-25 00:00:58

Telegram in 2020[1]:
> Q. Will you have ads?
> No.
Telegram in 2024[2]:
> Q. Will you have ads in my private chats and groups?
> No.
…but also:
> In 2021, Telegram launched Sponsored Messages – minimalist, privacy-conscious advertisements that can appear in certain public channels.
Hey, but at least they still promise not to sell your data, so that's fine. I'm sure they would never go back on this one. 🤡
[1] https://web.archive.org/web/20200229080907/https://telegram.org/faq#q-how-are-you-going-to-make-money-out-of-this
[2] https://telegram.org/faq?setln=en#q-how-are-you-going-to-make-money-out-of-this
#Telegram

2024-05-22 12:17:44

I'd just like to interject for a moment. What you're referring to as PC, is in fact, a Windows laptop, or as I've recently taken to calling it, Copilot plus PC.

2024-05-15 01:34:51

- reply

as an infosec and IT professional I can tell you that you are correct in thinking none of this is in any sense of the word "secure".

2024-05-14 02:09:02

"ChatGPT [prompt] consumes (…) up to 25 times more than a Google search"
https://www.brusselstimes.com/1042696/chatgpt-consumes-25-times-more-energy-than-google
> Making sure your electricity comes from wind, solar or nuclear power is a logical first step. Google itself, for example, says it has been running entirely on green electricity since 2015.
Story misses a crucial point:
👉 The goal isn't just to add green power. The goal is to emit less CO2!
New green capacity needs to *replace* old dirty stuff. Not be gobbled up by new data centers for AI.
🧵

2024-05-05 00:19:38

Okay, so, podcasts are great but sometimes I prefer to read instead of listen. 🤔
So what if – hear me out – there was a thing like podcasts, but for text! 🤯
It would still be distributed via RSS, you could still follow them and automagically pull them to your device. But instead of audio, there would be text. ✏️
👉 We could call them: textcasts!
And get this: I already have one! It was super easy to set up, actually. You can find it here:
https://rys.io/en/feed.rss

2024-05-04 05:13:41

May the Forth be with you!
https://media.mstdn.social/media_attachments/files/112/380/630/038/521/037/original/321e0704006acca9.jpeg

2024-05-04 05:04:21

Oh my Dog, @npub1hr7…jxyc yet again hits multiple nails square in their heads:
https://www.baldurbjarnason.com/2024/react-electron-llms-labour-arbitrage/
🔥 🔥 🔥
> Tech management will sacrifice technological progress – performance, design, and general product effectiveness – if it disempowers labour.
> If you’re unlucky enough to have to use any of this garbage we’re shipping and calling ‘software’, now you know why it all feels a bit shit.
> This is what unions were made for
🔥 🔥 🔥

2024-04-28 22:58:22

If #DNS is so great, why is there a .int, but not a .float, .char, or .double? 🤔

2024-04-28 19:19:44

neolibs: the market will solve it!
the market: haha lol AI brrrrt synergy pffffft lalala blockchain weeeeee! *hiccup*

2024-04-27 14:04:29

A few days ago [@ward](https://easymode.im/@ward) tooted about how it's somehow "AI art", but if it's human-made, inexplicably it's just "content":
https://easymode.im/notes/9s9fhdg8jh3gi3h7
His toot has been living rent-free in my head ever since.
I had ranted a few times before how "content" is a corporate-y way to devalue art. How "user-generated content" is a term designed to make it easier to deny the significance (not just monetary) of the amazing stuff people create online.
Contrasting this with "AI art" is jarring, and spot-on. 👀

2024-04-22 13:59:54

- reply

right, so "figuring out image was AI-generated" is somehow the same thing as "criticizing people who can't draw"? :blobcateyes:
So I guess "telling if something is a photograph" is also the same as "criticizing people who can't paint"? :blobcatcoffee:

2024-04-22 03:22:17

Remember when "count the fingers" was used mainly to check if a person is feeling okay?
Instead of to figure out if an image was "AI"-generated?

2024-04-14 16:38:23

- reply

well I named my blog after a hilarious Google Translate error. It had translated:
> Lög um öryggi net- og upplýsingakerfa mikilvægra innviða.
as:
> Songs on the security of network and information systems of critical infrastructure.
Now they got their act (sic!) together at least in this one case, it seems.

2024-04-05 22:35:50

- reply

> yeah, "toots" is the official name unfortunately
It's not and hasn't been for years.
It's a term some of us here use and find cute, but there is nothing stoping you from calling them whatever you wish. A lot of people call them, simply, "posts".
[@atocci](https://kbin.social/u/atocci)

2024-04-05 15:54:03

Happy *seventh* anniversary of "Six reasons Mastodon won't survive" to all who celebrate:
https://mashable.com/article/mastodon-wont-survive
#Fediverse #Mastodon
https://media.mstdn.social/media_attachments/files/112/218/941/632/936/145/original/1c061fc1eccb61fb.png

2024-04-01 23:11:30

- reply

it was a scheme to allow people to effectively donate money to him without being beholden to these pesky campaign finance laws etc.

2024-03-30 17:26:10

Whoever first gets Copilot to spit out a verifiable non-trivial part of the #xz backdoor gets a cookie.
Go.

2024-03-29 12:14:48

It just hit me: as shitty and annoying as they are, cookie banners and privacy screens are freaking amazing!
They are teaching a whole generation of Web users:
1. never to click on the default button;
2. to always be suspicious of intentions of anything online.
:blobcatcoffee:
#InfoSec #Privacy

2024-03-28 20:05:12

can't spell "anarchist" without "arch" btw.
:blobcatpeek:

2024-03-27 12:46:31

- reply

Florida, man.

2024-03-26 21:48:12

Here we go again:
Telegram’s peer-to-peer SMS login service is a privacy nightmare
https://techcrunch.com/2024/03/25/telegrams-peer-to-peer-sms-login-service-is-a-privacy-nightmare/
*sigh*
Stop using #Telegram. Seriously.
Telegram uses confusing language to pretend it is end-to-end encrypted by default. It is not — you have to enable that separately for each chat, and it *only* works for one-on-ones, not groups.
Telegram's protocol design is sus af (that's a technical term), and that's putting real people in real danger:
https://www.pwnallthethings.com/p/russia-is-spying-on-telegram-chats
#InfoSec #Privacy

2022-11-08 05:59:52

Seriously though, fedi was *built* by furries, trans and queer folk, disabled neurodivergent people.
This is *the reason* the culture here is what it is. Why CWs are a thing. Why image descriptions are a thing. Why privacy matters here. Why moderation tools not only exist, but are usable — and used.
If you had joined and asked yourself "wow, how come this place is so chill and kinda… nice?" — that's thanks to all the nice people from communities some people call "weird".
So #KeepFediWeird.