Eleanor Saitta

Thinking about security, failure, change, art, and living. Recruiting barbarians; complicate your narratives. Fractional CISO to startups via Systems Structure Ltd. HEL/NYC/LON

Work Me: https://structures.systems/our-team
Personal Me: https://dymaxion.org

Public Key

npub15zykay2ktrxph2lpf7y0eqpahhj9s5lp7pyjxfu9y006x62pjmcqnu6py0

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs2pztwj9t93nqm40s5lz8usq7mmezc20slqjfry7zj8hard9qeduqprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt67vaz5

Publishing to

relay.momostr.pink

Author Public Key

npub15zykay2ktrxph2lpf7y0eqpahhj9s5lp7pyjxfu9y006x62pjmcqnu6py0

Show more details

Last Notes

2026-01-03 18:40:12 GMT

The first protest I ever went to was against American overseas military adventures driven by oil money. That was in middle school in 1992, three years before the first UN Climate Change Conference of Parties (COP1 in Berlin in 1995). 33 years later, nothing has changed.

2025-12-26 16:48:48 GMT

The documentation for this image processing library is one of the most interesting things I've read in weeks:
https://github.com/celoyd/potato/blob/main/docs/personal.md
https://github.com/celoyd/potato/blob/main/README.md
https://github.com/celoyd/potato/blob/main/docs/concepts.md
Philosophical discussion of the nature of seeing and what am image is vs a map, fascinating technical details about how satellite imaging works and why it looks as bad as it often does, a lot of really thoughtful conversation about engineering and aesthetic process, and even an amusing unit of measurement — grams per terrapixel.

2025-12-24 11:45:23 GMT

RE: https://mas.to/@kissane/115771219606234540
This piece is a great exploration of a corner of how we collectively know things, told via the metaphor of the 1964 Valdez earthquake. More specifically it's about the process of figuring how to think about the way that our way of knowing things is changing and why.
#note1h8s…ej4d

2025-12-17 09:02:23 GMT

RE: https://mastodon.social/@zackwhittaker/115731387253612546
Now do you get why you want an ad blocker?
#note1jkz…cfrv

2025-12-13 21:41:15 GMT

- reply

I don't know how people live like this

2025-12-07 20:34:18 GMT

Still really genuinely angry at how much the passkey rollout has fucked up the flows for anyone using a security key.
Fuck forcing people to set pins on hardware tokens. Fuck defaulting to allowing a hardware token to log in without the password. Fuck making every mobile device you own a first class token and making login attempt spam a thing again.
I get that passwords are broken. I don't have a problem with the idea behind passkeys as such for less-technical users (although fuck vendor lock-in and non-portable credentials), but do not fuck over technical users trying to protect critical systems by breaking their workflows or destroying basic security primitives.

2025-11-27 14:28:48 GMT

Companies, don't try to stiff your consultants for work they've already done. It's a terrible look and it's likely to cost you more than you think you're going to save. Also usually illegal and always immoral, should shame be a feeling you experience.
Consultants, I strongly recommend having language requiring changes to the contract to be put in writing to your non-client email address, having at least a 10% late fee for delayed payments (with no exception in cases where the customer disputes the bill but not the work), and being very particular about how contracts may be terminated, especially if you work on long, open-ended engagements.

2025-11-24 10:18:25 GMT

I've been instituting exactly this kind of cooldown/delay on dependency updates at all of my clients for four or so years and I'm glad to see more people talking about it: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

2025-11-06 12:25:05 GMT

I'll take a break from the politics now for a brief word from our sponsors:
If you're a startup beginning your security journey and you're interested in help building a security program — not just from a technical security architecture perspective but also in terms of structure, hiring, and governance, I've got some availability right now. Over the past eight years, I've helped fourteen companies start their security journeys or validate their strategy, and I'm looking forward to a few more.
"I've always really enjoyed our discussions - focused and properly able to get into the details, but always pragmatic and able to keep it light, which not all leaders manage very well."
"Because of your work and the confidence it gave our investors, we were able to add another $150 million to our existing $300 million funding round."

2025-10-22 10:21:57 GMT

Hilarious side effect of the OpenAI pivot to porn plus the Swedish ban on online pornography purchases: Paying for ChatGPT in Sweden may be a criminal act soon.

2025-10-16 17:46:04 GMT

- reply

So, I've had some time to start digging into this properly. Unfortunately, this has been going on longer than I realized — after a couple of abortive attempts in 2020 and 2021, this stuff started getting rammed through as soon as the new government took office, and some ugly things have already passed. Stuff is weird, too — six week long public comment periods on incredibly dense legislation timed over summer vacation when literally the entire country is on holiday and long and dense pro-surveillance comments from a men's sexual health association?
The weirdest part to me, though, is the fact that almost no news organization considered completely upending the landscape of citizen privacy and police authority newsworthy — a few pieces in Hessari, but that's it. Combined with outlawing political strikes by unions — brought in by the same government at the same time — this is a massive authoritarian power grab.

2025-10-15 07:23:52 GMT

- reply

More details tk, but here are the links to the legislative proposals:
https://intermin.fi/hankkeet/hankesivu?tunnus=SM047:00/2023
https://intermin.fi/hankkeet/hankesivu?tunnus=SM048:00/2023#lainvalmistelu
https://intermin.fi/hankkeet/hankesivu?tunnus=SM046:00/2023#lainvalmistelu
https://intermin.fi/hankkeet/hankesivu?tunnus=SM040:00/2024#lainvalmistelu
https://intermin.fi/hankkeet/hankesivu?tunnus=SM023:00/2025#lainvalmistelu
https://intermin.fi/hankkeet/hankesivu?tunnus=SM061:00/2023
https://oikeusministerio.fi/hanke?tunnus=OM067:00/2024
These clowns must be stopped while there's still a Finnish civil society

2025-10-15 07:23:35 GMT

- reply

The official explanation for these changes is something something Russian hybrid warfare (a military intelligence issue that they already have tools to handle) and some unhinged waffle they've been trying to feed the press about gang violence — and remember, this is happening at the same time as they've thoroughly destroyed almost everything that remained of the Finnish social welfare system, which shockingly means there are a lot more desperate folks around, and even still they have to make nonsense up about crime.

2025-10-15 07:23:16 GMT

- reply

Finland, for historical reasons, is a country where most (white) people (with Finnish passports) trust the police, despite most of the police belonging to the fascist party. There is no organized digital rights work happening in this country (Effi technically exists and is for all purposes completely useless; if you're reading this and from Effi, prove me wrong). While Finland has historically had a strong reputation for freedom of the press, but this is only because the press have never wanted to publish anything the state doesn't like. When they do (a few years ago with a piece about a military research center), the police just show up without warrants, steal hard drives, and charge all the individual journalists with treason, despite none of them being e.g. party to an official secrets act.

2025-10-15 07:22:55 GMT

So last night I just found out that the far right Finnish government is planning on gutting limits to police use of malware, wiretaps, undercover infiltration, and police/military intelligence data sharing, and eliminating some or all of the constitutional protections around personal communication and the safety of the home and allowing tools now only used in the context of treason and terrorism investigations to be used much more widely. This will include investigations where not only has no crime happened yet, but no crime is expected to happen in the future.

2025-10-07 14:25:22 GMT

- reply

This is a solid summary: https://harris-sliwoski.com/chinalawblog/faq-what-foreign-companies-need-to-know-about-chinas-2025-anti-unfair-competition-law-aucl/

2025-10-07 13:04:18 GMT

Delighted to see China getting ahead of the game and banning scraping that circumvents technical restrictions and some kinds of deceptive advertising and monopolistic platform practices. Them claiming global enforcement scope (enforced by among other things market access bans) is also an interesting move; curious to see how it plays out in practice.

2025-08-19 14:12:02 GMT

A client of mine in the UK is looking for an experience contract IT support engineer. Initially, they'll be handling a few specific projects — Google Workspace hardening, macOS hardening via Kandji, a Yubikey rollout, deployment of MDM for mobile devices, etc. There will be some additional ongoing business as usual IT support on the side and also continuing after the initial project work is done. Company is in London, can be mostly remote though. DM if you're interested and feel free to pass it on to folks who you know are qualified. #getfedihired

2025-08-12 12:14:02 GMT

If you've worked with SDRs professionally, either at the hardware level or at the e.g. RF protocol implementation levels, I'd love to buy an hour of your time for a validation conversation about a potential project. DM if you're interested; boosts welcome.

2025-07-13 09:01:08 GMT

- reply

At some point, I went to a pretty interesting seeming security and usability academic conference, breaking my general rule of not bothering with that sort of thing. Basically all the work presented was useless because folks had only studied the work, not done it, and no one in the room had context to call bullshit. Not to mention, of course the general sort of academic ritual of ignoring bad work instead of calling it out, which only helps if you already know what's bad.

2025-07-13 07:13:56 GMT

New worst idea ever for geo engineering just dropped. We're speed running the 50s now:
https://arxiv.org/abs/2501.06623

2025-07-03 18:37:36 GMT

One of the most reliable things I learned, early on in my years of watching politics and working with organizations, is that when someone tells you that they believe, what they want to do, or who they are, it saves a ton of time if you just believe them and assume they're completely serious until proven otherwise.

2025-07-03 12:25:00 GMT

As far as I can tell, there is effectively no such thing as an activist lawyer in Finland. This is a bit of a shock and a real disappointment, but then again, I guess pretty unsurprising given the state of politics and protest in the country. Happy to be proven wrong, of course.

2025-07-01 09:55:00 GMT

When this case first came out, I was talking to a relatively senior Finnish journalist about freedom of the press in Finland. We came to the conclusion that Finland's then best in the world ranking on press freedom was entirely down to the fact that the press had never wanted anything that the government wasn't ok with having in the papers. This decision is broadly incompatible with freedom of expression. Prosecuting folks who agreed to keep state secrets is one thing. Accusing journalists of treason, let alone convicting them, for publishing material that in their professional opinion was newsworthy is completely unacceptable. The Finnish national security bureaucracy does and must not be above the constraints of international human rights law, and must not be permitted to either constrain a priori or decide post hoc what is in the national interests. I assume this will be appealed and that the Finnish Supreme Court (or, failing them, the European Court of Human Rights) does the right thing. This case has already caused a significant chilling effect on Finnish journalism — already not in a great position — and this is happening at a time when Finland's national security position and responsibilities are changing rapidly. We need transparency and accountability in the national security bureaucracy now more than ever.
https://yle.fi/a/74-20170451

2025-06-29 01:42:21 GMT

- reply

I should add, your honor, that when I say "tried to kill me", I mean pulled out from behind a taxi-van that was stopped talking to one of our march stewards and intentionally accelerated towards me until what felt like at least the speed limit if not more, while I was standing directly in the path of the vehicle wearing a neon vest and carrying a large "road closed" sign in such a manner that I had to move out of the way, passing close enough to me that if I had moved the ~500mm long sign in my hand to project away from my body, without extending my arm, it would have intersected with and likely removed the passenger side mirror of the car. He then proceeded to drive at and similarly scatter both our second and third steward teams, thankfully both without incident and without intersecting the body of the march. If he had intersected the march, regardless of whether or not people attempted to move, it is very likely there would have been deaths. As it was, only a little adrenaline. I should also note, your honor, that he chose to do this while both his (presumptive) wife and young child were in the car. And when I identify this car, I mean that I have a clear photograph of the license plate in context and that the police have seen the photo and been informed of what happened, and that we have at least five specific known witnesses.

2025-06-28 17:49:40 GMT

- reply

Oh, and by the way, you missed your safety inspection and that car isn't legal to be driving in the first place.

2025-06-28 17:42:55 GMT

- reply

One of the funny things about Finland is that by default, registration details for vehicles are public. So, Turo Jaakko Levänen and your beige Mercedes S-class, license plate EPC-493, nice to meet you!

2025-06-28 17:32:02 GMT

It's pride this week in Helsinki, and despite all of these fuckers who want us in the ground, we are in fact still fucking here and still fucking queer.
This week I ran a play party (oh, you think kink shouldn't be at pride? Fuck you, cop, we're gonna do more of it), the Pride edition for our drag and variety show (the last show of year seven!), and the safety team for the second ever Helsinki Dyke March. In that march, someone tried to kill me with a car, but you fucking missed, asshole. We're still fucking here, and we're still fucking queer.

2025-06-19 07:19:55 GMT

- reply

Where is this in settings? I've spent about 20 minutes looking through all the settings menus a half dozen times. Autofetch missing messages and autoload remote media are both off.

2025-06-18 17:15:29 GMT

@npub14kx…urew
The per-message dotted menu is no longer present in thread view, so I can't e.g. edit replies without re-finding them in my account view.

2025-05-23 23:53:58 GMT

- reply

I can't imagine a model fed all the fanfic in the world would possibly match a trope like that as being salient in a scenario blatantly constructed to evoke such a response. My god, the matrix multiplication must be self-aware and emotionally intelligent.

2025-05-19 07:00:13 GMT

- reply

Many of those forms are failing to keep up with main or to release fixes in a timely manner. Some of them are keeping alive old code no longer in the main browser and thus not maintained.
And if you don't want to use Firefox, well, back to Chrome it is.

2025-05-18 21:41:39 GMT

- reply

(and sure, yes, experiments are great! Projects that might eventually turn into something cool are great! Just, you know, don't actually rely on them to keep you safe, or to keep the machine you run them on safe, especially if you're in a context where there are actual threats and risks.

2025-05-18 21:37:55 GMT

When I say that I can't recommend third-party forks of either Firefox or Chrome for real world use, this kind of thing is why. *This* is the bar for what the security team for a browser needs to be able to do. A fork where the entire technical team is ten people that can't even keep up with upstream patches is sadly not in the running.
https://blog.mozilla.org/security/2025/05/17/firefox-security-response-to-pwn2own-2025/

2025-05-16 09:53:16 GMT

- reply

Yeah. If you operate from a starting point that you do not want to create a global search engine, but rather a collection of small, opinionated, topic-specific indexes focused largely on dedicated sites without picking up, e.g. single posts on otherwise-unrelated blogs and using direct or indirect human curation as the primary ingest mechanism, you might well succeed. There are a few domains I care about where I'd be very happy to use such a thing. 95% of my search traffic would never go there, but 5% is better than nothing.
The thing that makes global search useful is that it has a genuine claim to be both global and authoritative. At its best, it lets you, with some work, say "this piece of information is not generally known to exist". That property is irreplaceable and invaluable.
@npub1axd…s6u4 @npub105n…85x4 @npub1lhc…h9l6

2025-05-16 09:29:37 GMT

- reply

If your have topic recognizers for queries and for crawlers and they are a) always right, and b) never change, you could shard the index below that point. Crawlers could still be distributed and indexes wouldn't need to reference/communicate, but every crawler would need to update every index index shard. However, A is improbable and B is impossible.
You might be able to hack something together that could somehow meaningfully federate, but the level of computational inefficiency would be staggering. If we don't have a nonprofit that could run a single centralized web scale search engine, we definitely don't have ten thousand nonprofits that could together spend two orders of magnitude more to run a federated one.
@npub1lhc…h9l6 @npub105n…85x4

2025-05-16 07:57:29 GMT

- reply

Not to discourage folks from creating specific little bespoke indexes like that, but the beauty and utility of search has always been its global nature, which does not decentralize, unfortunately.
@npub1lhc…h9l6 @npub105n…85x4

2025-05-15 18:52:36 GMT

Does anyone know if Apple changed how iOS stores notification content after iOS 16?

2025-05-14 07:27:09 GMT

- reply

Do you know how security works at scale? This isn't news and among the majors, MS was mostly late to the party. That said, "spies" is doing a lot of work here. If you mean "collaborates specifically around threat intelligence", sure. If you mean "provides the US with general purpose intelligence outside the digital security space above and beyond the cooperation that the US can compel with statutory powers", no, we have no reason to believe that.
Also, with CISA dead, it's unclear that anyone on the USG side is still listening.

2025-04-18 09:11:10 GMT

Man, internet purity politics sure are bad at helping people build broad collations.

2025-04-16 15:15:07 GMT

- reply

One of my favorite old ones. Also now apparently American governance strategy.

2025-04-09 20:25:49 GMT

Does anyone have the actual list of retaliatory tariffs the EU passed today? Like, in full detail?

2025-04-07 11:06:23 GMT

It would be nice if signal would let users import and export lists of users, complete with nicknames and verified keys.
It would also be nice if, like on mastodon, we could leave notes about users to remember the context for them.
It would be even nicer if the notes could include some kind of structured data — hashtags would be fine — and the group system would let you set a hashtag filter that would soft-stop you from adding people without the hashtag to that group. Bonus points for integrating the chat folder system with hashtags as well.
This would go a long way toward helping the system scale for organizations.

2025-03-27 18:17:53 GMT

It would be really nice to have ad hoc group calls in signal, even if it's just syntactic sugar for creating a temp group and then auto deleting it.

2025-03-20 22:19:52 GMT

It's really nice that signal has "mute all" for chat folders. It would be nice if they also had "unmute all".

2025-03-14 12:04:35 GMT

- reply

This guy appears to be the sole original source; one can only assume a misinformation operation, at this point: https://www.linkedin.com/posts/serhii-demediuk-a383521aa_signal-activity-7303700457040809984-5dWZ

2025-03-14 11:29:23 GMT

- reply

(I didn't tag her because I assumed that if there could be an official comment from the org there already would be)
[@Mer__edith](https://mastodon.world/@Mer__edith )

2025-03-14 09:52:24 GMT

Anyone have any meaningful additional detail on this? It's widely enough reported that it seems to be real, but it does not make any particular sense and the implications are profound.
https://therecord.media/signal-no-longer-cooperating-with-ukraine

2025-03-12 07:20:08 GMT

By extension, this means that we also have a name for folks who work on design and development in these spaces: kleptographers!
https://antarian.social/@nsgeek/114139645751032693

2025-03-10 18:44:01 GMT

- reply

(and I guess, like, look, if you're gonna have large-scale use of torture, which solitary confinement is, things that reduce the direct harm done to victims are not in and of themselves bad. But also Jesus fuck and could we just not?)

2025-03-10 13:51:09 GMT

"We're happy to announce version 1.0 of the Torment Nexus, as popularized by the science fiction book 'Don't Invent the Torment Nexus'! Our innovative product breaks new ground in..."
https://www.theguardian.com/technology/2025/mar/08/vr-prison-california

2025-03-04 22:27:42 GMT

- reply

Also, I should say that I really do appreciate cis allies and folks reminding people to think about the trans folks (and immigrants!) who are first in the crosshairs, and yes, social privilege is very much a thing. That said, understand also that we still have agency, and that regardless of whether or not we are scared, a lot of us are also burning with a cold anger. Yes, please jump in front of the bullets aimed at us, but also, keep the hell up with us.
If you live in the US and you're not seriously mobilizing for direct action and resistance, what exactly are you waiting for? An angel from on high?

2025-03-04 20:02:24 GMT

- reply

And to be clear, that's the number from the 2021 census. It's almost certainly an undercount, both given that many folks have come out since then and that many folks will not have felt safe or ready to answer honestly. And even as an undercount, we're talking about the entire population of Houston. A more accurate number is probably somewhere between Chicago and Los Angeles.
Do you seriously fucking think we're going to die quietly? We've read our history. If we go, y'all coming with us.

2025-03-04 19:57:03 GMT

Are you familiar with the phrase "death before detransition"?
I'm just curious if folks understand the stakes for 2.3 million Americans right now.

2025-03-02 15:20:05 GMT

I feel like at this point, any country whose department of state etc does not issue a blanket "Do Not Travel" warning for the US is professionally negligent: https://www.kpbs.org/news/border-immigration/2025/02/28/german-tourist-held-indefinitely-in-san-diego-area-immigrant-detention-facility
Any professional organization, conference, or company expecting third-country nationals to travel to the US is negligent at best. The only ethical way to do this is to provide all travelers with on-call lawyers for their arrival and to post a bond for extraction expenses and physical and mental trauma damages.

2025-02-27 16:14:00 GMT

French Parliament go fuck yourself
https://tuta.com/blog/france-surveillance-nacrotrafic-law

2025-02-26 07:34:35 GMT

- reply

Also very pretty when a bunch of us in different colors decide to dance around together in a room with a little fog in it and occasionally useful for pointing at things

2025-02-20 23:46:21 GMT

So, because I'd previously boosted, I want to mention that the 'moving company' @npub1ets…l9u9 mentioned as providing free moves to trans folks in US red states is not in fact a moving company at all, and definitely not a licensed and insured one. They claim it is an SF Bay Area trans community project, but I haven't seen anything to validate this. I cannot recommend in good faith taking these folks up on this offer without a lot more information.

2025-02-15 14:43:29 GMT

@npub1prs…eh8y
Hey, do you know if there's a solution for Flickr legacy accounts? We had a pretty important and prolific photographer in the larp scene die a couple of months ago. Next of kin have control over the account and are keeping it paid up, but it's not a great longer-term option.

2025-02-15 12:51:17 GMT

The Lemkin Institute for Genocide Prevention and Human Security issued a second red flag alert for trans genocide in the US on Thursday: https://www.lemkininstitute.com/_files/ugd/58db98_c860c149ef554206b65db5569cb43213.pdf

2025-02-13 20:52:24 GMT

- reply

Here you go: https://infosec.exchange/@dymaxion/109928153037765084

2025-02-08 11:27:20 GMT

So, you've (I hope) actually read the Project 2025 document and thus know a big part of the stated policy objectives of this US government, if you're impacted by them. If you have, you're probably also confused as to where the hell the rest of the chaos that's clearly not in that plan came from.
Here's the rest of the owl: https://www.thenerdreich.com/reboot-elon-musk-ceo-dictator-doge/

2025-02-05 00:29:06 GMT

With the "shutdown" of USAID, the State department has ordered an emergency evacuation of all staff from over a hundred countries by Saturday. In their wake they will leave massive chaos. USAID feeds 53 million people a year, among other things. Many, many people are dying because of this, and many countries will never trust the US again.
USAID is a major part of American international soft power. The damage that this is causing can only be described as treasonous, even ignoring the human cost.
To be clear, this evacuation is impossible. Doing it from one country is very hard. Doing it everywhere all at once, even with all available military airlift assets, cannot happen. Regardless, on whatever schedule they do do this, this is not a normal international move. They are telling staff who in some cases have been in country for decades or who expected to be their for the rest of their careers that they have 48 hours to pack suitcases and leave everything else they own behind, to return to a country where they have no where to live and no job.
But then, that's the point.

2025-02-04 14:55:27 GMT

- reply

It only took the Atlantic fifteen days to call a coup a coup. Impressive!

2025-02-04 09:57:38 GMT

I do not understand how the futures people are still futuring right now

2025-02-02 10:26:38 GMT

When Quinn showed this to me before it went up, I thought it was a pretty sensible summary of the position we were obviously in — hopefully, really, looking for the positive things to think about in the longer-term, and well-written, but not actually surprising. Now that it has become somewhat more obvious to folks that the US is more or less finished, it might be a good time to think a little now about what comes after America: https://www.emptywheel.net/2020/11/03/what-comes-after-america/
And yes, we still have to get through this fascist coup and out the other side, and it's likely to be pretty awful. It helps to have something to fight for, though, not just against.

2025-02-02 02:02:17 GMT

I guess it's a nice distraction from everything else being shit to get an Android security update that completely breaks my house audio distribution system in a way that's going to require hardware purchases to fix.
Phones were an even bigger mistake than the web was.

2025-02-01 18:16:26 GMT

So, how long is it going to take any of the (likely non-US) mainstream media to start talking about this as a coup?

2025-01-22 14:15:14 GMT

- reply

So, there seems to be a lot of uncertainty and a lack of clear efficacy around TransRescue right now. I'm looking for alternate orgs to suggest, but there's nothing else in exactly that space.

2025-01-21 17:00:40 GMT

- reply

If you at all can, this is a really great time to donate or otherwise assist with https://transrescue.org/

2025-01-21 10:12:15 GMT

So, cis Americans, you're now living through the first day of a federal genocide against trans people, as defined by the Lemkin Institute for the Prevention of Genocide. As happens almost without exception unless stopped, it is both likely to proceed to mass murder and to expand to include additional social groups, possibly including you.
What are you going to do about this? Are you going to take up arms and fight to prevent your friends and neighbors from being murdered by the state? Are you going to harbor fugitives, get them medical care, and help them leave the country? Are you going to disrupt the function of state offices and destroy records to make their work impossible?
Or are you just going to hunker down and go along with what's asked of you, in hopes they don't get around to killing people like you? Are you, in other words, going to be a good Nazi?
If you think you're going to maybe go on a few big nonviolent protests and be angry on social media, like you did last time, but you know money is tight and you just started a new job and... congrats on failing to understand the situation and choosing to be a good Nazi.
History is unfortunately quite clear here. There are no other options left. Either you literally, physically fight this, or you collaborate.
If you think this is extreme, well, you've made your choice. See you in hell.

2025-01-15 11:40:04 GMT

- reply

Honestly, this is the first I've heard of it, and hopefully the last. If it's even dumber in other ways too.... Yeah. Lolsigh.

2025-01-15 11:30:28 GMT

Could people just stop trying to "improve" things they don't understand?
https://soatok.blog/2025/01/14/dont-use-session-signal-fork/

2025-01-10 00:17:49 GMT

- reply

To be fair, wireless printing is a black art
@npub1ffa…r8hz

2025-01-09 12:46:38 GMT

Do (software) emulators/VMs exist for Sharc DSPs? How performant are they on, say, modern macOS ARM?

2025-01-08 01:13:28 GMT

- reply

State censorship works

2025-01-07 18:25:29 GMT

Having just read a bit about the impact of the "business as usual" bias among German Jews in the runup to WW2 and the lack of meaningful resistance that it led to, is pretty terrifying watching the same bias today.

2024-12-19 19:18:52 GMT

When Silicon Valley talks about meritocracy, this is what they mean: https://mastodon.social/@grimalkina/112205399028342839
It's obviously never been about merit, but it also doesn't work for anyone — even the people who have enough privilege that they get held to a lower standard.

2024-12-19 13:31:44 GMT

- reply

One of the things I've often ended up doing as a consultant is telling organizations things they already know in a way that they're capable of listening to. This is generally stuff folks doing the work have been telling them, but who the execs refused to hear, and sometimes it's stuff that folks doing the work haven't said, because it definitely wasn't safe — but as an outsider I can say these things.
@npub10cc…lmq3 [@nick_tune](https://hachyderm.io/@nick_tune )

2024-12-17 22:31:32 GMT

- reply

It's always so weird when folks ask me how to get into security now. Like, I do my best to answer, of course, but it's almost an alien world.

2024-12-17 22:15:25 GMT

- reply

When I started in security, my boss pointed me at a couple of books to read in the month or so between getting hired and starting work, and then I was on-site at Microsoft doing code audits. And like, sure, I had part of a CS degree at that point, but for real it was just like, fuck around and learn it from first principles on the job.

2024-12-11 21:33:11 GMT

- reply

If you're going wide, a little bit of metadata would be useful — qualitative or quantitative, networks and years studied, and some slim ontology of intents (increase diversity, reduce mental harm, encourage virality), focuses (moderation, recommendations) and mode (technical intervention, etc)
@npub13ps…mpqm

2024-12-11 14:37:01 GMT

Your movement can either be ideologically pure or have an impact on the world.
Your call!

2024-12-04 16:10:41 GMT

If I were a CEO, I'd simply ensure my business didn't kill so many people it inspired assassins.

2024-12-03 00:11:50 GMT

- reply

It was just starting to be. The approach we were poking at would have been a browser plugin that let you do cert pinning for SRI, possibly with some kind of certificate transparency style system for the SRI hashes that have been seen. There are a lot of devils and details, but I think it could have both worked and likely turned into a standard, eliminating the need for the plugin and letting it lift the whole ecosystem.

2024-12-02 23:57:48 GMT

- reply

(back in the day, we spent a while digging into ways you could chip away at that problem when I was working on SecureDrop architecture bits, but afaik no one ever took a serious swing at it)

2024-12-02 23:56:22 GMT

- reply

Similarly, what's out there for cryptpad? They obviously both share the "you trust the server to not send you backdoored JS problem" that all these tools have, but beyond that?

2024-12-02 23:46:38 GMT

Is there a good, detailed protocol doc/security analysis for the Proton e2e/docs stuff they've come out with? I'd like to believe, but they really don't give you much to go on.

2024-11-29 01:21:15 GMT

- reply

How do people without phones or email use your service? One of the things about public transit is that when it really works, it has an obligation to serve *everyone*.
@npub12pw…zvxn @npub140q…j42v @npub1kqa…raly @npub19my…62ux

2024-11-23 02:04:41 GMT

This year for tdor, I read a lot of the posts and... Like, fuck, we're going to remember our dead the best ways we can. But if you're cis, I don't give two shits about your sympathy, I care if you're willing to fight for us. Don't talk to me about your feelings, send me a picture of the entrails of a transphobe whose belly you just cut open in the middle of fifth avenue. Make next year's list shorter the fucking hard way, because the "easy" ways aren't real any more.
[PS: Please do not actually send the photo, I don't want to get charged as an accessory. Better yet, don't take it, have good opsec, and live to gut another dozen transphobes.]
[[PPS: if this offends you or seems too radical, congratulations, you are the white moderate who terrified Martin Luther King. You are the obstacle.]]
[[[PPPS: No, this isn't me saying transphobes aren't people. Everyone is human and deserves basic common decency. But as they said (paraphrasing) in Tahrir Square, "yes, we're nonviolent, but that didn't mean we're going to just stand her and let them murder us. "]]]

2024-11-17 11:31:22 GMT

- reply

Yeah, largely in that kind of space. Also rigor around what it means to measure something, etc. Like, obviously calculus is useful — if nothing else, not having the conceptual tools of first and second derivatives makes looking at a line on a graph or the area under it less intuitively useful — but I think it's more about the things that you learn along the way.
@npub19jz…fhkq

2024-11-17 10:40:44 GMT

- reply

Hmm. Often, really just basic statistical numeracy so they could understand data they seeing in papers, etc. Sometimes, more the ability to reason about what is and isn't good data for quantitative decision-making — folks really love to make up meaningless numbers to let them avoid qualitative decisions when quant data isn't there. Sometimes data analysis to understand things like perf impact from log data for edge cases. So in some ways, not really statistics itself, but all things that I find that folks who made it through at least one real stats course are likely to be better at, if that makes sense?
@npub19jz…fhkq

2024-11-16 21:13:50 GMT

- reply

I work in tech, not physics or more classical engineering, but I can say that the number of times I've wished staff knew calculus when they didn't? Zero in twenty years. The number of times I've wished they knew basic statistics when they didn't? At least once a month, for twenty years.
@npub19jz…fhkq

2024-11-15 14:21:35 GMT

The RNA technology that was used to develop most of the covid vaccines is driving an absolute revolution in medicine right now. A vaccine for malaria, the disease that has killed more people than anything else in history. Personalized vaccines for cancers — the list goes on and we're just getting started. Much of this development is locked up in commercial pharma companies — there are papers, of course but replicating them in practice, let alone continuing development, is very hard without active access to the team involved. It's also very expensive. A lot of that development money comes from the US government. Now, yes it's a problem that that funding is going to private companies that are ransoming patients for their life savings in exchange for life-saving medicine, but this is as much a regulatory problem as it is a structural one. As long as those teams exist, the possibilities of these tools exist also.
Having an American government that wants to actively dismantle vaccine-related research and eliminate its funding is an existential threat to humanity:
https://mas.to/@Fitnessfoundry/113484127007301813

2024-11-03 17:48:35 GMT

- reply

Ngl, the act is a little sad here.

2024-10-17 07:10:42 GMT

Despite everything else, this is the most terrifying news I've read in months. It is I suppose inevitable that we're seeing a return to fascism and large scale war as climate impacts start to stack up, but the distraction from our efforts at decarbonization will prove fatal to human civilization within the lifetimes of folks already born: https://www.motherjones.com/environment/2024/10/scientists-alarmed-collapse-natural-carbon-sinks/

2024-10-16 13:10:43 GMT

- reply

It's phishable. U2f and passkeys authenticate the site before they'll log the user in. U2F and hardware tokens are a much better answer than trying to build it into the OS, but adoption has been hard. Allowing sealed export to a hardware token would at least help the lock-in problem, though.
@npub1x0p…wlp9 @npub1nnv…schu

2024-10-09 20:43:53 GMT

- reply

I love this! The work of course, but also the frame and the name. I hope it works!

2024-10-04 10:41:14 GMT

If only Finnish cities could look at the history of the impact of surveillance cameras on crime rates: https://yle.fi/a/74-20115922
Hint: it's zero. They do nothing. What does help is structuring your society so everyone in it can afford to live, wondering Finland could consider getting back to.

2024-10-04 07:56:39 GMT

It really sucks to be in a world where you have to choose between two vendors for the tools you must use to access most of your life, both of which have clearly stated they are actively working against both your best interests and the best interests of society. Of course, there's an alternative — various third parties, many of which are actively malicious and none of which are remotely reasonable choices when it comes to security, feature parity, or anything else.
Today this is about browsers, but the fact that I have to specify is its own problem.