yawnbox :softboy_pride:🔜40C3

i'm passionate about ethics and the internet

neuroqueer :autism: 🏳️‍🌈 dutch immigrant 🇪🇺🇳🇱

founder, director AS 396507 (npub1xsw…yq8t)
founder, director disobey discotheque (npub1zve…c7f4)
attack surface management at Swift
photojournalist for Disobey Press (npub12p9…4r6c) and #WikiPortraits

infosec blogger, student of EU data protection law, electric sailor, raver, vegan, sober, shy, direct; allergic to abuse, aggression, unkindness, and fascism

he/they :gaysparkles:
flags :softboy_pride: :demisexual_flag: :gay_man_flag: :flag_gay_pirate:
distros :bazzite: :debian: :macos:
make love not war ✌🏻
black lives matter ✊🏻
trans rights are human rights 🏳️‍⚧️
white, anti-whiteness

Blog: https://yawn.net
Fedi Activism: https://disobey.net
Privacy Activism: https://emeraldonion.org
Queer Activism: https://gay.amsterdam/@christopher

Public Key

npub1hu0ujc4n4xeg3k9p3575rn46ltppfvkd2g5vk7zy7exa6hf2cwvsuevz3q

NIP-05 Address

[email protected]

Profile Code

nprofile1qqst787fv2e6nv5gmzsc602pe6a04ss5ktx4y2xt0pz0vnwat54v8xgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntzwr4xa

Publishing to

relay.momostr.pink

Author Public Key

npub1hu0ujc4n4xeg3k9p3575rn46ltppfvkd2g5vk7zy7exa6hf2cwvsuevz3q

Show more details

Published at

2026-11-02T01:25:17Z

Kind type

0 Metadata

Event JSON

{ "id": "e264948f810bd81567c4b4cdc7f911e2b42fbf787bb3894eef28ff2782859eed", "pubkey": "bf1fc962b3a9b288d8a18d3d41cebafac214b2cd5228cb7844f64ddd5d2ac399", "created_at": 1793582717, "kind": 0, "tags": [ [ "emoji", "autism", "https://disobey.net/system/custom_emojis/images/000/181/990/original/93c71cae4c774276.png" ], [ "emoji", "gaysparkles", "https://disobey.net/system/custom_emojis/images/000/181/032/original/78dc90591bddfce1.png" ], [ "emoji", "softboy_pride", "https://disobey.net/system/custom_emojis/images/000/395/829/original/06e6098712d291c0.png" ], [ "emoji", "demisexual_flag", "https://disobey.net/system/custom_emojis/images/000/181/699/original/54133162b99e55f0.png" ], [ "emoji", "gay_man_flag", "https://disobey.net/system/custom_emojis/images/000/181/731/original/0b027d65bd06e113.png" ], [ "emoji", "flag_gay_pirate", "https://disobey.net/system/custom_emojis/images/000/237/855/original/4f25bcfc1064bcbf.png" ], [ "emoji", "bazzite", "https://disobey.net/system/custom_emojis/images/000/399/329/original/084bb62bbc00f927.png" ], [ "emoji", "debian", "https://disobey.net/system/custom_emojis/images/000/399/654/original/cccb7a978a2fc0b3.png" ], [ "emoji", "macos", "https://disobey.net/system/custom_emojis/images/000/399/331/original/dcd4da9b8557de3b.png" ], [ "t", "wikiportraits" ], [ "proxy", "https://disobey.net/users/yawnbox", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://disobey.net/users/yawnbox", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"yawnbox :softboy_pride:🔜40C3\",\"about\":\"i'm passionate about ethics and the internet\\n\\nneuroqueer :autism: 🏳️‍🌈 dutch immigrant 🇪🇺🇳🇱\\n\\nfounder, director nostr:npub1xswcgn9zpl0fzdljy8nq87m0yuwtqfk4nrxj3ckgsvyz9aea0htscmyq8t\\nfounder, director nostr:npub1zve37ls5a6wcmarfx37x3cr363j9vj0xh4pjv7d5tlnzm953xsus3fc7f4\\nattack surface management at Swift\\nphotojournalist for nostr:npub12p9fd7gm3wngxqc503yzw3jkhmkthtck53z3agj5mkeeza2fw9as4p4r6c and #WikiPortraits\\n\\ninfosec blogger, student of EU data protection law, electric sailor, raver, vegan, sober, shy, direct; allergic to abuse, aggression, unkindness, and fascism \\n\\nhe/they :gaysparkles: \\nflags :softboy_pride: :demisexual_flag: :gay_man_flag: :flag_gay_pirate: \\ndistros :bazzite: :debian: :macos:\\nmake love not war ✌🏻\\nblack lives matter ✊🏻\\ntrans rights are human rights 🏳️‍⚧️\\nwhite, anti-whiteness\\n\\nBlog: https://yawn.net\\nFedi Activism: https://disobey.net\\nPrivacy Activism: https://emeraldonion.org\\nQueer Activism: https://gay.amsterdam/@christopher\\n\",\"website\":\"https://disobey.net/@yawnbox\",\"picture\":\"https://disobey.net/system/accounts/avatars/109/343/748/640/765/511/original/0e38f39e21ede452.jpeg\",\"banner\":\"https://disobey.net/system/accounts/headers/109/343/748/640/765/511/original/cea210d16f4d6067.jpeg\",\"nip05\":\"[email protected]\"}", "sig": "58848d2fd5049cda864a60fbd8cab796bd13c2a1ea742e5ebfa47e7b28164c963faaf8237700c269bc18027bc750535206a622d05c52f3377aea21d322a7eb8b" }

Last Notes

2026-10-13 15:02:39 GMT

"The A19 chip in the new Apple TV 4K delivers [Memory Tagging Extension]"
Apple is giving MTE to smart watches and now home entertainment systems, at the same time as Google removing MTE from its flagship cell phone
@npub14vu…9wlz
https://www.apple.com/newsroom/2026/10/apple-unveils-the-new-apple-tv-4k/

2026-10-04 08:32:05 GMT

"Scientists have discovered a distinct change in the brains of people with long COVID that might explain some of the illness's most debilitating symptoms.
The dopamine neurons of some patients could be damaged or burned out.
That is still an early hunch, but a preliminary study in Canada of 24 people with long COVID found distinct changes in some brain regions, compared to healthy participants of the same age.
The worse the symptoms of memory decline, slow physical movements, and a lack of motivation, the greater the differences measured in dopamine nerve endings."
#LongCovid
https://www.sciencealert.com/brain-scans-of-24-people-with-long-covid-reveal-signs-of-injury-to-dopamine-neurons

2026-09-21 07:19:30 GMT

"Can the EU protect kids from the dangers of social media?"
this terrible phrasing, framing "social media" as if some unknowable thing where abusers are designing these systems, has helped me form an even stronger opinion about how wrong age surveillance and age censorship is
we need to criminalize executive leadership that leads to quantitative, social harms
stop punishing society for abuser's behavior

2026-09-17 15:50:52 GMT

RE: https://disobey.net/@yawnbox/117268148875371807
this means that high risk individuals can have confidence wearing a smart watch
lockdown mode (LDM) being enabled on a users phone had already automatically enabled LDM on the paired watch, but this is either critical layered security, or a vastly superior default or when stubborn at risk folks do not enable LDM and want a smart watch
#note1yxm…djg4

2026-09-14 07:12:27 GMT

- reply

i've confirmed with Apple Security that the new Series 12 Watch, with its A20-derived S11 SoC, does have hardware-backed MTE, SPTM/TXM and Exclaves
a smart watch with MTE at the same time Google pulled MTE from their Pixel 11

2026-09-10 12:29:35 GMT

:retootOk: in December 2025, at the Tor Operators meetup at #39C3, @npub1z66…55h8 and I presented about @npub1xsw…yq8t's work on specific Tor relay security improvements
Blog post: https://emeraldonion.org/blog/evolving-our-tor-relay-security-architecture/
We had hoped to raise (only) $5,000 via direct donations and possible grants in order to buy slightly newer AMD Epyc server to attempt to proof of concept. Sadly we only raised roughly $1,000
with #40C3 right around the corner, it would be really cool if we could find a hardware donation or financial grant to get something installed in our Fremont California datacenter soon ASAP! this way we can present new research for the betterment of the Tor network, online privacy, and anti-censorship tech

2026-09-01 21:18:25 GMT

thank you all for contacting me in various ways asking about delta.disobey.net
i'm very sorry about the temporary downtime. i've migrated the data into a new host, now docker, just waiting for outbound mail ports to be opened, then i can reconfigure dns and validate
please use the opportunity to setup a secondary relay on your client 💛
#deltachat #chatmail #censorshipresistance

2026-07-31 10:35:46 GMT

RE: https://ec.social-network.europa.eu/@HennaVirkkunen/117008348161347403
Dear Henna, can we put 30B into solar panels and sodium-ion batteries instead, please?
I know I'm no one, just a Dutch immigrant who wants to improve my life and the lives of other Europeans.
This is really, really detached from reality. Right now Spain and France are burning. Heatwave after heatwave, records being broken every month across Europe. We have critical energy supply issues even here in the Netherlands. and you want to invest in things that burn more energy? that burn more fossil fuels? that take and intoxify huge amounts of water?
We need to stop burning fossil fuels. We need to stop using energy on abusive technology. We need to be investing in actual, free energy from the sun. Please stop this American shit.
#note1xsh…rd5c

2026-07-23 17:04:58 GMT

- reply

ah, the interesting point to me is about special category data that is manifestly made public by posting about one's ADHD status on a public forum, in effect protecting admins who are controllers of said data, that may be perceived to be retaining and disseminating special category data of users who complain

2026-07-23 16:55:04 GMT

- reply

i certainly agree! in no small part because it's a DPA judgement not a court judgement, and certainly not an EU wide judgement. just very interesting to see such a close parity to the fediverse / public forum posts
the facts around WhatsApp messages seemed to have no bearing on the outcome too though. it was centered on merit of what information the complainant had already published on a fourm
edit: i don't think i implied anything about users (account holders) as being controllers

2026-07-23 16:13:15 GMT

interesting judgement regarding GDPR, and I agree. applies to the #fediverse i believe, and may protect fediverse admins
# Facts
"A data subject published a post concerning their ADHD diagnosis on a publicly accessible online forum under a pseudonym. A person (the controller) who was a follower of the data subject and had previously been in personal contact with them, knew that the pseudonym belonged to the data subject.
The controller subsequently sent a WhatsApp message to a mutual acquaintance stating that the data subject had received an ADHD diagnosis and included a link to the forum post.
The data subject lodged a complaint with the Austrian DPA (DSB), arguing that their health data had been disclosed to a third party. They alleged that the controller by forwarding the pseudonymous forum profile, had unequivocally linked it to their real identity."
# Holding
"The [Data Protection Authority (in Austria)] held that the data subject was identifiable to the controller as regards the publication of the forum post under her profile name. Since the post also included information concerning her gender, age and diagnosis, it concluded that it constituted her personal data under Article 4(1) GDPR.
The DPA further held that the prohibition on processing special categories of personal data under Article 9(1) GDPR did not apply because the data subject had manifestly made their health data public within the meaning of Article 9(2)(e) GDPR. It reasoned that actively disclosing the ADHD diagnosis in a publicly accessible forum constituted an unambiguous and conscious act by which the data subject made the information available to the public.
The DPA therefore dismissed the complaint as unfounded."
https://gdprhub.eu/index.php?title=DSB_(Austria)_-_2025-0.968.031
#mastoadmin #lawfedi #gdpr

2026-07-18 01:32:49 GMT

some random #emfcamp ^_^
https://disobey.net/system/media_attachments/files/116/938/398/258/068/813/original/ebf6a7acca03d8bb.jpeg
https://disobey.net/system/media_attachments/files/116/938/398/856/044/843/original/45ec6c8cf43c12a3.jpeg
https://disobey.net/system/media_attachments/files/116/938/399/125/754/378/original/4f47e5c80619f272.jpeg

2026-07-13 20:31:16 GMT

i've finished my draft analysis in my new blog post, "United States v. Peter Stokes, Microsoft Windows surveillance via GDID"
https://yawnbox.eu/blog/microsoft-gdid-surveillance/
# TL;DR
1. Microsoft (NSA) conducts dragnet surveillance on all Windows 10 and Windows 11 systems worldwide by default.
2. Microsoft's (NSA's) dragnet surveillance tracks Edge browser identifiers and Global Device Identifiers.
3. Microsoft's (NSA's) dragnet surveillance somehow captures full URL data even when a device uses a VPN, which is likely exfiltrated from everyone's "personal computer" via malicious software called Edge browser and Defender SmartScreen.

2026-06-15 11:01:59 GMT

- reply

Xi Jinping and Vladimir Putin looking at UK news today and
https://disobey.net/system/media_attachments/files/116/753/780/660/525/067/original/dfb573e863cb0af0.mp4

2026-06-15 10:58:14 GMT

- reply

UK, man, really on a roll today
"Britain’s Court of Appeal has ruled that the government’s proscription of the activist group Palestine Action as a “terrorist” organisation was lawful.
The ruling on Monday came after the government lodged an appeal challenging a High Court ruling in February that banning the group under the Terrorism Act 2000 was unlawful and disproportionate."
https://www.aljazeera.com/news/2026/6/15/uk-court-says-proscribing-palestine-action-as-terrorist-group-was-lawful

2026-06-15 08:12:41 GMT

i feel so sorry for queer kids who will spend even more of their lives not being able to make connections with people like them
the earliest years of development, delayed. do you know that the longer it takes for people to find out who they are, it causes irreparable stress and feelings of insecurity?
shame on these fragile men of privilege who are too afraid to hold the abuse of big tech accountable and instead remove human rights from the most vulnerable
https://disobey.net/system/media_attachments/files/116/753/115/253/285/595/original/43efc6178d16cd78.png

2026-04-23 15:18:44 GMT

can you recommend any public Trust & Safety (moderation, etc) policies for any fediverse instances?
i ask specifically for Pixelfed hosted in the EU/NL, but any example would be useful
i'm aware of @npub1y2r…kvzk resources but i'm looking for an actual public policy

2026-04-11 09:33:19 GMT

RE: https://mastodon.social/@Mohammedjhad/116385355845300775
.@npub122z…s4xy is a verified person via @npub1d6t…vdlg thanks to @npub1nv8…za59 and @npub1p09…m5vl - journalism is a critical function anywhere but especially in #Palestine - please donate to support his work
#note18y7…wtpl

2026-04-09 08:59:14 GMT

- reply

and [@PixelfedGlitch](https://hachyderm.io/@PixelfedGlitch ) is not keeping up to date
has anyone forked Pixelfed in a way that there is real community development? #pixelfed

2026-04-09 08:32:36 GMT

deeply honest question for #pixelfed admins or wannabe admins - how many of you actually get a fully functional instance working? how on earth have you managed to do so?

2026-03-17 13:16:51 GMT

hello #infosec fedi
can anyone recommend any learning resources - red/purple/blue team focused - concerning reverse shells and getting through forward proxies / secure web gateways?

2026-03-02 18:27:04 GMT

- reply

ARM64 Enhanced Memory Tagging Extension #EMTE exploit mitigation now exists on:
- iPhone 17e, 17, 17 Pro, and Air
- iPad Pro M5
- Macbook Pro M5, Air M5
EMTE is on-by-default, always-on, and no performance hit. Even without Lockdown Mode, this is arguably one of the most secure (internet connected) devices in the world. The 17e priced at 599 US, 719 EUR is kind of incredible.
If you're an at-risk individual, sincerely look at the 17e.
For critical work, such as journalism + sources, legal + clients, politics, activism: you can't beat the iPad Pro M5 Wifi version. I've been maintaining a detailed blog post about the iPad Wifi for years:
https://yawnbox.eu/blog/how-to-use-an-ipad-as-a-secure-calling-and-messaging-device/

2026-02-14 23:33:41 GMT

# Discord's Disturbing Ties to Global Surveillance | ID Verification, Palantir, & Thiel
#discord #surveillance
https://youtu.be/qhxsE8dvbs4

2026-02-07 15:01:23 GMT

tech funding question, on behalf of @npub1xsw…yq8t
@npub1n8y…l96n funded @npub1agn…p4ur and @npub1pst…xzgm (project: https://nlnet.nl/project/Coreboot-Phoenix/) to port @npub18ak…ghef and #OpenSIL to the Gigabyte MZ33-AR1 motherboard
following a talk at @npub1yau…atjv "Open source firmware for high assurance confidential infrastructure" (video: https://video.fosdem.org/2026/ud6215/LKWQL7-open_source_firmware_for_high_assurance_confidential_infrastructure.mp4 (mp4 file)), @npub1z66…55h8 and I are excited to use this exact hardware and firmware combination to test and publish more about our Stateless Relays project (EO blog post: https://blog.emeraldonion.org/evolving-our-tor-relay-security-architecture) instead of using an older/cheaper/more proprietary system, in partnership with @npub1vwv…cqgs and [@0n_odv](https://mastodon.cisti.org/@0n_odv ).
given that, in 2026, building a brand new AMD Epyc 9005 server system (target 64 cores, 12x 16GB, 32GB, or 64GB sticks of DDR5-6400 RDIMM) will run upwards of $25,000 for a single system, we need financial grants to cover the cost for the long-term betterment of the Tor network and any other privacy infrastructure operations.
who might fund this 100% volunteer, 100% donation-based project?
https://disobey.net/system/media_attachments/files/116/029/936/892/565/615/original/4ca5bad09b5483e7.png

2026-01-17 13:46:42 GMT

if you have ever been curious about running a web application firewall (WAF) in front of Mastodon or other fediverse instance, i've published a repo containing the #openappsec policy we're now using, which is also configured to maintain strong privacy protections. i've recently turned on prevent mode, blocking critical events
https://code.disobey.net/dd/ap-waf
there's a lot of skip exceptions needed in order to not block required ActivityPub transactions. even things like changing a password in Mastodon is seen as a critical (false) positive
given the number of skip exclusions, there's a lot of attack surface that admins won't be able to action on since so much of ActivityPub looks malicious, and a targeted attack could easily take advantage of these necessary skip policies
i'm curious if any ActivityPub devs have ever run a WAF in front of their instance, and curious if any improvements can be made to the spec to reduce transactions that look like malicious behavior
i have to trust that for the ActivityPub exclusions, Mastodon properly sanitizes inputs and so the overall risk is still low
either way, this is a big win for overall risk reduction for anyone serious about protecting their community
#MastoAdmin #ActivityPub #Mastodon #OpenAppSec

2026-01-15 20:51:18 GMT

hey #Greenland :nkoWave: now's a good time to stop using US tech, and teach your friends how to use Mastodon and other decentralized tech :meowHuggies:

2026-01-02 12:49:17 GMT

- reply

with consent from @npub13nu…0jwd, I took photos of their non-recorded #39C3 talk "Relationship Anarchy and Technologies of Connection"
https://immich.disobey.net/s/39c3-catileptic
Their talk was based on their essay and blog post, "Relationship Anarchy. Tinkering In the Belly of the Whale (zine)" https://catileptic.tech/posts/relationship-anarchy-technology/
Alex is a dear friend and being present for this talk was incredible. Coming from a default, dominant-culture of monogamy, I really enjoy challenging my own assumptions about relationships and hierarchy, and in a way that is open and welcome to all of the people that matter to me.
the lighting in this room was the most restrictive issue because there were no (or minimal) lights on, only the cloudy daylight from one side of the room coming from the windows. Thankfully the angle gave me some opportunity to get some bokeh on an otherwise boring tan background
Photos taken with the Sony a1ii and the Sony 85mm f/1.4 lens with embedded C2PA authentication
Photos are licensed CC0 - Creative Commons 0 - "No Rights Reserved"
https://disobey.net/system/media_attachments/files/115/825/536/919/150/419/original/6728fe8258e5d822.jpeg

2026-01-02 12:08:18 GMT

- reply

with consent from [@Mer__edith](https://mastodon.world/@Mer__edith ) (on Mastodon) and Udbhav Tiwari (in person), I took photos of them during their #39c3 talk, "AI Agent, AI Spy"
https://immich.disobey.net/s/39c3-meredith-udbhav
this talk was more challenging to photograph because they stood behind the podium the whole time (which is fine!) -- and since taking speaker photographs like this is new to me at a place like CCC, I didn't want to cause commotion or worry by moving around a bunch in front of the talk with a big camera.
Photos taken with the Sony a1ii and the Sony 85mm f/1.4 lens with embedded C2PA authentication. Some of them appear dark because i was playing around with metering modes, which is correctable in the RAW versions.
Photos are licensed CC0 - Creative Commons 0 - "No Rights Reserved"
https://disobey.net/system/media_attachments/files/115/825/407/082/512/527/original/3cced5a72959563c.jpeg

2026-01-02 11:38:15 GMT

- reply

I had a really enjoyable time walking around #39c3 and taking random abstract photos with a macro lens. here are some, and i'm uploading the rest to https://immich.disobey.net/s/39c3-random
my favorite two spots -- which I regret not making more time to photograph -- were the rocket + laser in the front, but also someone's subwoofer with a plate of water on top with hanging LEDs.
the sub + water + light combo was incredible with a macro lens (thanks @npub1c9z…hdq2 for letting my borrow your Sony 100m macro GM!), i only wish i had a tripod to play around with different focal lengths and exposure times. the light and water displacement causes beautifully chaotic scenes
photos are Creative Commons 0 (CC0) public domain
https://disobey.net/system/media_attachments/files/115/825/265/461/976/951/original/97ce0feedf7dbfca.jpeg
https://disobey.net/system/media_attachments/files/115/825/265/894/783/561/original/c0d7d29d2bc2dc93.jpeg
https://disobey.net/system/media_attachments/files/115/825/266/614/311/349/original/312d9e21c37bf090.jpeg
https://disobey.net/system/media_attachments/files/115/825/272/301/830/805/original/9aae198f5fa3545e.jpeg

2025-12-30 01:53:23 GMT

only at #39c3
https://disobey.net/system/media_attachments/files/115/806/017/623/712/585/original/3bbabec45e1b9de5.jpeg
https://disobey.net/system/media_attachments/files/115/806/017/945/193/117/original/655b1f1dcecb3799.jpeg

2025-12-28 15:41:09 GMT

with consent from @npub1fdr…lvhs, I took photos of him during his #39C3 talk, "A post-American, enshittification-resistant internet"
As I find time to finish uploading the photos, all 4,000+ will be here on a @npub1xsw…yq8t self-hosted #Immich server:
https://immich.disobey.net/s/39c3-cory
photos are Creative Commons CC0 “No Rights Reserved” https://creativecommons.org/public-domain/cc0/
photos taken on the Sony a1ii with the Sony 85mm f/1.4 lens
https://disobey.net/system/media_attachments/files/115/797/927/765/717/611/original/8c35295815487fe6.jpeg

2025-12-04 19:30:02 GMT

# Netherlands pulls out of Eurovision as organizer votes to keep Israel in 2026 contest
The Netherlands will not take part in next year's Eurovision Song Contest, with Dutch broadcast rights holder AvroTros deciding to boycott the event. The decision was made after the members of the event organizer, the European Broadcast Union (EBU), voted to allow Israel to remain in the 2026 edition of the competition."
#netherlands #nederland #eurovision #israel #freepalestine
https://nltimes.nl/2025/12/04/netherlands-pulls-eurovision-organizer-votes-keep-israel-2026-contest

2025-11-26 17:25:21 GMT

- reply

"#Exclaves land in MacOS
Nobody is really surprised that the MacOS 26.0.1 firmware image of the about to be released MacBook Pro #M5 reveals that Memory Integrity Enforcement (#MIE) on top of the ARM64 Enhanced Memory Tagging Extension (#EMTE) is used. Extremely surprising is however that Apple is now shipping the Secure Kernel (#SK) and #ExclaveCore / #ExclaveOS with MacOS. This means Apple's newest security boundary #Exclaves has finally arrived in MacOS."
https://www.linkedin.com/posts/stefan-esser-903582240_exclaves-m5-mie-activity-7384980813031043073-EfhS
#MTE #MemorySafety #ExploitMitigation
https://disobey.net/system/media_attachments/files/115/617/152/385/542/479/original/693387695d194769.png

2025-11-18 10:40:26 GMT

today is the 30th anniversary of the Japanese release of the first Ghost in the Shell film
"Ghost in the Shell is a 1995 Japanese animated tech noir cyberpunk action thriller film directed by Mamoru Oshii from a screenplay by Kazunori Itō, based on the 1989 manga by Masamune Shirow."
utmost respect for Atsuko Tanaka, the voice of Motoko Kusanagi, who passed away a little over a year ago on August 20, 2024
GitS is by far one of my personal favorite anime 🫶🏻
#GhostInTheShell #GitS
https://disobey.net/system/media_attachments/files/115/570/295/831/827/093/original/3dcf2d9f963bc574.jpeg

2025-11-02 15:08:23 GMT

- reply

curious about a comparison with Strongbox

2025-10-30 23:49:34 GMT

- reply

#MTE🧵
oh yes another point about synchronous (block mode) MTE
it may never come to web browsers because of JIT
which means that Lockdown Mode is still very important if you want to defend against web browser based attacks (if you browse the web from a "secure" iPad)
or maybe some theoretical iPadOS browser that is javascript-free (?) with the MTE flags enabled, but yeah...

2025-10-30 12:58:16 GMT

anyone in Europe want to trade 12 x 16GB (192GB) DDR4 UDIMM (Samsung M391A2K43BB1) for some number of DDR4 RDIMM? ideally at least 128GB worth
@npub1xsw…yq8t is building a replacement proxmox server in Amsterdam for disobey.net and it needs RDIMM, and RAM prices right now are so terrible 😟
https://disobey.net/system/media_attachments/files/115/463/231/450/892/267/original/32a1e110f22b5844.jpeg

2025-10-28 09:58:45 GMT

- reply

Another important takeaway with Apple’s lead in rolling out superior exploit mitigations on mass-market devices is that 0day attack chains will become harder, more expensive, and for some, impossible. This raises the bar for everyone’s security, even if you don’t use an Apple device, in multiple ways. But the important point here is that the kernel will become hardware to hit, and attacking 3rd-party apps directly, ones that are remotely addressable, will go up, making it even more important for 3rd party apps to be paying attention and to enable MIE/MTE features ASAP.
Once app makers are doing this for one type of device, it will make it easier and cheaper to do it again on another device, once more devices support hardware MTE, and once operating system owners enable block-mode/synchronous-MTE by default

2025-10-28 09:51:58 GMT

- reply

Something I learned recently which is probably not well understood by most within this space:
Arm9 and Arm10 have hardware MTE support. The Google Pixels that have these SoCs support hardware MTE; however, Google has set enabled in their version of Android audit-only mode so that Google can collect more data on MTE violations. This is what Apple calls “asynchronous MTE”.
Apple, in their A19 and M5 SoCs also fully support MTE with MTE offloading capabilities that eliminate the performance hit of enabling “synchronous MTE”, or, block mode MTE. MTE on these devices is always on for many of Apple’s first-party kernel and app layers, and any 3rd-party app that tests, compiles, and ships updated versions of their apps.
GrapheneOS users, the few, can enable block mode on their Arm9 and Arm10 Pixels, with a performance hit.
So one big takeaway here is that Apple is the first major player to enable block-mode MTE on mass-market devices. The second is that we need to put pressure on 3rd-party apps to build their apps with hardware MTE/MIE flags. Third, Google needs to enable block mode MTE, and then Android app need the same redevelopment.

2025-10-28 09:39:19 GMT

Please share with the community (and me) which #decentralized chat apps for iOS/iPadOS have been compiled with hardware MTE for the A19/M5 iPhone/iPad devices 😁

2025-10-27 22:19:29 GMT

- reply

I’ve learned that both WhatsApp and @npub1rkw…5q62 are blocked on MIE/MTE enablement due to audio codec limitations

2025-10-27 10:44:26 GMT

- reply

The tor network has had 100% uptime. 100%

2025-10-23 21:30:34 GMT

- reply

Free to watch on @npub1umd…wfr7
https://archive.org/details/citizenfour-edward-snowden-laura-poitras_202403
#CITIZENFOUR #LauraPoitras #Snowden #EdwardSnowden #privacy #surveillance #NSA #GCHQ #humanrights

2025-10-23 13:25:12 GMT

Apple confirms that the M5 chip in the MacBook Pro and iPad Pro supports Memory Integrity Enforcement (MIE)
MTE specifically is only supported on A19 and newer, including M5
https://disobey.net/system/media_attachments/files/115/423/697/957/396/571/original/6158c4be5e9bbb16.png

2025-10-21 12:55:36 GMT

Apple announced Memory Integrity Enforcement 42 days ago, @npub1rkw…5q62 has not yet announced MIE support for A19 and M5

2025-10-20 08:08:42 GMT

- reply

Open Whisper Systems has a long history of being anti-decentralization
[@Mer__edith](https://mastodon.world/@Mer__edith )

2025-10-07 15:09:49 GMT

I’m at #FediForum in #Rotterdam at @npub159r…xrh2 with @npub1drf…fpxa and @npub1zle…j2yy and other friends!

2025-09-19 17:45:33 GMT

i hope [@techlore](https://social.lol/@techlore ) or @npub12w6…2axu talks about Apple's new MIE (A19) to help spread the word about it.
journalists, activists, politicians, lawyers all need to better understand the value of exploit mitigations, especially ones that significantly reduce successful attack chains by mercenary spyware companies. if you had to choose between MIE or Lockdown Mode, you want MIE
also, MIE significantly helps Apple determine attempted attacks made against iPhones, leading to faster notifications if your're a victim of mercenary spyware

2025-09-14 15:30:53 GMT

a #ChatControl update (shared on the ISOC "Global Encryption Coalition" mailing list):
"The good news is that the blocking minority held. Members states raised concerns about privacy and cybersecurity as reasons for their opposition. Even countries that are officially in support of the proposal asked questions along these lines for the first time – showing that they are facing increased pressure back home.
The bad news is that #Denmark is moving forward even though they did not receive full support. They are keeping their plan to take this proposal to the Justice and Home Affairs Council meeting on October 14th.
After discussing with partners, we understand this as a strategy from Denmark. They are not making progress at the working level (the meeting today) and therefore will try directly at the political level (justice and home affairs). During these coming four weeks they will try to convince some of the blocking member states to reconsider their position.
What this means for us is that we need to keep up the pressure. We should be thanking the blocking countries for their position and encouraging the undecided or supportive countries to reconsider. We should keep up pressure in the media at the same time."

2025-08-22 13:08:02 GMT

my favorite open source software, as of August 2025
- VLC
- @npub1lxt…4044
- Transmission
- @npub1vwv…cqgs
- @npub1r62…wl6t
- @npub1hxz…r8sj
- @npub1f5q…vss4
- @npub16s6…2ny3
- @npub1rkw…5q62
- Strongbox
- Wireguard
- VScodium
- @npub163h…mv0n
- @npub1zq8…44y6
- Pi-hole
- @npub1t2q…n4vh
- Proxmox
- @npub1tgg…qwzh
- @npub1vpu…608s
- Immich

2025-08-21 13:51:37 GMT

- reply

after years of denial, glad to see it...

2025-08-10 23:29:13 GMT

#why2025
https://disobey.net/system/media_attachments/files/115/007/065/225/475/887/original/b8382d4b57f3e742.jpeg

2025-08-05 09:45:26 GMT

- reply

i think about this a lot and also refuse to CW posts about genocide in Palestine, i don't know what to CW with since "pspol" doesn't exist according to the important white countries

2025-08-01 12:18:53 GMT

holy shit
"The Business Court in Brussels, Belgium, has issued an unprecedentedly broad site-blocking order that aims to restrict access to shadow libraries including Anna's Archive, Libgen, OceanofPDF, Z-Library, and the Internet Archive's Open Library. In addition to ISP blocks, the order also directs search engines, DNS resolvers, advertisers, domain name services, CDNs and hosting companies to take action. "
#lawfedi
https://torrentfreak.com/belgium-bans-internet-archives-open-library-in-sweeping-site-blocking-order/

2025-04-18 06:58:37 GMT

abusive tech companies ("🤠") are drooling ("🤤") for generative AI and agentic AI ("👻") because:
1. 🤠 have decades of data about you already, 👻 is continued ROI
2. your attention and engagement via conversation with 👻 extracts new data types, even more data about you, and even more data about the people you talk about
3. engagement on behalf of 🤠 via 👻 is with impunity
4. your dependence on 👻 will mean unlimited, persistent access into your life and mind no different than the dependency you have on your cell phone being in your pocket and within arm's reach 24/7
5. 👻 will replace your friends in different ways. you will trust 👻 more and more as the tech improves
6. 👻 will learn how you work in way more nuanced detail than most people ever will. It will know how to most effectively talk to you, inform you, and control you
7. when 👻 becomes "on-device" in order to sway more users into trusting it, updates from the cloud will continue to allow 🤠 to collect data about your life and interact with you in ways that you trust and will most effectively sway your judgement
8. 👻 is trained to be extremely confident which makes them exceptional social engineers. 🤠 don't have to hire people to do this anymore

2025-04-10 10:37:12 GMT

- reply

i am surprised that infosec leaders are still going to hold conferences in Las Vegas

2025-04-07 09:20:22 GMT

I want to thank @npub14vu…9wlz and some other recent @npub13sl…t3va donors who donated a total of $780, enough to cover the cost of a new SiFive HiFive Premier P550 RISC-V dev board that we will use exclusively as a unfiltered Tor exit relay for hardware and OS diversity
Arrow.com, the only seller of the SiFive HiFive, is charging a $196 tariff + sales tax even though the boards they have in stock have already been in stock for months, raising the cost of the board substantially
I also want to thank @npub13xm…232t who's not only donated a chassis for the SiFive HiFive, but is racking and stacking our gear we've moved from Seattle to San Francisco ^_^

2025-04-04 19:18:00 GMT

- reply

" Call to Action
Silence is complicity. But action always has a reaction, no matter how big or small. As workers for this company, we must make our voices heard, and demand that Microsoft does the right thing: stop selling technology to the Israeli military.
If you are also concerned about this news, and you also want your work to be used ethically, I urge you to take action:
Sign the No Azure for Apartheid petition: We will not write code that kills. And join the campaign to add your voice to the growing number of concerned Microsoft employees.
Join me in showing our discontent in this thread. If you also feel tricked into deploying weapons which target children and civilians, urge leadership (CC’ed) to drop these contracts.
Don’t stop speaking up. Urge SLT to drop these contracts at every opportunity.
Start conversations with your co-workers about the points above - so many employees may not know!
Microsoft’s human rights statement prohibits retaliation against anyone who raises a human rights-related concern: Human rights statement | Microsoft CSR
Our company has precedents in supporting human rights, including divestment from apartheid South Africa and dropping contracts with AnyVision (Israeli facial recognition startup), after Microsoft employee and community protests. My hope is that our collective voices will motivate our AI leaders to do the same, and correct Microsoft’s actions regarding these human rights violations, to avoid a stained legacy. Microsoft Cloud and AI should stop being the bombs and bullets of the 21st century.
Sincerely,
A concerned Microsoft employee"
🧵 3/3
Source: https://www.theverge.com/news/643670/microsoft-employee-protest-50th-annivesary-ai

2025-04-04 19:17:37 GMT

- reply

" We are Complicit
When I moved to AI Platform, I was excited to contribute to cutting-edge AI technology and its applications for the good of humanity: accessibility products, translation services, and tools to “empower every human and organization to achieve more.” I was not informed that Microsoft would sell my work to the Israeli military and government, with the purpose of spying on and murdering journalists, doctors, aid workers, and entire civilian families. If I knew my work on transcription scenarios would help spy on and transcribe phone calls to better target Palestinians (source), I would not have joined this organization and contributed to genocide. I did not sign up to write code that violates human rights.
According to AP news, there is “a $133 million contract between Microsoft and Israel’s Ministry of Defense.”
“The Israeli military’s usage of Microsoft and OpenAI artificial intelligence spiked last March to nearly 200 times higher than before the week leading up to the Oct. 7 attack. The amount of data it stored on Microsoft servers doubled between that time and July 2024 to more than 13.6 petabytes.”
“The Israeli military uses Microsoft Azure to compile information gathered through mass surveillance, which it transcribes and translates, including phone calls, texts and audio messages, according to an Israeli intelligence officer who works with the systems. That data can then be cross-checked with Israel’s in-house targeting systems.”
Microsoft AI also powers the most “sensitive and highly classified projects” for the Israeli military, including its “target bank” and the Palestinian population registry. Microsoft cloud and AI enabled the Israeli military to be more lethal and destructive in Gaza than they otherwise could.
Microsoft has also been providing software, cloud services, and consulting services to the Israeli military and government, totaling millions in profit. War Criminal Benjamin Netanyahu has explicitly mentioned his strong ties to Microsoft. A list of these contracts with the Israeli military and government can be found here: An Introduction to Microsoft’s Complicity in Apartheid and Genocide
In fact, Microsoft is so deeply connected to the Israeli military that it was just yesterday designated one of the priority boycott targets of the BDS (Boycott, Divest, Sanctions) campaign.
Regardless of your political stances, is this the legacy we want to leave behind? Is working on deadly AI weapons something you can tell your children about? Do we want to be on the wrong side of history?
Even though your work could be unrelated to the cloud that the military uses, your work benefits the company and allows it to take on the contract. Regardless of your team, you serve a company that is arming the Israeli occupation. It is undeniable that part of your compensation, no matter how small, is being paid by genocide.
Whether you work on AI or not, you will be complicit if you do nothing. It is now OUR job to take a vocal stand against Microsoft AI’s involvement in crimes against humanity.
This is why I decided to speak up today, and why I signed this important petition to demand Microsoft cut ties with genocide. And I urge you all to do the same."
🧵 2/3
Source: https://www.theverge.com/news/643670/microsoft-employee-protest-50th-annivesary-ai

2025-04-04 19:17:07 GMT

" Hi all,
As you might have just seen on the livestream or witnessed in person, I disrupted the speech of Microsoft AI CEO Mustafa Suleyman during the highly-anticipated 50th anniversary celebration. Here’s why.
My name is Ibtihal, and for the past 3.5 years, I’ve been a software engineer on Microsoft’s AI Platform org. I spoke up today because after learning that my org was powering the genocide of my people in Palestine, I saw no other moral choice. This is especially true when I’ve witnessed how Microsoft has tried to quell and suppress any dissent from my coworkers who tried to raise this issue. For the past year and a half, our Arab, Palestinian, and Muslim community at Microsoft has been silenced, intimidated, harassed, and doxxed, with impunity from Microsoft. Attempts at speaking up at best fell on deaf ears, and at worst, led to the firing of two employees for simply holding a vigil. There was simply no other way to make our voices heard.
We are witnessing a genocide
For the past 1.5 years, I’ve witnessed the ongoing genocide of the Palestinian people by Israel. I’ve seen unspeakable suffering amidst Israel’s mass human rights violations - indiscriminate carpet bombings, the targeting of hospitals and schools, and the continuation of an apartheid state - all of which have been condemned globally by the UN, ICC, and ICJ, and numerous human rights organizations. The images of innocent children covered in ash and blood, the wails of mourning parents, and the destruction of entire families and communities have forever fractured me.
At the time of writing, Israel has resumed its full-scale genocide in Gaza, which has so far killed by some estimates over 300,000 Gazans in the past 1.5 year alone. Just days ago, it was revealed that Israel killed fifteen paramedics and rescue workers in Gaza, executing them “one by one,” before burying them in the sand -- yet another horrific war crime. All the while, our “responsible” AI work powers this surveillance and murder. The United Nations and the International Court of Justice have concluded that this is a genocide, with the International Criminal Court issuing arrest warrants for Israeli leaders."
🧵 1/3
Source: https://www.theverge.com/news/643670/microsoft-employee-protest-50th-annivesary-ai

2025-03-28 13:08:54 GMT

this is a fantastic interview
"Palestine Talks: In Conversation with Josie Guilbeau" (ex-US Army ex-NSA)
https://youtu.be/iJA8zNOjCDg

2025-03-25 20:44:22 GMT

- reply

but is the auditing better haha
(re https://en.wikipedia.org/wiki/XZ_Utils_backdoor)

2025-03-23 12:56:03 GMT

i think that everyone needs to read this
"As Fraenkel explained it, a lawless dictatorship does not arise simply by snuffing out the ordinary legal system of rules, procedures, and precedents. To the contrary, that system—which he called the “normative state”—remains in place while dictatorial power spreads across society. What happens, Fraenkel explained, is insidious. Rather than completely eliminating the normative state, the Nazi regime slowly created a parallel zone in which “unlimited arbitrariness and violence unchecked by any legal guarantees” reigned freely. In this domain, which Fraenkel called the “prerogative state,” ordinary law didn’t apply. (A prerogative power is one that allows a person such as a monarch to act without regard to the laws on the books; theorists from John Locke onward have offered various formulations of the idea.) In this prerogative state, judges and other legal actors deferred to the racist hierarchies and ruthless expediencies of the Nazi regime."
https://www.theatlantic.com/magazine/archive/2025/05/trump-executive-order-lawlessness-constitutional-crisis/682112/

2025-02-15 13:31:53 GMT

ASML in the Netherlands is hiring several #infosec roles
#GetFediHired
Expert Security Analyst – Security Incident Response Team
https://www.asml.com/en/careers/find-your-job/expert-security-analyst--security-incident-response-team-j00307486?ppc=EML-7
IT Security Risk Specialist
https://www.asml.com/en/careers/find-your-job/it-security-risk-specialist-j00314298?ppc=EML-7
Cybersecurity Assurance Officer
https://www.asml.com/en/careers/find-your-job/cybersecurity-assurance-officer-j00311921?ppc=EML-7

2025-02-10 18:22:40 GMT

lesigh. should i be concerned?
i currently do not trust Apple given the UK's order to change Advanced Data Protection and other client-managed keys
https://disobey.net/system/media_attachments/files/113/980/981/701/078/282/original/413017ba13839046.png

2025-02-10 11:19:01 GMT

in these dangerous times, it's important to reevaluate your online habits
for example: the surveillance systems baked into the WWW are a disaster. using Tor Browser can really help
how?
yes, Tor Browser has issues accessing many websites online. but what you can do to help this situation is to find the ones that do not block Tor and to use those ones in TB
one of the biggest sources of my WWW-surveillance risk comes from reading the news. news sites are notorious for surveillance
i don't want governments and blackbox algorithms knowing what i read, and from there, controlling content to me or from me in ways i'll never know
my biggest source of news is from the fediverse. so, what i do is i log into Mastodon etc in Tor Browser. this way the links that i click from fedi open in TB
this is safety by default. if a news site doesn't load in TB, i can easily copy the link into https://archive.is/, also opened (and pinned) in TB
archive.is has a captcha but once you move past it, it's worth it. if archive.is doesn't have the article you need, you can have them get it for you. reading it here will make the page much more responsive and readable since they strip out javascript any other heavy stuff you don't need or what to read an article
i'm happy to help coach people about any of this. if you're new to Tor, don't hesitate to reach out

2025-01-26 09:48:06 GMT

"The Trump White House has told three Democratic-selected members of the Privacy and Civil Liberties Oversight Board to resign or be fired, which would stop the independent agency from functioning.
The Trump White House is moving to paralyze a bipartisan and independent watchdog agency that investigates national security activities that can intrude upon individual rights."
https://archive.ph/gIfSw#selection-4539.0-4539.196

2025-01-26 08:54:09 GMT

- reply

i also don't understand why he'd stop going after the third component of the "cure" and get tested instead.
he knew that becoming world famous if he became S would result in constant surveillance. surely it would be easier to complete that task under the radar as he's always been successful at doing.
and yeah then still pretends to be E to attempt to steal an A boss? 🤨 wtf

2025-01-22 16:23:37 GMT

only privileged nerds make the claim that Matrix or XMPP is a replacement for Signal
get the fuck out of people's replies who are trying to help non-technical, vulnerable people learn about Signal

2025-01-22 16:08:39 GMT

- reply

sorry, apps aren't e2ee unless the e2ee is on-by-default
matrix is not e2ee

2024-12-27 12:22:17 GMT

- reply

uwu #38c3
https://disobey.net/system/media_attachments/files/113/724/759/566/444/193/original/978b5972fad98a18.jpg

2024-12-27 12:20:12 GMT

- reply

Upstairs directly above the entrance, sharing some stickers! CO2 not great
#38C3 #38c3novid
https://disobey.net/system/media_attachments/files/113/724/750/438/824/369/original/5c99fa23ba3840e2.jpg

2024-12-27 11:49:22 GMT

- reply

At #VeganChaos, Saal 6 @npub1z7h…tpgs
#38C3 #38c3novid
https://disobey.net/system/media_attachments/files/113/724/630/240/334/543/original/f2022eeb5e9ef66c.jpg

2024-12-27 10:29:11 GMT

- reply

Tea Hut @npub1t0k…uqf5 CO2 reading is slowly crawling up
#38C3 #38c3novid
https://disobey.net/system/media_attachments/files/113/724/306/386/024/222/original/fe928f0d0681db90.jpg

2024-12-27 10:05:52 GMT

Good morning #38C3, #38c3novid reading upstairs by Saal Z
https://disobey.net/system/media_attachments/files/113/724/220/128/894/398/original/e035ff8856f35190.jpg

2024-12-15 19:23:54 GMT

Have you ever thought about the privacy and security implications of Starlink satellites and cell phones? You're in luck, I've written a new blog post:
"Threat modeling Starlink satellite cellular risks"
https://yawnbox.is/blog/threat-modeling-starlink-satellite-cellular-risks/

2024-11-28 16:54:40 GMT

#MastoAdmins's can easily help the #Tor network by installing the Tor daemon on the linux server and configuring their web server to be a #WebTunnel bridge
disobey.net does it (https://metrics.torproject.org/rs.html#details/7E12D6CACBA1051FD23A48482E091257CD4701BC), you can too!
https://www.bleepingcomputer.com/news/security/tor-needs-200-new-webtunnel-bridges-to-fight-censorship/
"Hiding in plain sight: Introducing WebTunnel"
https://blog.torproject.org/introducing-webtunnel-evading-censorship-by-hiding-in-plain-sight/

2024-11-21 13:29:41 GMT

- reply

Also, we are looking for an #Internet #lawyer based in #Chile to help us understand the legal landscape for running #Tor exit relays there.
#LawFedi

2024-11-21 13:04:55 GMT

Can you recommend any possible community data center colocation in #Santiago #Chile?
#DataCenter #colocation #server #hosting

2024-11-20 12:45:03 GMT

Hello kind readers!
I'm in desperate need of a job and need your help connecting with hiring managers. I'm looking for the following (or related) roles:
1. technical program manager
2. security engineer/analyst
3. network security engineer/analyst
4. privacy engineer/analyst
5. SOC/NOC engineer/analyst
6. data center technician manager/engineer
CV: https://[yawnbox.is]/docs/cv-priv.pdf
I live in The Hague (NL) and i'm from Seattle (WA, USA). Remote jobs will allow my partner and I to continue to exist in NL. Freelance jobs in NL are also great. I would need work visa sponsorship anywhere outside of USA. I would relocate anywhere for a great job.
Things are desperate for us. Please help.
#GetFediHired #infosec #cybersecurity #Netherlands #Seattle

2024-11-20 03:10:19 GMT

- reply

active noise cancellation (anc) is lacking compared to real hearing protection, which you'll find with construction site or gun range ear muffs. and those are cheaper. but bulky and ugly.
that being said, the Sony XM series are the cheapest and best for what we've used for years... not for high quality feels or audio but they work. i prefer the Apple Airpods Max.
stacking cheap ear plugs under anc headphones is also a thing depending on the person/environment

2024-11-15 13:04:53 GMT

it's clear now, 5 months applying for IT and security jobs in the Netherlands, that it's exceptionally difficult to get even interviews if i don't have a work visa
this is a good example of a rejection email that i got today that is slightly more verbose than what i usually get:
"When selecting candidates, we do not only look at education, skills, motivation and recent work experience, but also practical aspects like distance, language skills and general fit. In this case, we were able to make a selection of applicants whom we have invited for interviews. Unfortunately, and despite your qualities and previous experience, you did not make the short list for this position. We decided to interview a few candidates who fit the ideal profile better based on their CV."
so, for those of you who may seek emigration (like to the Netherlands from the USA using the Dutch American Friendship Treaty (DAFT)), unless you are well connected and can get freelance jobs, the only real viable option is applying to full-time jobs in multi-national corps that are used to sponsoring work visas -- if you're qualified. because those are some of the hardest jobs to get.

2024-11-12 15:36:22 GMT

tools like @npub1vwv…cqgs, @npub1z4d…a4zy (by @npub1gz6…8v8g) and @npub1rkw…5q62 are going to be so important for protecting people in the coming years. please support them
#privacy #security #anonymity #journalism #whistleblowing

2024-11-12 14:51:03 GMT

as we go into January 2025, what journalists, activists, or advocates are there on the fediverse that people should follow that focus on the following?
1. #Women's rights
2. #LGBTQ+ rights
3. #BIPOC's rights

2024-11-11 16:11:34 GMT

WC3: ActivityPub Trust and Safety Task Force Meeting
https://www.w3.org/events/meetings/a54ae3c9-89bc-4bb1-b9db-e9494d2100e1/
Date:
12 November 2024, 11:00–12:00 Eastern Standard Time
Local (CEST):
12 November 2024, 17:00 – 18:00 Central European Standard Time
Location:
https://meet.jit.si/ap-trust-and-safety-tf

2024-11-10 11:28:43 GMT

- reply

yes, it's called an off-grid system. you can have your own battery storage or not

2024-11-06 12:35:31 GMT

For LGBTQIA folks,
Canada 🇨🇦 : https://www.pm.gc.ca/en/news/news-releases/2023/06/08/providing-lgbtqi-people-safe-home-canada (see: https://www.rainbowrailroad.org/request-help)
Netherlands 🇳🇱 : learn about the Dutch American Friendship Treaty, a freelance visa (see [@trans_rescue](https://mastodon.social/@trans_rescue ))

2024-11-02 17:54:27 GMT

- reply

I've written a new blog post taking a moderately deep dive into "Threat Modeling YubiKeys and Passkeys"
https://yawnbox.is/blog/threat-modeling-yubikeys-and-passkeys/
I greatly welcome feedback as I want to make sure I'm not misrepresenting anything. I want to make it better if it can be improved. I'm happy to be wrong, just please provide details and links!
also, i need a job! if you like my work, maybe you know of something where i'd be a good fit.
#infosec #cybersecurity #IAM #FIDO2 #WebAuthn #YubiKey #YubiKeys #passkey #passkeys #GetFediHired

2024-11-01 17:52:04 GMT

now when i write long thoughtful technical blog posts, i want cute artistic foxes prefacing each section like @npub1wfp…w2m9

2024-10-30 09:45:36 GMT

- reply

this is the only change i see affecting CSP in 4.3.1, you probably saw it already, affecting "app/lib/content_security_policy.rb"
https://github.com/mastodon/mastodon/pull/32439
aside, i was able to modify "config/environments/production.rb" to add hsts-preload
https://disobey.net/system/media_attachments/files/113/395/719/008/007/522/original/3befc8282d005b09.png

2024-10-30 09:21:04 GMT

- reply

this is my header
> add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
but there's no preload when i :
$ curl -Is https://disobey.net | grep -i strict-transport-security
this is a related thread where it discusses headers being managed by Rails:
https://github.com/mastodon/mastodon/issues/16379

2024-10-30 09:03:57 GMT

- reply

yeah so do i, -preload is an additional flag

2024-10-30 08:50:29 GMT

- reply

i've never been able to enable HSTS-preload via nginx, my assumption is that something else is taking control away from the admin
#MastoAdmin

2024-10-28 12:32:29 GMT

How do I add more of these "profile metadata" fields in my Mastodon profile? (backend editing) is it possible in vanilla Mastodon? not glitch
#mastoadmin
https://disobey.net/system/media_attachments/files/113/385/059/412/920/263/original/d66846b426ecf279.png

2024-10-28 11:50:32 GMT

hello #infosec fedi,
i need help finding companies which are hiring, so please RT. my background is in Platform Security, Data Protection, Windows, Linux, macOS, and ChromeOS systems security, Network Security, and Datacenter Operations.
my last few roles had me focused on IAM: FIDO2 (Yubikey) and 2FA deployments, PlatSec: TLS-intercept forward web proxy w/ DLP supporting corporate Threat Intel, Data Protection: data and liability minimization.
please reach out if you know of anything. the job market is not good and i'm struggling to keep my family in our new home in the Netherlands! i'd ideally like to work for an employer willing to give me an EU work visa, but remote work will provide necessary safety. I'm a US citizen.
#GetFediHired #cybersecurity

2024-10-25 22:46:38 GMT

hello #infosec fedi
do you know any employers who use tls-intercept forward web proxies? maybe some that are hiring?
my request includes MSSP/MDR teams as well, i just want to use my proxy skills, doesn't have to be for one company.
thanks! #getfedihired

2024-10-23 22:04:47 GMT

Today is the 10 year anniversary of #CITIZENFOUR, the out-in-theaters release in the United States was 2014 October 24
if you've never seen it, i highly recommend it! much of the government surveillance that it highlights are either still in practice or are being done by other governments all around the world
here are some old photos i made back on the opening night at SIFF Cinema in Seattle
#LauraPoitras #Snowden #EdwardSnowden #privacy #surveillance #NSA #GCHQ #humanrights
https://disobey.net/system/media_attachments/files/113/358/995/022/400/456/original/1a839d9e48546b18.jpg
https://disobey.net/system/media_attachments/files/113/358/995/008/736/788/original/10627b70fa9db31a.jpg

2024-10-18 21:28:56 GMT

- reply

cc @npub1ep8…29a5 "recommendations for coffee that tastes like Starbucks but doesn't have the anti-labor baggage that goes along with it?"

2024-10-09 09:53:21 GMT

- reply

#WindowsHello will soon offer users an option to sync their passkeys to their Microsoft account making them no longer device-bound
again, this changes the threat model for enterprises, if they care about such details. a device-bound passkey means the private key material exists no where else in the world. Cloud syncing of private keys is basically the same for TOTP private seeds -- those cloud providers, while encrypting the data at rest, do in fact have clear-text access to those secrets -- making them targets of social engineers, law enforcement, nation states and other hackers.
(only an end-to-end encryption cloud storage solution like Apple's Advanced Data Protection would protect synced passkeys)
HT @npub1sml…np04
https://blogs.windows.com/windowsdeveloper/2024/10/08/passkeys-on-windows-authenticate-seamlessly-with-passkey-providers/
#infosec #IAM #cybersecurity

2024-09-28 07:33:32 GMT

would a #Tor exit relay be useful to you if this was its exit policy?
https://disobey.net/system/media_attachments/files/113/214/015/220/404/441/original/1f98279087dd2c85.png