Nostr notes by christopher

if you have ever been curious about running a web application ...

2026-01-17T13:46:42Z

if you have ever been curious about running a web application firewall (WAF) in front of Mastodon or other fediverse instance, i've published a repo containing the #openappsec policy we're now using, which is also configured to maintain strong privacy protections. i've recently turned on prevent mode, blocking critical events

https://code.disobey.net/dd/ap-waf

there's a lot of skip exceptions needed in order to not block required ActivityPub transactions. even things like changing a password in Mastodon is seen as a critical (false) positive

given the number of skip exclusions, there's a lot of attack surface that admins won't be able to action on since so much of ActivityPub looks malicious, and a targeted attack could easily take advantage of these necessary skip policies

i'm curious if any ActivityPub devs have ever run a WAF in front of their instance, and curious if any improvements can be made to the spec to reduce transactions that look like malicious behavior

i have to trust that for the ActivityPub exclusions, Mastodon properly sanitizes inputs and so the overall risk is still low

either way, this is a big win for overall risk reduction for anyone serious about protecting their community

#MastoAdmin #ActivityPub #Mastodon #OpenAppSec

hey #Greenland :nkoWave: now's a good time to stop using US ...

2026-01-15T20:51:18Z

hey #Greenland :nkoWave: now's a good time to stop using US tech, and teach your friends how to use Mastodon and other decentralized tech :meowHuggies:

with consent from @npub13nu…0jwd, I took photos of their ...

2026-01-02T12:49:17Z

In reply to nevent1q…9tg7
_________________________

with consent from Alex / catileptic (npub13nu…0jwd), I took photos of their non-recorded #39C3 talk "Relationship Anarchy and Technologies of Connection"

https://immich.disobey.net/s/39c3-catileptic

Their talk was based on their essay and blog post, "Relationship Anarchy. Tinkering In the Belly of the Whale (zine)" https://catileptic.tech/posts/relationship-anarchy-technology/

Alex is a dear friend and being present for this talk was incredible. Coming from a default, dominant-culture of monogamy, I really enjoy challenging my own assumptions about relationships and hierarchy, and in a way that is open and welcome to all of the people that matter to me.

the lighting in this room was the most restrictive issue because there were no (or minimal) lights on, only the cloudy daylight from one side of the room coming from the windows. Thankfully the angle gave me some opportunity to get some bokeh on an otherwise boring tan background

Photos taken with the Sony a1ii and the Sony 85mm f/1.4 lens with embedded C2PA authentication

Photos are licensed CC0 - Creative Commons 0 - "No Rights Reserved"

with consent from ...

2026-01-02T12:08:18Z

In reply to nevent1q…4xsh
_________________________

with consent from [@Mer__edith](https://mastodon.world/@Mer__edith ) (on Mastodon) and Udbhav Tiwari (in person), I took photos of them during their #39c3 talk, "AI Agent, AI Spy"

https://immich.disobey.net/s/39c3-meredith-udbhav

this talk was more challenging to photograph because they stood behind the podium the whole time (which is fine!) -- and since taking speaker photographs like this is new to me at a place like CCC, I didn't want to cause commotion or worry by moving around a bunch in front of the talk with a big camera.

Photos taken with the Sony a1ii and the Sony 85mm f/1.4 lens with embedded C2PA authentication. Some of them appear dark because i was playing around with metering modes, which is correctable in the RAW versions.

Photos are licensed CC0 - Creative Commons 0 - "No Rights Reserved"

I had a really enjoyable time walking around #39c3 and taking ...

2026-01-02T11:38:15Z

In reply to nevent1q…gerf
_________________________

I had a really enjoyable time walking around #39c3 and taking random abstract photos with a macro lens. here are some, and i'm uploading the rest to https://immich.disobey.net/s/39c3-random

my favorite two spots -- which I regret not making more time to photograph -- were the rocket + laser in the front, but also someone's subwoofer with a plate of water on top with hanging LEDs.

the sub + water + light combo was incredible with a macro lens (thanks Wouter (npub1c9z…hdq2) for letting my borrow your Sony 100m macro GM!), i only wish i had a tripod to play around with different focal lengths and exposure times. the light and water displacement causes beautifully chaotic scenes

photos are Creative Commons 0 (CC0) public domain

only at #39c3 ...

2025-12-30T01:53:23Z

only at #39c3

with consent from @npub1fdr…lvhs, I took photos of him during ...

2025-12-28T15:41:09Z

with consent from Cory Doctorow (npub1fdr…lvhs), I took photos of him during his #39C3 talk, "A post-American, enshittification-resistant internet"

As I find time to finish uploading the photos, all 4,000+ will be here on a AS 396507 (npub1xsw…yq8t) self-hosted #Immich server:
https://immich.disobey.net/s/39c3-cory

photos are Creative Commons CC0 “No Rights Reserved” https://creativecommons.org/public-domain/cc0/

photos taken on the Sony a1ii with the Sony 85mm f/1.4 lens

# Netherlands pulls out of Eurovision as organizer votes to keep ...

2025-12-04T19:30:02Z

# Netherlands pulls out of Eurovision as organizer votes to keep Israel in 2026 contest

The Netherlands will not take part in next year's Eurovision Song Contest, with Dutch broadcast rights holder AvroTros deciding to boycott the event. The decision was made after the members of the event organizer, the European Broadcast Union (EBU), voted to allow Israel to remain in the 2026 edition of the competition."

#netherlands #nederland #eurovision #israel #freepalestine
https://nltimes.nl/2025/12/04/netherlands-pulls-eurovision-organizer-votes-keep-israel-2026-contest

today is the 30th anniversary of the Japanese release of the ...

2025-11-18T10:40:26Z

today is the 30th anniversary of the Japanese release of the first Ghost in the Shell film

"Ghost in the Shell is a 1995 Japanese animated tech noir cyberpunk action thriller film directed by Mamoru Oshii from a screenplay by Kazunori Itō, based on the 1989 manga by Masamune Shirow."

utmost respect for Atsuko Tanaka, the voice of Motoko Kusanagi, who passed away a little over a year ago on August 20, 2024

GitS is by far one of my personal favorite anime 🫶🏻

#GhostInTheShell #GitS

curious about a comparison with Strongbox

2025-11-02T15:08:23Z

In reply to nevent1q…c6ym
_________________________

curious about a comparison with Strongbox

anyone in Europe want to trade 12 x 16GB (192GB) DDR4 UDIMM ...

2025-10-30T12:58:16Z

anyone in Europe want to trade 12 x 16GB (192GB) DDR4 UDIMM (Samsung M391A2K43BB1) for some number of DDR4 RDIMM? ideally at least 128GB worth

AS 396507 (npub1xsw…yq8t) is building a replacement proxmox server in Amsterdam for disobey.net and it needs RDIMM, and RAM prices right now are so terrible 😟

Please share with the community (and me) which #decentralized ...

2025-10-28T09:39:19Z

Please share with the community (and me) which #decentralized chat apps for iOS/iPadOS have been compiled with hardware MTE for the A19/M5 iPhone/iPad devices 😁

I’ve learned that both WhatsApp and @npub1rkw…5q62 are ...

2025-10-27T22:19:29Z

In reply to nevent1q…2m98
_________________________

I’ve learned that both WhatsApp and Signal (npub1rkw…5q62) are blocked on MIE/MTE enablement due to audio codec limitations

The tor network has had 100% uptime. 100%

2025-10-27T10:44:26Z

In reply to nevent1q…fktt
_________________________

The tor network has had 100% uptime. 100%

Free to watch on @npub1umd…wfr7 ...

2025-10-23T21:30:34Z

In reply to nevent1q…9e5z
_________________________

Free to watch on internetarchive (npub1umd…wfr7)

https://archive.org/details/citizenfour-edward-snowden-laura-poitras_202403

#CITIZENFOUR #LauraPoitras #Snowden #EdwardSnowden #privacy #surveillance #NSA #GCHQ #humanrights

Apple confirms that the M5 chip in the MacBook Pro and iPad Pro ...

2025-10-23T13:25:12Z

Apple confirms that the M5 chip in the MacBook Pro and iPad Pro supports Memory Integrity Enforcement (MIE)

MTE specifically is only supported on A19 and newer, including M5

Apple announced Memory Integrity Enforcement 42 days ago, ...

2025-10-21T12:55:36Z

Apple announced Memory Integrity Enforcement 42 days ago, Signal (npub1rkw…5q62) has not yet announced MIE support for A19 and M5

Open Whisper Systems has a long history of being ...

2025-10-20T08:08:42Z

In reply to nevent1q…229x
_________________________

Open Whisper Systems has a long history of being anti-decentralization

[@Mer__edith](https://mastodon.world/@Mer__edith )

I’m at #FediForum in #Rotterdam at @npub159r…xrh2 with ...

2025-10-07T15:09:49Z

I’m at #FediForum in #Rotterdam at XPUB (npub159r…xrh2) with Tommi 🤯 (npub1drf…fpxa) and holly 🐜 (npub1zle…j2yy) and other friends!

i hope [@techlore](https://social.lol/@techlore ) or ...

2025-09-19T17:45:33Z

i hope [@techlore](https://social.lol/@techlore ) or The New Oil (npub12w6…2axu) talks about Apple's new MIE (A19) to help spread the word about it.

journalists, activists, politicians, lawyers all need to better understand the value of exploit mitigations, especially ones that significantly reduce successful attack chains by mercenary spyware companies. if you had to choose between MIE or Lockdown Mode, you want MIE

also, MIE significantly helps Apple determine attempted attacks made against iPhones, leading to faster notifications if your're a victim of mercenary spyware

a #ChatControl update (shared on the ISOC "Global Encryption ...

2025-09-14T15:30:53Z

a #ChatControl update (shared on the ISOC "Global Encryption Coalition" mailing list):

"The good news is that the blocking minority held. Members states raised concerns about privacy and cybersecurity as reasons for their opposition. Even countries that are officially in support of the proposal asked questions along these lines for the first time – showing that they are facing increased pressure back home.

The bad news is that #Denmark is moving forward even though they did not receive full support. They are keeping their plan to take this proposal to the Justice and Home Affairs Council meeting on October 14th.

After discussing with partners, we understand this as a strategy from Denmark. They are not making progress at the working level (the meeting today) and therefore will try directly at the political level (justice and home affairs). During these coming four weeks they will try to convince some of the blocking member states to reconsider their position.

What this means for us is that we need to keep up the pressure. We should be thanking the blocking countries for their position and encouraging the undecided or supportive countries to reconsider. We should keep up pressure in the media at the same time."

my favorite open source software, as of August 2025 - VLC - ...

2025-08-22T13:08:02Z

my favorite open source software, as of August 2025

- VLC
- Debian (npub1lxt…4044)
- Transmission
- The Tor Project (npub1vwv…cqgs)
- Tails (npub1r62…wl6t)
- Thunderbird: Free Your Inbox (npub1hxz…r8sj)
- Qubes OS (npub1f5q…vss4)
- Team KeePassXC (npub16s6…2ny3)
- Signal (npub1rkw…5q62)
- Strongbox
- Wireguard
- VScodium
- Mastodon (npub163h…mv0n)
- mailcow ✅ (npub1zq8…44y6)
- Pi-hole
- Organic Maps (npub1t2q…n4vh)
- Proxmox
- LibreOffice (npub1tgg…qwzh)
- LibreWolf (npub1vpu…608s)
- Immich

after years of denial, glad to see it...

2025-08-21T13:51:37Z

In reply to nevent1q…qshn
_________________________

after years of denial, glad to see it...

Nostr event nevent1qqs8lw0667rrt5ccrqav6ljd8e0nvarxhd6fsrwlcqt5gznh28vv6qqzyzl3ljtzkw5m9zxc5xxn6swwhtavy99je4fz3jmcgnmymh2a9tpejw0e33g

2025-08-10T23:29:13Z

#why2025

i think about this a lot and also refuse to CW posts about ...

2025-08-05T09:45:26Z

In reply to nevent1q…l7ru
_________________________

i think about this a lot and also refuse to CW posts about genocide in Palestine, i don't know what to CW with since "pspol" doesn't exist according to the important white countries

holy shit "The Business Court in Brussels, Belgium, has ...

2025-08-01T12:18:53Z

holy shit

"The Business Court in Brussels, Belgium, has issued an unprecedentedly broad site-blocking order that aims to restrict access to shadow libraries including Anna's Archive, Libgen, OceanofPDF, Z-Library, and the Internet Archive's Open Library. In addition to ISP blocks, the order also directs search engines, DNS resolvers, advertisers, domain name services, CDNs and hosting companies to take action. "

#lawfedi

https://torrentfreak.com/belgium-bans-internet-archives-open-library-in-sweeping-site-blocking-order/

abusive tech companies ("🤠") are drooling ...

2025-04-18T06:58:37Z

abusive tech companies ("🤠") are drooling ("🤤") for generative AI and agentic AI ("👻") because:

1. 🤠 have decades of data about you already, 👻 is continued ROI

2. your attention and engagement via conversation with 👻 extracts new data types, even more data about you, and even more data about the people you talk about

3. engagement on behalf of 🤠 via 👻 is with impunity

4. your dependence on 👻 will mean unlimited, persistent access into your life and mind no different than the dependency you have on your cell phone being in your pocket and within arm's reach 24/7

5. 👻 will replace your friends in different ways. you will trust 👻 more and more as the tech improves

6. 👻 will learn how you work in way more nuanced detail than most people ever will. It will know how to most effectively talk to you, inform you, and control you

7. when 👻 becomes "on-device" in order to sway more users into trusting it, updates from the cloud will continue to allow 🤠 to collect data about your life and interact with you in ways that you trust and will most effectively sway your judgement

8. 👻 is trained to be extremely confident which makes them exceptional social engineers. 🤠 don't have to hire people to do this anymore

i am surprised that infosec leaders are still going to hold ...

2025-04-10T10:37:12Z

In reply to nevent1q…suet
_________________________

i am surprised that infosec leaders are still going to hold conferences in Las Vegas

I want to thank @npub14vu…9wlz and some other recent ...

2025-04-07T09:20:22Z

I want to thank Jonah Aragon :MN: (npub14vu…9wlz) and some other recent AS 396507 (npub13sl…t3va) donors who donated a total of $780, enough to cover the cost of a new SiFive HiFive Premier P550 RISC-V dev board that we will use exclusively as a unfiltered Tor exit relay for hardware and OS diversity

Arrow.com, the only seller of the SiFive HiFive, is charging a $196 tariff + sales tax even though the boards they have in stock have already been in stock for months, raising the cost of the board substantially

I also want to thank whil (npub13xm…232t) who's not only donated a chassis for the SiFive HiFive, but is racking and stacking our gear we've moved from Seattle to San Francisco ^_^

" Call to Action Silence is complicity. But action always has ...

2025-04-04T19:18:00Z

In reply to nevent1q…ctrt
_________________________

" Call to Action

Silence is complicity. But action always has a reaction, no matter how big or small. As workers for this company, we must make our voices heard, and demand that Microsoft does the right thing: stop selling technology to the Israeli military.

If you are also concerned about this news, and you also want your work to be used ethically, I urge you to take action:

Sign the No Azure for Apartheid petition: We will not write code that kills. And join the campaign to add your voice to the growing number of concerned Microsoft employees.

Join me in showing our discontent in this thread. If you also feel tricked into deploying weapons which target children and civilians, urge leadership (CC’ed) to drop these contracts.

Don’t stop speaking up. Urge SLT to drop these contracts at every opportunity.

Start conversations with your co-workers about the points above - so many employees may not know!

Microsoft’s human rights statement prohibits retaliation against anyone who raises a human rights-related concern: Human rights statement | Microsoft CSR

Our company has precedents in supporting human rights, including divestment from apartheid South Africa and dropping contracts with AnyVision (Israeli facial recognition startup), after Microsoft employee and community protests. My hope is that our collective voices will motivate our AI leaders to do the same, and correct Microsoft’s actions regarding these human rights violations, to avoid a stained legacy. Microsoft Cloud and AI should stop being the bombs and bullets of the 21st century.

Sincerely,

A concerned Microsoft employee"

🧵 3/3

Source: https://www.theverge.com/news/643670/microsoft-employee-protest-50th-annivesary-ai

" We are Complicit When I moved to AI Platform, I was excited ...

2025-04-04T19:17:37Z

In reply to nevent1q…0ez4
_________________________

" We are Complicit

When I moved to AI Platform, I was excited to contribute to cutting-edge AI technology and its applications for the good of humanity: accessibility products, translation services, and tools to “empower every human and organization to achieve more.” I was not informed that Microsoft would sell my work to the Israeli military and government, with the purpose of spying on and murdering journalists, doctors, aid workers, and entire civilian families. If I knew my work on transcription scenarios would help spy on and transcribe phone calls to better target Palestinians (source), I would not have joined this organization and contributed to genocide. I did not sign up to write code that violates human rights.

According to AP news, there is “a $133 million contract between Microsoft and Israel’s Ministry of Defense.”

“The Israeli military’s usage of Microsoft and OpenAI artificial intelligence spiked last March to nearly 200 times higher than before the week leading up to the Oct. 7 attack. The amount of data it stored on Microsoft servers doubled between that time and July 2024 to more than 13.6 petabytes.”

“The Israeli military uses Microsoft Azure to compile information gathered through mass surveillance, which it transcribes and translates, including phone calls, texts and audio messages, according to an Israeli intelligence officer who works with the systems. That data can then be cross-checked with Israel’s in-house targeting systems.”

Microsoft AI also powers the most “sensitive and highly classified projects” for the Israeli military, including its “target bank” and the Palestinian population registry. Microsoft cloud and AI enabled the Israeli military to be more lethal and destructive in Gaza than they otherwise could.

Microsoft has also been providing software, cloud services, and consulting services to the Israeli military and government, totaling millions in profit. War Criminal Benjamin Netanyahu has explicitly mentioned his strong ties to Microsoft. A list of these contracts with the Israeli military and government can be found here: An Introduction to Microsoft’s Complicity in Apartheid and Genocide

In fact, Microsoft is so deeply connected to the Israeli military that it was just yesterday designated one of the priority boycott targets of the BDS (Boycott, Divest, Sanctions) campaign.

Regardless of your political stances, is this the legacy we want to leave behind? Is working on deadly AI weapons something you can tell your children about? Do we want to be on the wrong side of history?

Even though your work could be unrelated to the cloud that the military uses, your work benefits the company and allows it to take on the contract. Regardless of your team, you serve a company that is arming the Israeli occupation. It is undeniable that part of your compensation, no matter how small, is being paid by genocide.

Whether you work on AI or not, you will be complicit if you do nothing. It is now OUR job to take a vocal stand against Microsoft AI’s involvement in crimes against humanity.

This is why I decided to speak up today, and why I signed this important petition to demand Microsoft cut ties with genocide. And I urge you all to do the same."

🧵 2/3

Source: https://www.theverge.com/news/643670/microsoft-employee-protest-50th-annivesary-ai

" Hi all, As you might have just seen on the livestream or ...

2025-04-04T19:17:07Z

" Hi all,

As you might have just seen on the livestream or witnessed in person, I disrupted the speech of Microsoft AI CEO Mustafa Suleyman during the highly-anticipated 50th anniversary celebration. Here’s why.

My name is Ibtihal, and for the past 3.5 years, I’ve been a software engineer on Microsoft’s AI Platform org. I spoke up today because after learning that my org was powering the genocide of my people in Palestine, I saw no other moral choice. This is especially true when I’ve witnessed how Microsoft has tried to quell and suppress any dissent from my coworkers who tried to raise this issue. For the past year and a half, our Arab, Palestinian, and Muslim community at Microsoft has been silenced, intimidated, harassed, and doxxed, with impunity from Microsoft. Attempts at speaking up at best fell on deaf ears, and at worst, led to the firing of two employees for simply holding a vigil. There was simply no other way to make our voices heard.

We are witnessing a genocide

For the past 1.5 years, I’ve witnessed the ongoing genocide of the Palestinian people by Israel. I’ve seen unspeakable suffering amidst Israel’s mass human rights violations - indiscriminate carpet bombings, the targeting of hospitals and schools, and the continuation of an apartheid state - all of which have been condemned globally by the UN, ICC, and ICJ, and numerous human rights organizations. The images of innocent children covered in ash and blood, the wails of mourning parents, and the destruction of entire families and communities have forever fractured me.

At the time of writing, Israel has resumed its full-scale genocide in Gaza, which has so far killed by some estimates over 300,000 Gazans in the past 1.5 year alone. Just days ago, it was revealed that Israel killed fifteen paramedics and rescue workers in Gaza, executing them “one by one,” before burying them in the sand -- yet another horrific war crime. All the while, our “responsible” AI work powers this surveillance and murder. The United Nations and the International Court of Justice have concluded that this is a genocide, with the International Criminal Court issuing arrest warrants for Israeli leaders."

🧵 1/3

Source: https://www.theverge.com/news/643670/microsoft-employee-protest-50th-annivesary-ai

this is a fantastic interview "Palestine Talks: In ...

2025-03-28T13:08:54Z

this is a fantastic interview

"Palestine Talks: In Conversation with Josie Guilbeau" (ex-US Army ex-NSA)
https://youtu.be/iJA8zNOjCDg

but is the auditing better haha (re ...

2025-03-25T20:44:22Z

In reply to nevent1q…uw8w
_________________________

but is the auditing better haha

(re https://en.wikipedia.org/wiki/XZ_Utils_backdoor)

i think that everyone needs to read this "As Fraenkel ...

2025-03-23T12:56:03Z

i think that everyone needs to read this

"As Fraenkel explained it, a lawless dictatorship does not arise simply by snuffing out the ordinary legal system of rules, procedures, and precedents. To the contrary, that system—which he called the “normative state”—remains in place while dictatorial power spreads across society. What happens, Fraenkel explained, is insidious. Rather than completely eliminating the normative state, the Nazi regime slowly created a parallel zone in which “unlimited arbitrariness and violence unchecked by any legal guarantees” reigned freely. In this domain, which Fraenkel called the “prerogative state,” ordinary law didn’t apply. (A prerogative power is one that allows a person such as a monarch to act without regard to the laws on the books; theorists from John Locke onward have offered various formulations of the idea.) In this prerogative state, judges and other legal actors deferred to the racist hierarchies and ruthless expediencies of the Nazi regime."

https://www.theatlantic.com/magazine/archive/2025/05/trump-executive-order-lawlessness-constitutional-crisis/682112/

ASML in the Netherlands is hiring several #infosec roles ...

2025-02-15T13:31:53Z

ASML in the Netherlands is hiring several #infosec roles

#GetFediHired

Expert Security Analyst – Security Incident Response Team
https://www.asml.com/en/careers/find-your-job/expert-security-analyst--security-incident-response-team-j00307486?ppc=EML-7

IT Security Risk Specialist
https://www.asml.com/en/careers/find-your-job/it-security-risk-specialist-j00314298?ppc=EML-7

Cybersecurity Assurance Officer
https://www.asml.com/en/careers/find-your-job/cybersecurity-assurance-officer-j00311921?ppc=EML-7

lesigh. should i be concerned? i currently do not trust Apple ...

2025-02-10T18:22:40Z

lesigh. should i be concerned?
i currently do not trust Apple given the UK's order to change Advanced Data Protection and other client-managed keys

in these dangerous times, it's important to reevaluate your ...

2025-02-10T11:19:01Z

in these dangerous times, it's important to reevaluate your online habits

for example: the surveillance systems baked into the WWW are a disaster. using Tor Browser can really help

how?

yes, Tor Browser has issues accessing many websites online. but what you can do to help this situation is to find the ones that do not block Tor and to use those ones in TB

one of the biggest sources of my WWW-surveillance risk comes from reading the news. news sites are notorious for surveillance

i don't want governments and blackbox algorithms knowing what i read, and from there, controlling content to me or from me in ways i'll never know

my biggest source of news is from the fediverse. so, what i do is i log into Mastodon etc in Tor Browser. this way the links that i click from fedi open in TB

this is safety by default. if a news site doesn't load in TB, i can easily copy the link into https://archive.is/, also opened (and pinned) in TB

archive.is has a captcha but once you move past it, it's worth it. if archive.is doesn't have the article you need, you can have them get it for you. reading it here will make the page much more responsive and readable since they strip out javascript any other heavy stuff you don't need or what to read an article

i'm happy to help coach people about any of this. if you're new to Tor, don't hesitate to reach out

"The Trump White House has told three Democratic-selected ...

2025-01-26T09:48:06Z

"The Trump White House has told three Democratic-selected members of the Privacy and Civil Liberties Oversight Board to resign or be fired, which would stop the independent agency from functioning.

The Trump White House is moving to paralyze a bipartisan and independent watchdog agency that investigates national security activities that can intrude upon individual rights."

https://archive.ph/gIfSw#selection-4539.0-4539.196

i also don't understand why he'd stop going after the ...

2025-01-26T08:54:09Z

In reply to nevent1q…dpmy
_________________________

i also don't understand why he'd stop going after the third component of the "cure" and get tested instead.

he knew that becoming world famous if he became S would result in constant surveillance. surely it would be easier to complete that task under the radar as he's always been successful at doing.

and yeah then still pretends to be E to attempt to steal an A boss? 🤨 wtf

only privileged nerds make the claim that Matrix or XMPP is a ...

2025-01-22T16:23:37Z

only privileged nerds make the claim that Matrix or XMPP is a replacement for Signal

get the fuck out of people's replies who are trying to help non-technical, vulnerable people learn about Signal

sorry, apps aren't e2ee unless the e2ee is on-by-default ...

2025-01-22T16:08:39Z

In reply to nevent1q…e580
_________________________

sorry, apps aren't e2ee unless the e2ee is on-by-default

matrix is not e2ee

uwu #38c3 ...

2024-12-27T12:22:17Z

In reply to nevent1q…w0uy
_________________________

uwu #38c3

Upstairs directly above the entrance, sharing some stickers! CO2 ...

2024-12-27T12:20:12Z

In reply to nevent1q…nw9u
_________________________

Upstairs directly above the entrance, sharing some stickers! CO2 not great
#38C3 #38c3novid

At #VeganChaos, Saal 6 @npub1z7h…tpgs #38C3 #38c3novid ...

2024-12-27T11:49:22Z

In reply to nevent1q…tym7
_________________________

At #VeganChaos, Saal 6 Vegan Chaos Community (npub1z7h…tpgs)

#38C3 #38c3novid

Tea Hut @npub1t0k…uqf5 CO2 reading is slowly crawling up #38C3 ...

2024-12-27T10:29:11Z

In reply to nevent1q…8lg0
_________________________

Tea Hut House of Tea #39C3 📞4832 (npub1t0k…uqf5) CO2 reading is slowly crawling up
#38C3 #38c3novid

Good morning #38C3, #38c3novid reading upstairs by Saal Z ...

2024-12-27T10:05:52Z

Good morning #38C3, #38c3novid reading upstairs by Saal Z

Have you ever thought about the privacy and security implications ...

2024-12-15T19:23:54Z

Have you ever thought about the privacy and security implications of Starlink satellites and cell phones? You're in luck, I've written a new blog post:

"Threat modeling Starlink satellite cellular risks"

https://yawnbox.is/blog/threat-modeling-starlink-satellite-cellular-risks/

#MastoAdmins's can easily help the #Tor network by installing ...

2024-11-28T16:54:40Z

#MastoAdmins's can easily help the #Tor network by installing the Tor daemon on the linux server and configuring their web server to be a #WebTunnel bridge

disobey.net does it (https://metrics.torproject.org/rs.html#details/7E12D6CACBA1051FD23A48482E091257CD4701BC), you can too!

https://www.bleepingcomputer.com/news/security/tor-needs-200-new-webtunnel-bridges-to-fight-censorship/

"Hiding in plain sight: Introducing WebTunnel"

https://blog.torproject.org/introducing-webtunnel-evading-censorship-by-hiding-in-plain-sight/

Also, we are looking for an #Internet #lawyer based in #Chile to ...

2024-11-21T13:29:41Z

In reply to nevent1q…m0pz
_________________________

Also, we are looking for an #Internet #lawyer based in #Chile to help us understand the legal landscape for running #Tor exit relays there.

#LawFedi

Can you recommend any possible community data center colocation ...

2024-11-21T13:04:55Z

Can you recommend any possible community data center colocation in #Santiago #Chile?

#DataCenter #colocation #server #hosting

Hello kind readers! I'm in desperate need of a job and need ...

2024-11-20T12:45:03Z

Hello kind readers!

I'm in desperate need of a job and need your help connecting with hiring managers. I'm looking for the following (or related) roles:

1. technical program manager
2. security engineer/analyst
3. network security engineer/analyst
4. privacy engineer/analyst
5. SOC/NOC engineer/analyst
6. data center technician manager/engineer

CV: https://[yawnbox.is]/docs/cv-priv.pdf

I live in The Hague (NL) and i'm from Seattle (WA, USA). Remote jobs will allow my partner and I to continue to exist in NL. Freelance jobs in NL are also great. I would need work visa sponsorship anywhere outside of USA. I would relocate anywhere for a great job.

Things are desperate for us. Please help.

#GetFediHired #infosec #cybersecurity #Netherlands #Seattle

active noise cancellation (anc) is lacking compared to real ...

2024-11-20T03:10:19Z

In reply to nevent1q…eq02
_________________________

active noise cancellation (anc) is lacking compared to real hearing protection, which you'll find with construction site or gun range ear muffs. and those are cheaper. but bulky and ugly.

that being said, the Sony XM series are the cheapest and best for what we've used for years... not for high quality feels or audio but they work. i prefer the Apple Airpods Max.

stacking cheap ear plugs under anc headphones is also a thing depending on the person/environment

it's clear now, 5 months applying for IT and security jobs in ...

2024-11-15T13:04:53Z

it's clear now, 5 months applying for IT and security jobs in the Netherlands, that it's exceptionally difficult to get even interviews if i don't have a work visa

this is a good example of a rejection email that i got today that is slightly more verbose than what i usually get:

"When selecting candidates, we do not only look at education, skills, motivation and recent work experience, but also practical aspects like distance, language skills and general fit. In this case, we were able to make a selection of applicants whom we have invited for interviews. Unfortunately, and despite your qualities and previous experience, you did not make the short list for this position. We decided to interview a few candidates who fit the ideal profile better based on their CV."

so, for those of you who may seek emigration (like to the Netherlands from the USA using the Dutch American Friendship Treaty (DAFT)), unless you are well connected and can get freelance jobs, the only real viable option is applying to full-time jobs in multi-national corps that are used to sponsoring work visas -- if you're qualified. because those are some of the hardest jobs to get.

tools like @npub1vwv…cqgs, @npub1z4d…a4zy (by ...

2024-11-12T15:36:22Z

tools like The Tor Project (npub1vwv…cqgs), SecureDrop (npub1z4d…a4zy) (by Freedom of the Press (npub1gz6…8v8g)) and Signal (npub1rkw…5q62) are going to be so important for protecting people in the coming years. please support them

#privacy #security #anonymity #journalism #whistleblowing

as we go into January 2025, what journalists, activists, or ...

2024-11-12T14:51:03Z

as we go into January 2025, what journalists, activists, or advocates are there on the fediverse that people should follow that focus on the following?

1. #Women's rights
2. #LGBTQ+ rights
3. #BIPOC's rights

WC3: ActivityPub Trust and Safety Task Force Meeting ...

2024-11-11T16:11:34Z

WC3: ActivityPub Trust and Safety Task Force Meeting

https://www.w3.org/events/meetings/a54ae3c9-89bc-4bb1-b9db-e9494d2100e1/

Date:
12 November 2024, 11:00–12:00 Eastern Standard Time

Local (CEST):
12 November 2024, 17:00 – 18:00 Central European Standard Time

Location:
https://meet.jit.si/ap-trust-and-safety-tf

yes, it's called an off-grid system. you can have your own ...

2024-11-10T11:28:43Z

In reply to nevent1q…pv44
_________________________

yes, it's called an off-grid system. you can have your own battery storage or not

For LGBTQIA folks, Canada 🇨🇦 : ...

2024-11-06T12:35:31Z

For LGBTQIA folks,

Canada 🇨🇦 : https://www.pm.gc.ca/en/news/news-releases/2023/06/08/providing-lgbtqi-people-safe-home-canada (see: https://www.rainbowrailroad.org/request-help)

Netherlands 🇳🇱 : learn about the Dutch American Friendship Treaty, a freelance visa (see [@trans_rescue](https://mastodon.social/@trans_rescue ))

I've written a new blog post taking a moderately deep dive ...

2024-11-02T17:54:27Z

In reply to nevent1q…79vz
_________________________

I've written a new blog post taking a moderately deep dive into "Threat Modeling YubiKeys and Passkeys"

https://yawnbox.is/blog/threat-modeling-yubikeys-and-passkeys/

I greatly welcome feedback as I want to make sure I'm not misrepresenting anything. I want to make it better if it can be improved. I'm happy to be wrong, just please provide details and links!

also, i need a job! if you like my work, maybe you know of something where i'd be a good fit.

#infosec #cybersecurity #IAM #FIDO2 #WebAuthn #YubiKey #YubiKeys #passkey #passkeys #GetFediHired

now when i write long thoughtful technical blog posts, i want ...

2024-11-01T17:52:04Z

now when i write long thoughtful technical blog posts, i want cute artistic foxes prefacing each section like Soatok Dreamseeker (npub1wfp…w2m9)

this is the only change i see affecting CSP in 4.3.1, you ...

2024-10-30T09:45:36Z

In reply to nevent1q…0vc9
_________________________

this is the only change i see affecting CSP in 4.3.1, you probably saw it already, affecting "app/lib/content_security_policy.rb"

https://github.com/mastodon/mastodon/pull/32439

aside, i was able to modify "config/environments/production.rb" to add hsts-preload

this is my header > add_header Strict-Transport-Security ...

2024-10-30T09:21:04Z

In reply to nevent1q…sq4s
_________________________

this is my header

> add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

but there's no preload when i :

$ curl -Is https://disobey.net | grep -i strict-transport-security

this is a related thread where it discusses headers being managed by Rails:

https://github.com/mastodon/mastodon/issues/16379

yeah so do i, -preload is an additional flag

2024-10-30T09:03:57Z

In reply to nevent1q…fds3
_________________________

yeah so do i, -preload is an additional flag

i've never been able to enable HSTS-preload via nginx, my ...

2024-10-30T08:50:29Z

In reply to nevent1q…23su
_________________________

i've never been able to enable HSTS-preload via nginx, my assumption is that something else is taking control away from the admin

#MastoAdmin

How do I add more of these "profile metadata" fields in ...

2024-10-28T12:32:29Z

How do I add more of these "profile metadata" fields in my Mastodon profile? (backend editing) is it possible in vanilla Mastodon? not glitch

#mastoadmin

hello #infosec fedi, i need help finding companies which are ...

2024-10-28T11:50:32Z

hello #infosec fedi,

i need help finding companies which are hiring, so please RT. my background is in Platform Security, Data Protection, Windows, Linux, macOS, and ChromeOS systems security, Network Security, and Datacenter Operations.

my last few roles had me focused on IAM: FIDO2 (Yubikey) and 2FA deployments, PlatSec: TLS-intercept forward web proxy w/ DLP supporting corporate Threat Intel, Data Protection: data and liability minimization.

please reach out if you know of anything. the job market is not good and i'm struggling to keep my family in our new home in the Netherlands! i'd ideally like to work for an employer willing to give me an EU work visa, but remote work will provide necessary safety. I'm a US citizen.

#GetFediHired #cybersecurity

hello #infosec fedi do you know any employers who use ...

2024-10-25T22:46:38Z

hello #infosec fedi

do you know any employers who use tls-intercept forward web proxies? maybe some that are hiring?

my request includes MSSP/MDR teams as well, i just want to use my proxy skills, doesn't have to be for one company.

thanks! #getfedihired

Today is the 10 year anniversary of #CITIZENFOUR, the ...

2024-10-23T22:04:47Z

Today is the 10 year anniversary of #CITIZENFOUR, the out-in-theaters release in the United States was 2014 October 24

if you've never seen it, i highly recommend it! much of the government surveillance that it highlights are either still in practice or are being done by other governments all around the world

here are some old photos i made back on the opening night at SIFF Cinema in Seattle

#LauraPoitras #Snowden #EdwardSnowden #privacy #surveillance #NSA #GCHQ #humanrights

cc @npub1ep8…29a5 "recommendations for coffee that tastes ...

2024-10-18T21:28:56Z

In reply to nevent1q…tvff
_________________________

cc CoffeeGeek (npub1ep8…29a5) "recommendations for coffee that tastes like Starbucks but doesn't have the anti-labor baggage that goes along with it?"

#WindowsHello will soon offer users an option to sync their ...

2024-10-09T09:53:21Z

In reply to nevent1q…z0fm
_________________________

#WindowsHello will soon offer users an option to sync their passkeys to their Microsoft account making them no longer device-bound

again, this changes the threat model for enterprises, if they care about such details. a device-bound passkey means the private key material exists no where else in the world. Cloud syncing of private keys is basically the same for TOTP private seeds -- those cloud providers, while encrypting the data at rest, do in fact have clear-text access to those secrets -- making them targets of social engineers, law enforcement, nation states and other hackers.

(only an end-to-end encryption cloud storage solution like Apple's Advanced Data Protection would protect synced passkeys)

HT jesterchen42 (npub1sml…np04)

https://blogs.windows.com/windowsdeveloper/2024/10/08/passkeys-on-windows-authenticate-seamlessly-with-passkey-providers/

#infosec #IAM #cybersecurity

would a #Tor exit relay be useful to you if this was its exit ...

2024-09-28T07:33:32Z

would a #Tor exit relay be useful to you if this was its exit policy?

Google #chrome / #chromeOS no longer device-bound #passkeys ...

2024-09-20T19:36:02Z

Google #chrome / #chromeOS no longer device-bound #passkeys

Changes the threat model for enterprises, if they care about such details

https://techcrunch.com/2024/09/19/google-rolls-out-automatic-passkey-syncing-via-password-manager/

#infosec #IAM #cybersecurity

i'm not finding a solution for getting #Wireguard working on ...

2024-09-17T14:28:23Z

i'm not finding a solution for getting #Wireguard working on #macOS15 #Sequoia

uninstall/install (from the app store) does not work. restarts do not work. none of my tunnels will connect

anyone having/not having this issue?

what #email providers do you trust, that supports the following? ...

2024-09-17T14:10:37Z

what #email providers do you trust, that supports the following?

1. bring your own domain.tld
2. supports #SPF, #DKIM, #DMARC
3. ideally: #DNSSEC/#DANE

no, i do not want feedback about self-hosted options, thank you.

#infosec #privacy

fyi #ASUS #AM4 #AM5 motherboard owners, the new BIOS just dropped ...

2024-09-14T15:28:31Z

fyi #ASUS #AM4 #AM5 motherboard owners, the new BIOS just dropped

1. Updated to AMD #AGESA PI 1.2.0.1a.
2. Resolved the #SMM Lock Bypass and Sinkhole security vulnerabilities.
3. The control limit mode (cTDP to105W) was moved to a more accessible location for different processors.

(ROG STRIX B650E-I GAMING WIFI link)

https://rog.asus.com/us/motherboards/rog-strix/rog-strix-b650e-i-gaming-wifi-model/helpdesk_bios/

personal opinion as a matodon admin, i hope that ATprotocol and ...

2024-08-31T13:41:42Z

In reply to nevent1q…6qvm
_________________________

personal opinion as a matodon admin, i hope that ATprotocol and activitypub will be able to interop at a protocol level someday soon

do you have #ADHD? are you medicated for it? my partner has #OCD ...

2024-08-27T09:28:01Z

do you have #ADHD? are you medicated for it?

my partner has #OCD and #ADHD. because of his #OCD, he is afraid to even try an #ADHD medication

and nearly every day in the latter half of the day he suffers from a debilitating "deadness", which we presume is related to his conditions

can you share your positive experiences with #ADHD meds to help encourage him to try them?

#durov hot takes - data is toxic. - if telegram were e2ee to ...

2024-08-25T15:56:03Z

#durov hot takes

- data is toxic.
- if telegram were e2ee to begin with (by default) then no one would have any idea what were actually happening on said platform.
- telegram isn't made to be that way, by design. you reap what you sow.
- you don't make billions by protecting everyone's privacy.
- content moderation can't scale unless you build in mass surveillance systems. (or you're federated and community responsibility is not centrally managed)

telegram/#durov is being targeted because, since it's not e2ee, it's very easy to find 'bad behavior' on telegram, which makes it an easy target for these kinds of charges

either this #durov case will 1) cause more tech bro companies to build in more surveillance systems, or 2) build more e2ee into said systems, or 3) both depending on capitalism motivations

the US is less likely to come down hard on American corps because money

Hello fedi, I'm helping my partner use my Win11 gaming PC to ...

2024-08-19T14:56:46Z

Hello fedi,

I'm helping my partner use my Win11 gaming PC to record #Minecraft content for #YouTube and #Peertube

We've installed #OBS and these attached screenshots are the changes i've made. We don't know a lot about video encoding or anything related, this is all new to us. Can you help us maximize video and audio quality, for the following hardware specs?

RTX 4090
64GB DDR5-6400
Ryzen9 7950X3D
Alienware AW3423DWF 34" OLED Ultrawide (HDR) @ 3440x1440 @ 165Hz

#video #encoding #streaming #recording #fedihelp

does anyone know how to get #SignalProxy working behind ...

2024-08-10T17:58:22Z

In reply to nevent1q…qq78
_________________________

does anyone know how to get #SignalProxy working behind Cloudflare? Signal (npub1rkw…5q62)

#signalapp #signal

who at #Mastodon HQ do i need to bother about responding to an ...

2024-08-08T11:10:44Z

who at #Mastodon HQ do i need to bother about responding to an email kindly requesting they add new Mastodon server to their public listing of available servers?

i submitted one 2023 September 23...

i wish people's Mastodon profiles would show the top 10 used ...

2024-08-07T14:25:27Z

i wish people's Mastodon profiles would show the top 10 used hashtags that a person posts about, so it's easier to understand what i'm getting into when i follow someone. also the posts per day count. and like github, a heatgraph of how often they've been posting

#Mastodon

government backdoors in cryptography be like #privacy ...

2023-08-01T18:12:27Z

government backdoors in cryptography be like

#privacy #surveillance #encryption #e2ee #KOSA #EARNITAct #OnlineSafetyBill #ChatControl #eIDAS

Why I love #Mastodon 1. we are not the product 2. no ...

2022-11-16T20:24:45Z

Why I love #Mastodon

1. we are not the product

2. no #SurveillanceCapitalism

3. I can host my own node and be a part of all communities

4. no AI filtering and controlling what I see and when. what gets amplified is organic

5. it brings decency and fairness to social media

6. central authority is exceptionally limited to the software development team which is open-source, and anyone can contribute

7. billionaires can go fuck themselves