Nostr notes by Dominic White

first I’ve seen that. My code is open source at ...

2026-06-13T15:39:11Z

In reply to nevent1q…ntgq
_________________________

first I’ve seen that. My code is open source at https://github.com/singe/QuantumHello and I can’t see theirs to check overlap. But it’s a pretty simple idea that’s basically just a variation on:
`openssl s_client -connect example.com:443 -servername example.com \
-tls1_3 -groups X25519MLKEM768`

Oh, and the code is at https://github.com/singe/QuantumHello if ...

2026-06-13T10:05:56Z

In reply to nevent1q…9w68
_________________________

Oh, and the code is at https://github.com/singe/QuantumHello if you’d just like a little go cmd for checking yourself.

You'll no doubt enjoy the irony that this site does not in ...

2026-06-13T10:04:44Z

In reply to nevent1q…rqpv
_________________________

You'll no doubt enjoy the irony that this site does not in fact support PQ. But I'd be interest in hearing what real risk that presents.

Check whether a site supports post quantum crypto* ...

2026-06-13T10:00:17Z

Check whether a site supports post quantum crypto* https://quantumhello.xyz

* Well hybrid PQ key exchange in the form of TLS 1.3 with X25519MLKEM768

that’s a really nice summary of the convo.

2026-01-23T05:10:40Z

In reply to nevent1q…ggxc
_________________________

that’s a really nice summary of the convo.

I hear ya. My knee jerk agreement with you was “don’t rewrite ...

2026-01-19T16:39:27Z

In reply to nevent1q…g7q6
_________________________

I hear ya. My knee jerk agreement with you was “don’t rewrite grep” but honestly if it’s learning you want rewriting grep is probably a better approach. If it’s speed you want and a brief search didn’t turn up something close then why not. For context my recent exp was the Burp App Store which didn’t have a simple global sed-like tool. Perhaps an argument for unix philosophy in tooling too.

that’s if your goal is to make something globally useful. If ...

2026-01-19T16:27:46Z

In reply to nevent1q…v3zk
_________________________

that’s if your goal is to make something globally useful. If your goal is to solve your current problem it’s a different set of incentives.

We’ve crossed the rubicon where for many simple tech use cases ...

2026-01-19T16:18:05Z

We’ve crossed the rubicon where for many simple tech use cases it’s easier to vibe code exactly what you want than it is to research several existing solutions and test them.

I’ll need to look closer but it feels like they would be more ...

2026-01-19T15:11:34Z

In reply to nevent1q…lvv6
_________________________

I’ll need to look closer but it feels like they would be more work than what I needed.

In Portswigger's Burp I needed a way to do Match & ...

2026-01-19T15:02:11Z

In Portswigger's Burp I needed a way to do Match & Replace globally across all utilities, not just the proxy so I wrote an extension https://github.com/singe/burp_global_match_replace

We (Orange Cyberdefense) are attempting to become a CVE CNA & ...

2025-12-24T12:01:06Z

We (Orange Cyberdefense) are attempting to become a CVE CNA & in prep for that collected the various vulns we had reported over the years that had corresponding public information. 108 of them! It’s mostly a vanity list but will be where we publish new vulns in future. https://advisories.orangecyberdefense.com/advisories

Here’s a free scanner for that FortiWeb CVE-2025-64446 I made ...

2025-11-18T17:07:36Z

Here’s a free scanner for that FortiWeb CVE-2025-64446 I made for you. https://github.com/sensepost/CVE-2025-64446

@npub12ts…x422 Hello and welcome back to ZA. Looking forward to ...

2025-05-28T07:29:21Z

Jeff Moss (npub12ts…x422) Hello and welcome back to ZA. Looking forward to your talk today.

Something pandoc can do?

2025-05-26T16:50:13Z

In reply to nevent1q…dhxw
_________________________

Something pandoc can do?

Its always been like that. Early twitter, late twitter too.

2025-05-11T08:03:11Z

In reply to nevent1q…spsp
_________________________

Its always been like that. Early twitter, late twitter too.

Working with s/mime on macOS has first class support with the ...

2025-04-28T09:55:23Z

Working with s/mime on macOS has first class support with the "security cms" command and keychain. Here's how to replace openssl with it, with the mutt mail client being the specific use case https://github.com/singe/smutt

Microsoft Outlook is pants at usability and running a fat GUI ...

2025-04-26T21:43:14Z

Microsoft Outlook is pants at usability and running a fat GUI isn’t great for security. About a year ago I went on a mission to make mutt (the CLI mail client) work in a sandbox so I could read my work Microsoft365 mail nicely and more securely. Here’s how https://github.com/singe/muttpack

Amazing that despite numerous C2 comms to this IP from malware, ...

2025-04-14T12:24:31Z

Amazing that despite numerous C2 comms to this IP from malware, it's still clean as a whistle on VT. So much for all that vaunted threat intel helping us clean up malicious comms.

https://www.virustotal.com/gui/ip-address/45.144.53.145/relations

I’m increasingly convinced that AI is less likely to replace ...

2025-04-06T18:11:07Z

I’m increasingly convinced that AI is less likely to replace junior hackers & more likely to replace the seniors who refuse to use it.

Juniors are more open to experimenting with it, & are … cheaper. The wave of layoffs in security in 2023 targeted a lot of seniors due to cost.

Prompt engineering made sense in the early days of diffusion ...

2025-03-05T10:53:26Z

Prompt engineering made sense in the early days of diffusion models where you knew the training set and could weight certain styles more heavily. But I’m finding it increasingly less important with LLMs. Instead, dumping the system prompt and knowing what tools it has available is way more useful.

and no weird looks?

2024-12-02T09:17:03Z

In reply to nevent1q…d7cn
_________________________

and no weird looks?

Is it just me that struggles with greeting people at work? My ...

2024-12-02T09:11:28Z

Is it just me that struggles with greeting people at work? My preferred approach is to just shake everyone’s hand, or if the person is from a “no touching” culture a slight head bow with no difference across genders. But I regularly get puzzled looks or awkward expressions. What am I missing?

absolutely, and the disinformation is so tightly wound into that ...

2024-11-08T06:11:57Z

In reply to nevent1q…ctx2
_________________________

absolutely, and the disinformation is so tightly wound into that nobody can differentiate. I’m interested in the idea of https://ground.news/ and its blind spot feed as a potential counter to it.

I’m genuinely worried about a Trump presidency at a time where ...

2024-11-08T04:48:17Z

I’m genuinely worried about a Trump presidency at a time where we have a proxy war in Eastern Europe with N Korea allied with Russia against “the west”. A proxy war in the Middle East with “the west” vs Iran & proxies. China ready to move on Taiwan. Weak & divided European leadership …

2/2 believe in and want to see. Made possible by Trump’s lack ...

2024-11-08T04:36:12Z

2/2 believe in and want to see. Made possible by Trump’s lack of firm policy objectives & capricious ever-shifting statements. It’s hard to accuse someone of flip flopping when they’ll doing it in the same sentence. It somehow raises the noise floor allowing a blank canvas for a voter to project to.

I’m doing Movember this year with a focus on raising awareness ...

2024-10-29T19:47:42Z

I’m doing Movember this year with a focus on raising awareness about colon cancer, since it typically kills more men than prostate & testicular cancer & it took my Dad. I’d appreciate it if you shared my page, joined me, or donated for cancer research. https://ex.movember.com/mospace/15243648

call me vain - but that there’s no reference to the original ...

2024-10-25T06:35:15Z

In reply to nevent1q…70kq
_________________________

call me vain - but that there’s no reference to the original research behind the field work makes me sad. https://m.youtube.com/watch?v=3HFiv7NvWrM & https://github.com/sensepost/birp

Soldier of FORTRAN :ReBoot: (npub1d86…jwwp) is involved though and is the OG progenitor of so much of it, who’s still working on it and mentoring new peeps like Michelle.

If you had to recommend one place for a user to report phishing ...

2024-10-21T18:25:26Z

If you had to recommend one place for a user to report phishing URLs that would lead to the widest dissemination to list that would actually block it, and/or encourage someone to investigate it - what would it be? Virustotal, safe browsing, somewhere else?

Microsoft on mitigating Kerberoasting ...

2024-10-12T16:05:22Z

Microsoft on mitigating Kerberoasting https://www.microsoft.com/en-us/security/blog/2024/10/11/microsofts-guidance-to-help-mitigate-kerberoasting/

I’d love to stop seeing this vuln in so many reports.

In January 2020 a Raspberry Pi4 B 2G cost R720 it now costs R950. ...

2024-09-11T04:53:38Z

In January 2020 a Raspberry Pi4 B 2G cost R720 it now costs R950. I was shocked at the 32% price increase. A quick calc showed that was only* 6.12% annual average inflation - and I was once again reminded how bad humans** are at understanding compounding effects.

* that’s not bad for South Africa
** I may be generalising too much - at least me

This was a keynote I gave to our first BSides in Johannesburg ...

2024-08-26T18:47:29Z

This was a keynote I gave to our first BSides in Johannesburg recently. It covers what I think a community needs to do to create great hackers and warns of the dangers of racing to the bottom. While it focuses on South Africa - it’s, I think, more widely useful.

https://youtube.com/watch?v=Ri5DoRRnGWs (or on invidious https://yewtu.be/watch?v=Ri5DoRRnGWs)

Something in @npub1fdr…lvhs’s @npub1dqd…8xy4 talk has been ...

2024-08-11T00:41:14Z

Something in Cory Doctorow (npub1fdr…lvhs)’s DEF CON (npub1dqd…8xy4) talk has been sitting with me all day. To summarise badly:

Tech workers were looked after when it was a scarce skill. The layoffs make it clear it isn’t as scarce anymore.

As the saying goes - the future is here just not evenly distributed.

Abused amazon delivery/warehouse workers are the tech worker future.

The only defense is to unionise.

WiFi hackers let out a sad sigh. ...

2024-07-10T04:15:18Z

WiFi hackers let out a sad sigh.

@npub1tdp…hx5s I’m excited to see some ZA news here!

2024-07-07T16:44:27Z

Cliff the Reporter🇿🇦 (npub1tdp…hx5s) I’m excited to see some ZA news here!

worked as a gift link for me. Thanks!

2024-06-30T17:42:07Z

In reply to nevent1q…dmtt
_________________________

worked as a gift link for me. Thanks!

ill try out make, thanks!

2024-06-29T11:39:44Z

In reply to nevent1q…9sqm
_________________________

ill try out make, thanks!

I’ve been experimenting with different ways of posting to ...

2024-06-29T10:06:57Z

In reply to nevent1q…tvzq
_________________________

I’ve been experimenting with different ways of posting to multiple networks. I used buffer here and see that it shortened the links with a tracker. That’s a frustrating deal breaker if I can’t turn it off.

MSRC is going to start issuing CVEs for cloud stuff ...

2024-06-27T19:42:02Z

MSRC is going to start issuing CVEs for cloud stuff https://x.com/msftsecresponse/status/1806385031801110886

I went through a bit of a creative volcano eruption, and produced ...

2024-06-27T17:57:11Z

I went through a bit of a creative volcano eruption, and produced a few tools:

* tidcli https://buff.ly/3VZVPY5 a macOS TouchID prompter for shell scripts
* jollyexec https://buff.ly/3KZ6MDc allow constrained execution from a container to a host
* macOS seatbelt/sandbox profile creator https://buff.ly/4baEsrU
* constrained container networking using sockets https://buff.ly/3RAUkwW
* a PR to DavMail to allow certificate lookups from the O365 GAL https://buff.ly/3xr5X2V

I saw this somewhere on Fedi and thought it was excellent ...

2024-06-27T11:28:59Z

I saw this somewhere on Fedi and thought it was excellent https://motherfuckingwebsite.com

he did, it’s a whole thing, but he sent most of it to his ...

2024-06-24T23:41:57Z

In reply to nevent1q…7qwf
_________________________

he did, it’s a whole thing, but he sent most of it to his parents. LE just covered it at https://youtube.com/watch?v=oELwtNQDP_A

just double check it didn’t mess with some. It does that ...

2024-06-21T15:49:17Z

In reply to nevent1q…k7w8
_________________________

just double check it didn’t mess with some. It does that sometimes.

yeah, me too. Stumbled on it yesterday.

2024-06-21T13:35:07Z

In reply to nevent1q…05wt
_________________________

yeah, me too. Stumbled on it yesterday.

If you’re a mac user struggling to fit everything in your menu ...

2024-06-21T12:24:21Z

If you’re a mac user struggling to fit everything in your menu bar (especially iStat users), this command will reduce the unnecessarily large spacing between icons so they can all fit before the dreaded notch.

defaults -currentHost write -globalDomain NSStatusItemSpacing -int 8

We just hit Winter Solstice in the Southern Hemisphere. That ...

2024-06-21T04:39:37Z

We just hit Winter Solstice in the Southern Hemisphere. That means it’s nearly time to migrate north for BlackHat and DEFCON.

doing a “git add .” after reviewing “git status” can be a ...

2024-06-20T17:24:24Z

In reply to nevent1q…r7a8
_________________________

doing a “git add .” after reviewing “git status” can be a great timesaver.

subscribe to my OnlyCats

2024-06-20T03:41:01Z

In reply to nevent1q…95fk
_________________________

subscribe to my OnlyCats

Recompiling a 20+ year old Unix code base with modern hardening ...

2024-06-19T20:26:24Z

Recompiling a 20+ year old Unix code base with modern hardening compiler flags - and it “just working” the first time is a great feeling.

it really is super useful. I saw so many ways of invoking it to ...

2024-06-19T20:15:26Z

In reply to nevent1q…7jxm
_________________________

it really is super useful. I saw so many ways of invoking it to solve this problem but thought this was nice and clean and might help others when googling.

It turns out you can’t share a Unix socket to a container using ...

2024-06-19T19:26:22Z

It turns out you can’t share a Unix socket to a container using Docker for Mac or Windows.

This was my quick workaround that may be helpful to others: https://gist.github.com/singe/3c6bde78191f1a9bd414a4d729e98f1c

I don’t know what “human centric compute” is, but I can see ...

2024-06-19T08:22:45Z

In reply to nevent1q…c45g
_________________________

I don’t know what “human centric compute” is, but I can see how a CAPTCHA is user hostile. Care to elaborate?

CAPTCHA The Republic ...

2024-06-19T07:03:48Z

CAPTCHA The Republic

If, like me, you didn’t get the reference at first ...

2024-06-18T19:48:53Z

In reply to nevent1q…cuax
_________________________

If, like me, you didn’t get the reference at first https://en.m.wikipedia.org/wiki/Colorless_green_ideas_sleep_furiously

An excellent obituary.

Reposting a comment I made on the internal chat in case it might ...

2024-06-18T14:46:40Z

Reposting a comment I made on the internal chat in case it might be useful to others.

On self censoring your creativity because someone else might have done it already or it might not be good enough:

On the weekend I had reason to reimplement the deprecated macOS ...

2024-06-18T11:01:31Z

On the weekend I had reason to reimplement the deprecated macOS seatbelt/sandbox trace command https://gist.github.com/singe/88aa76814b89a2fc3d6e7a48607706c9

It’s rough and ready right now but works for my purposes. Give it a try if you want to sandbox your macOS commands.

Honestly mandatory reading at this point. ...

2024-06-17T13:00:21Z

Honestly mandatory reading at this point. https://mastodon.sdf.org/@ThinkstCanary/112632004468573615

I just packaged a new release for tidcli my simple Touch ID ...

2024-06-16T18:34:49Z

In reply to nevent1q…dywk
_________________________

I just packaged a new release for tidcli my simple Touch ID command line prompter. It now has both x86_64 and arm64 binaries. I also updated the readme with a usage example.

https://github.com/singe/tidcli

+1 what a nice thing to start here. I appreciate it.

2024-06-14T15:15:09Z

In reply to nevent1q…epzg
_________________________

+1 what a nice thing to start here. I appreciate it.

The MK party’s rejecting of the election results in South ...

2024-06-02T06:23:00Z

The MK party’s rejecting of the election results in South Africa is another early indication of the chaos & corruption they will help entrench in our political system. Calling for a recount when their objection is actually about transmission of the voting tally, not counting, is either stupid or malicious.

Mechanisms exist for objecting to a mistransmission (which are also independently audited) and we’ve had fewer objections this election that last (32 vs 56). No recount needed.

let’s save up and buy white.net you can have molly.white.net if ...

2024-05-28T15:14:06Z

In reply to nevent1q…znhs
_________________________

let’s save up and buy white.net you can have molly.white.net if I can have dominic.white.net ;)

Quote of the day from one of the seasoned Meta bugs bounty ...

2024-05-21T10:09:57Z

Quote of the day from one of the seasoned Meta bugs bounty hunters - true for all hacking “if you go deep enough you’ll find something”. Haroon Meer (npub1wks…80mk) won’t remember telling me in my 1st week at SensePost (npub1zus…7yk2) that his career till that point was just repeatedly going deep in new areas.

hahaha. I wish Sc00bz was on fedi.

2024-05-16T18:42:12Z

In reply to nevent1q…mjwr
_________________________

hahaha. I wish Sc00bz was on fedi.