Nostr notes by nyan

hm, no :3

2026-10-27T13:51:38Z

In reply to nevent1q…dmek
_________________________

hm, no :3

pffff, as if you hold that in your normal shit tier IT ...

2026-10-19T14:28:31Z

In reply to nevent1q…nnnk
_________________________

pffff, as if you hold that in your normal shit tier IT environment, thats actually confidential

...too late :3

2026-10-17T09:32:44Z

In reply to nevent1q…w4tl
_________________________

...too late :3

hmye, stockholm goes on the list :3

2026-10-16T19:09:53Z

In reply to nevent1q…g02m
_________________________

hmye, stockholm goes on the list :3

fuck it, someone name a nice european city to visit in late ...

2026-10-16T19:01:10Z

fuck it, someone name a nice european city to visit in late october

secure@cloud.com is the contact for three separate CNAs, ...

2026-10-16T13:44:47Z

In reply to nevent1q…fy8e
_________________________

secure@cloud.com is the contact for three separate CNAs, apparently? (Jaspersoft, Spotfire, Netscaler)

Shower thought: tool that blocklists every IP trying to complete ...

2026-10-15T20:02:20Z

Shower thought: tool that blocklists every IP trying to complete a TCP handshake (as in: on the final ACK) against any port not in use

Lol. Lmao. A company I applied for a job with in early July ...

2026-10-05T13:21:42Z

Lol. Lmao. A company I applied for a job with in early July finally responded, with a rejection, of course.

Motherfuckers, if it takes you 3 months to write a response ... dont even bother.

except zombies, I guess?

2026-10-03T08:55:47Z

In reply to nevent1q…0v4z
_________________________

except zombies, I guess?

Do you think anyone will actually drop netscaler/citrix over ...

2026-10-03T06:29:27Z

Do you think anyone will actually drop netscaler/citrix over this? Or even just move them behind a von?

yknow, somehow MISP is one of these things I pretty much only ...

2026-10-02T18:21:00Z

yknow, somehow MISP is one of these things I pretty much only know by their vulnerabilities :3

Nostr event nevent1qqs8xapk9ja44qtnwakvmwwag68402er4uvwvsrcdgquekq468wxruqzypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2y0jhtej

2026-10-02T10:42:31Z

IT, OT, sure. But what the fuck is AT.

zefuq??

2026-09-28T07:25:50Z

In reply to nevent1q…4euv
_________________________

zefuq??

I need some input: how much do you use the "&" in ...

2026-09-23T10:55:08Z

I need some input: how much do you use the "&" in natural language as a stand-in for "and" (not programming languages)?

Windows contains an S, just saying

2026-09-22T18:55:51Z

In reply to nevent1q…tzpk
_________________________

Windows contains an S, just saying

Nostr event nevent1qqsffawx0nljvvvgavhxm9xddjgfu0xn0rk086l02fd33uhpednak3czypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2yglynsl

2026-09-22T18:48:43Z

The S in Linux stands for security.

A completely vibes based tier list of USAF aircraft (excluding ...

2026-09-19T16:59:45Z

In reply to nevent1q…dj6v
_________________________

A completely vibes based tier list of USAF aircraft (excluding trainers, transports, ...) which I drew up with < 15s of thought per aircraft which I will absolutely stand behind.

Nostr event nevent1qqsy0atw27cx3mhwqs4f4wggmwg33ctl5ru0fgcj8v22kmuz38r5w4gzypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2y3wseew

2026-09-19T16:09:30Z

Do you think the USAF would sell me a F-117 if I asked nicely?

BALLOONS! DIRIGIBLES! BLIMPS AND ZEPPELINS! Put the computers ...

2026-09-17T17:55:17Z

In reply to nevent1q…2m80
_________________________

BALLOONS! DIRIGIBLES! BLIMPS AND ZEPPELINS! Put the computers into the actual clouds!

Nostr event nevent1qqsr634usjpcp00e25pkcl3n4n60k5p26j22szrw0aspvwyttdvsj3qzypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2yv0z82j

2026-09-10T16:26:09Z

Someone give me a funny tld to check, am booooored

though, honestly, .gov is the one that bothers me the most. Just ...

2026-09-07T17:26:35Z

In reply to nevent1q…rvps
_________________________

though, honestly, .gov is the one that bothers me the most. Just use gov.us like a normal country.

oh, in that case: .statebank. Which state bank? Well, India of ...

2026-09-07T17:25:38Z

In reply to nevent1q…jyfp
_________________________

oh, in that case: .statebank. Which state bank? Well, India of course. They now hold the sole ownership of the .statebank TLD. Every other state bank? Shit out of luck. Including *checks note* the State Bank of Pakistan.

Nostr event nevent1qqsy0pnxqphpa6gv8e3ry6ajcftg58dp779rvn8r5n8sl2clhc4xr2szypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2ysree9p

2026-09-07T16:19:37Z

.... .wolterskluwer is a fucking tld?

Nostr event nevent1qqs9rm6xy5mcs76ef4n5xedkgtysu5c0ceycv7tmdajxzty7nz7l80szypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2yz294sz

2026-09-06T14:09:27Z

3.5in SATA SSD :3

zefuq am I reading...

2026-09-04T20:59:10Z

In reply to nevent1q…ae25
_________________________

zefuq am I reading...

so, mastodon. Boring answer: Private statuses. More interesting ...

2026-09-03T20:58:55Z

In reply to nevent1q…retz
_________________________

so, mastodon. Boring answer: Private statuses. More interesting answer: Filters.

Silly project idea: Trying to store large amount of data in ...

2026-09-03T20:43:41Z

Silly project idea: Trying to store large amount of data in configurations/account metadata of online services.

RE: https://infosec.exchange/@nyanbinary/117207985299047821 ...

2026-09-03T16:26:17Z

RE: https://infosec.exchange/@nyanbinary/117207985299047821

apropos, anyone got a recommendation for a simple fucking audio player? like, mp3 player, shouldn't need network connection, 3.5mm preferred over bluetooth, no apps or shit. I wanna listen to audio & maybe check the time.

quoting
note187h…pjct

its not my fault I didn't bring a music player to the pool to stop my brain from thinking, is it? (it is my fault)

brave words for someone in foopsing distance ...

2026-09-03T16:15:33Z

In reply to nevent1q…2y6f
_________________________

brave words for someone in foopsing distance :neocat_scream_angry:

its not my fault I didn't bring a music player to the pool to ...

2026-09-03T16:12:04Z

In reply to nevent1q…ek33
_________________________

its not my fault I didn't bring a music player to the pool to stop my brain from thinking, is it? (it is my fault)

whats a chasubel but a boymodding hoodie

2026-09-03T16:09:26Z

In reply to nevent1q…905v
_________________________

whats a chasubel but a boymodding hoodie

Oh, plenty of evangelicals are afraid of your subversive powers!

2026-09-03T16:08:08Z

In reply to nevent1q…vz0u
_________________________

Oh, plenty of evangelicals are afraid of your subversive powers!

Being trans is a lot like being pope, if you think about it - ...

2026-09-03T16:07:33Z

Being trans is a lot like being pope, if you think about it - name change, needs approval from a bunch of old dudes (in some countries) & an eternal waiting list, plenty of DIYers, ...

ill probably just keep wearing it on laundry days tbh, its still ...

2026-09-03T10:29:27Z

In reply to nevent1q…8d0k
_________________________

ill probably just keep wearing it on laundry days tbh, its still a perfectly fine hoodie. Just feels odd...

Ey, was mach ich jetzt mit dem Pulli mit dem Logo meines ...

2026-09-03T10:23:36Z

Ey, was mach ich jetzt mit dem Pulli mit dem Logo meines ehemaligen Arbeitgebers nachdem ich da in Teilen gekündigt hab weil ich mit so ner Firma nix mehr zu tuen haben will...

So, has anyone done the math on the predictive power of EPSS vs ...

2026-09-02T20:39:58Z

So, has anyone done the math on the predictive power of EPSS vs actual kev catalogues yet? :eyes_squint:

Like, I guess the primary metric would be "how many near-future-KEVs would you have missed using EPSS for priorisation", with "..and how many did you 'unnecessarily' patch"?

brb, sending dudes

2026-09-02T18:18:22Z

In reply to nevent1q…4ng3
_________________________

brb, sending dudes

out of curiousity, what do I need to do to get a shutout? ...

2026-09-02T18:17:05Z

In reply to nevent1q…0erc
_________________________

out of curiousity, what do I need to do to get a shutout? :neobot_angel_pleading:

Using LLMs to reformulate documents to fingerprint the recipient ...

2026-09-01T19:12:43Z

Using LLMs to reformulate documents to fingerprint the recipient to catch leaks

Yeah, I definitely need to build a grouping feature into ...

2026-09-01T14:23:57Z

Yeah, I definitely need to build a grouping feature into [@fuckeduprefs_bot](https://infosec.exchange/@fuckeduprefs_bot )

same, xfce, same ...

2026-09-01T10:46:09Z

same, xfce, same

not mine, I stole it from either @npub1s6e…n008 or ...

2026-08-31T20:16:24Z

In reply to nevent1q…4723
_________________________

not mine, I stole it from either :rainbowCrow: (npub1s6e…n008) or K. Reid Wightman :verified: 🌻 :donor: :clippy: (npub1jfd…v80a) (forgot who :( )

decode the morse code ;)

2026-08-31T18:57:34Z

In reply to nevent1q…eczc
_________________________

decode the morse code ;)

Nostr event nevent1qqs8h0mm4u56mgwk0spyfp5kkyyl4kqw7pfnxuggv0elayu5xv6j22qzypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2y5yqeux

2026-08-29T05:15:39Z

meow meow meow meow

logs? The thing thats made from dead trees? Do we look like a ...

2026-08-28T13:06:53Z

In reply to nevent1q…myks
_________________________

logs? The thing thats made from dead trees? Do we look like a woodworking enterprise? Of course we dont have "logs"...

to quote the pip description: > Built to encrypt anything from ...

2026-08-27T19:30:23Z

In reply to nevent1q…xv6c
_________________________

to quote the pip description:

> Built to encrypt anything from grandma's pie recipe to the nuclear launch codes

I was literally just looking at them & I have no idea what it ...

2026-08-27T19:25:02Z

In reply to nevent1q…9h8u
_________________________

I was literally just looking at them & I have no idea what it is but some of them are bonkers: https://db.gcve.eu/vuln/cve-2026-81681

Cloud stuff should have an easy to set up "shoot everything ...

2026-08-27T09:22:50Z

Cloud stuff should have an easy to set up "shoot everything if cost >= 5 bucks" option

Oh great, just ran into our automated security scanning as part ...

2026-08-26T10:06:20Z

Oh great, just ran into our automated security scanning as part of our pipelines for the first time.

This means that I cant deploy an application update because alpine 3.24 doesnt yet include yesterdays openssl updates & this is detected as two High sev vulns, both DoS. One, our application can only be reached through the waf, so good luck with exploiting some quic vulns. Two, we dont even use tls in the image itself, this is handled by the hoster. Three, the vulnerable version runs anyway, I just cant update. Four, as the vulns that are tagged as High are DoS & as such exploitation impact would necessarily be less than turning it off.

No, I cant skip the test, I dont have the permissions...

yeah, sitting is kinda hard rn :3

2026-08-24T20:06:38Z

In reply to nevent1q…7spt
_________________________

yeah, sitting is kinda hard rn :3

dont make me sit down and find one

2026-08-24T20:01:09Z

In reply to nevent1q…lr75
_________________________

dont make me sit down and find one

thats D & we had that, too

2026-08-23T19:43:45Z

In reply to nevent1q…ygvd
_________________________

thats D & we had that, too

Reminder that i++ is a postincrement: it returns the value before ...

2026-08-23T18:38:46Z

Reminder that i++ is a postincrement: it returns the value before incrementation.

This means that the expression C has the same value as the subsequent expression C++.

Heh, how did I make it through writing this one without making a ...

2026-08-23T14:18:48Z

In reply to nevent1q…80fa
_________________________

Heh, how did I make it through writing this one without making a single joke about Githubs uptime

Mrrrrp meow. New blogpost, looking at CVE references again. This ...

2026-08-23T14:08:18Z

Mrrrrp meow. New blogpost, looking at CVE references again. This time: Github references: https://blagh.nyanbinary.de/posts/github-cve-references/

This one ... is a lot of plots for not a lot of information & the basic conclusion is something Dio9sys (npub1n4k…jm05) (I think?) already noted months ago: The writeups by the original reporters (& associated PoCs etc) keep disappearing quite quickly. We are talking "10-30% in 5 years", making up (probably) the majority of dead github references.

So if you are a CNA: Please host those yourself or REALLY make sure to archive those.

fr tho, maybe R, depending on what you are doing?

2026-08-23T09:35:17Z

In reply to nevent1q…jpxt
_________________________

fr tho, maybe R, depending on what you are doing?

have you considered rust? /s :neobot_giggle:

2026-08-23T09:31:26Z

In reply to nevent1q…xsgc
_________________________

have you considered rust? /s :neobot_giggle:

could have stayed but neither wanted to continue working for a ...

2026-08-22T19:49:33Z

In reply to nevent1q…u2gz
_________________________

could have stayed but neither wanted to continue working for a company that treats their employees like this nor deal with the clusterfuck of what comes after a layoff of this size at this short of a notice.

alas money can be exchanged for goods and services and I am ...

2026-08-22T19:46:49Z

In reply to nevent1q…xrnq
_________________________

alas money can be exchanged for goods and services and I am nothing if not an appreciator of goods and services :neocat_pensive:

RE: https://infosec.exchange/@fuckeduprefs_bot/117140752768921896 ...

2026-08-22T19:37:23Z

RE: https://infosec.exchange/@fuckeduprefs_bot/117140752768921896

see, fuck you, johnsoncontrols. First, just link to the fucking advisory, it isn't hard, its literally right there. Second, why does the HEAD 404 but the GET 200? Third, Why does your HEAD response have a content-length: 103 but no actual content?

quoting
note1uyq…vrpt

OwO whats this, new reference?
*looks inside*
Status 404

CVE: CVE-2026-27875
Reference: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://db.gcve.eu/vuln/CVE-2026-27875

Fiiine, I wrote a cover letter instead of doing more data ...

2026-08-22T19:30:52Z

Fiiine, I wrote a cover letter instead of doing more data dumpster diving. Now give headpats

oh, and having to enter an email address twice but one of the ...

2026-08-22T10:34:34Z

In reply to nevent1q…lzfl
_________________________

oh, and having to enter an email address twice but one of the fields doesn't allow copy-paste

Nothing kills my interest in working at your place quicker than ...

2026-08-22T10:33:35Z

Nothing kills my interest in working at your place quicker than having to write a coverletter

Only reason I didnt push some half-broken shit to prod today is ...

2026-08-21T18:08:16Z

Only reason I didnt push some half-broken shit to prod today is that I took the day off. :3

why the hell is our edr admin internet-accessible.

2026-08-21T14:02:44Z

In reply to nevent1q…e09a
_________________________

why the hell is our edr admin internet-accessible.

you know, try to tile the heptagons, notice they dont, then ...

2026-08-20T17:34:13Z

In reply to nevent1q…qtrs
_________________________

you know, try to tile the heptagons, notice they dont, then pretend the trees of gaps were intended as fjords :3

its called "fjords"

2026-08-20T17:29:44Z

In reply to nevent1q…s2qz
_________________________

its called "fjords"

Nostr event nevent1qqsg04ueqmdahkurc6nmnppykeknmvpp59kl7zlzvcyws9ye5237rdqzypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2ylutwyc

2026-08-19T19:08:59Z

I posted this just for me. It doesn't have to make sense to ...

2026-08-19T17:11:20Z

In reply to nevent1q…6trw
_________________________

I posted this just for me. It doesn't have to make sense to anyone else

Nostr event nevent1qqstnf0n8x2jpm6s2g6mztvmcmx4tmvxsjv3fwkc2eycp0f0w4x08yczypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2ykpgj4n

2026-08-19T17:10:41Z

Palo Avarto

...motherfucking .lgbt is on the list? CANCELLED

2026-08-19T14:36:35Z

In reply to nevent1q…zjj6
_________________________

...motherfucking .lgbt is on the list? CANCELLED

just feels like more of a ... statement than an actual useful ...

2026-08-19T14:34:42Z

In reply to nevent1q…nd29
_________________________

just feels like more of a ... statement than an actual useful tool...

... which, yeah, fair, it's gayint :neobot_giggle:

also, like, .accenture as an example, as much as I like to make ...

2026-08-19T14:34:09Z

In reply to nevent1q…y8sx
_________________________

also, like, .accenture as an example, as much as I like to make fun of it... yeah, its low impact to block (not even sure if its used at all) but it's also, like, 0 risk not to block?

still annoyed this includes a bunch of regional tlds, tbh. Like, ...

2026-08-19T14:33:02Z

In reply to nevent1q…e38e
_________________________

still annoyed this includes a bunch of regional tlds, tbh. Like, I get it, y'all are the big US, but blocking .nrw may not actually be low-regret for Europeans, lol :neobot_giggle:

idk what you mean, the Dow Jones is over 50000? :neocat_confused:

2026-08-19T14:08:32Z

In reply to nevent1q…wagp
_________________________

idk what you mean, the Dow Jones is over 50000? :neocat_confused:

I know Zero Trust is the hot shit and all but Zero Trust is a ...

2026-08-19T14:06:57Z

I know Zero Trust is the hot shit and all but Zero Trust is a requirement, not a permission. Zero Trust doesn't mean "drop the perimeter as a protection measure", it means "the perimeter isn't a sufficient protection measure, you need more".

Wait, no, it's not the hot shit anymore, we now do agentic security, apparently.

You are not an expert at $thing. Do not create stunning $thing at ...

2026-08-18T09:33:48Z

You are not an expert at $thing. Do not create stunning $thing at a world class level. Do make mistakes.

I heard y'all liked Patch Tuesday. As such we are now also ...

2026-08-17T13:45:19Z

I heard y'all liked Patch Tuesday. As such we are now also introducing Patch Monday, Wednesday, and Thursday. Unfortunately the Change Board was opposed to Patch Friday so instead we are introducing Emergency Patch Friday.

i swear to fucking god, We’re building the one ring to rule ...

2026-08-17T12:52:40Z

In reply to nevent1q…me6z
_________________________

i swear to fucking god, We’re building the one ring to rule them all, but this time for the defenders to have this power. is the most braindead "I didnt actually engage with the material" sentence I have ever read, ffs...

I may have overdone it this time

2026-08-16T09:39:21Z

In reply to nevent1q…eau7
_________________________

I may have overdone it this time

inefficiently coding a solution to force yourself to do chores ...

2026-08-16T09:38:06Z

inefficiently coding a solution to force yourself to do chores while the computer computes 😌

RE: https://mastodon.social/@fesshole/117095714647436178 so, I am ...

2026-08-14T20:32:05Z

RE: https://mastodon.social/@fesshole/117095714647436178

so, I am not saying there is an opportunity here but I frequently see phishing sites use wikipedia images as part of the fake sites and ....

quoting
note1lqe…9m6h

How did I get into server backend stuff? I used to have a simple static HTML website but some idiot hotlinked an image costing me bandwidth so I learned enough to serve his site's users Goatse and everyone else the legit image. That's how I got started with backend stuff.

How the fuck am I supposed to track link availability if github ...

2026-08-12T18:23:32Z

How the fuck am I supposed to track link availability if github cant even be asked to have sufficient uptime to miss 2 consecutive checks, ffs

are you THAT predictable? :neobot_giggle:

2026-08-12T13:33:54Z

In reply to nevent1q…c3w3
_________________________

are you THAT predictable? :neobot_giggle:

"I wrote that code a year ago, I have no idea what I was ...

2026-08-11T18:10:03Z

"I wrote that code a year ago, I have no idea what I was doing" :neofox_drake_dislike:
"I have no idea what I was doing when I started writing this line" :neofox_drake_like:

Nostr event nevent1qqsg9h0qf9q880u3je0946vlyvt6zexut76dxeq2wx9059asmhgcquszypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2yeqyhpr

2026-08-10T16:32:07Z

I didnt forget to eat YOU forgot to eat :neocat_scream_angry:

Nostr event nevent1qqstfr9s6ecu5dy5nprapn9yyn6xsvch3svt2n4vcnr6teu29xega5szypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2y7ut3yv

2026-08-08T14:13:22Z

Meow

The kind of brain that remembers the reason behind a specific ...

2026-08-08T06:22:08Z

The kind of brain that remembers the reason behind a specific emoji on a discord server that was added before any of the current batch of mods even joined but also forgets things like "taking meds", "a meal or two", or "drinking water".

RE: https://infosec.exchange/@kev_bot/117056104549752230 Happy ...

2026-08-07T20:46:18Z

RE: https://infosec.exchange/@kev_bot/117056104549752230

Happy Friday afternoon/evening to all Progress Software customers 🥳

quoting
note13kg…nuhr

New KEV: CVE-2026-8037
https://www.cve.org/CVERecord?id=CVE-2026-8037

In:
* Progress Software/Object Scale Connection Manager
* Progress Software/LoadMaster
* Progress Software/MOVEit WAF
* Progress Software/ECS Connections Manager

Added to CISA KEV catalog on 2026-08-07: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037

SSVC:
*Exploitation: active
*Automatable: no
*Technical Impact: total

EPSS: 0.847930000

spreading misinformation on the internet? I'd never

2026-08-07T14:31:18Z

In reply to nevent1q…tpyh
_________________________

spreading misinformation on the internet? I'd never

Oh shit! ...

2026-08-07T14:30:33Z

Oh shit!

thats a good question, where is GAYINTs AI strategy, do y'all ...

2026-08-06T13:33:45Z

In reply to nevent1q…spv6
_________________________

thats a good question, where is GAYINTs AI strategy, do y'all want to be left behind :neocat_scream_angry:

Ok, I need someone to explain file access auditing in Windows to ...

2026-08-05T19:12:54Z

Ok, I need someone to explain file access auditing in Windows to me...

I enable the Audit File System policy, then I create an Audit "permission" entry for files/folders I want to monitor (I guess those are the SACLs? Would help if frontend & docs used in any way related language). Do those grant permissions (the frontend kinda implies that?) or are they just a mask for events? I guess the second?
So if I Everyone/The Entire List Of Permissions the Audit "permission" then I get all accesses?

Nostr event nevent1qqsdyerdv8pf2ckrq5n30we9adh3ulmc657rwwzkvg7uzuxfgueatmqzypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2ycnppaq

2026-08-04T16:38:50Z

Agents.md but only giving subtlety wrong instructions.

Civic pride 😌 ...

2026-08-04T15:23:47Z

Civic pride 😌

I have no idea what you'd be celebrating but good on you ...

2026-08-04T10:08:49Z

In reply to nevent1q…c96y
_________________________

I have no idea what you'd be celebrating but good on you anyway :3

Nostr event nevent1qqsw8g84ypn5syw30p8lksjycy47r584a6scdplvdl7fn24akudak7gzypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2y5swnqh

2026-08-04T10:08:31Z

Happy August 4th to those that celebrate.

spreadsheets? :neofox_drake_dislike: spreading them cheecks! ...

2026-08-04T09:54:36Z

spreadsheets? :neofox_drake_dislike:
spreading them cheecks! :neofox_drake_like:

<li>Yip! It's not bad, fwiw, it just ...

2026-08-03T12:00:34Z

In reply to nevent1q…flrl
_________________________

<li>Yip! It's not bad, fwiw, it just doesn't provide any protection against a someone changing the tag later. The package guidelines mention this ( <a href="https://wiki.archlinux.org/title/Arch_package_guidelines#Package_sources"; target="_blank" rel="nofollow noopener" translate="no">https://wiki.archlinux.org/title/Arch_package_guidelines#Package_sources</a> ) as a best practice. That said: None of this matter if you pin the hash of the tarball or something anyway.</li><li>I meant the case where an attacker-controlled key is pinned as a valid/trusted key. This could be an attacker substituting the developer keys with their own (detectable, of course, if someone checks) or the attacker ... being the dev :neobot_giggle:</li>

Nostr event nevent1qqsg5k2ru6re00w4x45yzw9k6tgxmymr0xm7qgjmnserthvldpm2tqczypv5zenar8jqkavpjaka7g9l4c5qytmgxl65vlyk7r3h0knm5fj2ymjz3k8

2026-08-03T11:23:22Z

Head hurty :neocat_pensive: