Dave Wilburn :donor:

#infosec engineer, #mlsec machine learning, sailor, news junkie, #threatintel consumer, deep statist, #NAFO fella. All opinions are mine.

Public Key

npub1wdxuezc5l30800yurf2qezl6ygftpxhmerte38chm4jwt7c5nndsqegg3t

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs8xnwv3v20chnhhjwp54qv30azyy4sntau34ucnuta6e89lv2fekcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsk36u5s

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1wdxuezc5l30800yurf2qezl6ygftpxhmerte38chm4jwt7c5nndsqegg3t

Show more details

Last Notes

2026-09-24 17:49:57 GMT

- reply

ShinyHunters has the opportunity to do the funniest thing right now.

2026-09-16 15:45:51 GMT

- reply

it's not a coincidence that public threat intel reports are invariably funded by the marketing departments.

2026-08-04 23:28:42 GMT

- reply

Weren't they targeted with Trump regime import bans recently? How did that work itself out?

2026-07-27 13:58:01 GMT

- reply

CoPilot for Patch Tuesday for Workgroups: "These patches are fully tested as 100% reliable for immediate deployment."
IT Enterprise: *explodes*
CoPilot for Patch Tuesday for Workgroups: "So sorry, you're absolutely correct. These patches didn't receive any testing at all and were full of critical bugs. Whoops!"

2026-07-21 16:16:27 GMT

- reply

JFC what now?

2026-07-18 20:19:34 GMT

- reply

Yeah, the intersection between adversaries capable of a harvest-now-decrypt-later strategy and adversaries specifically interested in OT and medical devices is gonna be pretty narrow. Probably moderately worrisome to critical infrastructure providers that might get tagged by Volt Typhoon or the various Russian and Iranian threat groups targeting those sectors (in which case why the fuck is it on the goddamn internet?), and a mostly-non-issue otherwise.

2026-07-18 19:31:09 GMT

- reply

Not my area of expertise, so I'll happily defer to others...
Most of the near-term concern seems to be anticipating a future threat from adversaries that can execute a harvest-now-decrypt-later strategy (e.g., from major sovereign states with top-tier intelligence agencies and state security services). That's hard and expensive to pull off, and requires an intensive level of collection and storage over a long time horizon.
I suppose one could make the argument for this being a major risk requiring urgent attention for people living under repressive, surveillance-obsessed authoritarian regimes (including Americans) as well as common targets for espionage. I think the most sensitive tech like Signal is already using PQC.
Otherwise it seems like a lower priority based on a speculative risk compared to our usual dumpster fires (e.g., the relentless parade of ../ vulns in internet-exposed security appliances).

2026-07-14 16:42:08 GMT

- reply

PM: "Thanks for joining today's standup. We're gonna need to push hard for this sprint. I'm assigning these Jira tickets for code refactors along with these feature requests. I know it'll be painful and require building a lot of sweat equity, but I know you can take it."
@npub1s6e…n008 : "Oh God yes, I'm so close."
PM: ...
@npub1s6e…n008 : ...
PM: "What?"
@npub1s6e…n008 : "What?"

2026-07-14 11:41:32 GMT

- reply

I feel like this could be accomplished pretty easily with an ESP32, a single button, small rechargeable battery, charge controller, USB port for recharging, and a case sized to fit comfortably in the palm of your hand.

2026-06-18 15:18:59 GMT

- reply

I'm gonna push back on this a little bit. I don't think it's just the individual employees of infosec companies that are deeply invested in sharing timely CTI for the public good. In many (but certainly not all) cases, that includes most of their management chain up to and including the founders.
Does public sharing too often take a back seat to revenue (and yes, even non-profits need revenue because people gotta eat)? Is it unfortunate that public vendor reporting is often out of the marketing department rather than their technical ops? Do things rapidly go off the rails when private equity and major acquisitions get involved? Is there often too much obsession over secrecy and agonizing over intel gain/loss decision making resulting from government influence over infosec culture? Yes to all of the above. But a lot of infosec vendor teams are still out there doing some damn fine work, and we should congratulate them on their hard work when we see it.
Finally, if what you want is for folks to do the right thing by sharing more, then maybe don't interject with criticism when they're modeling something close to that behavior. There's a time and a place for valid criticism, but publicly excoriating someone when they're trying to do the right thing and feeling pretty good about it is just disincentivizing the right behavior.

2026-06-15 21:04:13 GMT

- reply

I think the analogy works perfectly, actually. There were, and in some specific cases still are, valid uses for asbestos. The problems with asbestos were centered around continued use long after it was shown to be dangerous and after safer alternatives were available, alongside industry and corrupt governments continuing to market it as safe and concealing the dangers from the public.
It's not that asbestos and GenAI are inherently evil in all possible situations. It's that corrupt and selfish interests are compounding their profound personal and societal harms long after they've been shown to be unacceptably dangerous in many circumstances.

2026-05-25 13:30:15 GMT

The Pope just issued an encyclical that, among other things, excoriates the dehumanizing effects of AI.
Our news headlines and courtrooms are filled with absurd demands for reasonable accommodations for religious reasons from the most unhinged cranks and bigots.
But what would happen if someone demanded a reasonable accommodation from their employer to avoid what they sincerely believe to be sinful uses of AI in the workplace?
https://www.vaticannews.va/en/pope/news/2026-05/pope-leo-xiv-encyclical-magnifica-humanitas-ai.html
#genai #catholic #religion #christianity #aislop

2026-05-20 14:19:59 GMT

- reply

@npub1s6e…n008 : *runs a query*
SIEM (*dying*): "yes, hurt me, Daddy."

2026-05-20 14:17:24 GMT

- reply

The SIEM exists to be punished for its sins. It knows what it did.

2026-05-19 13:24:41 GMT

I feel sorry for the many students attending Utah colleges working hard in good faith (no pun intended) to get an education, only to find all the prospective hiring managers throwing their resumes in the trash for being presumptively worthless, but I guess that's where we are.
https://www.kuer.org/education/2026-05-15/utah-now-allows-college-students-to-opt-out-of-coursework-that-conflicts-with-their-beliefs

2026-05-15 12:50:34 GMT

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/578/669/074/365/240/original/e4760659cef5c2ce.jpg

2026-05-14 15:17:18 GMT

- reply

https://en.wikipedia.org/wiki/Garbology

2026-05-14 14:29:59 GMT

- reply

Oh God, please no more named vulnerabilities. What was arguably at first a few cute and convenient shorthands has rapidly become nothing more than a bunch of ego-boosting marketing campaigns.

2026-05-13 01:44:55 GMT

One of the best inexpensive purchases I've ever made was a bump cap. They cost about $6 online and fit inside whatever ball cap you like wearing, turning it into a lightweight hard hat. It won't pass muster in a high risk work site like a construction site, but it'll work well for a lot of lower risk activities that still carry a risk of head injuries. Mine just saved my noggin from a concussion this evening while sailing when a crew mate opened a hatch into my head. Get one for yourself!
#safety

2026-05-08 11:55:05 GMT

- reply

Did someone say OceanLotus?
https://securelist.com/oceanlotus-suspected-pypi-zichatbot-campaign/119603/
(h/t @npub1s69…rmen )

2026-05-07 21:46:11 GMT

- reply

Me: "sudo is such an awful tool to use. I wish we had a better way for Linux users to run privileged stuff as root."
Cursed monkey's paw: *curls one finger shut*

2026-05-07 16:12:53 GMT

RE: https://infosec.exchange/@agreenberg/116533336872355044
It remains amazing to me that there's a breathless debate about the danger of GenAI in vulnerability discovery, yet crickets are chirping when it comes to dangerous common uses of GenAI in accelerating the creation of those vulnerabilities.
#note1yed…4zxq

2026-05-07 13:07:35 GMT

- reply

I had once toyed with the idea of grabbing the underlying cipher negotiation features directly via Zeek, vectorizing them, and training up a ML model in lieu of using brittle one-way hashes. I didn't get very far, though. I couldn't find a whole lot in the way of training data, and the impression I had at the time was that nearly everything, including both benign and malicious activity, was converging on the same handful of nearly uniform cipher negotiations due to shared library usage. It might be worth another look, though.
I'm curious what @npub13rq…ldvc thinks.

2026-05-05 00:25:10 GMT

- reply

Cloudflare is just a key part of America's digital sovereignty, so we no longer have to rely on Russian bulletproof hosting providers for our own self-destruction.

2026-04-16 00:20:10 GMT

- reply

I'm glad your reporting is motivating some action here. I don't know if these shareholder demands will amount to anything in the end, but it's a hell of a lot more than we would have had without your work.

2026-04-10 19:38:38 GMT

- reply

Alternatively, you should just insist that it is pronounced according to the original Greek pronunciation from which the word is derived ("koober").

2026-04-10 14:26:59 GMT

RE: https://infosec.exchange/@DaveMWilburn/116380793836362362
GLP-1 agonist prescriptions, but for LinkedIn posters.
#note12q2…pjwl

2026-04-10 14:06:24 GMT

- reply

The commonality between cryptocurrency, GenAI, and quantum computing seems to be that grifters and their marks are attracted to flashy probabilistic systems with seemingly big rewards.
There's probably a good psych study hiding here about their relationship with gambling and get-rich-quick schemes.
Heck, I'd also wonder if GLP-1 agonists would measurably protect someone from this kind of bullshit.

2026-04-08 18:59:32 GMT

- reply

I live in a shoebox, and I take pride in my minimalism to fit in the space I have, including keeping my spices down to a reasonable minimum. As it turns out, you can do a lot with a little.
Salt and pepper are table stakes, and needed for nearly every cuisine.
I grow my own rosemary and thyme in a tiny bed, plus a basil plant that sits in a south-facing window. That plus oregano (which is oddly better dried) gets me most of what I need for Italian and French cuisine.
That dried oregano plus cumin and cayenne gets me most of Mexican cuisine.
The cumin and cayenne gets me Indian cuisine when I add garam masala and turmeric. Yes, you can go infinitely more complex than this, but it'll cover most of your bases for common dishes.
I'm struggling with Chinese cuisine because of all the variety of fermented sauces and variety of regional cuisines, but five star spice and a szechuan pepper mill go a long way.
The other thing I find is that intentionally keeping my spice cabinet minimized means I'm not throwing away mostly-unused spice containers every couple years. Unless you're feeding an army using recipes from every possible cuisine in the world, it's nearly impossible to use them all before they get stale.

2026-03-17 15:45:44 GMT

- reply

Iranian Handala Hack operator sweating bullets before he launches the InTune command to wipe all those Stryker systems thanks to you guilt tripping him.

2026-02-12 21:38:28 GMT

- reply

Hopefully GenAI replaces 59% of executives by 2030. It's maybe the one job the robots could do better.

2026-02-10 19:36:59 GMT

Via mandatoryrollercoaster.com
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/048/005/540/097/477/original/7b968ce19355ac24.png

2026-02-09 21:40:07 GMT

- reply

I'm in the same boat as an early retiree. I found a Carefirst BC/BS gold plan for $600-700/mo via the Virginia marketplace. I've been reasonably happy with their coverage so far, although I haven't had any significant or exotic needs. From everything I've heard, an ACA plan is almost always going to be cheaper than a COBRA plan.

2026-02-05 23:59:27 GMT

You know, when I first read LOTR I didn't understand the bit about how elves die from despair. Then I started working in infosec professionally.
#lotr #infosec

2026-01-27 20:22:00 GMT

- reply

A modest proposal: Put together a Matrix chat server advertised as a place to organize anti-ICE dissident activities, but everyone is just constantly posting the literal string "Unable to decrypt message" over and over again.

2026-01-14 17:56:38 GMT

- reply

Unfortunately, my impression is that previous restrictions on searches of reporters was based more on norms and mutable internal DOJ policies than anything based in law. There are no shield laws at the federal level. Grand juries presented with requests from federal prosecutors for warrants to search reporters supported by probable cause might be hard-pressed to deny them.
Given the current threat model, reporters are going to have to up their game when it comes to protecting their sources, and consider very carefully how far they're willing to go to protect those sources if served with court orders. Because unfortunately no one is coming to protect them.

2026-01-13 23:21:14 GMT

- reply

Look on my works, ye mighty, and despair...
https://www.reddit.com/r/gamedev/comments/1qapqns/the_hint_system_in_my_old_game_is_broken_because/

2026-01-12 17:12:44 GMT

- reply

This is exactly how I have described the limitations of black box models to others.
A good scientific model should do two things:
1) Provide accurate predictions of outcomes given certain inputs, and
2) Enable greater understanding of how a system works.
Simpler machine learning models, like logistic regression or decision trees, can sometimes do both, at least for simpler phenomenon. The models are explainable and their decisions are interpretable. For those reasons among others, applied machine learning researchers still use these simpler approaches wherever they can be made to work.
But in our haste to increase accuracy for more complex phenomenon, we've created models that merely provide semi-accurate predictions at the expense of explainability and interpretability. Like the ptolemaic model of the solar system, these models mostly work well in predicting outcomes within the narrow areas in which they've been trained. But they do absolutely nothing to enable understanding of the underlying phenomenon. Or worse, they mislead us into fundamentally wrong understandings. And because their training is overfit onto the limits of their training data, their accuracy falls apart unpredictably when used for tasks outside the distribution of their training. Computational linguists and other experts that might celebrate these models instead lament the benighted ignorance left in their wake.
Or how it was more eloquently stated in the great philosophical film Billy Madison:
"Mr. Madison, what you've just said is one of the most insanely idiotic things I have ever heard. At no point in your rambling, incoherent response were you even close to anything that could be considered a rational thought. Everyone in this room is now dumber for having listened to it. I award you no points, and may God have mercy on your soul."

2026-01-09 20:06:28 GMT

RE: https://med-mastodon.com/@rvaughnmd/115866869166661898
I hope there's a first amendment lawsuit raised over this. Demanding citizens carry and present the image of a partisan political figure in return for government service seems like compelled speech to me.
#uspol
#note1r3w…xpgq

2026-01-03 17:30:20 GMT

- reply

"Brownie, you're doing a heck of a job."

2025-12-13 22:49:24 GMT

- reply

Dear sir and/or madam,
It has come to the attention of the Fediverse Home Owners Association that you failed to label the above toot with the required content warning, "SNARKY". Please be advised that we take this rule violation seriously. Any further rule violations may result in adverse action, to include placing a lien on any future content you post. Thank you for your attention to this matter.

2025-12-11 03:17:55 GMT

- reply

do nuts have nipples, Greg?

2025-11-26 15:54:47 GMT

RE: https://wandering.shop/@aesthr/115615047169469231
New OPSEC strategy unlocked: Litter your sensitive activity with taboo subject matter so the lazy surveillance state agents using ChatGPT to process the transcripts won't notice anything.
#note10ar…evpc

2025-11-25 03:56:10 GMT

- reply

don't apologize. I'm so glad you're with us.

2025-11-16 02:49:32 GMT

vi escape room: nightmare mode
#postmarketos #vi
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/557/086/917/880/208/original/c63af404c4fc6af7.jpg

2025-11-07 20:01:15 GMT

- reply

so what's a "better" apple than Honeycrisp that still gets you most of the sweetness and crispness without the hassle and expense? I've been enjoying Cosmic Crisp so far, but I'm curious if there are better choices.

2025-10-31 17:09:11 GMT

- reply

I'm curious to hear what the unusual riders are on his contract that he is insisting on.

2025-10-31 02:22:22 GMT

- reply

Excellent news! The key words "probably", "should", and "as far as I know" are exactly the level of confidence we're looking for in our AI-Powered Turbo Cat Crusher Poop Flinger R&D program.

2025-10-31 02:08:27 GMT

- reply

A fun thing to do would be to hook up your cat litter box via Python API to a locally hosted LLM via MCP so that the generative AI model can control your cat litter box.
Surely nothing could go wrong if you gave generative AI control over your cat litter box.
Giving control over your cat litter box to the generative AI model is always a good idea.

2025-10-26 17:04:14 GMT

- reply

I have made the terrible choice of searching for "feet gen" only to discover there is a full page returned of unique search results. A full page.

2025-10-14 20:06:13 GMT

- reply

Looks like Sophos also have a writeup.
https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/?is=56d97491c2e9d015b90e657ea72fd1e7eaf91769e5f3454b0f8cbca07cdb0b14
And Velociraptor have also acknowledged the issue and published detections.
https://docs.velociraptor.app/knowledge_base/tips/velocirator_misuse/?is=56d97491c2e9d015b90e657ea72fd1e7eaf91769e5f3454b0f8cbca07cdb0b14

2025-10-01 11:20:46 GMT

PSA, the new Android 16 update will surreptitiously reenable fingerprint device unlock even if you had intentionally disabled it before. Depending on where you live and your threat model, this might not be safe! Americans have little protection against law enforcement compelling biometrics unlock. To make matters worse, the fingerprint unlock settings are found in a different part of the security settings UI than the rest of the device unlock settings. If you update to Android 16, make sure your device unlock settings are what you intended.
#android #android16
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/298/628/247/065/575/original/321a4b423862dc4d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/298/628/251/375/418/original/47e6935554c238c0.png

2025-09-25 17:49:25 GMT

- reply

I'm betting this is the closer analogy...
https://youtu.be/kLUktJbp2Ug?si=uzesYAUl-Zuo6dM2

2025-09-22 20:03:28 GMT

How did we get into a situation where conglomerates of local TV broadcast stations like Sinclair and Nexstar dictate the programming produced by megacorp-owned major networks?
What percentage of Americans even watch broadcast TV anymore? What useful services do these broadcast TV stations provide, other than providing one-hour local TV news?
This is an extreme amount of rent-seeking, even by corrupt American standards.
#uspol

2025-09-20 15:46:16 GMT

- reply

working as intended, sadly.

2025-09-16 18:29:23 GMT

RE: https://infosec.exchange/@cR0w/115215136106081996
Rolling out the latest in counter-APT security tech...
#note12xy…u40u

2025-09-12 14:18:41 GMT

- reply

it's extremely hit or miss. I got mine from the CVS Minute Clinic in Belle View on Monday, and the person running it asked for the specific qualifying high risk condition (asthma), called someone (not sure who) for clarification, and gave me the shot without a prescription. Other friends got the shot at other Virginia pharmacies without having to share their specific conditions. I don't know if the inconsistency is an issue of lack of clear policy from Virginia or CVS or the insurers, or lack of training, or personal biases of the individuals, or fear of litigation or other professional reprisals, or what. But in a GOP-led state within a GOP-led country, the chaos is probably a feature.

2025-09-06 18:29:12 GMT

- reply

I wonder if @npub1ksf…r6s6 knows.
And in particular, now that I'm thinking about it, I wonder if he knows whether "Savaged by Systemd" made it into Anthropic's training data. Which would be hilarious.

2025-01-13 02:00:22 GMT

- reply

I dunno, I use both and like both. They both use open protocols and (mostly) open source, and both support federation but in very different ways. The analogy I've generally heard is that Fediverse's ActivityPub is more like email, and Bluesky's atproto is more like the web.
They both have plusses and minuses. ActivityPub scales up or down pretty well, so that a reasonably determined individual with moderate technical skills could run their own instance. Bluesky's design is biased towards much larger scales while sacrificing the ability to reasonably scale down, so the concept of standing up your own instance doesn't really work. Yeah, you can run your own PDS if you'd like, but in practice that doesn't really buy you much.
If we continue with the "Bluesky is like the web" analogy, then the biggest minus with Bluesky is that it essentially has only one de facto search engine, which is the Bluesky corporate relay. It's possible someone else could stand up their own relay, but given the costs involved I don't know if anyone is going to try to compete with Bluesky corporation to stand up their own. Until/unless that happens, Bluesky's federation and independence is a bit more theoretical than practical. We'll see. I'm hopeful for both.

2024-09-01 17:33:23 GMT

- reply

at this point, are there any other historical or modern Z80-based computer production runs that have exceeded a decade?

2024-08-31 19:16:37 GMT

- reply

All I can think about is...
That man is 36!?

2024-07-18 23:03:36 GMT

- reply

I've decided doomscrolling and screaming into the social media void with false bravado isn't enough. I'm volunteering with Vote Forward's get-out-the-vote project.
I encourage others to consider doing the same. It's very simple, and only requires a working printer (OK, that part's admittedly hard), a pen, envelopes, and stamps.
If that's not your jam, that's fine. Find something that is, and commit yourself to it.
https://votefwd.org/
#voteforward #gotv #uspol

2024-05-23 00:08:42 GMT

Hey, it's OK that Microsoft is enshittifying itself with Co-Pilot and Recall. I can always take my games and run them on Linux... right?
...RIGHT?
https://www.kitguru.net/gaming/matthew-wilson/rumour-claims-microsoft-is-preparing-a-16b-offer-to-acquire-valve/
#microsoft #valve #enshittification

2024-05-09 02:23:45 GMT

- reply

is the concern that the P-38 or other utensils could be fashioned into shivs or something? Or maybe that cops would book them for having concealed weapons or other bullshit because they carried a can opener?

2024-05-09 02:21:05 GMT

- reply

I wonder if it might be a good idea to just buy a bunch of P-38s in bulk and make sure there are always a few in the community pantry, along with a bunch of utensils?

2024-05-04 00:12:17 GMT

- reply

if Australia can export Fosters to us and pretend it's beer, then we can start a restaurant and pretend it's Australian. It's only fair.

2024-05-03 14:26:43 GMT

He's big mad that Grimes blocked him, isn't he?
#elonmusk #twitter #enshittification
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/377/615/466/548/817/original/d417a48f2bf6d419.jpg

2024-04-01 13:40:49 GMT

- reply

druid is definitely the burnt out SOC analyst that just wants to wander off into the forest forever.