Troed Sångberg

Demoscene coder. Cybersec consultant. A child of the 80s home computer era.

I use two accounts. This one is tech/retro/cybersec focused. Random social chitchat on random topics can be found over at Troed Sångberg (npub14zw…pf4e)

Homepage: https://troed.se
Youtube: https://www.youtube.com/@troedsangberg
Matrix: Troed Sångberg (npub1zef…n89f):matrix.troed.se
Demoscene: https://sync.wtf

Public Key

npub1zefwsyke7ygwak29yp75xh2mgujwmzrh7anucur7z0vzgsq9465ssgn89f

NIP-05 Address

[email protected]

Profile Code

nprofile1qqspv5hgztvlzy8wm9zjql2rt4d5wf8d3pmlwe7vwplp8kpygqz6a2gprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntuthytj

Publishing to

relay.momostr.pink

Author Public Key

npub1zefwsyke7ygwak29yp75xh2mgujwmzrh7anucur7z0vzgsq9465ssgn89f

Show more details

Last Notes

2025-02-26 15:19:18 GMT

Dear @npub19kd…t56d
"We're consolidating our social media presence due to limited resources and no longer posting on Mastodon. Follow us on Reddit"
Where do you think your staunchest supporters are today?
/Proton Visionary that doesn't use Reddit for reasons
(quote from the account info, they didn't even make a post of it)
#Proton

2025-02-25 11:01:23 GMT

I often see people recommending Signal for communication.
The difference between #Signal and #Matrix is that if a country implements legal backdoor requirements Signal will leave that market. That means no more app downloads and (I assume) IP blocks on the server.
Matrix ... will just keep functioning. People in that country will have to make choices whether to comply or not comply with the laws for themselves.
That's the difference between centralized and decentralized services.

2025-02-09 11:49:56 GMT

I think there's a general need for education regarding influence operations (and my focus is on those by Russia) here on the fediverse.
1) No, Russia isn't just pushing right-wing agendas/topics. The _stated_ purpose, from 1997 IIRC, is to sow division in the west. That means that there's roughly an equal chance that a raging leftwing lunatic is on Russia's payroll as your average Tate-Musk-Trump-Orban-Fico fanatic.
2) "Doomism" is a goal. The more we are complaining on how bad things are - the more successful they are. A great way to counter these influence operations is to talk about how _good_ things are. Because there's plenty of awesomeness in our society (I'm not from the US - that's a global perspective) to share.
3) These operations are _long term_. The troll factories aren't just newly created accounts spamming out the same message everywhere. That online magazine that has published for 10 years could be a sleeper influence operation. A person _living in Germany_ spending time online just as anybody else could too.
4) You're getting influenced. Basic psychology says you cannot avoid it (the anchoring effect). The only thing you can do is to be aware of it, and actively working against the very goals of the influence operations.
Remember what those were now again?
#InfluenceOperations #Russia #MAGA #Politics

2025-02-03 12:31:38 GMT

- reply

That's what they invented image generation AI for!

2025-01-28 13:05:47 GMT

This is the next battleground. I hope all #MastoAdmin moderators are on their toes.
"The narratives propagated by these accounts are consistent with previous Doppelgänger activities. They aim to undermine support for Ukraine, sow discord within German politics, and incite gender-based animosity. The operation employs tactics such as bulk account creation, inauthentic commenting, and the use of local personas to enhance credibility."
https://kyivinsider.com/russian-influence-operations-expand-to-bluesky/
#Fediverse

2025-01-26 11:42:24 GMT

Has @Kagi stopped sending subscriptions money to Putin yet?
They know full well this is what they're doing, actively avoiding sanctions by routing it through Kazakhstan.
#Kagi

2025-01-26 09:47:47 GMT

- reply

Funny "coincidence" - my account here was created on that very same day ;)
I had already managed to escape his reality distortion field since before.

2025-01-22 15:37:11 GMT

- reply

nitpicking: he wasn't convicted for any murder solicitation.
"just" running the huge drug bazaar.

2025-01-18 07:31:23 GMT

Wanting to ban X because of its danger to democratic societies but arguing for not banning TikTok is a pretty weird take.
One of my kids went down the TikTok algorithm rabbit hole and suddenly argued for some quite horrible takes on the world that were very far from their upbringing and culture. They managed to get out again, with some parental guidance, and are now vehemently arguing for how no one should be exposed to this app.
Hearing my own kid suddenly quoting Andrew Tate in a discussion was a pretty interesting wakeup call.
Oh, and there's how they just subverted the Romanian presidential election too of course.

2025-01-17 09:28:03 GMT

- reply

As a tax payer I want my government to use open source. Since Synapse Pro isn't, it's simply not usable for such cases.
Thank you for detailing the need for doing the same development to the open source Synapse as you have already done on Synapse Pro. I hope you do agree, it would be a pity to have to fork.

2025-01-10 08:33:24 GMT

- reply

"I am devloper. strncpy is safe because it has 'n'".

2024-12-21 14:31:11 GMT

- reply

Alright, thanks! Puya have QFN20 MCUs (M0+) for next to nothing so that's interesting in itself.
https://www.lcsc.com/datasheet/lcsc_datasheet_2205171716_PUYA-PY32F030F28U6TR_C3018717.pdf

2024-12-21 14:27:08 GMT

- reply

SY is used by Puya?
(I also spend lots of time deducing what package markings are used - red teaming hw/fw - so that's good info. I thought they were PY)

2024-12-21 14:14:23 GMT

- reply

I'm getting Microchip vibes.
"Package: BP = 20-pin, QFN Lead-Free ROHS Compliant Package"
(not this specific IC though)
https://partsearch.io/microchip/ucs1003-1-bp/

2024-12-20 15:59:51 GMT

- reply

This would be the _single round_ hashed somewhat bad Master password users I assume though*? Those should indeed be bruteforceable.
Somewhat surprised users didn't understand that when LastPass did communicate about the single round hashing etc - they could've just moved their crypto to another seed :/
I know someone in cybersec who has on purpose left some small amounts of bitcoin in a wallet where the seed existed in their LastPass account at the time. Those coins are still there - but the user had a strong Master password.
*) if my memory serves me right

2024-12-18 13:37:09 GMT

- reply

"one bad click"
2) "years ago he used Google Photos to store an image of the secret seed phrase that was protecting his cryptocurrency wallet"
3) "Google Authenticator by default also makes the same codes available in one’s Google account online"
next person:
4) "I put my seed phrase into a phishing site"
This is not a post about people being dumb, on the contrary. It's too easy to put trust into the wrong apps/web sites - and that's where the real issue lies.
The lesson should be: Your data is not safe in the cloud. Stop putting pictures, codes and security backups there.

2024-12-11 11:43:39 GMT

- reply

ping @npub1zdf…6u9l
@npub1y9l…l4t2

2024-12-04 14:52:16 GMT

- reply

Well then this will blow your mind :D The Hatari emulator compiled to web assembly and all the disks you could imagine for quick launch!
http://absencehq.de/atariaviary/

2024-11-29 20:38:28 GMT

- reply

"bluesky's mainstream decentralisation success"
Number of instances:
Mastodon: 9100+
BlueSky: 1
Can you let me know how you define "decentralisation"?

2024-11-19 10:05:47 GMT

The three part playlist of the hack I did of an IoT device that lead to public disclosure and the vendor pushing updated firmware.
Did you know that what I describe, while chaining two different things, is an exploit class in itself? Go hunt down those STM32 devices using AES now :D
https://www.youtube.com/watch?v=ZbKLAjPYOEg&list=PLB4jycyWL4uMzoRZLm0z2Jaty9q9fabtN
#STM32 #AES #IoT #ReverseEngineering #CyberSecurity

2024-10-31 12:22:32 GMT

- reply

Snyggt grävt! Det finns faktiskt ännu en sak med bit.ly man skulle kunna ha nämnt. Visst, företaget bakom tjänsten är amerikansk, men domänen tillhör Libyen och kan närsomhelst dras tillbaks under deras kontroll.
https://www.theguardian.com/technology/2010/oct/08/bitly-libya

2024-10-17 13:35:53 GMT

- reply

I have now gotten a reply from Vlad. It's the same canned response that he has sent to others, and it doesn't touch upon the fact that he lied about Yandex in public.
The key message is that he consider Yandex to "contribute valuable information to our users" and "allowing our users to form their own informed opinions".
I don't know about you, but I don't consider Kremlin's propaganda to be "valuable information" or something "informed opinions" can be based upon.
#Kagi is a no-go. It's possible, based on Vlad's actions, that it's part of an actual influence operation sponsored by Russia.
I will now inform the proper public channels in the EU about what I've seen, and if there's something to worry about with Kagi sending money to Russia and possibly filtering Kremlin propaganda through their search results I assume they'll act.
@npub1zq5…dlp2
#Infosec

2024-10-16 16:01:23 GMT

- reply

After having seen the statement from the founder of #Kagi I sent him an email with the above article. According to what he writes on the Discord that's how he wants people to communicate - directly with him.
It's now been more than 24 hours and I've had no reply.
This doesn't look good at all. I wonder what the people working for Vlad think.
@npub1zq5…dlp2

2024-10-15 14:48:31 GMT

- reply

I can thus no longer recommend #Kagi, and from an #Infosec perspective it might even be necessary to actively recommend against.
Here's the truth:
"In February 2024, after political and legal pressure, the Russian search and technology company Yandex sold its business in Russia to an investment fund with close ties to the Kremlin. For the time being, this seems to be the final step in Yandex’s gradual political appropriation by Russia’s ruling elites."
https://www.zois-berlin.de/en/publications/zois-spotlight/the-sad-fate-of-yandex-from-independent-tech-startup-to-kremlin-propaganda-tool
(2/2)
@npub1zq5…dlp2

2024-10-15 14:46:57 GMT

Apparently the search engine #Kagi that I have been paying for, and recommending everybody to use, might have ... issues.
I've just witnessed the founder being challenged on their Discord about them doing business together with Yandex - where the founder (Vlad) claimed that Yandex has nothing to do with Putin's regime.
This is a lie. And it's a weird one, coming from the founder of a company who's actively involved in doing business with them.
(1/2)
@npub1zq5…dlp2
https://files.ioc.exchange/media_attachments/files/113/311/975/547/111/921/original/c2c28954884cd9bc.png

2024-08-24 21:30:04 GMT

Spelkollektivet, an indie game development ... cult? I'm a former colleague of the founder James and yeah, nothing would surprise me :D
Apparently a documentary will drop soon - see the trailer here: https://www.youtube.com/watch?v=O4wg-jysRtc
#indiegame

2024-08-21 09:52:31 GMT

- reply

oh
it helps to read the correct section of AN2606. Let's forget about this little ... mishap.

2024-08-21 08:27:10 GMT

Dear STM32F412. Why are you not USART2:ing on PA14/PA15 when in the system bootloader?
AN2606 says you should! *crying*

2024-08-20 15:29:00 GMT

Please help my gamerkid. Boost for reach.
I'm failing as a dad. He just bought a Deltaco GAM-169T bluetooth controller to use in Fortnite, on Windows.
The controller works perfectly well everywhere - but in Fortnite, via bluetooth. It works in Fortnite with the USB cable plugged in, but he bought a wireless controller for a reason.
I've tried everything I know, but since I haven't used Windows since 2008 I don't have any deep insights into what can go wrong here.
(It's not the "ignore gamepad" or "lock to mouse input" options within Fortnite - and I've made sure Steam, Xbox etc don't start up when the computer boots)

2024-08-05 18:12:14 GMT

- reply

Yeah it's less than clear. However, the way you should see it is that you as an IOCX user should expect to see our rules upheld. Also sending the report to the originating server is just a bonus (if it's an instance where there's a chance it might make a difference).
We (I'm on the moderator team here) will always moderate according to our rules - regardless of whether the user is local or not.

2024-05-13 09:39:01 GMT

- reply

Funny story - I once packed in a hurry and just threw lots of medication on top of my clothing in the luggage. When Japanese customs opened the luggade they exclaimed "that's a lot of pills" and I realized this was going to take a while.
Carefully mentioned that I worked for Sony as I mentioned packing in a rush and they immediately commented "you work for Sony!?" at which point I could flash my badge.
They just closed up the luggage again and wished me a good trip. Japanese national pride is always a good play.

2024-05-04 07:20:21 GMT

- reply

Self-hosted LLaMa-3 (8B model):
https://files.ioc.exchange/media_attachments/files/112/381/604/199/622/012/original/e470d167d5db3efb.png

2024-05-04 07:17:32 GMT

- reply

While I agree with you - I think that those who do use it are using GPT 4, Claude 3 or one of the other state of the art models. GPT 3.5 is "old" :)