#security

#apple #cybersecurity #infosec #security #ios

ALT text details

REMIND LEGISLATORS: "A backdoor for the good guys only is not possible.”

beSpacific

@bespacific@newsie.social

@psuPete Recommends - Weekly highlights on cyber security issues, 03/01/25 https://www.llrx.com/2025/03/pete-recommends-weekly-highlights-on-cyber-security-issues-march-1-2025/ Five posts from this week: #Trump has purged government websites; The Wayback Machine trying to preserve the record; Turn off your read receipts. They’re a #security risk; You can now easily remove personal info from #Google Search results; Google plans to end #SMS verification in favor of #QR codes; and #Verizon isn’t doing enough to protect customers from #robocall scams. #cybercrime #privacy

beSpacific

@bespacific@newsie.social

ApplSec

@applsec@infosec.exchange

🧪 NEW BETA RELEASES 🧪

thinkberg

@thinkberg@tetrax.de

Von wegen #Arbeitsagentur: Wer nen schoenen #Job hat, darf mich gerne anpingen. Mit #ubirch hab ich 8 Jahre als #CTO gewerkelt. Dabei war Hardware (#Calliope mini, #Trackle), Software (embedded, Blockchain, #security, #cryptography, #trust) - speziell der elektonische #Impfnachweis und am Ende #ESG greenhouse gas accounting. Ich helfe Teams mit ihren Aufgaben zu wachsen und stabile Produkte zu produzieren.

thinkberg

@thinkberg@tetrax.de

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

“It is unsurprising that allies in #Europe are gathering in London this weekend & equally unsurprising that the #UK is being taken much more seriously in Brussels & capitals,” Ashton said.

And yet there are limits to #Starmer’s #diplomacy. He was unable to extract any #security guarantees from #Trump for #Ukraine, despite an exaggerated show of deference to the president. That included Starmer hand-delivering an invitation for a state visit from #KingCharles….

#geopolitics #Russia #US #NATO

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

The #summit meeting has thrust #Starmer into an unaccustomed place for a British prime minister: at the heart of #Europe during a crisis. >8 years after the country voted to leave the #EU, the rapidly changing #security landscape is driving #Britain closer to the continent.

Catherine Ashton, a Briton who served as the EU’s high representative for #ForeignAffairs & security policy, said Starmer’s successful meeting w/ #Trump had reinforced his credentials as a leader for Europe.

#geopolitics

BiznisBox

@biznisbox@fosstodon.org

🚀 BiznisBox v2 is here! 🎉

After 6+ months of development, we’re bringing you a major upgrade with:

🔐 2FA & Login Notifications – Enhanced security for safer access
🔗 Webhook Support – Seamless third-party integrations
🛠️ New Support Ticket Module – Streamlined issue tracking
📜 New Contracts Module – Better document organization
🎨 Complete UI Redesign – Modern, intuitive & sleek
Upgrade now & experience the future of business management! 🚀

#BiznisBox #Update #Productivity #Security #NewRelease

Tuta

@Tutanota@mastodon.social

France is about to pass the worst surveillance law in the EU.

Here's how you can stop them: 👉 https://tuta.com/blog/france-surveillance-nacrotrafic-law

#BiznisBox #Update #Productivity #Security #NewRelease

ALT text details

REMIND LEGISLATORS: "A backdoor for the good guys only is not possible.”

BiznisBox

@biznisbox@fosstodon.org

🚀 BiznisBox v2 is here! 🎉

After 6+ months of development, we’re bringing you a major upgrade with:

Tim Mak

@timkmak@journa.host

Good morning to readers; Kyiv remains in Ukrainian hands.

#Zelenskyy said a deal with #Russia is pointless w/o #security #guarantees.

Here’s why: #Kyiv made this mistake before.

#Moscow broke ceasefire after #Minsk agreements. International lawyer Oleksandr watched it all unfold.

Tim Mak

@timkmak@journa.host

Good morning to readers; Kyiv remains in Ukrainian hands.

#Zelenskyy said a deal with #Russia is pointless w/o #security #guarantees.

Here’s why: #Kyiv made this mistake before.

#Moscow broke ceasefire after #Minsk agreements. International lawyer Oleksandr watched it all unfold.

☮ ♥ ♬ 🧑‍💻

@peterrenshaw@ioc.exchange · Reply to ☮ ♥ ♬ 🧑‍💻's post

“Principle 4. Individuals’ #security and #privacy on the internet are fundamental and must not be treated as optional.”

“The Mozilla #Manifesto Addendum

Pledge for a Healthy #Internet

The open, global internet is the most powerful communication and collaboration resource we have ever seen. It embodies some of our deepest hopes for human progress. It enables new opportunities for learning, building a sense of shared humanity, and solving the pressing problems facing people everywhere.

Over the last decade we have seen this promise fulfilled in many ways. We have also seen the power of the internet used to magnify divisiveness, incite violence, promote hatred, and intentionally manipulate fact and reality. We have learned that we should more explicitly set out our aspirations for the human experience of the internet. We do so now.”

Lol 🤪 Principles

#mozilla <https://mozilla.org/en-US/about/manifesto/>

ALT text details

The first five points of the Mozilla 10 principles document. Principle 4 highlighted. source https://www.mozilla.org/en-US/about/manifesto/

{Insert Pasta Pun}

@risottobias@tech.lgbt

does anybody have a good demo library for correctly doing Shamir Secret Sharing?

#Security #BlueTeam #Cryptography

GrapheneOS

@GrapheneOS@grapheneos.social

GrapheneOS version 2025022700 released:

https://grapheneos.org/releases#2025022700

See the linked release notes for a summary of the improvements over the previous release.

Forum discussion thread:

https://discuss.grapheneos.org/d/20369-grapheneos-version-2025022700-released

#GrapheneOS #privacy #security

Frederik Borgesius

@Frederik_Borgesius@akademienl.social

'The EU’s chat control legislation is reportedly back on the table... Polish officials have now tabled a new proposal, which is open for feedback until 20 February.'
#law #eu #privacy #surveillance #csam #encryption #security #cybersecurity https://secure.dialog-mail.com/v/145667/1/Wdn4xzHFg8/99136250

Tuta

@Tutanota@mastodon.social

France is about to pass the worst surveillance law in the EU.

Here's how you can stop them: 👉 https://tuta.com/blog/france-surveillance-nacrotrafic-law

ALT text details

REMIND LEGISLATORS: "A backdoor for the good guys only is not possible.”

Tuta

@Tutanota@mastodon.social

France is about to pass the worst surveillance law in the EU.

Here's how you can stop them: 👉 https://tuta.com/blog/france-surveillance-nacrotrafic-law

#PracticeSafeText #e2ee #encryption #OnlineSafetyAct #privacy #security

ALT text details

REMIND LEGISLATORS: "A backdoor for the good guys only is not possible.”

Open Rights Group

@openrightsgroup@social.openrightsgroup.org

❌ You can't trade privacy to prevent crime.

⚠️ Message scanning tech punches a hole in everyone's security. Surveillance organisations, hackers, scammers and predators alike will be able to creep into your life.

Read our longread on the need to protect end-to-end encryption ⬇️

https://www.openrightsgroup.org/blog/the-case-for-encryption/

heise Security

@heisec@social.heise.de

LibreOffice: Manipulierte Dokumente können in Windows Befehle einschleusen

In LibreOffice können Angreifer unter Windows eine Lücke missbrauchen, durch die Dateien nach Klick auf Links ausgeführt werden.

https://www.heise.de/news/LibreOffice-Manipulierte-Dokumente-koennen-in-Windows-Befehle-einschleusen-10296915.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#LibreOffice #Security #Sicherheitslücken #news

heise Security

@heisec@social.heise.de

LibreOffice: Manipulierte Dokumente können in Windows Befehle einschleusen

In LibreOffice können Angreifer unter Windows eine Lücke missbrauchen, durch die Dateien nach Klick auf Links ausgeführt werden.

https://www.heise.de/news/LibreOffice-Manipulierte-Dokumente-koennen-in-Windows-Befehle-einschleusen-10296915.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#LibreOffice #Security #Sicherheitslücken #news

Justin Collins

@presidentbeef@ruby.social

I am hiring a Senior Privacy Engineer at Gusto: https://job-boards.greenhouse.io/gusto/jobs/6527585

Preferring candidates in Denver, but can hire (remote) in Atlanta, Austin, Chicago, Los Angeles, Miami, Toronto.

More roles coming soon...

#FediHire #security #privacy

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

OPM’s Own Guidance Says Fed Employees Never Have to Respond to the Elon Emails
https://talkingpointsmemo.com/edblog/opms-own-guidance-says-fed-employees-never-have-to-respond-to-the-elon-emails

"new system [created by #Doge] was given the name Government-Wide Email System (GWES). On February 5th, 2025... OPM published this document... in sections 4.2 and 4.3, federal government employees are never obligated to respond to any GWES emails and are under no obligation to share any information."

#ElonMusk #Musk #5Bullets #email #GWES #OPM #Privacy #Security #Government #News #USA

ALT text details

Screen shot of the Privacy Impact Assessment for the Government Wide Email System (GWES) page 7-8.

Linux Is Best

@Linux_Is_Best@misskey.de

Someone really should start another not self-hosted, non-US-based, Password Manager. I only know of two:

1) Heylogin
2) pCloud

(1Password, is owned by a Canadian company, owned by a US company).

1) Heylogin - Sucks.

It is completely tired to your phone. Using their web browser extension? Check your phone. Want to log in to a site? Check your phone. Want to update a login details? Check your phone.

You ever lose or damage your phone, you're f-cked. It is not designed for multiple devices either.

2) pCloud

It is indeed outside US-jurisdiction. The company is not owned by any business in the USA. It does not own any businesses itself in the USA. But they do resell services in the USA, and the only way you can avoid not being assigned to one of those US Servers is to use a VPN so you'll be forwarded to their Europe Servers.

From their own documentation:

" As a consequence API calls have to be made to the correct API host name depending were the user has been registered – api.pcloud.com for United States and eapi.pcloud.com for Europe. "

#PasswordManager #Password #Security #Privacy

Open Rights Group

@openrightsgroup@social.openrightsgroup.org

❌ You can't trade privacy to prevent crime.

⚠️ Message scanning tech punches a hole in everyone's security. Surveillance organisations, hackers, scammers and predators alike will be able to creep into your life.

Read our longread on the need to protect end-to-end encryption ⬇️

#PracticeSafeText #e2ee #encryption #OnlineSafetyAct #privacy #security

https://www.openrightsgroup.org/blog/the-case-for-encryption/

Open Rights Group

@openrightsgroup@social.openrightsgroup.org

❌ You can't trade privacy to prevent crime.

⚠️ Message scanning tech punches a hole in everyone's security. Surveillance organisations, hackers, scammers and predators alike will be able to creep into your life.

Read our longread on the need to protect end-to-end encryption ⬇️

#PracticeSafeText #e2ee #encryption #OnlineSafetyAct #privacy #security

https://www.openrightsgroup.org/blog/the-case-for-encryption/

@BjornW@mastodon.social

Thought experiment:

@letsencrypt offers certificates to encrypt the traffic between a website & your browser.

They reside in the US & thus are subject to the judiciary system of the US.

What are the possible risks for websites outside the US, given the current unstable political situation & administration? What type of damage could an executive order do? How could this be mitigated?

Boosts appreciated.

#Politics #Security #GeoPolitics #Encryption #LetsEncrypt #CyberSecurity #Tech

Mike Kuketz 🛡

@kuketzblog@social.tchncs.de

Apple entfernt seine höchste »Sicherheitsstufe« für Nutzerdaten in UK, nachdem die Regierung Zugriff auf Daten forderte. Die »Advanced Data Protection« (ADP) stellt durch Ende-zu-Ende-Verschlüsselung sicher, dass nur Kontoinhaber auf ihre gespeicherten Fotos oder Dokumente zugreifen können. Das gilt nun nicht mehr.

#apple #security #adp #sicherheit

Notesnook

@notesnook@fosstodon.org

Notesnook v3.0.27 is out with an all new command palette, quick open, support for pasting markdown directly, and much more!

Read the full release notes here: https://blog.notesnook.com/notesnook-v3.0.27

#notesnook, #notetaking, #privacy, #security, #productivity, #encryption

Mark

@paka@mastodon.scot

European Court of Human Rights Confirms: Weakening Encryption Violates Fundamental Rights

In a milestone judgment—Podchasov v. Russia—the #European Court of #HumanRights ( #ECtHR) has ruled that weakening of #encryption can lead to general and indiscriminate #surveillance of the #communications of all users and violates the #HumanRight to #privacy.

https://www.eff.org/deeplinks/2024/03/european-court-human-rights-confirms-undermining-encryption-violates-fundamental

#security #freedom #authoritarian #backdoors #hackers #IdentityTheft #banking

Terence Eden’s Blog

@blog@shkspr.mobi

The least secure TOTP code possible

https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/

If you use Multi-Factor Authentication, you'll be well used to scanning in QR codes which allow you to share a secret code with a website. These are known as Time-based One Time Passwords (TOTP⁰).

As I've moaned about before, TOTP has never been properly standardised. It's a mish-mash of half-finished proposals with no active development, no test suite, and no-one looking after it. Which is exactly what you want from a security specification, right?!

So let's try to find some edge-cases and see where things break down.

One Punch Man

This is possibly the least secure TOTP code I could create. Scan it and see whether your app will accept it.

QR code.

What makes it so crap? There are three things which protect you when using TOTP.

The shared secret. In this case, it is abcdefghijklmno - OK, that's not the easiest thing to guess, but it isn't exactly complex.
The amount time the code is valid for before changing. Most TOTP codes last 30 seconds, this lasts 120.
The length of the code. Most codes are 6 digits long. In theory, the spec allows 8 digits. This is 1. Yup. A single digit.

BitWarden showing a single digit for 119 seconds.

If you were thick enough to use this¹, an attacker would have a 1/10 chance of simply guessing your MFA code. If they saw you type it in, they'd have a couple of minutes in which to reuse it.

Can modern TOTP apps add this code? I crowdsourced the answers.

Surprisingly, a few apps accept it! Aegis, 1password, and BitWarden will happily store it and show you a 1 digit code for 120 seconds.

A few reject it. Authy, Google Authenticator, and OpenOTP claim the code is broken and won't add it.

But, weirdly, a few interpret it incorrectly! The native iOS app, Microsoft Authenticator, and KeepassXC store the code, but treat it as a 6 digit, 30 second code.

Do The Right Thing

What is the right thing to do in this case? The code is outside the (very loosely defined) specification. Postel's Law tells us that we should try our best to interpret malformed data - which is what Aegis and BitWarden do.

But, in a security context, that could be dangerous. Perhaps rejecting a dodgy code makes more sense?

What is absolutely daft² is ignoring the bits of the code you don't like and substituting your own data! Luckily, in a normal TOTP enrolment, the user has to enter a code to prove they've saved it correctly. Entering in a 6 digit code where only 1 is expected is likely to fail.

We're Only Human

A one-digit code is ridiculous. But what about the other extreme? Would a 128-digit code be acceptable? For a human, no; it would be impossible to type in correctly. For a machine with a shared secret, it possibly makes sesne.

On a high-latency connection or with users who may have mobility difficulties, a multi-minute timeframe could be sensible. For something of extremely high security, sub-30 seconds may be necessary.

But, again, the specification hasn't evolved to meet user needs. It is stagnant and decaying.

What's Next?

There's an draft proposal to tighten up to TOTP spec which has expired.

It would be nice if the major security players came together to work out a formal and complete specification for this vital piece of security architecture. But I bet it won't ever happen.

Google have archived their work on authentication standards.
Apple points to Google's outdated spec.
YubiCo's incompatible spec hasn't been updated in 4 years.
The otpauth registration lists a consortium called https://openauthentication.org who don't appear to published anything in a decade.
Microsoft don't have any documentation whatsoever.

So there you have it. We're told to rely on TOTP for our MFA - yet the major apps all disagree on how the standard should be implemented. This is a recipe for an eventual security disaster.

How do we fix it?

Yes! Just like Top of The Pops! The famous British TV show! Wow! I bet you're the first person in history to make that joke! Have a biscuit. ↩︎
Please don't! ↩︎
I wanted to use the words "utterly fucking stupid" but I felt it was unprofessional. ↩︎

#CyberSecurity #rant #security #standards #totp

Terence Eden’s Blog

@blog@shkspr.mobi

The least secure TOTP code possible

https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/

If you use Multi-Factor Authentication, you'll be well used to scanning in QR codes which allow you to share a secret code with a website. These are known as Time-based One Time Passwords (TOTP⁰).

So let's try to find some edge-cases and see where things break down.

One Punch Man

This is possibly the least secure TOTP code I could create. Scan it and see whether your app will accept it.

QR code.

What makes it so crap? There are three things which protect you when using TOTP.

The shared secret. In this case, it is abcdefghijklmno - OK, that's not the easiest thing to guess, but it isn't exactly complex.
The amount time the code is valid for before changing. Most TOTP codes last 30 seconds, this lasts 120.
The length of the code. Most codes are 6 digits long. In theory, the spec allows 8 digits. This is 1. Yup. A single digit.

BitWarden showing a single digit for 119 seconds.

If you were thick enough to use this¹, an attacker would have a 1/10 chance of simply guessing your MFA code. If they saw you type it in, they'd have a couple of minutes in which to reuse it.

Can modern TOTP apps add this code? I crowdsourced the answers.

Surprisingly, a few apps accept it! Aegis, 1password, and BitWarden will happily store it and show you a 1 digit code for 120 seconds.

A few reject it. Authy, Google Authenticator, and OpenOTP claim the code is broken and won't add it.

But, weirdly, a few interpret it incorrectly! The native iOS app, Microsoft Authenticator, and KeepassXC store the code, but treat it as a 6 digit, 30 second code.

Do The Right Thing

But, in a security context, that could be dangerous. Perhaps rejecting a dodgy code makes more sense?

We're Only Human

On a high-latency connection or with users who may have mobility difficulties, a multi-minute timeframe could be sensible. For something of extremely high security, sub-30 seconds may be necessary.

But, again, the specification hasn't evolved to meet user needs. It is stagnant and decaying.

What's Next?

There's an draft proposal to tighten up to TOTP spec which has expired.

It would be nice if the major security players came together to work out a formal and complete specification for this vital piece of security architecture. But I bet it won't ever happen.

Google have archived their work on authentication standards.
Apple points to Google's outdated spec.
YubiCo's incompatible spec hasn't been updated in 4 years.
The otpauth registration lists a consortium called https://openauthentication.org who don't appear to published anything in a decade.
Microsoft don't have any documentation whatsoever.

So there you have it. We're told to rely on TOTP for our MFA - yet the major apps all disagree on how the standard should be implemented. This is a recipe for an eventual security disaster.

How do we fix it?

Yes! Just like Top of The Pops! The famous British TV show! Wow! I bet you're the first person in history to make that joke! Have a biscuit. ↩︎
Please don't! ↩︎
I wanted to use the words "utterly fucking stupid" but I felt it was unprofessional. ↩︎

#CyberSecurity #rant #security #standards #totp

Terence Eden’s Blog

@blog@shkspr.mobi

The least secure TOTP code possible

https://shkspr.mobi/blog/2025/02/the-least-secure-totp-code-possible/

If you use Multi-Factor Authentication, you'll be well used to scanning in QR codes which allow you to share a secret code with a website. These are known as Time-based One Time Passwords (TOTP⁰).

So let's try to find some edge-cases and see where things break down.

One Punch Man

This is possibly the least secure TOTP code I could create. Scan it and see whether your app will accept it.

QR code.

What makes it so crap? There are three things which protect you when using TOTP.

The shared secret. In this case, it is abcdefghijklmno - OK, that's not the easiest thing to guess, but it isn't exactly complex.
The amount time the code is valid for before changing. Most TOTP codes last 30 seconds, this lasts 120.
The length of the code. Most codes are 6 digits long. In theory, the spec allows 8 digits. This is 1. Yup. A single digit.

BitWarden showing a single digit for 119 seconds.

If you were thick enough to use this¹, an attacker would have a 1/10 chance of simply guessing your MFA code. If they saw you type it in, they'd have a couple of minutes in which to reuse it.

Can modern TOTP apps add this code? I crowdsourced the answers.

Surprisingly, a few apps accept it! Aegis, 1password, and BitWarden will happily store it and show you a 1 digit code for 120 seconds.

A few reject it. Authy, Google Authenticator, and OpenOTP claim the code is broken and won't add it.

But, weirdly, a few interpret it incorrectly! The native iOS app, Microsoft Authenticator, and KeepassXC store the code, but treat it as a 6 digit, 30 second code.

Do The Right Thing

But, in a security context, that could be dangerous. Perhaps rejecting a dodgy code makes more sense?

We're Only Human

On a high-latency connection or with users who may have mobility difficulties, a multi-minute timeframe could be sensible. For something of extremely high security, sub-30 seconds may be necessary.

But, again, the specification hasn't evolved to meet user needs. It is stagnant and decaying.

What's Next?

There's an draft proposal to tighten up to TOTP spec which has expired.

It would be nice if the major security players came together to work out a formal and complete specification for this vital piece of security architecture. But I bet it won't ever happen.

Google have archived their work on authentication standards.
Apple points to Google's outdated spec.
YubiCo's incompatible spec hasn't been updated in 4 years.
The otpauth registration lists a consortium called https://openauthentication.org who don't appear to published anything in a decade.
Microsoft don't have any documentation whatsoever.

So there you have it. We're told to rely on TOTP for our MFA - yet the major apps all disagree on how the standard should be implemented. This is a recipe for an eventual security disaster.

How do we fix it?

Yes! Just like Top of The Pops! The famous British TV show! Wow! I bet you're the first person in history to make that joke! Have a biscuit. ↩︎
Please don't! ↩︎
I wanted to use the words "utterly fucking stupid" but I felt it was unprofessional. ↩︎

#CyberSecurity #rant #security #standards #totp

Sooraj Sathyanarayanan

@ianonymous3000@mastodon.social

If you’re a Windows user, I can help you switch to Linux. Please stop supporting an insecure and privacy-intrusive operating system. What’s stopping you from switching to Linux/macOS? Ask all your questions, and I’ll answer everything.

#linux #macOS #privacy #security #windows

Orhun Parmaksız 👾

@orhun@fosstodon.org

Breaking news for the crab people 🚨

🦀 Ring, a widely used Rust cryptography library, is now unmaintained.

🔐 Security advisory: https://rustsec.org/advisories/RUSTSEC-2025-0007

➡️ Details: https://github.com/briansmith/ring/discussions/2414

#rustlang #opensource #library #security #cryptography

Orhun Parmaksız 👾

@orhun@fosstodon.org

Breaking news for the crab people 🚨

🦀 Ring, a widely used Rust cryptography library, is now unmaintained.

🔐 Security advisory: https://rustsec.org/advisories/RUSTSEC-2025-0007

➡️ Details: https://github.com/briansmith/ring/discussions/2414

#rustlang #opensource #library #security #cryptography

Orhun Parmaksız 👾

@orhun@fosstodon.org

Breaking news for the crab people 🚨

🦀 Ring, a widely used Rust cryptography library, is now unmaintained.

🔐 Security advisory: https://rustsec.org/advisories/RUSTSEC-2025-0007

➡️ Details: https://github.com/briansmith/ring/discussions/2414

#rustlang #opensource #library #security #cryptography

Aral Balkan

@aral@mastodon.ar.al

Today I learned that the alarm system that came with our house – a very popular one here in Ireland – can be disarmed via Siri.

The default command?

“Hey, Siri, disarm.”

I shit you not.

#security #smartHome #youGottaBeFuckingKiddingMe #siri #openSesame

Aral Balkan

@aral@mastodon.ar.al

Today I learned that the alarm system that came with our house – a very popular one here in Ireland – can be disarmed via Siri.

The default command?

“Hey, Siri, disarm.”

I shit you not.

#security #smartHome #youGottaBeFuckingKiddingMe #siri #openSesame

Mike Kuketz 🛡

@kuketzblog@social.tchncs.de

#apple #security #adp #sicherheit

Johannes Ernst

@j12t@j12t.social

A family member has a Mac that appears compromised. It behaves strangely, runs with higher load than it should and macOS produced some error messages that imply it quarantined some code. I think the machine should be wiped completely and rebuilt.

#Security people: how would you go about this without inadvertently carrying bad stuff over to another Mac or the rebuilt Mac? There are many files, email etc that need to be preserved.

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

#Russia's main demands to stop the fighting include a withdrawal of Kyiv's troops from Ukrainian territory Moscow [illegally] claims & an end to #Ukraine's ambitions to join #NATO. Ukraine says Russia must withdraw from its territory, & wants #security guarantees from the West. The #Trump admin says Ukraine has unrealistic, "illusionary" goals.

#geopolitics #StandWithUkraine

Kyle 🕵️‍♂️💻

@beardedtechguy@infosec.exchange

This is NOT GOOD, not good AT ALL!

Now it will be only a matter of time before the US will want the same!

#Privacy #InfoSec #Apple #ADP #iCloud #Data #Security

Kyle 🕵️‍♂️💻

@beardedtechguy@infosec.exchange

This is NOT GOOD, not good AT ALL!

Now it will be only a matter of time before the US will want the same!

#infosec #breach #databreach #security

#Privacy #InfoSec #Apple #ADP #iCloud #Data #Security

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Trump Guts Crucial OPM Team as Elon Musk Gains Even More Power

The Office of Personnel Management has just limited access to certain government records on #ElonMusk and his #DOGE minions.
https://newrepublic.com/post/191663/elon-musk-opm-privacy-team

"The Trump administration has fired members of the “privacy team” at the #OPM, a move that will hinder #public access & scrutiny over #government records related to the #security clearances of #ElonMusk & Doge."

#Musk #Coup #Trump #Corruption #Politics #Privacy #USPol #News #US #USA

ALT text details

Headline and text from article: Headline: Trump Guts Crucial OPM Team as Elon Musk Gains Even More Power The Office of Personnel Management has just limited access to certain government records on Elon Musk and his DOGE minions. by Hafiz Rashid February 18, 2025 / 4:32 p.m. ET Text: The Trump administration has fired members of the “privacy team” at the Office of Personnel Management, a move that will hinder public access and scrutiny over government records related to the security clearances of Elon Musk and his team at the Department of Government Efficiency. CNN discovered the terminations when it made a freedom of information act (FOIA) request to OPM looking for those records, particularly regarding DOGE workers who were granted access to classified or sensitive information. An OPM email address responded to CNN’s request and said, “Good luck with that, they just fired the whole privacy team.”

steve mookie kong

@mookie@chow.fan

Point of view always matters.

ALT text details

Two panes. First is screaming woman it reads it’s a data breach! Second pane is a cool cat and reads: unintentional off site backup

Andrew 🌻 Brandt 🐇

@threatresearch@infosec.exchange

This is *the most malicious, brutal* malicious compliance I've seen in quite some time, possibly ever, and I am HERE FOR IT. Thank you, @jwz

https://www.jwz.org/xscreensaver/google.html

#privacy #security #infosec #Android #screensaver

Melroy van den Berg

@melroy@mastodon.melroy.org

I wrote a new blog post about DNS (part 1)!

Learn how DNS works in more depth and I even provide you will some useful terminal commands you can try yourself:

https://blog.melroy.org/2025/dns-part-1/

#dns #security #linux #unbound #bind #linux #recursive authoritative# server #nsd #dig #zone #domain #name #system

Andrew 🌻 Brandt 🐇

@threatresearch@infosec.exchange

This is *the most malicious, brutal* malicious compliance I've seen in quite some time, possibly ever, and I am HERE FOR IT. Thank you, @jwz

https://www.jwz.org/xscreensaver/google.html

#privacy #security #infosec #Android #screensaver

Linux Is Best

@Linux_Is_Best@misskey.de

My list of digital service providers outside the jurisdiction of the United States of America. 😉

https://codeberg.org/Linux-Is-Best/Outside_Us_Jurisdiction

The list is now hosted on Codeberg, an alternative to GitHub or GitLab, but based out of Germany. 😉

#Vpn #Dns #Cdn #WebHosting #Email #PasswordManager #WebSearch #Privacy #Security #Project2025 #Fascism #Nazis

SecureDrop

@securedrop@freedom.press

We’ve seen significant interest in newsrooms setting up SecureDrop to better protect whistleblowers, so we've put together a quick list of 5 key things you should know before setting it up:

https://securedrop.org/news/five-things-to-know-about-securedrop/

#SecureDrop #security #whistleblowing #OpenSource

SecureDrop

@securedrop@freedom.press

We’ve seen significant interest in newsrooms setting up SecureDrop to better protect whistleblowers, so we've put together a quick list of 5 key things you should know before setting it up:

https://securedrop.org/news/five-things-to-know-about-securedrop/

#SecureDrop #security #whistleblowing #OpenSource

Linux Is Best

@Linux_Is_Best@misskey.de

Microsoft and the United States Government have a working partnership. You should consider try using Linux.

For a newbie, I would suggest Ultramarine Linux (KDE Plasma) or MX Linux (KDE Plasma). But ultimately, your goal should be to try using Linux.

If you need to keep a copy of Windows for gaming, that's fine. But still try using Linux too.

#Project2025 #Fascism #Nazis #DonaldTrump #Trump #ElonMusk #Musk #Privacy #Security #UsJurisdiction

Linux Is Best

@Linux_Is_Best@misskey.de

Privacy Guides

@privacyguides@mastodon.neat.computer

We're Privacy Guides, a non-profit project & community focused on personal data security and privacy. 👋

Much like the right to interracial marriage, woman's suffrage, freedom of speech, and many others, our right to privacy hasn't always been upheld. In several dictatorships, it still isn't. Generations before ours fought for our right to privacy. Privacy is a human right, inherent to all of us, that we are entitled to (without discrimination).
You shouldn't confuse privacy with secrecy. We know what happens in the bathroom, but you still close the door. That's because you want privacy, not secrecy. Everyone has something to protect. Privacy is something that makes us human.

We're on a mission to inform the public about the value of digital privacy, and about global government initiatives which aim to monitor your online activity.

#PrivacyGuides #Introduction #Privacy #Security

Linux Is Best

@Linux_Is_Best@misskey.de

Christian Wolff

@Christian_Freiherr_von_Wolff@defcon.social

For every obvious reason and then some, I'm not linking to anything here; I refer herein and throughout to the adult video website that functionally everyone knows exists.

What they want you to believe is that they've made the decision to geo-block U.S. states requiring users to verify their age, specifically because they care about their users' privacy, supposedly.

Adult websites don't need government issued IDs on file to de-anonymize and track people; they already do that, and already do so very well.

So:
"These Terms of Service, your use of this Website, and the relationship between you and us shall be governed by the laws of the Republic of Cyprus, without regard to conflict of law rules. Nothing contained in these Terms of Service shall constitute an agreement to the application of the laws of any other nation to this Website. You agree that this Website shall be deemed a passive Website that does not give rise to personal jurisdiction over us, either specific or general, in jurisdictions other than the Republic of Cyprus. The sole and exclusive jurisdiction and venue for any action or proceeding arising out of or related to these Terms of Service shall be in an appropriate court located in Limassol, Cyprus. You hereby submit to the jurisdiction and venue of said Courts."

They are a business and nothing else, they always care only about their own profit and never about anything else, and it's simply a technical matter that to comply with age verification laws outside of the jurisdiction in which they already hide everything, would nullify the above quoted legally binding contract between themselves, their users, and their precious tax haven.

It is absolutely in their financial best interest to lose a certain number of existing customers when the only alternative necessitates that they stop evading taxes and getting away with it; Al Capone, eat your heart out.

They do not care at all about anyone's privacy, whatsoever.

#privacy #security #infosec #uspol

Benedikt Ritter (he/him)

@britter@chaos.social

How do folks deal with GitHub and GPG keys? #github #security #gpg #pgp

Option	Voters
One key per email address	6 (86%)
Subkeys	1 (14%)

Joni Suikeli

@jonisuikeli@mementomori.social

Thanks to the threats from the United States, I have only now become interested in getting to know the EU properly, and especially its security issues.

If there are people here who know how to get involved at EU level, all tips and advice are welcome, thank you!

#EU #Security

Joni Suikeli

@jonisuikeli@mementomori.social

Thanks to the threats from the United States, I have only now become interested in getting to know the EU properly, and especially its security issues.

If there are people here who know how to get involved at EU level, all tips and advice are welcome, thank you!

#EU #Security

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Elon Musk’s DOGE Shares Classified U.S. Intel With Entire World

Elon Musk’s minions posted classified data on their website for anyone to see.
https://newrepublic.com/post/191580/elon-musk-doge-classified-us-intel-data-website

"this incident doesn’t speak well of the pseudo-agency’s #security procedures. The website has already been hacked by Thursday evening thanks to #coding vulnerabilities. And since #DOGE has gotten into all kinds of sensitive #data, every #American could be at risk."

#ElonMusk #Coup #Musk #GOP #Politics #News #USPol #Press #USA

ALT text details

News headline from The New Republic: Elon Musk’s DOGE Shares Classified U.S. Intel With Entire World Elon Musk’s minions posted classified data on their website for anyone to see. by Hafiz Rashid February 14, 2025 / 4:56 p.m. ET

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Elon Musk’s DOGE Shares Classified U.S. Intel With Entire World

Elon Musk’s minions posted classified data on their website for anyone to see.
https://newrepublic.com/post/191580/elon-musk-doge-classified-us-intel-data-website

#ElonMusk #Coup #Musk #GOP #Politics #News #USPol #Press #USA

ALT text details

Andrew 🌻 Brandt 🐇

@threatresearch@infosec.exchange

This is *the most malicious, brutal* malicious compliance I've seen in quite some time, possibly ever, and I am HERE FOR IT. Thank you, @jwz

https://www.jwz.org/xscreensaver/google.html

#privacy #security #infosec #Android #screensaver

Privacy Guides

@privacyguides@mastodon.neat.computer

We're Privacy Guides, a non-profit project & community focused on personal data security and privacy. 👋

Much like the right to interracial marriage, woman's suffrage, freedom of speech, and many others, our right to privacy hasn't always been upheld. In several dictatorships, it still isn't. Generations before ours fought for our right to privacy. Privacy is a human right, inherent to all of us, that we are entitled to (without discrimination).
You shouldn't confuse privacy with secrecy. We know what happens in the bathroom, but you still close the door. That's because you want privacy, not secrecy. Everyone has something to protect. Privacy is something that makes us human.

We're on a mission to inform the public about the value of digital privacy, and about global government initiatives which aim to monitor your online activity.

#PrivacyGuides #Introduction #Privacy #Security

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

DOGE’s .gov site lampooned as coders quickly realize it can be edited by anyone

DOGE site is apparently not running on government servers.
https://arstechnica.com/tech-policy/2025/02/doges-gov-site-lampooned-as-coders-quickly-realize-it-can-be-edited-by-anyone/

"DOGE appears to have skipped #security steps that are expected of #government websites. That pattern is troubling some federal workers...

makes it possible for bad actors to alter official databases of government information."

#ElonMusk #Musk #Doge #Programming #Tech #Data #Fail #News #US #USA

ALT text details

News headline: DOGE’s .gov site lampooned as coders quickly realize it can be edited by anyone DOGE site is apparently not running on government servers. by Ashley Belanger – Feb 14, 2025 10:24 AM

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

DOGE software approval alarms Labor Dept employees

Elon Musk’s #DOGE subordinates received approval to use #software at the Labor Dept that could be used to transfer large amounts of #data...
https://www.nbcnews.com/tech/security/doge-software-approval-alarms-labor-department-employees-data-security-rcna191583

"The approval for Musk’s team to use the remote-access and file-transfer software, known as PuTTY, has alarmed... #Labor Dept’s career employees...

“This is completely opposite of what we’d do to protect #privacy.”"

#Musk #Doge #Coup #Corruption #Tech #Security #News #USA #US

ALT text details

News headline: Security DOGE software approval alarms Labor Department employees Elon Musk’s DOGE subordinates received approval to use software at the Labor Department that could be used to transfer large amounts of data, two employees said.

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Does DOGE Pose a National Security Risk?

Uncertainty About Access & Authority Will Worry Allies and Tempt Adversaries
https://www.foreignaffairs.com/united-states/elon-musk-does-doge-pose-national-security-risk

"what the #intelligence agencies of US allies & adversaries see when [ #Trump] grants sweeping access... to a team of young people who have no #government experience... and who work for an unelected figure w/extensive personal financial interests... American adversaries surely see an espionage & blackmail bonanza."

#Musk #Coup #Corruption #Security #US

ALT text details

News headline: Does DOGE Pose a National Security Risk? Uncertainty About Access and Authority Will Worry Allies and Tempt Adversaries by James Goldgeier and Elizabeth N. Saunders February 7, 2025 (Sorry, this one's a bit late)

The Matrix.org Foundation

@matrix@mastodon.matrix.org

The world needs secure communication more than ever, as a bulwark against the surveillance, authoritarianism, and oppression increasingly enabled by Big Tech. Matrix seeks to meet that need, as an open source, decentralised, encrypted comms protocol.

But Trust & Safety is more difficult in a decentralised environment. How are we building a safer Matrix?

https://matrix.org/blog/2025/02/building-a-safer-matrix/

#Matrix #Security #Privacy #TrustAndSafety #OpenSource #FOSS

Jan Penfrat

@ilumium@eupolicy.social

European Parliament #security advice after #China hacked #US infrastructure: Use plaintext #Microsoft Teams and only use encrypted @signalapp if Teams is unavailable. 🤷

Politico: "Parliament’s email reminded lawmakers they should use (...) Teams and #Jabber when possible and only #Signal if the two are unavailable."

“The use of Signal is proposed as a safe alternative in cases where no equivalent corporate tool is available,” the Parliament’s press service said in a statement.

Jan Penfrat

@ilumium@eupolicy.social

European Parliament #security advice after #China hacked #US infrastructure: Use plaintext #Microsoft Teams and only use encrypted @signalapp if Teams is unavailable. 🤷

Politico: "Parliament’s email reminded lawmakers they should use (...) Teams and #Jabber when possible and only #Signal if the two are unavailable."

“The use of Signal is proposed as a safe alternative in cases where no equivalent corporate tool is available,” the Parliament’s press service said in a statement.

HiramFromTheChi 👨🏽‍💻💭

@hiramfromthechi@mastodon.social

Any device that needs to be off because it can't be trusted with your conversations should not exist in the first place.

#privacy #privacymatters #security #infosec #cybersecurity #cybersec #amazon #amazonecho #surveillance

ALT text details

A sign on a door of a healthcare facility that says: "Please remember to not discuss patient information (PHI) unless the Amazon Echo is muted."

HiramFromTheChi 👨🏽‍💻💭

@hiramfromthechi@mastodon.social

Any device that needs to be off because it can't be trusted with your conversations should not exist in the first place.

#privacy #privacymatters #security #infosec #cybersecurity #cybersec #amazon #amazonecho #surveillance

ALT text details

A sign on a door of a healthcare facility that says: "Please remember to not discuss patient information (PHI) unless the Amazon Echo is muted."

HiramFromTheChi 👨🏽‍💻💭

@hiramfromthechi@mastodon.social

Any device that needs to be off because it can't be trusted with your conversations should not exist in the first place.

#privacy #privacymatters #security #infosec #cybersecurity #cybersec #amazon #amazonecho #surveillance

ALT text details

A sign on a door of a healthcare facility that says: "Please remember to not discuss patient information (PHI) unless the Amazon Echo is muted."

Sooraj Sathyanarayanan

@ianonymous3000@mastodon.social

#linux #macOS #privacy #security #windows

Andrew Lock

@andrewlock@hachyderm.io

Blogged: Preventing client-side cross-site-scripting vulnerabilities with Trusted Types

https://andrewlock.net/preventing-client-side-cross-site-scripting-vulnerabilities-with-trusted-types/

In this post I describe how the Trusted Types feature in a Content-Security-Policy can protect you against cross-site-scripting attacks

#dotnet #security

nat

@nat@partyon.xyz

IMPORTANT PSA FOR ALL IPHONE USERS

Siri is "reading" all of your apps. Note, you must INDIVIDUALLY turn this feature off for every single app ***even if you have Siri completely disabled.***

#apple #iphone #security #cybersecurity #phone #safety #siri #fascism

ALT text details

National Lawyers Guild - Southern Arizona Chapter We know everyone has switched over to Signal for any potentially sensitive communication by now, but did you know that if you have an iPhone, you may have Apple Intelligence and Siri reading all your apps? To turn this function off, you need to: 1. Go into your settings, and open Apps 2. Open each App individually, find the button that says Apple Intelligence or Siri, and click on that button 3. Toggle it off You'll need to do this for each individual app. We recommend doing it not just for your messaging apps, but for all apps. Photos in comments to help direct you to the right screens (note this is from an older model iPhone, yours might look a little different).

beSpacific

@bespacific@newsie.social

Compromised? In this interview, https://www.muellershewrote.com/p/a-fork-in-the-road-is-federal-employee I speak to a systems security specialist who found privacy problems surrounding the HR@opm.gov email servers #IT #security #natsec #nationalsecurity #cybercrime #cybersecurity #hacking #surveillance #malware #email #DOGE #Musk #treasury #OPM #FAA #FEMA #education #privacy #PII

beSpacific

@bespacific@newsie.social

Open Rights Group

@openrightsgroup@social.openrightsgroup.org

“The government want to be able to access anything and everything, anywhere, any time.

Their ambition to undermine basic security is frightening, unaccountable and would make everyone less safe.

It is straightforward bullying.”

🗣️ ORG’s @JamesBaker on the UK government’s order to break Apple’s encryption for millions.

#e2ee #encryption #Apple #ukpolitics #ukpol #privacy #security

https://metro.co.uk/2025/02/08/privacy-fears-millions-government-demands-access-messages-photos-22520358/

Morten Linderud

@Foxboron@chaos.social

My talk on `ssh-tpm-agent` I held at #FOSDEM has been released!

Video: https://video.fosdem.org/2025/ub4132/fosdem-2025-5544-hardware-backed-ssh-keys-ssh-tpm-agent.av1.webm

Abstract: https://fosdem.org/2025/schedule/event/fosdem-2025-5544-hardware-backed-ssh-keys-ssh-tpm-agent/

Slides: https://pub.linderud.dev/talks/Hardware-backed-SSH-keys.pdf

#TPM #SSH #Security #Linux

Morten Linderud

@Foxboron@chaos.social

My talk on `ssh-tpm-agent` I held at #FOSDEM has been released!

Video: https://video.fosdem.org/2025/ub4132/fosdem-2025-5544-hardware-backed-ssh-keys-ssh-tpm-agent.av1.webm

Abstract: https://fosdem.org/2025/schedule/event/fosdem-2025-5544-hardware-backed-ssh-keys-ssh-tpm-agent/

Slides: https://pub.linderud.dev/talks/Hardware-backed-SSH-keys.pdf

#TPM #SSH #Security #Linux

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Trump Has Disturbing Response to DOGE’s Massive Overreach of Power:
Donald Trump admitted that Elon Musk’s agency has access to too much sensitive data.
https://newrepublic.com/post/191322/donald-trump-elon-musk-doge-overreach-power

"“Why does #DOGE need all of that?” asked one reporter.

“Well, it doesn’t, but they get it very easily,” Trump admitted. “I mean, we don’t have very good #security in our country, & they get it very easily.”

#Trump appeared completely unbothered by the massive intrusion on the #privacy of #US citizens"

#Musk #Coup

ALT text details

News headline: Trump Has Disturbing Response to DOGE’s Massive Overreach of Power Donald Trump admitted that Elon Musk’s agency has access to too much sensitive data. Edith Olmsted February 7, 2025 / 4:23 p.m. ET

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Elon Musk’s #DOGE Is Expected to Examine Another #Treasury System Next Week:
The new target, sources said, is a sensitive database that tracks the flow of money across the #government.
https://www.propublica.org/article/elon-musk-doge-cars-treasury-examine

"The #data in the system, known as the Central Accounting Reporting System, or #CARS, is considered sensitive...

People who work with the system have in the past been briefed that the #database may be of interest to foreign #intelligence agencies"

#Musk #Coup #Tech #Security #News #USA

ALT text details

News headline: Trump Administration Elon Musk’s DOGE Is Expected to Examine Another Treasury System Next Week The new target, sources said, is a sensitive database that tracks the flow of money across the government.

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Musk’s DOGE Teen Was Fired By #Cybersecurity Firm for Leaking Company Secrets:
Edward Coristine posted online that he had retained access to the firm’s servers. Now he has access to sensitive govt information.
https://archive.is/1v8FG#selection-1405.0-1411.136

“I can confirm that #EdwardCoristine 's brief contract was terminated after the conclusion of an internal investigation into the #leaking of proprietary company information"

#ElonMusk #Tech #Coup #Musk #DOGE #Politics #Government #Data #Security #News #US #USA

ALT text details

News headline: Politics |Cybersecurity Musk’s DOGE Teen Was Fired By Cybersecurity Firm for Leaking Company Secrets Edward Coristine posted online that he had retained access to the firm’s servers. Now he has access to sensitive government information.

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

The Government’s Computing Experts Say They Are Terrified:

Four IT professionals lay out just how destructive Elon Musk’s incursion into the US govt could be.
https://www.theatlantic.com/technology/archive/2025/02/elon-musk-doge-security/681600/

"“This is the largest data breach & the largest #IT #security breach in our country’s #history—at least that’s publicly known”...

nobody yet knows which info #DOGE has access to, or what it plans to do with it...

“I don’t think the public quite understands the level of danger.”"

#Musk #Coup #Tech #News #USA

ALT text details

News headline: Technology The Government’s Computing Experts Say They Are Terrified Four IT professionals lay out just how destructive Elon Musk’s incursion into the U.S. government could be. By Charlie Warzel and Ian Bogost

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Musk’s rats:
They’re burrowing into every #data system in the federal govt, although many wouldn’t pass a #security test
https://robertreich.substack.com/p/doge-poop

"Sure, there’s some waste & fraud in #government. That’s why every department had an #InspectorGeneral to find & stop it — until #Trump fired most of them. In addition, before Musk’s rats tunneled into the General Services Administration, accountants oversaw every department’s & agency’s spending.

In other words, the #coup continues."

#Musk #News

ALT text details

Headline: Musk’s rats They’re burrowing into every data system in the federal government, although many wouldn’t pass a security test by Robert Reich Feb 07, 2025

Aral Balkan

@aral@mastodon.ar.al

If Apple complies with this, the UK government will gain access to all iCloud data globally. The only way Apple comes out of this with any integrity is to leave the UK market. If they give in to this, every regime in the world will demand the same thing. And that’s before we even get to the fact that there’s no such thing a “backdoor” for just so-and-so. Either there is a door or there isn’t and if there is, anyone who obtains the key can use it.

https://www.theguardian.com/technology/2025/feb/07/uk-confronts-apple-with-demand-for-cloud-backdoor-to-users-encrypted-data

#apple #backdoor #UK #encryption #privacy #security #personhood #data #democracy #humanRights #iCloud

Aral Balkan

@aral@mastodon.ar.al

https://www.theguardian.com/technology/2025/feb/07/uk-confronts-apple-with-demand-for-cloud-backdoor-to-users-encrypted-data

#apple #backdoor #UK #encryption #privacy #security #personhood #data #democracy #humanRights #iCloud

Fedora Project

@fedora@fosstodon.org

Looking for opportunities to harden your Fedora system? Here's one way to make your VPN use more secure with NetworkManager.

➡️ https://fedoramagazine.org/protect-your-vpn-from-tunnelvision-attacks-with-networkmanager/

#Fedora #Privacy #Security #Linux #OpenSource #NetworkManager

Zak

@zak@infosec.exchange

Remember that there are computers in your house other than the ones that you interact with regularly. Your wireless router is a computer. Your TV is probably a computer. Your home appliances and lights might even be computers. And they all need updates and security patches. Keep the computers in your house up to date!

https://passage.1password.com/post/passkey-ready

Kushal Das :python: :tor: 🇵🇸

@kushal@toots.dgplug.org

To all #windows #malware #security #virus #infosec people here, did you see anything on Windows creating a lot of files with names like:

```
ኅȻㅺ慦愔驦䦔钓呩쥷儋ፑʑ壖兝㈪箖鴍퉛맩䑼னᖲ緄㵲
```
Most probably self replicating over external drives etc. Please RT for more reach.

Jeremiah Lee

@Jeremiah@alpaca.gold · Reply to Jeremiah Lee's post

Passkey Ready is a free analytics tool from 1Password for anonymously measuring what percentage of your users are ready for passkeys. It also suggests a rollout strategy for passwordless auth in your product.

#passkey #security

Jeremiah Lee

@Jeremiah@alpaca.gold · Reply to Jeremiah Lee's post

Do passkeys have some growing pains?

Yes: https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/

Are they being addressed?

Yes: https://fidoalliance.org/fido-alliance-publishes-new-specifications-to-promote-user-choice-and-enhanced-ux-for-passkeys/

Should products start prompting users to sign in with passkeys today? Yes.

Should products keep existing email+password+OTP authentication? Yes, for now.

Should products try to sign up new users with passkeys and fall back to email+password+OTP? Yes.

#Flatpak #Security #GNOME

Phil

@phil@fed.bajsicki.com

Of public interest:

At least 15,000 people fully, without limits, irrevocably, licensed their personal information, public image, name and all data that reached loops.video infrastructure... to @dansup@mastodon.social 's loops.video platform.

Had they known they're entirely losing control of everything, would they be using the platform?

Explanation in the renote, and here:

https://bajsicki.com/blog/loops-video-terms/

Is this what we, as a #society, want?

#mastodon #admin #dataprivacy #datasecurity #fediverse #federation #ActivityPub #privacy #security #copyright #consent #instagram #tiktok #pixelfed #loopsvideo

RE: https://fed.bajsicki.com/notes/a349itz9il

ALT text details

Daniel Supernault (@dansup@mastodon.social) bragging about his loops.video platform crossing 15000 users.

Phil

@phil@fed.bajsicki.com

How about no?

You're way overstepping with this, poisoning the entire ActivityPub ecosystem.

Let me break this down for you...

https://bajsicki.com/blog/loops-video-terms/

In short: if you really intend to federate, respect your users and their data.

Implementing federation while keeping these terms is a severe breach of trust, and would poison the entirety of the network in an way which will cripple ActivityPub, and undermine the very foundation of what AP stands for with regard to privacy, data ownership, and control over what we post to the network.

Hopefully that's not your intention. Is it?

#mastodon #admin #dataprivacy #datasecurity #fediverse #federation #ActivityPub #privacy #security #copyright #consent #instagram #tiktok #pixelfed #loopsvideo

RE: https://mastodon.social/users/dansup/statuses/113841956808397142

TheEvilSkeleton

@TheEvilSkeleton@treehouse.systems

At last, the USB portal originally authored by @refi64 in 2021, later continued by Georges Stavracas in 2023, and finalized by @hub and @swick, has been merged!

The USB portal allows sandboxed formats like Flatpak to access USB devices without poking holes in the sandbox. This is great for security, as accessing USB devices will now need to be explicitly granted by the user.

Now we just need to wait for implementers to implement them in their respective portal implementations, starting with GNOME: https://gitlab.gnome.org/GNOME/xdg-desktop-portal-gnome/-/merge_requests/159

The documentation for the USB portal is available on the xdg-desktop-portal website: https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Usb.html

Jeremiah Lee

@Jeremiah@alpaca.gold

Passkeys should be the default sign up/in method for every consumer app.

OpenID Connect should be the default for organization-managed user accounts.

Email+password+OTP is legacy.
Sign in with XYZ is legacy.

Get with the times, apps.

Change the defaults.

Migrate users.

Remove the insecure login.

https://caniuse.com/passkeys

https://gitlab.gnome.org/GNOME/xdg-desktop-portal-gnome/-/merge_requests/159

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Musk’s Takeover Of The Government’s Computer Systems Needs To Be Understood As A Cyberattack, Or Worse
https://www.techdirt.com/2025/02/03/musks-takeover-of-the-governments-computer-systems-needs-to-be-understood-as-a-cyberattack-or-worse/

"These systems #Musk and his “team” have accessed are among the most sensitive and critical to the running of the #USA...

Yet here is Musk, a man who regularly chats with Vladimir #Putin, with access to it all, if not also outright control."

#ElonMusk #Coup #Tech #Technology #CyberSecurity #Security #NationalSecurity #Treasury #OPM #Russia #China #Trump #News #US

ALT text details

News headline and text from article. Headline: Musk’s Takeover Of The Government’s Computer Systems Needs To Be Understood As A Cyberattack, Or Worse Privacy from the we've-been-pwned dept Mon, Feb 3rd 2025 10:47am - Cathy Gellis Text: People sometimes think that cybersecurity is just about defending computer systems from remote adversaries. But it’s broader than that; cybersecurity has always been about protecting computer systems more generally from any sort of misuse, no matter how the adversary might access them. So that Elon Musk and his minions have managed to walk right into government offices to take over computer systems where they had no legitimate authorization or entitlement needs to be understood as a cyberattack by a rogue actor.

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

"These systems #Musk and his “team” have accessed are among the most sensitive and critical to the running of the #USA...

Yet here is Musk, a man who regularly chats with Vladimir #Putin, with access to it all, if not also outright control."

#ElonMusk #Coup #Tech #Technology #CyberSecurity #Security #NationalSecurity #Treasury #OPM #Russia #China #Trump #News #US

ALT text details

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

"These systems #Musk and his “team” have accessed are among the most sensitive and critical to the running of the #USA...

Yet here is Musk, a man who regularly chats with Vladimir #Putin, with access to it all, if not also outright control."

#ElonMusk #Coup #Tech #Technology #CyberSecurity #Security #NationalSecurity #Treasury #OPM #Russia #China #Trump #News #US

ALT text details

TheEvilSkeleton

@TheEvilSkeleton@treehouse.systems · Reply to TheEvilSkeleton's post

As we're aware, the USB portal was merged a few months ago. All that's needed is for apps and desktops to implement them, so we can use them inside sandboxes without compromising security.

Just today, the USB portal implementation for xdg-desktop-portal-gnome was merged! Apps that use the USB portal will be able to request specific USB devices without giving unfiltered access to all your USB devices.

#GNOME #USB #Flatpak #Security

ALT text details

Dialog with a header bar and page with a description and list of USB devices. The header bar has the Deny button on the left side, “Access USB Devices” in the title, and Allow on the right side. The description reads “ASHPD Demo wants to access the following USB devices”. The list shows a row with “Elgato” as the title and “Stream Deck Plus” as the description, along with its serial number in a popover.

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

インターネット検閲：世界的脅威を理解する
https://qiita.com/pseudonym2/items/2d99d96d203f5f99031d?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security #VPN #初心者 #ブロックチェーン #Tor

TheEvilSkeleton

@TheEvilSkeleton@treehouse.systems · Reply to TheEvilSkeleton's post

As we're aware, the USB portal was merged a few months ago. All that's needed is for apps and desktops to implement them, so we can use them inside sandboxes without compromising security.

https://gitlab.gnome.org/GNOME/xdg-desktop-portal-gnome/-/merge_requests/159

#GNOME #USB #Flatpak #Security

ALT text details

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

The War at Home:
Elon Musk and The Security State's Uvalde Moment:
“We have a Constitutional crisis, period," says NSA whistleblower Tom Drake, who can't help but notice how the three-letter agencies that went after him aren't stopping this
https://www.forever-wars.com/elon-musk-and-the-security-states-uvalde-moment/

"The danger to the #Constitution is running amok inside govt buildings. But the #Security State stands outside, deterred, & will present any number of rationalizations about how this isn't their job."

#ElonMusk #Musk #Coup #News #US

ALT text details

News headline: The War at Home Elon Musk and The Security State's Uvalde Moment “We have a Constitutional crisis, period," says NSA whistleblower Tom Drake, who can't help but notice how the three-letter agencies that went after him aren't stopping this. by Spencer Ackerman 03 Feb 2025 • 6 min read

Erik Jonker

@ErikJonker@mastodon.social

Made me think about #cybersecurity , this Doom game running inside (!) a PDF file, by @j0hnnyxm4s
https://doompdf.pages.dev/doom.pdf

#doom #linux #pdf #security

Simple Nomad

@simplenomad@rigor-mortis.nmrc.org

On a slightly lighter topic, there is a Netflix limited series entitled "Zero Day" which from the trailer (https://www.youtube.com/watch?v=FOfBiiPdQPI) looks to be slightly "exaggerated" from a pure technical perspective. The IMDB listing does not show any infosec-related technical advisor. I am wondering how shit this is going to be. On the plus side, a hell of a talented cast!

#infosec #security #hacking

Erik Jonker

@ErikJonker@mastodon.social

Made me think about #cybersecurity , this Doom game running inside (!) a PDF file, by @j0hnnyxm4s
https://doompdf.pages.dev/doom.pdf

#doom #linux #pdf #security

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

【CTF】防衛省サイバーコンテスト2025:Writeup
https://qiita.com/kk0128/items/dbc889300be1bb047b53?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security #CTF #writeup

boredsquirrel

@Rhababerbarbar@tux.social · Reply to Mozilla's post

@mozillaofficial

Finally! This will allow better process #sandboxing, and make the #flatpak and #android app finally an option?

https://bugzilla.mozilla.org/show_bug.cgi?id=1756236

https://bugzilla.mozilla.org/show_bug.cgi?id=1565196

#security #firefox #sandbox #linux

onrust 🍉

@onrust@infosec.exchange · Reply to onrust 🍉's post

Principles for a New Security Industry, as per noah's article:

We owe it to our users to criticise, thoroughly, our own industries. To do otherwise is to harm both our users and the industries in which we exist.
Where possible, this should be done publicly and productively. Security or safety by obscurity is ineffective and counterproductive.
We must consider threat models beyond our own.
We must do away with the notion that collaboration is less desirable than individual, “you do you” styles of operating. The only way we build a safer (digital/physical) world is together.
We must prioritise actually doing the things that keep us safe.
We must react strongly and truthfully to incorrect notions.
We must actively reject this wherever we see it, and remember that we have an obligation to teach.
As best we can, we must act to prevent harm.
We have to decide to actively pursue a safer world and make plans to put that into action.
No matter how influential we are, we must remember that the work comes first. Your CVE list is useless on an empty planet.
We must be aware of our own mistakes and seek to correct them.

Some principles have further annotations, they're in the full article fyi: https://covid.tips/fluconf-post/

onrust 🍉

@onrust@infosec.exchange · Reply to onrust 🍉's post

Hmmm ... TOR and Signal get flagged as 'so-called “freedom” tools' that received funds from state actors (US govt)

hhmmmm :think_bread:

onrust 🍉

@onrust@infosec.exchange · Reply to onrust 🍉's post

mentions multiple kinds of abuse (partner, parental, employer)

So important:

"When we make security onerous, (...) we help an abusive partner who can use a lack of 2FA to spy on an account, or a parent who wishes to spy on their child’s communications, or an employer who uses their security tooling to prevent unionisation."

#FluConf #security #TechWorkers

onrust 🍉

@onrust@infosec.exchange · Reply to onrust 🍉's post

Proper security works best when using multiple 'layers' of intervention. Preferably a combination of technical tooling and social (education/policy) steps to protect one another.

Yet that's not what we're doing at all right now, noah comments.

Today, technical tools and messaging are ...

used to protect profits at the expense of our being able to live truly self-actualised lives.
We are told that masks are scary, that security is “too hard”, that companies or government entities that use pandemic-driven-eugenics or New Cold War driven weakening/distorting of digital security processes have our best interests at heart.

So, people working in security: "[are we] willing to let that stand"?

onrust 🍉

@onrust@infosec.exchange · Reply to onrust 🍉's post

Love this point:

security is a “force multiplier”, not a blocker — that by taking action now, by making digital security a habit, we can make it harder for disaster to strike later.

And also, if and when disaster might strike, the impact can be reduced compared to when you hadn't taken any measures at all

onrust 🍉

@onrust@infosec.exchange · Reply to onrust 🍉's post

If your threat is that the Mossad is gonna do Mossad things to your email account, try as you might, YOU'RE STILL GONNA BE MOSSAD'ED UPON

(sorry for shouting)

#FluConf #security #cybersecurity

ALT text details

A table with three threats and their corresponding solutions, relating to email security (paraphrased): 1) Threat: Yr ex wants to break into your email. Solution: Use a strong password generated by and stored in a password manager, and 2FA. 2) Threat: Criminals want to break into yr email. Solution: As with (1), but also don't open suspicious unsolicited emails. 3) Threat: Mossad wants to break into yr email. Solution: "Magical amulets? Fake your own death, move into a submarine? YOU'RE STILL GONNA BE MOSSAD'ED UPON"

onrust 🍉

@onrust@infosec.exchange · Reply to onrust 🍉's post

The result?

If you're in security and are making light of infectious diseases, happily infecting coworkers and others, then:

we indicate that our commitment to security stops once our paycheque or fame or particular social mode of interacting is on the line.

onrust 🍉

@onrust@infosec.exchange

Next up at#FluConf is noah (@text) with:

The Swiss Cheese Model: How Infosec Must Learn From Pandemic Response

Read it here: https://covid.tips/fluconf-post/

The article's blurb:

As a digital security professional and a pandemic activist it has been tremendously revealing to me to see how my professional community has responded to the pandemic. After a brief year of "safe mode" conferences and online trainings, the "back to normal" urge overrode many people's threat models and notable figures in the community began joking about getting covid at conferences, or client engagements, or work trips and so on. This proposal is something of a manifesto aimed at reminding the security community (and indeed the technology community) about our commitments to Defence in Depth, and drawing comparisons between still-successful pandemic interventions and how we can apply these same techniques to information security...and a plea for a new kind of cybersecurity community, one that aims to work in solidarity with our users rather than in spite of them, one that strives to prevent digital as well as physical social murder.

this resonates so strongly here 😬 😭

#CovidIsNotOver #security

Michel Lind

@michelin@hachyderm.io

This is definitely not OK

https://futurism.com/openai-signs-deal-us-government-nuclear-weapon-security

#ClownShow #GenerativeAI #NuclearWeapons #Security

Michel Lind

@michelin@hachyderm.io

This is definitely not OK

https://futurism.com/openai-signs-deal-us-government-nuclear-weapon-security

#ClownShow #GenerativeAI #NuclearWeapons #Security

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

"Wyden Demands Answers Following Report of Musk Personnel Seeking Access to Highly Sensitive U.S. Treasury Payments System:

In New Letter to Treasury Secretary Bessent, Wyden Warns That Political Meddling in Treasury Payments Risks Severe Economic Damage, Calls Out Dangerous Conflicts of Interest Stemming from Elon Musk’s Close Business Ties to the Chinese Government
https://www.finance.senate.gov/chairmans-news/wyden-demands-answers-following-report-of-musk-personnel-seeking-access-to-highly-sensitive-us-treasury-payments-system

#ElonMusk #Treasury #Coup #Musk #China #Corruption #Trump #Politics #Economy #Security #US #USA

ALT text details

Headline and text. Headline: Wyden Demands Answers Following Report of Musk Personnel Seeking Access to Highly Sensitive U.S. Treasury Payments System In New Letter to Treasury Secretary Bessent, Wyden Warns That Political Meddling in Treasury Payments Risks Severe Economic Damage, Calls Out Dangerous Conflicts of Interest Stemming from Elon Musk’s Close Business Ties to the Chinese Government Text: Washington, D.C. – Senate Finance Committee Ranking Member Ron Wyden, D-Ore., demanded answers from Treasury Secretary Scott Bessent today following a report that personnel affiliated with Elon Musk have sought access to a highly sensitive Treasury Department payment system. That system, which is maintained by non-political staff, disperses trillions of dollars each year, such as Social Security and Medicare benefits, tax credits for individuals and businesses, grants and payments to government contractors, including those that compete directly with Musk-owned companies. Senator Wyden wrote in a new letter: “To put it bluntly, these payment systems simply cannot fail, and any politically-motivated meddling in them risks severe damage to our country and the economy. I am deeply concerned that ... these officials associated with Musk may have intended to access these payment systems to illegally withhold payments to any number of programs... I am concerned that mismanagement of these payment systems could threaten the full faith and credit of the United States.”

Zhi Zhu 🕸️

@ZhiZhu@newsie.social · Reply to Zhi Zhu 🕸️'s post

Exclusive: Musk aides lock government workers out of computer systems at US agency, sources say
https://www.reuters.com/world/us/musk-aides-lock-government-workers-out-computer-systems-us-agency-sources-say-2025-01-31/

"Aides to #ElonMusk charged with running the US #government human resources agency have locked career civil servants out of computer systems that contain the personal data of millions of federal employees...

"We have no visibility into what they are doing with the computer and data systems," one of the officials said."

#Musk #Coup #Trump #Politics #Tech #Security #News #USA

ALT text details

Headline and photo with caption. Headline: Exclusive: Musk aides lock workers out of OPM computer systems By Tim Reid February 1, 20258:27 AM CSTUpdated 6 min ago Photo: Elon Musk amid a group of men in suits raising his fists above his head in celebration. Caption: [1/3]Elon Musk, January 20, 2025, Washington, D.C. Ricky Carioti/Pool via REUTERS Purchase Licensing Rights

adb

@adbenitez@mastodon.social

📢 BREAKING NEWS!!!

🎉 #ArcaneChat got public on #GooglePlay some hours ago!!! 🔥

https://play.google.com/store/apps/details?id=com.github.arcanechat

also check the official website:
https://arcanechat.me

TIP: getting it from #fdroid or direct download is recommended, but if you have friends that only know how to install from Google Play, now it is possible for them!

Thanks a lot to the ArcaneChat beta-testers that made this milestone possible! you rock!!!! 🤩

#DeltaChat #decentralization #encryption #security #whatsapp #alternative

adb

@adbenitez@mastodon.social

📢 BREAKING NEWS!!!

🎉 #ArcaneChat got public on #GooglePlay some hours ago!!! 🔥

https://play.google.com/store/apps/details?id=com.github.arcanechat

also check the official website:
https://arcanechat.me

TIP: getting it from #fdroid or direct download is recommended, but if you have friends that only know how to install from Google Play, now it is possible for them!

Thanks a lot to the ArcaneChat beta-testers that made this milestone possible! you rock!!!! 🤩

#DeltaChat #decentralization #encryption #security #whatsapp #alternative

Stefano Marinelli

@stefano@bsd.cafe

A few days ago, a client of mine asked me to install an open-source software (which I won’t name for now). The software has only one official installation method: Docker. This is because, as they themselves admit, it has a huge number of dependencies - some quite outdated - that need to be carefully managed and forced into place; otherwise, nothing works.

I tried replicating the same setup on FreeBSD but didn’t succeed, as some dependencies either aren’t compatible or simply refuse to run. I could try finding workarounds, but I can already picture the chaos every time an update is needed.

So, I decided to build it via Docker to get a better sense of what we’re dealing with. The sheer number of dependencies that Node pulls in is impressive, but even more staggering is the number of warnings and errors it spits out: deprecated and unsupported packages, security vulnerabilities, generic warnings- you name it, and there’s plenty of it.

Since my client needs to launch this service but is subject to audits, they want to be fully compliant and ensure security. Given their substantial budget, they offered financial support to the developers (a company, not just a group of hobbyists) to help improve the project either by making it FreeBSD - compatible or, at the very least, by reducing dependencies with critical vulnerabilities. The client was willing to pay a significant sum, and since the improvements would be open-source, everyone would benefit.

The response from the team? A flat-out refusal. They claimed they couldn’t accept any amount of money because many of these dependencies are "necessary and irreplaceable, as parts of the code relying on them were written by people who no longer work on the project, and we can’t rewrite the core of the software.” Then came the part that really got under my skin: they stated they would rather deal directly “with my client, not with me, because in the end, my concerns are just useless and irrational paranoia.”

Translation? Just pay, and you’ll pass compliance checks - never mind the fact that underneath, it’s a tangled mess of outdated and insecure components. And don’t make a fuss about it.

While I can understand some of the challenges the team faces, I might have accepted this response if it had come from a group of volunteers or hobbyists. But if you’re a company whose sole business revolves around a single software product (with no real competition at the moment), this approach is not just short-sighted - it’s outright dangerous for your users’ security and for your own survival as a business.

The result? They lost a paying client who was ready to invest a significant budget into their software. That budget will now go elsewhere. My client is considering hiring developers to build a similar project with better security (they have both the time and the money for it). I’ll do my best to convince them to release it as open-source - at which point, a new “competitor” will emerge in the market.

#IT #SysAdmin #OSS #Security #Infosec

$^Kur0den\d{4}$ :irai_houki_tyuu:'s avatar$

^Kur0den\d{4}$

@kur0den0010@chpk.kur0den.net

『Cloudflare WAFのLeaked Credentials Checkを国内最速？で検証する #Security - Qiita』 - https://qiita.com/kanish/items/32d30bb0d6e5ef868cf2

Natasha Nox 🇺🇦🇵🇸

@Natanox@chaos.social

Irregular reminder that https://european-alternatives.eu/alternatives-to exists, a great list of service providers from Europe (including the exact nation as well as tags to know what's FOSS *AND* Self-hostable) that will enable you to move away from services hosted within and governed by the upcoming US Regime laws.
#privacy #security #Europe #USA #Safety

SpaceLifeForm

@SpaceLifeForm@infosec.exchange · Reply to The Tor Project's post

@torproject

Should have left X long ago. Now is the time.

#Security #Privacy

Natasha Nox 🇺🇦🇵🇸

@Natanox@chaos.social

nixCraft 🐧

@nixCraft@mastodon.social

Meta (Facebook) is no longer banning Distrowatch and discussion of Linux allowed again. https://lwn.net/Articles/1006859/ (adding screenshot in case it is taken down)

#linux #security #infosec #cybersecurity

ALT text details

Malware scanner error Posted Jan 30, 2025 7:02 UTC (Thu) by osandov (subscriber, #97963) Parent article: Linux-related discussion as a cybersecurity threat I (Meta employee) can share this: Our automated systems blocked distrowatch.com for hosting a link to a file detected by third party security vendors as malware. This was an error and has since been addressed. Discussions of Linux are allowed on our services.

Emeritus Prof Christopher May

@ChrisMayLA6@zirk.us

Q. will Greenland be the litmus test for how Europe responds to Trump?

Nathalie Tocci, thinks it reveals that:

'Europeans are scared. They fear Trump & their fear is paralysing. It freezes their actions & quiets their rhetoric. The more Trump confirms their fears through his repeated threats, the less they are inclined to react. Trump presumably smells the fear & like all bullies revels in it, upping the ante'!

Time to toughen up?

#politics #security #Greenland

https://www.theguardian.com/commentisfree/2025/jan/30/greenland-europe-donald-trump-us-threats

Emeritus Prof Christopher May

@ChrisMayLA6@zirk.us

Q. will Greenland be the litmus test for how Europe responds to Trump?

Nathalie Tocci, thinks it reveals that:

Time to toughen up?

#politics #security #Greenland

https://www.theguardian.com/commentisfree/2025/jan/30/greenland-europe-donald-trump-us-threats

Frankie ✅

@Some_Emo_Chick@mastodon.social

DeepSeek collects keystroke data and more, storing it in Chinese servers

You might want to learn about DeepSeek's privacy policy before you sign up.

https://mashable.com/article/deepseek-ai-privacy-policy-keystroke-data-chinese-servers

#news #tech #technology #security #privacy #AI #deepseek

heise Security

@heisec@social.heise.de

Elektronische Patientenakte: Gematik hielt Sicherheitslücke für "akzeptabel"

Die Gematik nahm die Sicherheitslücken bei der E-Patientenakte wohl erst nach Kenntnis von gültigen, auf Kleinanzeigen käuflichen Praxisidentitäten ernst.

https://www.heise.de/news/Elektronische-Patientenakte-Gematik-hielt-Sicherheitsluecke-fuer-akzeptabel-10259471.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#DigitalHealth #elektronischePatientenakteePA #Security #news

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

zizmor v1.3.0 is released!

this release brings a new audit (overprovisioned-secrets), plus a handful of bugfixes/enhancements to existing audits.

notes here: https://github.com/woodruffw/zizmor/releases/tag/v1.3.0

#rust #security

ALT text details

a screenshot of zizmor running and showing the results of the overprovisioned-secrets audit

Adrianna Tan

@skinnylatte@hachyderm.io

Human Rights Watch is hiring a Director of Information Security

https://job-boards.greenhouse.io/humanrightswatch/jobs/7833377002

#GetFediHired #Jobs #Security #InfoSec

Adrianna Tan

@skinnylatte@hachyderm.io

Human Rights Watch is hiring a Director of Information Security

https://job-boards.greenhouse.io/humanrightswatch/jobs/7833377002

#GetFediHired #Jobs #Security #InfoSec

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

zizmor v1.3.0 is released!

this release brings a new audit (overprovisioned-secrets), plus a handful of bugfixes/enhancements to existing audits.

notes here: https://github.com/woodruffw/zizmor/releases/tag/v1.3.0

#rust #security

ALT text details

a screenshot of zizmor running and showing the results of the overprovisioned-secrets audit

LabPlot

@LabPlot@floss.social

Today is the Data Privacy (Protection) Day! So let us remind you that in #LabPlot, an open-source data analysis and visualization software, Your Data is Yours!

@labplot@lemmy.kde.social @opensource @libre_software @privacy

Boosts appreciated! 🙂 :boost_love: 🚀

#DataSecurity #DataProtection #DataPrivacy #Privacy #Ownership #InfoSec #DataAnalysis #DataScience #Analytics #Data #DataAnalytics #DataViz #FOSS #FLOSS #SoftwareLibre #OpenSource #OpenScience #Science #Engineering #KDE #Business #Security #Orwell

Volla

@volla@mastodon.social

Es gibt Neuigkeiten zum Versandstatus des Volla Tablets!

Hier gehts zum Blog Artikel:

https://volla.online/de/blog/files/tablet-shipping-startet.html

-----------------

Shipping of Volla Tablet has started. Find the blog article here:

https://volla.online/en/blog/files/tablet-shipping-started.html

#volla #vollaos #opensource #software #hardware #vollatablet #opensourcehardware #tablet #peertopeer #innovation #freedom #privacy #security

Volla

@volla@mastodon.social

Es gibt Neuigkeiten zum Versandstatus des Volla Tablets!

Hier gehts zum Blog Artikel:

https://volla.online/de/blog/files/tablet-shipping-startet.html

-----------------

Shipping of Volla Tablet has started. Find the blog article here:

https://volla.online/en/blog/files/tablet-shipping-started.html

#volla #vollaos #opensource #software #hardware #vollatablet #opensourcehardware #tablet #peertopeer #innovation #freedom #privacy #security

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

初心者向けサイバー攻撃の種類と対策の基礎知識
https://qiita.com/nucomiya/items/c30c8de57eba7ccdfbe3?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security #DDoS #サイバーセキュリティ

Metin Seven

@Seven@pixelfed.art

Isometric pixel art from a series of pixel illustrations I made for a Dutch infosec company.

The illustrations were printed as stickers. See other posts for more.

#PixelArt #isometric #security #InfoSec #safety #tech #technology #coding #CharacterDesign #stickers #design #artwork #illustration #illustrator #digital #DigitalArt #style #art #arts #arte #artist #artists #GraphicDesign #2D #3D #CreativeToots #FediArt #MastoArt #ArtistsOnMastodon

ALT text details

Isometric pixel art of a virtual reality gamer, sitting in a chair, while being surrounded by VR game elements in space: space fighter jets and a floating spaceship landing platform.

Metin Seven

@Seven@pixelfed.art

ALT text details

Isometric pixel art of a virtual reality gamer, sitting in a chair, while being surrounded by VR game elements in space: space fighter jets and a floating spaceship landing platform.

Hollo

@hollo@hollo.social

In related news, #Hollo has also released #security updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework

@fedify@hollo.social

We have released #security updates (1.0.14, 1.1.11, 1.2.11, 1.3.4) to address CVE-2025-23221, a #vulnerability in #Fedify's #WebFinger implementation. We recommend all users update to the latest version of their respective release series immediately.

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

TIL: GitHub Actions is surprisingly case-insensitive

https://yossarian.net/til/post/github-actions-is-surprisingly-case-insensitive/

#til #github #github_actions #security

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

TIL: GitHub Actions is surprisingly case-insensitive

https://yossarian.net/til/post/github-actions-is-surprisingly-case-insensitive/

#til #github #github_actions #security

Mark Wyner :vm:

@markwyner@mas.to

Are passkeys really better than passwords? And what happens when you no longer have access to the authentication device?

I keep reading up on this. But I find few answers. Is anyone willing to elaborate?

#InfoSec #Privacy #Passwords #Security

Dainius Happy 🇱🇹 ❤ 🇺🇦

@anthroposamu@mastodon.social

almost_pwned.md
https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4
g.co, Google's official URL shortcut (update: or Google Workspace's domain verification, see bottom), is compromised. People are actively having their Google accounts stolen.
#security

Dainius Happy 🇱🇹 ❤ 🇺🇦

@anthroposamu@mastodon.social

otaku binary オタクバイナリ

@otakubinary@sakurajima.moe

Seems that Crunchyroll had a breach. You should change your password.

The option to change the password in menu settings (logged in) didn't work throws an error.

Log out or try in another browser and select forgot password in login menu this will send you a link to reset the password

https://animehunch.com/crunchyroll-premium-login-details-leaked-users-at-high-risk/

#Crunchyroll #anime #manga #otaku #security #animation

Jordan Warne

@jw@social.lol

You need to protect your communication, not only for your own sake but for those around you. I produced a video at @privacyguides to raise awareness around the insecurity of SMS and to push people towards more secure alternatives. #privacy #encryption #security

https://www.youtube.com/watch?v=B9BWXvn-rB4

Jordan Warne

@jw@social.lol

https://www.youtube.com/watch?v=B9BWXvn-rB4

tricia, queen of house cyberly

@triciakickssaas@infosec.exchange

Features aren't always innocent 😉

In the most recent publication by Akamai Technologies' Security Intelligence Group, Tomer Peled found yet -a n o t h e r- vuln in K8s. this time in Log Query, and it can do some big bad.

Did you know that out of the 12 vulns found in Kubernetes since 2023, Tomer has found 4 of them?!?!? i work with the coolest people

anyway, couldn't resist a britney parody sooooooo

https://www.akamai.com/blog/security-research/2024-january-kubernetes-log-query-rce-windows

#kubernetes #k8s #vulnerability #security #cybersecurity #parody

tricia, queen of house cyberly

@triciakickssaas@infosec.exchange

Features aren't always innocent 😉

In the most recent publication by Akamai Technologies' Security Intelligence Group, Tomer Peled found yet -a n o t h e r- vuln in K8s. this time in Log Query, and it can do some big bad.

Did you know that out of the 12 vulns found in Kubernetes since 2023, Tomer has found 4 of them?!?!? i work with the coolest people

anyway, couldn't resist a britney parody sooooooo

https://www.akamai.com/blog/security-research/2024-january-kubernetes-log-query-rce-windows

#kubernetes #k8s #vulnerability #security #cybersecurity #parody

otaku binary オタクバイナリ

@otakubinary@sakurajima.moe

Seems that Crunchyroll had a breach. You should change your password.

The option to change the password in menu settings (logged in) didn't work throws an error.

Log out or try in another browser and select forgot password in login menu this will send you a link to reset the password

https://animehunch.com/crunchyroll-premium-login-details-leaked-users-at-high-risk/

#Crunchyroll #anime #manga #otaku #security #animation

Privacy Guides

@privacyguides@mastodon.neat.computer

If you’re going to participate in a protest or other form of activism, you need to keep yourself protected.

Your smartphone can be an essential tool, but it also represents a huge risk to your privacy and security. If you decide to bring a phone along, understanding these best practices when it comes to securing it will help keep you and your data safe.

https://www.privacyguides.org/articles/2025/01/23/activists-guide-securing-your-smartphone/

#Privacy #Security #Article #PrivacyGuides #Guide

Privacy Guides

@privacyguides@mastodon.neat.computer

If you’re going to participate in a protest or other form of activism, you need to keep yourself protected.

Your smartphone can be an essential tool, but it also represents a huge risk to your privacy and security. If you decide to bring a phone along, understanding these best practices when it comes to securing it will help keep you and your data safe.

https://www.privacyguides.org/articles/2025/01/23/activists-guide-securing-your-smartphone/

#Privacy #Security #Article #PrivacyGuides #Guide

$^Kur0den\d{4}$ :irai_houki_tyuu:'s avatar$

^Kur0den\d{4}$

@kur0den0010@chpk.kur0den.net

ポリシーによってはドメイン部以外もリファラとして送信されるのね

『主要ブラウザのReferrer Policyについて調べてみた #Security - Qiita』 - https://qiita.com/n3_x/items/c2bafd5872af61147c89

$^Kur0den\d{4}$ :irai_houki_tyuu:'s avatar$

^Kur0den\d{4}$

@kur0den0010@chpk.kur0den.net

Privacy Guides

@privacyguides@mastodon.neat.computer

If you’re going to participate in a protest or other form of activism, you need to keep yourself protected.

Your smartphone can be an essential tool, but it also represents a huge risk to your privacy and security. If you decide to bring a phone along, understanding these best practices when it comes to securing it will help keep you and your data safe.

https://www.privacyguides.org/articles/2025/01/23/activists-guide-securing-your-smartphone/

#Privacy #Security #Article #PrivacyGuides #Guide

Jonah Aragon

@jonah@neat.computer

I was feeling inspired to write this morning after looking through a lot of this type of article and noticing they all omitted kind of important information. This includes all of the basics, and the stuff I thought was under-discussed, for example: AirDrop's privacy problems, and the importance of security patches in this specific scenario.

I hope someone finds this useful, and if I'm still missing anything or could explain something better, please let me know!

https://www.privacyguides.org/articles/2025/01/23/activists-guide-securing-your-smartphone/

#Privacy #Security #Activism #Protest #PrivacyGuides

nickbearded

@nickbearded@mastodon.social

The website is live!

https://www.bashcore.org/

#linux #bashcore #cli #nogui #debian #security #pentesting #education #bash

BrianKrebs

@briankrebs@infosec.exchange

Some fascinating research out on hacking a Subaru via STARLINK connected vehicle service.

"On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK connected vehicle service that gave us unrestricted targeted access to all vehicles and customer accounts in the United States, Canada, and Japan.

Using the access provided by the vulnerability, an attacker who only knew the victim’s last name and ZIP code, email address, phone number, or license plate could have done the following:

Remotely start, stop, lock, unlock, and retrieve the current location of any vehicle.

Retrieve any vehicle’s complete location history from the past year, accurate to within 5 meters and updated each time the engine starts.

Query and retrieve the personally identifiable information (PII) of any customer, including emergency contacts, authorized users, physical address, billing information (e.g., last 4 digits of credit card, excluding full card number), and vehicle PIN.

Access miscellaneous user data including support call history, previous owners, odometer reading, sales history, and more.

After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously."

https://samcurry.net/hacking-subaru#introduction

#cars #security #subaru @starlink

BrianKrebs

@briankrebs@infosec.exchange

Some fascinating research out on hacking a Subaru via STARLINK connected vehicle service.

Using the access provided by the vulnerability, an attacker who only knew the victim’s last name and ZIP code, email address, phone number, or license plate could have done the following:

Remotely start, stop, lock, unlock, and retrieve the current location of any vehicle.

Retrieve any vehicle’s complete location history from the past year, accurate to within 5 meters and updated each time the engine starts.

Access miscellaneous user data including support call history, previous owners, odometer reading, sales history, and more.

After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously."

https://samcurry.net/hacking-subaru#introduction

#cars #security #subaru @starlink

heise Security

@heisec@social.heise.de

Cisco: Kritische Sicherheitslücke in Meeting Management

Cisco warnt vor einer kritischen Sicherheitslücke in Meeting Management sowie Schwachstellen in Broadworks und ClamAV.

https://www.heise.de/news/Cisco-Kritische-Sicherheitsluecke-in-Meeting-Management-10253499.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Cisco #Virenscanner #Security #Sicherheitslücken #news

BrianKrebs

@briankrebs@infosec.exchange

Some fascinating research out on hacking a Subaru via STARLINK connected vehicle service.

Using the access provided by the vulnerability, an attacker who only knew the victim’s last name and ZIP code, email address, phone number, or license plate could have done the following:

Remotely start, stop, lock, unlock, and retrieve the current location of any vehicle.

Retrieve any vehicle’s complete location history from the past year, accurate to within 5 meters and updated each time the engine starts.

Access miscellaneous user data including support call history, previous owners, odometer reading, sales history, and more.

After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously."

https://samcurry.net/hacking-subaru#introduction

#cars #security #subaru @starlink

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

【メモ】セキュリティインシデントを調べるときに参考になるサイトまとめ
https://qiita.com/koinunopochi/items/413246b8466ba3505bc8?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security

heise Security

@heisec@social.heise.de

Cisco: Kritische Sicherheitslücke in Meeting Management

Cisco warnt vor einer kritischen Sicherheitslücke in Meeting Management sowie Schwachstellen in Broadworks und ClamAV.

https://www.heise.de/news/Cisco-Kritische-Sicherheitsluecke-in-Meeting-Management-10253499.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Cisco #Virenscanner #Security #Sicherheitslücken #news

Metin Seven 🎨

@metin@graphics.social

Signal is a secure messenger, but there are interesting alternatives, such as @matrix , @session , @delta , @simplex or XMPP …

➡️ https://matrix.org

➡️ https://getsession.org

➡️ https://delta.chat

➡️ https://simplex.chat

➡️ https://xmpp.org

If you’d like to learn more about these options, have a look at the responses to this toot.

#matrix #session #signal #XMPP #messenger #decentralized #tech #technology #OpenSource #FOSS #WhatsApp #security #InfoSec #data #safety

ITSEC News

@itsecbot@schleuss.online

Cloudflare CDN flaw leaks user location data, even through secure chat apps - A security researcher discovered a flaw in Cloudflare's content delivery network (CDN), w... https://www.bleepingcomputer.com/news/security/cloudflare-cdn-flaw-leaks-user-location-data-even-through-secure-chat-apps/ #security

Linux Is Best

@Linux_Is_Best@misskey.de

List of service providers outside the United States jurisdiction. 😉

🤫 VPN =

* iVPN, located in Gibraltar, Europe (UK territory)
https://www.ivpn.net

* Mullvad VPN, located in Sweden, Europe
https://mullvad.net

* Goose VPN, located in the Netherlands, Europe
https://goosevpn.com

* Xeovo VPN, located in Finland, Europe
https://xeovo.com

🌐 Managed DNS =

* AdGuard DNS, located in Cyprus, Europe
https://adguard-dns.io

* ClouDNS, located in Bulgaria, Europe
https://www.cloudns.net

* deSEC, located in Germany, Europe
https://desec.io

🌐 Public DNS =

* CIRA Canadian Shield, located in Canada, North America
https://www.cira.ca/en/canadian-shield/configure/

* Mullvad DNS, located in Sweden, Europe
https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

🔏 Privacy focused e-mail =

* Tuta, located in Germany, Europe
https://tuta.com

* Soverin, located in the Netherlands, Europe
https://soverin.com

* Startmail, located in the Netherlands, Europe
https://www.startmail.com

* Mailfence, located in Belgium, Europe
https://mailfence.com

🌍 Domain Registration / Web Hosting =

* Scalewy, located in France, Europe
https://www.scaleway.com

* OVH, located in France, Europe
https://www.ovhcloud.com

* Netcup, located in Germany, Europe
https://www.netcup.com

* Glesys, located in Sweden, Europe
https://glesys.com

🌍 CDN =

* OVH, located in France, Europe
https://www.ovhcloud.com/en/web-hosting/options/cdn/

* Key CDN, located in Switzerland, Europe
https://www.keycdn.com

#Project2025 #DonaldTrump #Trump #Facism #Fedi #Fediverse #ActivityPub #Email #Vpn #Domain #WebHosting #DNS #CDN #Privacy #Security #FreedomOfSpeech #UnitedStates #America #Usa

Branedy

@Branedy@mastodon.social

So much for National Security #trump #security #musk

Branedy

@Branedy@mastodon.social

So much for National Security #trump #security #musk

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

NymVPNの”匿名モード”とは？技術的解説
https://qiita.com/pseudonym2/items/819bbaf88bfdd653a932?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

ハニーポット観測：Apache HTTP Serverパストラバーサル脆弱性（CVE-2021-41773，CVE-2021-42013）を標的とした攻撃の攻撃分析
https://qiita.com/melkruri/items/3f432bd00361bdfc9155?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Apache #Security #IoT #honeypot

Hollo

@hollo@hollo.social

In related news, #Hollo has also released #security updates: 0.3.6 & 0.4.4. Update now!

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Lockdownyourlife

@Lockdownyourlife@infosec.exchange

Are you on Signal or Wire yet? Go do that. Gently move your friends/fam over to one of the platforms. Set disappearing messages on both sides of the conversation. Be careful what you say in group chats, know who you trust, and who are your Vault people. For REAL sensitive stuff, in-person, no phones.

Normalize going places without your phones, leave them at home now and again to establish a pattern.

Please understand anyone who works in advocacy, healthcare (esp reproductive rights/women's healthcare), journalists, some gov officials, marginalized groups will likely be targeted.

If this doesn't fit your threat model/risk profile, you know someone who will be impacted by oversight, surveillance or someone snitching

#tech #infosec #security #safety #privacy #security #community #education

SnowshadowII

@SnowshadowII@beige.party

🇺🇸 🇺🇸 🇺🇸

Go back to any old social media profiles that you don’t use anymore and delete those accounts.

Delete/erase old email accounts/inboxes that are defunct.

Strip any information about your family or where you live from blogs or company websites.

Use a service like Delete Me or Aura to systematically go through the internet and remove personally identifiable information.

#Trump #Privacy #US #security

Lockdownyourlife

@Lockdownyourlife@infosec.exchange

Normalize going places without your phones, leave them at home now and again to establish a pattern.

Please understand anyone who works in advocacy, healthcare (esp reproductive rights/women's healthcare), journalists, some gov officials, marginalized groups will likely be targeted.

If this doesn't fit your threat model/risk profile, you know someone who will be impacted by oversight, surveillance or someone snitching

#tech #infosec #security #safety #privacy #security #community #education

SnowshadowII

@SnowshadowII@beige.party

🇺🇸 🇺🇸 🇺🇸

Go back to any old social media profiles that you don’t use anymore and delete those accounts.

Delete/erase old email accounts/inboxes that are defunct.

Strip any information about your family or where you live from blogs or company websites.

Use a service like Delete Me or Aura to systematically go through the internet and remove personally identifiable information.

#Trump #Privacy #US #security

Maximum MEW

@maximum_mew@indieweb.social

I learned about the Opt Out Project's Cyber-Cleanse by @cyberlyra here on Mastodon. So grateful for a roadmap to regaining some of my online privacy.

https://maryewarner.com/2025/01/20/diving-deep-on-the-opt-out-cyber-cleanse/

#tech #privacy #security

Hollo

@hollo@hollo.social

In related news, #Hollo has also released #security updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Hollo

@hollo@hollo.social

In related news, #Hollo has also released #security updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Hollo

@hollo@hollo.social

In related news, #Hollo has also released #security updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Hollo

@hollo@hollo.social

In related news, #Hollo has also released #security updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Hollo

@hollo@hollo.social

In related news, #Hollo has also released #security updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Hollo

@hollo@hollo.social

In related news, #Hollo has also released #security updates: 0.3.6 & 0.4.4. Update now!

https://hollo.social/@fedify/01948487-87b2-709d-953f-8799b78433ed

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

Fedify: an ActivityPub server framework

@fedify@hollo.social

The Vulnerability

A security researcher identified multiple security issues in Fedify's lookupWebFinger() function that could be exploited to:

Perform denial of service attacks through infinite redirect loops
Execute server-side request forgery (#SSRF) attacks via redirects to private network addresses
Access unintended URL schemes through redirect manipulation

Fixed Versions

1.3.x series: Update to 1.3.4
1.2.x series: Update to 1.2.11
1.1.x series: Update to 1.1.11
1.0.x series: Update to 1.0.14

Changes

The security updates implement the following fixes:

Added a maximum redirect limit (5) to prevent infinite redirect loops
Restricted redirects to only follow the same scheme as the original request (HTTP/HTTPS)
Blocked redirects to private network addresses to prevent SSRF attacks

How to Update

To update to the latest secure version:

# For npm users
npm update @fedify/fedify

# For Deno users
deno add jsr:@fedify/fedify

We thank the security researcher who responsibly disclosed this vulnerability, allowing us to address these issues promptly.

For more details about this vulnerability, please refer to our security advisory.

If you have any questions or concerns, please don't hesitate to reach out through our GitHub Discussions, join our Matrix chat space, or our Discord server.

어둠사자

@gnh1201@catswords.social · Reply to 어둠사자's post

Product #Security Bad Practices from #FBI

https://ic3.gov/CSA/2025/250117.pdf

Mark Heftler

@markheftler@esq.social

2025 kicks off with A Modest Divestment, a deliberate effort to reduce my reliance on US-based big tech. Canceling 365, switching to #Startmail & #Internxt, and exploring #OnlyOffice. Saying goodbye to #Meta and tightening up #privacy protections. Here's to a secure, private, and independent year ahead.

https://copingalgorithms.com/posts/a-modest-divestment

#security #protonmail #microsoft #fediverse #bigtech

Linux Is Best

@Linux_Is_Best@misskey.de

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

i've released `zizmor` v1.2.0!

some key changes:

- there's a new `bot-conditions` audit, which can detect spoofable `github.actor` checks!
- precision/accuracy improvements to the `unpinned-uses` and `excessive-permissions` audits!
- bugfixes for the `template-injection` and `artipacked` audits!
- more general bugfixes, including a (hopeful) improvement to the SARIF output behavior and fixes to our parsing of some workflow/expression edge cases

and from a sustainability perspective: many thanks to https://astral.sh/ for being our first logo-level sponsor!

full release notes here:

https://woodruffw.github.io/zizmor/release-notes/#v120

#rust #security #opensource

ALT text details

a screenshot of zizmor with findings from the new bot-conditions audit

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

i've released `zizmor` v1.2.0!

some key changes:

and from a sustainability perspective: many thanks to https://astral.sh/ for being our first logo-level sponsor!

full release notes here:

https://woodruffw.github.io/zizmor/release-notes/#v120

#rust #security #opensource

ALT text details

a screenshot of zizmor with findings from the new bot-conditions audit

Kagi HQ

@kagihq@mastodon.social

Kagi mentioned as one of the key ways you can keep your family safe online:

"Mogull plans to make it the default search engine for all his relatives."

https://www.scworld.com/resource/five-cybersecurity-tips-to-keep-your-extended-family-safe-online

#Kagi #Security #Search #AdFree

Phil

@phil@fed.bajsicki.com

ALT text details

Daniel Supernault (@dansup@mastodon.social) bragging about his loops.video platform crossing 15000 users.

Phil

@phil@fed.bajsicki.com

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

Sphinx：LightningやNymを支える匿名データフォーマット
https://qiita.com/pseudonym2/items/200be1bb6daa55bf05ad?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

https://www.heise.de/news/WordPress-Plug-in-W3-Total-Cache-Potenziell-1-Millionen-Websites-attackierbar-10246228.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

Phil

@phil@fed.bajsicki.com

Daniel Supernault

@dansup@mastodon.social

Regardless of what happens with TikTok, I'm still focused on shipping https://loops.video to the world, and open sourcing the entire platform!

History has proven that technology like this is best used when the people have control, and can build their own communities.

#LongLiveLoops

$^Kur0den\d{4}$ :irai_houki_tyuu:'s avatar$

^Kur0den\d{4}$

@kur0den0010@chpk.kur0den.net

『安全なウェブサイトの作り方に学ぶセッション管理 #Security - Qiita』 - https://qiita.com/kujira_engineer/items/133af11f9386957a052c

heise Security

@heisec@social.heise.de

WordPress-Plug-in W3 Total Cache: Potenziell 1 Millionen Websites attackierbar

Stimmen die Voraussetzungen, können Angreifer Websites mit dem WordPress-Plug-in W3 Total Cache ins Visier nehmen. Ein Sicherheitspatch ist verfügbar.

#Patchday #Security #Sicherheitslücken #Updates #Wordpress #news

heise Security

@heisec@social.heise.de

WordPress-Plug-in W3 Total Cache: Potenziell 1 Millionen Websites attackierbar

Stimmen die Voraussetzungen, können Angreifer Websites mit dem WordPress-Plug-in W3 Total Cache ins Visier nehmen. Ein Sicherheitspatch ist verfügbar.

https://www.heise.de/news/WordPress-Plug-in-W3-Total-Cache-Potenziell-1-Millionen-Websites-attackierbar-10246228.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Patchday #Security #Sicherheitslücken #Updates #Wordpress #news

Guy

@phlogiston@mastodon.nz

I was wondering ... as #email encryption via PGP/GnuPG is not suitable for true and ongoing end-to-end confidentiality. But what about authenticity of mails? I dislike S/MIME for its corporate nature, and #PGP via PGP/MIME is well enough supported by many (free) mail clients.

What's the #cryptography or #security community's view on PGP for signing emails? Or what would a suitable alternative be? I haven't come across any, though.

1/2

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

VPN、Tor、I2P - Nymはどう比較されるのか？
https://qiita.com/pseudonym2/items/e9ac6c66a0ba3b2ab108?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

https://github.com/NixOS/nixpkgs/pull/373845

nixpkgs security changes

@nixpkgssecuritychanges@social.gerbet.me

rsync: 3.3.0 -> 3.4.1

#security #nixpkgs #nixos

Teddy / Domingo (🇨🇵/🇬🇧)

@TeddyTheBest@framapiaf.org

Defensive #Linux #Security
Picture found at https://darkwebinformer.com/defensive-linux-security/

ALT text details

Linux Security Apps

mailbox.org

@mailbox_org@social.mailbox.org

👋 Goodbye spam and viruses! 📩

Keep your inbox clean and safe with spam and virus protection from mailbox.org!

✔️ Top filter technology
✔️ Customisable to your needs
✔️ Data protection first and foremost

👉 Switch now and mail stress-free

#Spamprotection #Security #Privacy

nixCraft 🐧

@nixCraft@mastodon.social

The rsync utility in Linux, *BSD, and Unix-like systems are vulnerable to multiple security issues, including arbitrary code execution, arbitrary file upload, information disclosure, and privilege escalation. Hence, you must patch the system ASAP https://www.cyberciti.biz/linux-news/cve-2024-12084-rsyn-security-urgent-update-needed-on-unix-bsd-systems/

#infosec #security #linux #unix

ALT text details

A critical vulnerability (CVE-2024-12084 and five others) requires immediate patching on Linux, *BSD, macOS, and Unix-like systems to protect your systems from attacks. Update Rsync now!

Prainbow (she/her) 🏔️Colorado

@Prainbow@mastodon.social

"Data privacy advocates have long warned of the risks that data brokers pose to individuals’ privacy and national security. Researchers with access to the sample of Gravy Analytics’ location data posted by the hacker say that the information can be used to extensively track people’s recent whereabouts."
#Privacy #Security #Tracking #DataBreach
https://techcrunch.com/2025/01/13/gravy-analytics-data-broker-breach-trove-of-location-data-threatens-privacy-millions/

nixCraft 🐧

@nixCraft@mastodon.social

#infosec #security #linux #unix

ALT text details

A critical vulnerability (CVE-2024-12084 and five others) requires immediate patching on Linux, *BSD, macOS, and Unix-like systems to protect your systems from attacks. Update Rsync now!

nixCraft 🐧

@nixCraft@mastodon.social

#infosec #security #linux #unix

ALT text details

A critical vulnerability (CVE-2024-12084 and five others) requires immediate patching on Linux, *BSD, macOS, and Unix-like systems to protect your systems from attacks. Update Rsync now!

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

ブロックチェーンを安全にスケーリングする
https://qiita.com/pseudonym2/items/24a744a9a2899cfad655?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#Spamprotection #Security #Privacy

mattlqx

@matt@lqx.net

The solution to my hotel’s cooling issues in their data closet is simply to leave the door open. Yikes! #security #opsec

mailbox.org

@mailbox_org@social.mailbox.org

👋 Goodbye spam and viruses! 📩

Keep your inbox clean and safe with spam and virus protection from mailbox.org!

✔️ Top filter technology
✔️ Customisable to your needs
✔️ Data protection first and foremost

👉 Switch now and mail stress-free

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

最も匿名性に優れたVPNの選び方
https://qiita.com/pseudonym2/items/bd1841a0ef54a5169a5a?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

コンピュータでプロキシをオフにする方法(詳細ver.)
https://qiita.com/pseudonym2/items/cf07c9dda5d06cbb54fe?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

https://grahamcluley.com/smashing-security-podcast-399/

Natasha Nox 🇺🇦🇵🇸

@Natanox@chaos.social

Stefano Marinelli

@stefano@bsd.cafe

UPDATE: I haven't seen Recall in action there. I was just asking the doctor how they'll deal with it.

This morning, I went to the doctor for a scheduled appointment. While she was looking at the results of blood tests from two years ago on the screen (and suggested repeating them for a follow-up), I realized she was using Windows 11. A detail came to mind. The doctor is extremely polite and friendly, so I asked her, "How do you handle the feature called Recall?" The doctor was taken aback and had no idea what I was talking about. I was about to drop the conversation, but she, being a serious professional, immediately called the technicians who manage their PCs to ask for clarification. They downplayed it, saying it's not an issue and that it's a feature "on all PCs, so we can't do anything about it." She started to express that she didn’t like it and wanted it deactivated. No luck: they won’t proceed because, according to them, even deactivating it is "a hack that could compromise future updates." She’s furious and will talk to her colleagues and the decision-makers. She wants secure systems because "there’s patient data involved."

In reality, patient data is stored on servers (which I haven't investigated), but everything that appears on the screen is, in my opinion, at risk.

I’ve offered to help them find a solution—because, if I'm right, all they need is LibreOffice and a browser. In that case, I’ll suggest one of the *BSD or Linux systems and do it for free.

I don’t want to make money off my doctor. I just want patient data to be (sufficiently) secure.

#IT #Recall #Windows #OwnYourData #Security #Privacy #RunBSD #Linux

Kagi HQ

@kagihq@mastodon.social

Kagi is "pick of the week" in this latest Smashing Security podcast episode by cybersecurity veterans Graham Cluley and Carole Theriault:

#Kagi #Search #AdFree #Security #Privacy

Jcrabapple (Catppuccin King)

@jcrabapple@dmv.community

Some developers have picked up the Mull source code and they're continuing development under the name Ironfox.

IronFox OSS / IronFox · GitLab

https://gitlab.com/ironfox-oss/IronFox

#Android #Firefox #FOSS #Security #Privacy

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

Nym mixnetはブロックチェーンではないが、ブロックチェーンで動いている
https://qiita.com/pseudonym2/items/2066252b305bad71d295?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#CyberSec #SOC #Blueteam #SecOps #Security

RDP Snitch

@rdpsnitch@infosec.exchange

2025-01-08 RDP #Honeypot IOCs - 350 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec

Top IPs:
68.183.88.109 - 200
185.42.12.81 - 16
185.170.144.198 - 16

Top ASNs:
AS14061 - 226
AS396982 - 24
AS59425 - 18

Top Accounts:
hello - 254
Administr - 24
Domain - 18

Top ISPs:
DigitalOcean, LLC - 226
Chang Way Technologies Co. Limited - 24
Google LLC - 24

Top Clients:
Unknown - 350

Top Software:
Unknown - 350

Top Keyboards:
Unknown - 350

Top IP Classification:
hosting - 248
Unknown - 64
proxy - 24

Pastebin links with full 24-hr RDP Honeypot IOC Lists:
https://pastebin.com/7emQHvAD

joschi

@joschi@hachyderm.io

Hey #AWS peeps,
are there any published checksums (or better: signed artifacts) for the AWS certificate bundles listed at https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesDownload?

I'd like to be sure I'm adding the right certificates into my certificate store. 😅

#AmazonRDS #SSL #TLS #security

Downshift 🥥🌴

@Downshift@mstdn.ca

#DivestOS, a custom #Android #ROM that offers #security and #privacy features, shuts down after ten years.

https://divestos.org/pages/news#end

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

“Five Eyes”の監視を打ち破るには？Nymミックスネットのプライバシー
https://qiita.com/pseudonym2/items/e895980c3ec684354954?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

Brooke Kuhlmann

@bkuhlmann@mastodon.social

Last year I mentioned you should enable global Bundler 2.6.0's support for checksums in your Gemflile.lock for enhanced security:

`bundle config --global lockfile_checksums true`

Well, Maciej has a write up on why this is important that goes into much more detail: https://mensfeld.pl/2025/01/the-silent-guardian-why-bundler-checksums-are-a-game-changer-for-your-applications/

Please enable if you haven't already!

#ruby #security

Chris‌‬ Hayes‌

@chris_hayes@fosstodon.org

If anyone is looking at #Jobs, particularly in #privacy and #security, #1Password has more than a few openings - https://jobs.lever.co/1password

Einstein^Vaderbilt

@azuresaipan@defcon.social

On Mobile Phone Security
https://www.kicksecure.com/wiki/Mobile_Phone_Security
#SS7 and #baseband #vulnerabilities

What about #mobian hardening on a #MechaComet with a cellular hat? Then there's only carrier protocol weaknesses...

If ISPs use microwave relays (the hated 'air' - remember Max Headroom) and NSA access points, is domestic broadband really secure either? But the cable or fiber doesn't have 'carrier' vulns.
https://www.kicksecure.com/wiki/Router_and_Local_Area_Network_Security

#kicksecure #whonix #docs #security-misc

XenoPhage :verified:

@XenoPhage@infosec.exchange

So, #security folks, how are you handling all of these job scams? Specifically, we're seeing a lot of folks coming to us who were "hired" by us, but the hiring process was a scam. ie, we had nothing to do with it.

I'm not sure there's much of anything we *can* do, but maybe I'm incorrect? Thoughts?

#scams #hiring #advice

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

分散型VPN：NymVPNの技術　Mixnetの簡単な紹介
https://qiita.com/pseudonym2/items/91e378e3adebe0388fed?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #AWS #Security #mount_s3

Brooke Kuhlmann

@bkuhlmann@mastodon.social

Last year I mentioned you should enable global Bundler 2.6.0's support for checksums in your Gemflile.lock for enhanced security:

`bundle config --global lockfile_checksums true`

Well, Maciej has a write up on why this is important that goes into much more detail: https://mensfeld.pl/2025/01/the-silent-guardian-why-bundler-checksums-are-a-game-changer-for-your-applications/

Please enable if you haven't already!

#ruby #security

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

Mountpoint for Amazon S3の有用性について考える
https://qiita.com/yuri_snowwhite/items/19c9afd9ce7dfa6557a9?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

MS Ignite 2024のセキュリティセッションの再生リスト
https://qiita.com/ishiayaya/items/ac42a8b00ec8bc911df0?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Microsoft #Security #Defender #Microsoft365 #Purview

Scott 🏴

@scott@tams.tech

I just brought up a new, bespoke service. New subdomain, freshly minted LetsEncrypt cert. I hit it once for testing, and then within seconds comes a barrage of requests for common paths... /config.json, /.vscode/sftp.json (lol), /.DS_Store, /.env

of course my service had nothing of interest on these paths (phew) but how the hell did someone enumerate that fresh subdomain so quickly!? How did they know to hit it?

#webDev #sysAdmin #devOps #security

PrivacyDigest

@PrivacyDigest@mas.to

Time to check if you ran any of these 33 malicious #Chrome extensions

At least 33 #browser extensions hosted in Google’s Chrome Web Store, some for as long as 18 months, were surreptitiously siphoning sensitive data from roughly 2.6 million devices.
#privacy #security #chromeextensions

https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extensions-discovered-on-2-6-million-devices/

PrivacyDigest

@PrivacyDigest@mas.to

Time to check if you ran any of these 33 malicious #Chrome extensions

https://arstechnica.com/security/2025/01/dozens-of-backdoored-chrome-extensions-discovered-on-2-6-million-devices/

Frankie ✅

@Some_Emo_Chick@mastodon.social

Asking some reasonable questions about Elon Musk's "help" with the Cybertruck bombing case

#news #tech #technology #security #privacy #cybertruck #tesla #elonmusk #bombing

Frankie ✅

@Some_Emo_Chick@mastodon.social

Asking some reasonable questions about Elon Musk's "help" with the Cybertruck bombing case

#news #tech #technology #security #privacy #cybertruck #tesla #elonmusk #bombing

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

zizmor 1.0

https://blog.yossarian.net/2025/01/02/zizmor-1-0

#security #oss #devblog #programming #rust

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

zizmor 1.0

https://blog.yossarian.net/2025/01/02/zizmor-1-0

#security #oss #devblog #programming #rust

मोक्ष / untrusem

@untrusem@merveilles.town

Finally joined merveilles. So, here I go again, again

I am Moksh / untrusem, A kid with questions, from #India.
I am firm believer in #privacy and #security and also practice #permacomputing, My other shenanigans include #emacs, #bsd, #lisp, *nix and learning about #solarpunk. But I delve into so much things to write all of them down.

I also likes esoteric things. I try to program but a novice in that.

I will use my time here to steal knowledge from you amazing people, so watch out :)

#Introduction #untrusem

Cloudflare

@cloudflare@noc.social

In his most recent article, Cloudflare Field CTO John Engates shares how, despite the cloud revolution in IT service delivery, a critical piece remains elusive: IT still lacks sufficient visibility and control over #Networking and #Security. https://cfl.re/3DBYwZn

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

OAuth 2.0の認可エンドポイントにおける脆弱な実装例と対策について考える
https://qiita.com/task4233/items/3af1b3d2690b44979659?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security #OAuth #OAuth2_0

Brett Flippin

@bflipp@vmst.io

I made the mistake of engaging with a thread over the weekend where an obvious paranoid schizophrenic decided to start replying to me.

I’ve muted them on my PC but the fact that mutes are only client side means my notifications are likely a god damn minefield and I’m avoiding looking at them on my phone. This is a REALLY STUPID DESIGN.

#mastodon #security #safety

neatchee

@neatchee@urusai.social

🚨 SECURITY PSA - 7ZIP VULN🚨

Update your 7zip, folks

https://cybersecuritynews.com/7-zip-vulnerability-arbitrary-code/

#cybersecurity #zeroday #7zip #malware #security #it #infosec

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

セキュリティ入門：『安全なウェブサイトの作り方』Railsでの具体例付きさらっと解説
https://qiita.com/ho_na/items/39dab467adeba7a30116?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Rails #プログラミング #Security #初心者 #エンジニア

Downshift 🥥🌴

@Downshift@mstdn.ca

#DivestOS, a custom #Android #ROM that offers #security and #privacy features, shuts down after ten years.

https://divestos.org/pages/news#end

Frederik Borgesius

@Frederik_Borgesius@akademienl.social

‘the VW [Volkswagen] Group stored sensitive information for 800,000 electric vehicles from various brands on a poorly secured Amazon cloud—essentially leaving the digital door wide open for anyone to waltz in. And not just briefly, but for months on end. The breach impacts fully electric models across Audi, VW, Seat, and Skoda brands, affecting vehicles not just in Germany but throughout Europe and other parts of the world.’ https://databreaches.net/2024/12/27/massive-vw-group-data-leak-exposed-800000-ev-owners-movements-from-homes-to-brothels/ #privacy #security #surveillance #cybersecurity

Frederik Borgesius

@Frederik_Borgesius@akademienl.social

Frederik Borgesius

@Frederik_Borgesius@akademienl.social

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

CORSの設定とプリフライトが発生する条件
https://qiita.com/Kennie/items/ba41893cc7dca536b4aa?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security #CORS

Marcus "MajorLinux" Summers

@majorlinux@toot.majorshouse.com

You may want to hold off on installing Windows 11 for a bit.

A weird Windows 11 bug won’t let some people install any security updates

https://www.theverge.com/2024/12/26/24329779/windows-11-october-november-installer-usb-media-secuity-update-bug

#Windows11#Bug #Security #Updates #OperatingSystem #Microsoft #Tech

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

ヴィクトリア朝時代のハッキング
https://qiita.com/k-morita412/items/d8e385d1ec165316ab6e?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security #インターネット #歴史 #書評 #AdventCalendar2024

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

サイバーセキュリティ超初心者だった私が今までのことを振り返ってみて
https://qiita.com/GenkaiChan/items/cec81770fbd8d2f0c966?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security #振り返り

{Insert Pasta Pun}

@risottobias@tech.lgbt

okay what was that wifi / authentication / four-eyes system that sounds kinda like shoggoth or an acryonym or something.

#Security #BlueTeam #CyberSecurity

Pete Prodoehl 🍕

@rasterweb@mastodon.social

Can scanning a QR code do this? I want to call bullshit because I’ve seen two (non-techie) friends share this. Can a computer security expert weigh in on this?

> “There is a QR code to scan, and once scanned, all the information from that phone will be sent to scammers. They receive all access to the phone. All personal and financial information is accessible to the scammers and often the victim's bank accounts are drained.”

#computer #security #scam

Sovereign Tech Fund

@sovtechfund@mastodon.social · Reply to Sovereign Tech Fund's post

The Sovereign Tech Agency is looking for an experienced and innovative expert in #opensource #security to lead the Sovereign Tech Resilience program.

https://www.sovereign.tech/jobs/cybersecurity-program-lead #fossjobs #getfedihired

PrivacyDigest

@PrivacyDigest@mas.to

#Tracker firm #Hapn spilling names of thousands of #GPS #tracking customers | TechCrunch

A #security researcher alerted TechCrunch in late November to customer names and affiliations — such as the name of their workplace — spilling from one of Hapn’s servers, which TechCrunch has seen.
#privacy #surveillance

https://techcrunch.com/2024/12/18/tracker-firm-hapn-spilling-names-of-thousands-of-gps-tracking-customers/

GENKI

@nibushibu@vivaldi.net

パスワード関係、に任せちゃってる…

#vivaldi #password #security

PrivacyDigest

@PrivacyDigest@mas.to

#SupremeCourt to Hear TikTok’s Challenge to Law That Could Ban It

The company and its Chinese parent invoked the #FirstAmendment in urging the justices to step in before a Jan. 19 deadline to sell or be shut down.
#China #tiktok #scotus #privacy #security

https://www.nytimes.com/2024/12/18/us/politics/supreme-court-tiktok-ban.html

Scratch Monkey BLU3

@nchprgmng@hackers.town

Urgently seeking work, please boost 🙏

Good day netizens. Blue has returned after 10 years in tech, once again on the job hunt. I have worked a variety of roles from hands-on computer repair to NOC tech to Sys admin and more. In that time, I have accrued several certifications including the #Swimlane Certified #SOAR Administrator, #CompTIA #Network+, #Security+, #Pentest+, #CertifiedNetworkVulnerabilityProfessional, and #CASP+. I'm currently looking for #remotework for anywhere in the #US . I'm targeting #cybersecurity roles, since that is what I am passionate about and my certifications are focused in, but I am also open to other IT roles such as software engineer, dev ops, etc. I'm a #transgender woman trying to provide for her #LGBTQIA family and any pay would greatly help us make ends meet as we try to survive in this refuge state where the cost of living is so much higher than back home. Boosts and sharing is welcome, thanks for your time and help. #getfedihired #breakingintoinfosec #infosec #informationtechnology #sysadmin #netadmin #redteam #pentest

Gérald Barré

@meziantou@hachyderm.io

Generating SBOM for NuGet packages #NuGet #dotnet #security https://www.meziantou.net/generating-sbom-for-nuget-packages.htm?utm_medium=social&utm_source=mastodon

arihak

@arihak@techhub.social

Ad blockers are becoming essential #security tools:
Threat actors often abuse ad networks - Even #Facebook ads or #Google’s Search sponsored results aren’t immune to malvertising.
“Ad networks have proven exceptionally successful; they are fine-tuned machines built from the ground up to distribute traffic on a massive scale,” the Guardio Labs explain in the new report.
https://cybernews.com/security/fake-captchas-reaching-millions-malvertising-mayhem/

Yellow Flag

@WPalant@infosec.exchange

I just replied to a blog comment, and I thought that I post my reply here as well:

I think that I have good reasons to be “against Avast,” having published seven articles on them so far. The security issues alone are bad enough. But Avast abused their position to collect and sell users’ browsing profiles. After they were caught they claimed the data to be anonymized, they claimed to only sell aggregated data – and they continue lying to this day, despite there being conclusive evidence to the contrary. While the company has been bought, it’s still the same people in charge. This sort of undermines any trust in them for anything related to security.

As the security of antivirus software goes, I’m not very fond of any as the articles in the “antivirus” category of my blog show. With Kaspersky it wasn’t only the security issues but also how they handled them, pushing out half-hearted fixes only for these to be circumvented shortly afterwards. McAfee and BullGuard had massive security issues stemming from being careless about security and not following best practices.

I’ve found a critical security issue in Bitdefender’s solution as well, but with them I at least had the impression that they were trying. Unfortunately, that’s currently the bar in the antivirus industry – at least trying to make their product secure.

Security-wise, one good thing about Windows Defender is that it only needs to do one job. It doesn’t need all the extra functionality as a selling argument. It doesn’t need to be a banking browser, it doesn’t need to be a phishing protection, it only needs to be an antivirus solution. It can keep a very small attack surface compared to all those antivirus suites, and so it does (yes, I checked).

#antivirus #security #avast #McAfee #BullGuard #Bitdefender #WindowsDefender

やまのく

@yamanoku@mastodon.social

セキュリティエンジニアって200職あんねん（分類とキャリアの話） #Security - Qiita

https://qiita.com/ahera/items/3bea4df41423ef208700

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

セキュリティエンジニアって200職あんねん（分類とキャリアの話）
https://qiita.com/ahera/items/3bea4df41423ef208700?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Security #キャリア #初心者エンジニア #セキュリティエンジニア

Qiita - 人気の記事

@qiita@rss-mstdn.studiofreesia.com

CVE-2024-10979をローカルで再現してみる
https://qiita.com/ikeda_takato/items/df354bcd5953a1c11ef6?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #PostgreSQL #Security #CVE_2024_10979

Talya (she/her) 🏳️‍⚧️✡️

@Yuvalne@433.world

the biggest update to #Signal since usernames - fully encrypted, fully secure cloud backups - are coming soon!
the first part of it - message syncing to a new secondary device - is now in pre-beta testing!
go and help test it out!
https://community.signalusers.org/t/help-us-test-desktop-history-syncing/65452?u=rassilon1963

#FOSS #E2EE #Security #Privacy

Frankie ✅

@Some_Emo_Chick@mastodon.social

Firefox, one of the first “Do Not Track” supporters, no longer offers it.

It was more than useless. Websites did not have to honor it and in fact would use it as one more point of entropy for fingerprinting your identity.

https://arstechnica.com/gadgets/2024/12/firefox-one-of-the-first-do-not-track-supporters-no-longer-offers-it/

#news #tech #technology #security #privacy #mozilla #firefox

lars

@ls@social.lsnet.eu

@dansup This doesn't seem like a good idea to me. On the one hand, transcoding uses up a lot of battery power, and on the other hand, simpler smartphones may not be able to cope with it, or it takes a long time and the device gets pretty warm.

But I see the bigger problem in #security: If the encoding is done on the client side, an attacker can prepare the video in such a way that it crashes the decoder on other phones or use security vulnerabilities to execute code, with #Loops as a multiplicator.

Mysk🇨🇦🇩🇪

@mysk@mastodon.social

The severity level of this bug is critical, 9.8 out of 10. Upgrade your devices.

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2024-54492&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1&source=CISA-ADP

#iOS #iPhone #security #infosec #Apple #cybersecurity
https://mastodon.social/@mysk/113636630798700926

David Bisset

@davidbisset@phpc.social

"What's the worst password incorrect dialog box?"

🤔

#webDev #security #UI #memes

ALT text details

Dialog box that says something the effect of "Error: This password is already used by starboy99. Try another." This text may not be letter for letter exact.

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

zizmor 0.9.0 is released!

some key changes:

* bugfixes/precision improvements around a handle of safe template patterns (e.g. `runner.temp`)
* precision improvements to our handling of matrices and matrix expansions, thanks to @ubiratansoares
* the terminal interface has been reworked to use tracing spans internally, making it even more responsive

full release notes here: https://github.com/woodruffw/zizmor/releases/tag/v0.9.0

#rust #security #opensource

ALT text details

a screen recording of `zizmor` auditing a remote repository, showing the new tracing span based progress indicators

Turris project

@turris@fosstodon.org

Hi #Fediverse, let's start our journey here with our #introduction. We are #Turris project by #CZNIC. We develop and produce #opensource #wifi #router with focus on #security running #Linux distribution based on #OpenWrt. Of course, we provide automatic #updates and #root accounts. We have a #network of #honeypots running on our devices and create a dynamic #firewall based on the data.

Morten Linderud

@Foxboron@chaos.social

I'm mind blown you can compromise a release CI/CD system with two malicious branch names. Like how.

https://github.com/ultralytics/ultralytics/issues/18027

#Security #SupplyChainSecurity

TheEvilSkeleton

@TheEvilSkeleton@treehouse.systems

At last, the USB portal originally authored by @refi64 in 2021, later continued by Georges Stavracas in 2023, and finalized by @hub and @swick, has been merged!

The documentation for the USB portal is available on the xdg-desktop-portal website: https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Usb.html

#Flatpak #Security #GNOME

FreeBSD Foundation

@FreeBSDFoundation@mastodon.social

FreeBSD 14.2 is here! New ZFS, Firecracker VMM, AIM for UDP, rtw89(4) driver, & AddressSanitizer. Explore performance & security updates! 🔗https://buff.ly/4f5bZG5
#FreeBSD #OpenSource #Networking #Virtualization #Security #Performance

Seth Michael Larson

@sethmlarson@fosstodon.org

I've noticed a concerning trend of "slop security reports" being sent to open source projects. Here are thoughts about what platforms, reporters, and maintainers can do to push back:

#oss #opensource #security

https://sethmlarson.dev/slop-security-reports?utm_campaign=mastodon

Veronica Olsen 🏳️‍🌈🇳🇴🌻

@veronica@mastodon.online

Someone told me yesterday of a minutes app for meetings they'd found. Knowing how these apps work, I checked the security policy. I got my fears confirmed. It collects data and share it with 8 third parties, including use for ads & analysis.

I showed her this, and said she should probably get consent from others when using the app. Today she told me she'd uninstalled it and thanked me for the warning!

We can't expect people to figure this out. We need better regulation.

#AI #Security #Privacy

Tuta

@Tutanota@mastodon.social

At Tuta, we believe that best security must be free for everyone.

We are happy to announce that in December all existing Tuta accounts will be upgraded to quantum-safe encryption! 🥳🎉

With TutaCrypt your data is safe - now and in the future. ⚛️ 🔒

Learn more about this quantum leap in #security: https://tuta.com/blog/post-quantum-cryptography

ALT text details

Crypto lock of Tuta

heise Security

@heisec@social.heise.de

Helldown-Ransomware: Einbruch durch Sicherheitslücke in Zyxel-Firewalls

IT-Forscher beobachten, dass die Helldown-Ransomware nach Einbruch in Netze durch Sicherheitslücken Zyxel-Firewalls zuschlägt.

https://www.heise.de/news/Helldown-Ransomware-Einbruch-durch-Sicherheitsluecke-in-Zyxel-Firewalls-10176669.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Firewall #Ransomware #Security #Sicherheitslücken #news

heise Security

@heisec@social.heise.de

Wordpress-Plug-in Anti-Spam by Cleantalk gefährdet 200.000 Seiten

Im Wordpress-Plug-in Anti-Spam by Cleantalk klaffen gleich zwei Sicherheitslücken, durch die nicht authentifizierte Angreifern Instanzen kompromittieren können.

https://www.heise.de/news/Wordpress-Plug-in-Anti-Spam-by-Cleantalk-gefaehrdet-200-000-Seiten-10175993.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Security #Sicherheitslücken #Wordpress #news

Mike Fiedler, Code Gardener

@miketheman@hachyderm.io

I wrote a report on a recent #Python #malware package uploaded to #PyPI over here: https://blog.pypi.org/posts/2024-11-25-aiocpa-attack-analysis/

#OpenSource #Security

🄷e⃞i⃞t⃞e⃞c⃞ Ⓜ️

@Heitec@mastodon.social

Signal Is Now a Great Encrypted Alternative to Zoom and Google Meet
And Signal app is FREE 😁
#security #encrypted #message
https://lifehacker.com/tech/signal-is-now-a-great-encrypted-alternative-to-zoom-google-meet

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

PyPI's support for PEP 740 now includes GitLab, extending support beyond the initial scope (which was GitHub). that means that, if you're a GitLab CI/CD user, you can now upload attestations to PyPI and the index will verify and re-serve them!

docs here: https://docs.pypi.org/attestations/producing-attestations/#gitlab-cicd

#pypi #python #security

ALT text details

screencap of https://docs.pypi.org/attestations/producing-attestations/#gitlab-cicd

Hazelnoot

@hazelnoot@enby.life

Urgent Warning for Fedi Admins

We've discovered an ongoing Denial-of-Service attack against Misskey-based instances. The attacks exploit a zero-day vulnerability impacting Misskey, Sharkey, IceShrimp, and other related software. Patches are in progress and will be released ASAP. We encourage all admins to update immediately!

Note: this is a different vulnerability from the ones that were recently announced! You should update today and again tomorrow at the scheduled time.

Update: Sharkey version 2024.9.2 has been released with a patch. You can get the update here: https://activitypub.software/TransFem-org/Sharkey/-/releases/2024.9.2

#Misskey #Sharkey #IceShrimp #FediAdmins #Security

Joel "Allegedly Human" Goguen

@jgoguen@hachyderm.io

Have you ever thought about how awesome it would be to work with me? My team is looking for a Senior #SRE with good #security sense!

The SRE job description is https://www.mongodb.com/careers/jobs/6361896, either #RemoteWork anywhere in North America or hybrid/in-office. No formal #infosec experience required, good sense is perfectly fine; this is first and foremost a SRE role with security as a focus.

Apply even if you don't meet all requirements! You don't need to be perfect!

#GetFediHired #FediJobs

Frankie ✅

@Some_Emo_Chick@mastodon.social

Let's Encrypt is 10 years old today!
Let's Encrypt is a free, automated, and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Huge thanks to everyone involved in making HTTPS available to everyone for free

https://letsencrypt.org/

#tech #technology #security #privacy #encryption #https #letsencrypt #ISRG

Senioradmin

@Haydar@social.tchncs.de

Oha, das ist provokativ: Dieser Blogartikel sagt:

- Nutzt kein #PGP / #GPG
- Nutzt kein #XMPP + OMEMO
- Nutzt kein #Matrix (im Sinne: verlasst euch nicht auf die Verschlüsselung)
- E-Mails verschlüsseln ist sinnlos

Ich kenne den Autor nicht und würde ihn nicht erwähnen, würde der Artikel nicht in ernstzunehmenden ITSec-Newslettern zitiert

https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/

Meinungen? #itsec #security

yossarian (1.3.6.1.4.1.55738)

@yossarian@infosec.exchange

Security means securing people where they are

https://blog.yossarian.net/2024/11/18/Security-means-securing-people-where-they-are

#security #oss

Mark

@paka@mastodon.scot

US senators urge investigation into Musk

Senators argued #Musk’s involvement in #SpaceX programs should be reviewed for potential debarment & exclusion due to the alleged contacts. Debarment would bar him from certain contracts and privileges.

Relationships between well-known US #adversary & Musk, beneficiary of billions in US govt funding, is serious risk regarding #Musk’s reliability as contractor & #SecurityClearance holder

https://kyivindependent.com/democratic-senators-urge-investigation-into-musks-calls-with-russia-reuters-reports/

#security #NationalSecurity #traitors

Cloudflare

@cloudflare@noc.social

Election infrastructure is vital to global democracies. Find out how the Internet plays its part, in this conversation with Cloudflare and Accenture. Watch the full Modern Security episode here >> https://cfl.re/48HUZnR

#CloudflareTV #Election #Voting #Security

Benjamin Carr, Ph.D. 👨🏻‍💻🧬

@BenjaminHCCarr@hachyderm.io

Le Monde used #Strava to track the movements of world leaders. They don’t use tracking devices, but their #bodyguards do.
#EmmanuelMacron: https://www.lemonde.fr/en/france/article/2024/10/27/how-emmanuel-macron-can-be-tracked-watch-the-first-episode-of-stravaleaks_6730708_7.html
#Biden and #Trump: https://www.lemonde.fr/en/united-states/article/2024/10/28/biden-and-trump-put-in-danger-by-secret-service-agents-watch-the-second-episode-of-stravaleaks_6730825_133.html
#Putin: https://www.lemonde.fr/en/international/article/2024/10/29/putin-s-bodyguards-go-on-runs-near-palace-he-denies-owning-stravaleaks-episode-3_6730915_4.html
#StravaLeaks #Security

Nix Kelley

@nixkelley@blog.housewayreth.org · Reply to Nix Kelley's post

#security tip:

unless you know your chats or audio/video calls are secure, DON'T say anything that you wouldn't say around an unsafe person.

does this restrict your speech? yes it fucking does. but only in certain spaces.

be the annoying person who suggests over and over again to set up a secure group chat with your fellow community members. almost every service is free to use.

remember that #Discord is not secure comms. remember that #Instagram chats, and activity there, is not secure comms. remember that anything owned by Meta is not secure comms no matter what the company says.

be too careful. it's better to be too careful than careless for a moment.

Agnieszka R. Turczyńska

@agturcz@circumstances.run

Is there any European body giving recommendations/requirements about It security, similar to NIST? Especially I'm looking for an organisation giving recommendations for passwords related policies. Preferably a widely scoped, but if there is anything reasonable in a particular industry, I'd be glad to know it as well.
#itsecurity #itsec #opsec #security

Asta [AMP]

@aud@fire.asta.lgbt

Hey everyone! A couple good things to remember:

Signal is your friend! https://signal.org/
Be careful about what you post on corporate and federated social media. You don't need to self censor but you should take extra spicy discussions to something like Signal!

(people: please feel free to add hot tips for helping people keep things private!)

EDIT: It's definitely worth pointing out what I mean about "spicy". Expressing frustration in a way that could easily be misinterpreted by law enforcement? That's spicy! Planning a safe, legal protest? I'd argue that's spicy! That's the sort of thing I mean by this. No encryption or software is perfect; consider the level of risk when utilizing the tools.

But broadcasting stuff on social media can carry a lot of risk, so just... you know.

#security #secureCommunications

Olly 👾

@Olly42@nerdculture.de

Apple creates Private Cloud Compute VM to let Researchers find Bugs. :apple_inc:

The company also seeks to improve the system's security and has expanded its security bounty program to include rewards of up to [$1 Million] for vulnerabilities that could compromise “the fundamental security and privacy guarantees of PCC”.

https://security.apple.com/blog/pcc-security-research

#apple #pcc #vm #securityresearch #bug #bounty #programming #ai #it #security #privacy #engineer #media #tech #news

ALT text details

Apple created a Virtual Research Environment to allow public access to testing the security of its Private Cloud Compute system, and released the source code for some “key components” to help researchers analyze the privacy and safety features on the architecture. The company also makes available the Private Cloud Compute Security Guide, which explains the architecture and technical details of the components and the way they work. <https://security.apple.com/documentation/private-cloud-compute>

ALT text details

[ImageSource: Apple] Interacting with the Private Cloud Compute client from the Virtual Research Environment. Apple provides a Virtual Research Environment (VRE), which replicates locally the cloud intelligence system and allows inspecting it as well as testing its security and hunting for issues. “The VRE runs the PCC node software in a virtual machine with only minor modifications. Userspace software runs identically to the PCC node, with the boot process and kernel adapted for virtualization,” Apple explains, sharing documentation on how to set up the Virtual Research Environment on your device. VRE is present on macOS Sequia 15.1 Developer Preview and it needs a device with Apple silicaon and at least 16GB of unified memory. <https://security.apple.com/documentation/private-cloud-compute/vresetup>

heise Security

@heisec@social.heise.de

Change Healthcare: Größtes Datenleck im US-Gesundheitswesen

Nach einem Cyberangriff auf Change Healthcare Anfang des Jahres gibt es Gewissheit. Krankendaten von fast einem Drittel der US-Bevölkerung wurden geleakt.

https://www.heise.de/news/Change-Healthcare-Groesstes-Datenleck-im-US-Gesundheitswesen-9998090.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#DigitalHealth #Security #news

Jonathan Lamothe

@me@social.jlamothe.net

Just got a notification from F-Droid that my browser ( #Fennec ) has known #security issues. Looks like I'm in the market for a new browser on my mobile devices.

I know I'm gonna hate asking this, but what browser sucks the least on #Android these days?

João Costa 💚🇵🇹🇪🇺🇬🇧🇺🇦

@joaocosta@mastodon.social

"Russia’s Central Bank raised its key #InterestRate from 19% to a historic 21% on Friday"

"seasonally adjusted price growth last month rose to 9.8% year-on-year from 7.5% in August. Core #inflation increased to 9.1% from 7.7% over the same period."

"russia has faced volatile prices since it sent troops into #Ukraine in February 2022"

"#russia is set to spend almost 9% of its GDP on #defense and #security this year"

#ArrestPutin #StopRussianAggression #ArmUkraineToWIN

https://www.themoscowtimes.com/2024/10/25/russias-central-bank-raises-key-rate-to-historic-21-signals-aggressive-fight-to-curb-inflation-a86806

Pedro Piñera

@pedro@mastodon.pepicrft.me

There should be a SOC 2 version for companies that are just getting started. The amount of work required to be compliant can kill companies… #security

Erik L. Midtsveen

@midtsveen@social.linux.pizza

Your average free spirit, boosting psychedelics, complaining about North Korea, ranting about mobile security, and reminding you why @pir matters!

If you’re really curious, check out my website: https://midtsveen.github.io

#Monero #GrapheneOS #FreeKorea #Psychedelics #Cannabis #Privacy #DigitalFreedom #OpenSource #Security #Freedom #FreeSpirit

XenoPhage :verified:

@XenoPhage@infosec.exchange

BSides Delaware parking and hotel information is up on the website now! https://bsidesdelaware.com/2024-venue/

If you don't have your tickets yet, WHAT ARE YOU WAITING FOR! Come join us!

https://www.eventbrite.com/e/security-bsides-delaware-2024-registration-1007007766337

AND SPEAK! CFP is open and waiting for your amazing submissions!

http://bit.ly/BDECFP24

#security #conference #BSides #BsidesDE

Membook

@membook@rigcz.club

#meme #memes #memy #mem #yesbut #privacy #camera #phone #laptop #security #cybersecurity

ALT text details

A two-panel illustration. The first panel shows a hand applying the sticker, obscuring the camera with the caption "YES,". The second panel depicts a smartphone screen with a front camera in the notch, labeled "BUT".

xoron

@xoron@infosec.exchange

Decentralized Encrypted P2P Chat

Blog: https://positive-intentions.com/blog/introducing-decentralized-chat

GitHub: https://github.com/positive-intentions/chat

Demo: https://chat.positive-intentions.com

Follow for more!

#cryptography #p2p #decentralized #webrtc #cybersecurity #privacy #security

ALT text details

positive-intentions

Jeremiah Lee

@Jeremiah@alpaca.gold

Grant Negotiation and Authorization Protocol (GNAP), the successor to OAuth 2, became RFC 9635 yesterday!

GNAP is easier to use than OAuth 2.0, with best practices as defaults and clearly articulated uses cases.

https://www.rfc-editor.org/rfc/rfc9635

#webDev #security

Sascha Wübbena

@wuebbsy@sueden.social

Wichtiger Hinweis am Rande:

Wer via #MicrosoftIntune die WLAN-Daten auf iPhones, iPads und Macs verteilt, damit nur Unternehmensgeräte ins Netzwerk können, der sollte UNBEDINGT die #Passwörter-App ausblenden.

Es wäre sonst möglich, sich in der Rubrik „WLAN“ den Anmelde-QR-Code anzeigen zu lassen, was es dann zu einem Kinderspiel macht, auch private Geräte ins Netzwerk einzubinden.

Die bessere Variante ist, den Zugang zum #WLAN nur mittels eines Zertifikats zuzulassen. #Security #Microsoft365

Quad9DNS

@quad9dns@mastodon.social

We're excited to announce the receipt of critical funding from @craignewmark Philanthropies to continue and further our work on improving the #security and stability of the Internet through our #DNS services, as part of CNP's commitment to #CyberCivilDefense.

https://www.quad9.net/news/press/quad9-receives-support-from-craig-newmark-philanthropies-to-protect-against-cyber-threats

#privacy

nixCraft 🐧

@nixCraft@mastodon.social

There is no such thing as a backdoor for good guys. Once you place a backdoor, you compromise the safety and privacy of all your users. A third party or bad guys will get access to it and abuse it further. The concept of a "backdoor for good guys" is fundamentally flawed and dangerous. It sets a dangerous precedent. Security and privacy should be absolute. There's no safe way to create a backdoor that can't be exploited by malicious actors. #privacy #security #infosec

Carey Parker

@FirewallDragons@mastodon.social

My 400TH #podcast is only 5 weeks away! For 7.5 years, I've helped my audience improve their #privacy & #security. And damn it, that's worth celebrating! 🥂🐉🔥

Wanna help? Post a link to a fav episode & tag it #FDSD400!

Stay tuned for more...

💯 💯 💯 💯

https://podcast.firewallsdontstopdragons.com/

Thomas Broyer

@tbroyer@piaille.fr · Reply to Thomas Broyer's post

And another one published simultaneously: Why are JWT?

about why you don't actually want to add them to your application, and certainly not as a kind of session token

https://blog.ltgt.net/jwt/

#jwt #security #webdev

Thomas Broyer

@tbroyer@piaille.fr

New blog post: Beyond the login page

about why authentication is much more than just a login page and password storage and verification

https://blog.ltgt.net/beyond-the-login-page/

#webdev #authentication #security #login

Harris Lapiroff 🔥

@harris@social.coop

Fresh #introduction!

Hi, I'm Harris.

Professionally I work for Freedom of the Press Foundation (https://freedom.press/) managing our web team and @dangerzone. I'm a web developer learning to put my skills to good use.

My posts are likely to be about #security #privacy #webdev #dataviz #design #ux #ml and, lately, some self-conscious #epidemiology epistemic trespassing.

I also do a lot of social dance #baking #cooking and #cocktail making—maybe I'll try posting about those a bit more often!

ALT text details

Me holding a red margarita.

ALT text details

Me dancing with a partner in a wooden outdoor pavillion.

ALT text details

Portrait of me leaning on a railing on a rooftop. I'm a mixed Asian-Caucasian man with wire rimmed round glasses and long black hair in my thirties. I'm wearing a white shirt with botanical flower print.

Mike Kuketz 🛡

@kuketzblog@social.tchncs.de

Fennec und Mull sind besonders für datenschutzbewusste Nutzer interessant, aber wegen der verzögerten Updates nicht für jeden geeignet. Teil 5 der Artikelserie »Sichere und datenschutzfreundliche Browser«. 👇

https://www.kuketz-blog.de/fennec-und-mull-sichere-und-datenschutzfreundliche-android-browser-teil-5/

#fennec #mull #browser #firefox #brave #mozilla #datenschutz #sicherheit #privacy #security

Mad A. Argon :qurio:

@madargon@is-a.cat

How I see attempts to force #backdoors in E2E #encryption...

#drawing #comic #geek #government #privacy #security

ALT text details

Comic with title "Government's fight against encryption". First picture: Nerdy-looking man with beard holds baloon. Other man has a needle and says: "I want a small hole in this so I could use it if I would need to." Man with beard replies: "But it's impossible! Or you would destroy everything..." Second picture: Closer view, head, shoulders and arm of bearded man with ballon. Only hands of man with needle are visible, needle is close to ballon. Man with needle says: "I said only small hole. Nobody else would know about this." Bearded man replies: "It doesn't work... THIS WAY!". His last two words are on third picture, with close view of ballon and hand touching its surface with needle. On last, fourth picture there is orange-yellow explosion with big text "BOOM!".

{Insert Pasta Pun}

@risottobias@tech.lgbt

hold up. I just remembered something.

a phone (android or iOS, I forget) said "you can set the phone to [technician-safe] mode while [repair guy] fixes it"

I mean I expect the SSDs of my devices to /always/ have that same evil maid data protection at all times?*

like what exactly does that add?

#security #blueteam

*as distinct from tampering from the device itself. e.g., not full evil maid, more like "read the C:/ drive without authentication". as in, "wait it would let you read it without auth while the SSD is offline before?"

I mean maybe the NVMe has like, a cached drive key, that you could get from specialized hardware / jtags, and this tells the device "hey, forget the drive key"

but also... shouldn't it do that anytime the device powers off? (and restore SSD access via TPM? or via password and small bootloader?)

#iPhone #android

Berkubernetus

@fuzzychef@m6n.io

Red Hat Open Source Practice Office (#OSPO) is hiring not one, not two, but three new staff! If you're into working 100% on community #OpenSource, one of these jobs may be for you.

All positions are attached to either the Ireland or Czech office.

Security Community Architect: work in our Verticals Team identifying, boosting, and participating in #OSS #Security communities: https://redhat.wd5.myworkdayjobs.com/en-US/jobs/jobs/details/Security-Community-Architect_R-041442-1?a=04a05835925f45b3a59406a2a6b72c8a

#FediHired (1/2)

MadeInDex

@madeindex@mastodon.social

✔ @torproject & @tails are going to strengthen their collaboration by merging¹! 👍

✔ #Tor has also released a new alpha

✔ It seems this #update does not address any of the potential #security issues, recently suspected after #German #lawenforcement claims to have used #timinganalysis to unmask Tor users.

✔ Potential solutions: timing delays, cover traffic...

¹https://blog.torproject.org/tor-tails-join-forces/
²https://blog.torproject.org/tor-is-still-safe/

#Torproject #Tails #Privacy #Surveillance #Freedom #Germany #Tech #Internet #Gov #IT

Nonilex

@Nonilex@masto.ai

MVP #KamalaHarris speaking soon in #Pittsburgh, #Pennsylvania about building an #economy that will work for all Americans.

#OpportunityEconomy #MiddleClass #labor #unions #protection #security #education #training #infrastructure

#Vote for #KamalaHarris & Gov #TimWalz to protect our fundamental freedoms & defeat #Trump & the #MAGA #Republicans this #election.

#VoteBlue
#HarrisWalz2024
https://www.youtube.com/watch?v=XokApnr_Cak

Dr. John Barentine FRAS

@JohnBarentine@astrodon.social

"The team used a DJI Phantom 4 Pro drone as a stand-in for such an aircraft for an experiment. Using a ground-based radar system, the team spotted the tiny drone thanks to the radiation emitted by a Starlink #satellite, which was flying over the Philippines at the time."

https://futurism.com/the-byte/chinese-researchers-detect-stealth-aircraft-starlink

#Space #Security #Defense

Curtis "Ovid" Poe (he/him)

@ovid@fosstodon.org

Have you ever heard of SS7? It's the backbone of most of our phone system and it's extremely insecure. Here's Veritasium exposing how easy it is to intercept your calls and texts without your knowledge.

#security #phone #veritasium #ss7 #CyberSecurity #hacking

https://www.youtube.com/watch?v=wVyu7NB7W6Y&ab_channel=Veritasium

Alex Shoup

@alexshoup@mastodon.social

I guess I should probably do an #introduction

- IT professional
- #Ohio born and raised
- Lifelong fan of #OhioState football.
- Advocate of #OpenSource, #Privacy, and #Security.
- #Linux user (btw, I use #Arch)
- Building experience with my #Homelab

Chris Alemany🇺🇦🇨🇦🇪🇸

@chris@mstdn.chrisalemany.ca

Any security/privacy experts have any thoughts about Apple’s Private Relay service through their iCloud+ subscription?
Good?
Bad?
Irrelevant?
I won’t be getting rid of my iCloud account anytime soon, so unless there is some other compelling reason not to, it seems worth using it.
Edit: Ironically, I couldn’t send this post from my local server because, I think, of my local DNS so… Private Relay off now. 😆
#Apple #Firewall #security #privacy #icloud

ALT text details

A white text on black screenshot of the ICloud Private Relay description says: “iCloud Private Relay Private Relay is an innovative Internet privacy service built directly into iCloud that lets you connect to the internet and browse the web in a more secure and private way. Normally, when you browse the web, your local network can use your DNS records to see the names of the websites you're visiting. In addition, the websites you visit may collect your IP address, which allows them to determine your identity and approximate location without your explicit permission. All of this information can be aggregated over time into a detailed profile about you that may be used for targeted advertising and other purposes. To help solve this problem, Private Relay protects users' web browsing in Safari, DNS resolution queries, and insecure http app traffic. It routes the traffic through two separate internet relays that hide your IP address and encrypt your web traffic such that no single party-including Apple—can see both who you are and what sites you're visiting. Private Relay is available to all iCloud+ subscribers. You can turn it on or off any time from your iCloud settings.”

Max "Sweaty Sunsets of September" Eddy

@maxeddy@infosec.exchange

I never did an #introduction!

Hi, I'm Max. I live in #NYC and do #journalism at PCMag where I cover #infosec, #security, and #privacy. I also write reviews of #VPN and professionally complain about #capitalism. I'm the Unit Chair of the ZDCG #union and moonlight as a #labor organizer. If you want to learn about how to unionize your workplace, plz DM me. I play #banjo badly and think about #medieval literature. I'm spending too much money on #fountainpens.

Mysk🇨🇦🇩🇪

@mysk@mastodon.social

🚨🎬 🧵 1/4
Here is what happens when you insert an unlocked SIM card into a locked iPhone:
- The #iPhone accepts the SIM card and connects to the internet 😳
- Apple immediately adds the phone number of the SIM card to the Apple ID of the iPhone owner 😲
- #Apple accepts the new phone number as a username to sign in with the Apple ID of the iPhone owner 😱
- iOS activates the new phone number for iMessage 🤯

The video:

https://youtu.be/ln-8KnwtdSw

#privacy #security #iOS #iPhone #cybersecurity #infosec

Mysk🇨🇦🇩🇪

@mysk@mastodon.social

🚨🎬 Privacy Concerns about Apple Push Notifications

TL;DR: data-hungry apps use push notifications as a trigger to send app analytics and device information to their remote servers, even if the apps aren't running at all on your iPhone. Such apps include TikTok, Facebook, FB Messenger, Instagram, Threads, X, and many more.

Watch this video to see it in action:
https://youtu.be/4ZPTjGG9t7s

🧵 1/9

#Privacy #Security #Cybersecurity #Apple #iPhone #Facebook #TikTok #InfoSec #iOS

João Costa 💚🇵🇹🇪🇺🇬🇧🇺🇦

@joaocosta@mastodon.social

Bilateral #security agreements signed with 🇺🇦#Ukraine

1️⃣ 12/1🇬🇧#UK
2️⃣ 16/2🇩🇪#Germany
3️⃣ 16/2🇫🇷#France
4️⃣ 23/2🇩🇰#Denmark
5️⃣ 24/2🇨🇦#Canada
6️⃣ 24/2🇮🇹#Italy
7️⃣ 02/3🇳🇱#Netherlands
8️⃣ 03/3🇫🇮#Finland
9️⃣ 11/4🇱🇻#Latvia
1️⃣0️⃣ 28/5🇪🇸#Spain
1️⃣1️⃣ 28/5🇧🇪#Belgium
1️⃣2️⃣ 28/5🇵🇹#Portugal
1️⃣3️⃣ 31/5🇸🇪#Sweden
1️⃣4️⃣ 31/5🇳🇴#Norway
1️⃣5️⃣ 31/5🇮🇸#Iceland
1️⃣6️⃣ 13/6🇺🇸#US
1️⃣7️⃣ 13/6🇯🇵#Japan
1️⃣8️⃣ 27/6🇪🇪#Estonia
1️⃣9️⃣ 27/6🇱🇹#Lithuania
2️⃣0️⃣ 27/6🇪🇺#EU
2️⃣1️⃣ 08/7🇵🇱#Poland
2️⃣2️⃣ 10/7🇱🇺#Luxembourg
2️⃣3️⃣ 11/7🇷🇴#Romania
2️⃣4️⃣ 18/7🇨🇿#Czechia
2️⃣5️⃣ 18/7🇸🇮#Slovenia
2️⃣6️⃣ 04/9🇮🇪#Ireland
2️⃣7️⃣ 11/9🇱🇹#Lithuania

@BjornW@mastodon.social

Here's my #introduction:
I live in The Netherlands, Europe. I work as a self-employed tech consultant & software developer. I like to tinker & have way too many interests :)

Likely to toot about:
#technology #techpolicy, #opensource #openstandards #opencontent #publicdomain #creativecommons #copyright #sustainability #diy #infosec #security #data #privacy #accessibility #ui #ux #interactiondesign #ethics #webdevelopment #devops #sysadmin #climatecrisis #food #music #linux #debian #ubuntu

h o ʍ l e t t

@homlett@mamot.fr

→ #Google's reCAPTCHA v2 just labor #exploitation, boffins say
https://www.theregister.com/2024/07/24/googles_recaptchav2_labor/

“The conclusion can be extended that the true purpose of #reCAPTCHA v2 is a #free image-labeling #labor and #tracking #cookie farm for advertising and #data #profit masquerading as a #security service”

Reclaim Your Tech

@reclaimyourtech@assemblag.es

(1/2)
Announcing the launch of a new blog, Reclaim Your Tech (https://reclaimyour.tech).

This blog was founded on the premise that digital infrastructure should be owned by individuals, their families, and their communities. Being user first, it will provide technical guides, open-source tools, software recommendations, essays, and discussion.

#blog #techblog #security #privacy #enshittification #opensource #foss #linux

Lukasz Olejnik

@LukaszOlejnik@mastodon.social

My book “PROPAGANDA: from disinformation and influence to operations and information warfare” treats the subject adequately, comprehensively, broadly, expertly. How does information influence work? Offence & defence. Expert arrangement of the subject.
#cybersecurity #propaganda #disinformation #book #books #security https://blog.lukaszolejnik.com/propaganda-my-book-on-information-security/

Jef Kazimer😶‍🌫️

@JefTek@infosec.exchange

With the ever increasing attacks on users, moving to #multifactorauthentication is a must in order to reduce the attack surface of just relying on a password to secure access to resources. Implementing #MFA that is enforced all the time relies on also having a good user experience, which gave rise to mobile authenticator apps since many users always have their phones with them. However it also gave rise to #mfabombing and griefing to get those users to approve. With the recent GA of #microsoftauthenticator #azuread orgs can enable number match and context for the push notification to further improve the #security of the users by avoiding the blind approval of a push notification.

🔥 See the post on the AzureAD blog here and go enable these settings for your organization https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/advanced-microsoft-authenticator-security-features-are-now/ba-p/2365673 #microsoft #office365 #o365 #cloudsecurity

heise online

@heiseonline@social.heise.de

Faktencheck: Telegram ist weniger privat als andere Messenger

Die Annahme, Telegram sei besonders sicher, scheint sich hartnäckig zu halten. Fakt ist: In puncto Verschlüsselung ist Telegram der Konkurrenz unterlegen.

https://www.heise.de/hintergrund/Faktencheck-Telegram-ist-weniger-privat-als-andere-Messenger-9860521.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Security #Telegram #Verschlüsselung #news

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

Pummel #Starlink out of the sky? Impossible; as David Burbach, #NationalSecurity affairs prof at the #US Naval War College,…[said], “Nobody has enough anti-satellite weapons to come anywhere near shooting that down.”

& Starlink, which currently operates in 75 countries, is only getting bigger. A new batch of #satellites went up today. #SpaceX has already received approval from #US regulators [🤬] to launch thousands more,

#ElonMusk #power #Security #law #regulation #Tech #internet #access

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

The #Brazil fiasco may have led to #ElonMusk backing down, but it has also revealed just how easily he can serve #Starlink users whatever #content HE may want. #Musk’s fame, the omnipresence of his many businesses, & his growing attention to #politics does not automatically translate to #ForeignPolicy expertise [ya think? He’s a #Putin fanboy FFS]. But what could Brazil—or any nation—really do to curb his control?

#power #Security #law #regulation #Tech #internet #access #information

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

Since #ElonMusk took over #Twitter, he has made it a cozy home for #FarRight provocateurs, reinstated the accounts of previously banned bad actors, promoted #ConspiracyTheories, & made the website worse at separating fact from fiction. And yet, #Musk believes that #X is the “number 1 source of news in the world.” [🤦🏼‍♀️] For a part of the world that relies on #Starlink, Musk could, if he wanted, make it the ONLY #news source.[😱]

#Security #Tech #law #power #regulation #internet #access #information

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

Other companies are working on their own #internet constellations, incl’g #Amazon, but they’re lagging far behind—& none of their leaders owns prominent #SocialMedia companies, where they can [personally] govern the flow of #information.

Compared w/ #SpaceX, the world’s town square, as #Musk calls #X, is a cauldron of #chaos, especially for users.

#ElonMusk #Security #Tech #law #power #regulation #access #Starlink

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

At the time of this writing—& that’s important to note, because #SpaceX launches a fresh batch nearly every week—more than 6k operational #Starlink #satellites are circling Earth, accounting for >½ of all functioning satellites in orbit.

Starlink has grown so large in part because SpaceX is simply the most prolific #space company in the world.

#ElonMusk #Security #Tech #law #power #regulation #internet #access #information

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

The deal resembled agreements between #Israel & other world powers for #HumanitarianAid, but as far as we know, the #UnitedStates, where #SpaceX is registered, did not send #Musk to the #MiddleEast to broker it. He flew over on his private jet.

#Starlink is what’s known in the #satellite business as a #megaconstellation.

#Security #Tech #law #power #regulation #internet #access

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

#Musk toured a kibbutz that #Hamas had attacked, dressed in a suit instead of his trademark occupy mars T-shirt, & offered #Starlink’s services to the Israeli govt. #Israel has imposed #internet blackouts & destroyed #telecommunications #infrastructure in #Gaza…. This summer, after lengthy negotiations, Israeli authorities allowed #SpaceX to activate #Starlink in one hospital in Gaza, w/more service on the way.

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

As one undersecretary told @NewYorker’s Ronan Farrow, “Even though #Musk is not technically a diplomat or statesman, I felt it was important to treat him as such, given the #influence he had on this issue.”

Last year, when #Israel’s PM Benjamin #Netanyahu hosted #ElonMusk for a visit, the billionaire looked—& [cos]played—the part of a world leader traveling to a war zone.

#Security #Tech #law #power #regulation #Starlink #internet #access

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

Soon, #Musk found himself w/ immense decision-making #power, as #Ukraine authorities pleaded w/him to activate #Starlink over a port city in #Crimea, apparently so that they could conduct a surprise drone attack on #Russia’s fleet anchored there. By the end of the war’s first year, when #SpaceX no longer wanted to foot the bill for Starlink ops, the #Pentagon jumped to take over the job before SpaceX could cut off access.

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

#Musk dispatched terminals to places reeling from natural disasters, & then to the front lines of war. When #Russia invaded #Ukraine in early 2022, it hacked the #satellite provider that the Ukrainian military relied on for communications. Ukrainian ofcls appealed to #ElonMusk for help, & #SpaceX dispatched truckloads of #Starlink terminals to the besieged country, for free.

#power #Security #law #regulation #Tech #information

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

Not only can #ElonMusk now determine who gains traction on a small but #influential corner of the web; in certain corners of the #globe, he can also determine WHO has #access to the #internet at all, & #regulate WHAT people encounter when they use it.

For a service that took off only about 5 yrs ago, #Starlink has become impressively ubiquitous, available for use on all 7 continents.

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

This particular feud has crystallized an unsettling truth that is growing more apparent each day: #Musk is becoming an #internet god [oh he’s gonna love that 🤢]. #Space-based internet & #SocialMedia are a potent combination, & their #control by a single person is quite unprecedented—& alarming in the same manner as a federal govt restricting online speech via sweeping decree.

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

(& pursue #legal action over assets). But in other ways, the debacle is a microcosm of fraught, ongoing debates over #FreeSpeech & #internet #regulation around the world [& businesses abiding by the laws of the countries in which they operate]

…[#Musk’s] actions could be seen as a…corrective to govt overreach. But they seem less magnanimous when you consider that the alternative to govt overreach is…a World Wide Web governed by the whims of the world’s richest man.

#Security #Tech #law #power

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

The fight reached a boil in recent days, when #deMoraes instructed #internet providers in #Brazil to cut off access to #X altogether & #Musk refused to block the site on #Starlink until the latter business got its accounts back.

In some ways, this is classic Musk, scuffling w/ govt agencies when he believes they’re infringing on HIS enterprises. “What a scumbag!” Musk posted about de Moraes yesterday, after Starlink reversed course & agreed to block X….

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

#ElonMusk, the CEO of #SpaceX, received a medal from the Brazilian govt. But now #Starlink’s Brazilian service is tangled in a mess of #political tensions, #CourtOrders, personal #insults, & #threats to revoke the company’s license to operate in the country. And this drama all started because of another #Musk business that links strangers around the globe: #X, née #Twitter.

#Security #Tech
https://www.theatlantic.com/technology/archive/2024/09/elon-musk-brazil-starlink-x/679711/

Nonilex

@Nonilex@masto.ai

#ElonMusk Has the Off Switch

With both #X & #Starlink under his control, the world’s richest man wields unprecedented #power.

By Marina Koren

Since Starlink first beamed down to Brazil 2yrs ago, hundreds of communities in the Amazon that were previously off the grid found themselves connected to the rest of the world. Here was the purest promise of SpaceX’s #satellite #internet—to provide #connectivity in even the most remote places on Earth—fulfilled.

fraggLe!

@fwaggle@moodoo.org

#introduction as I can tag now.

I'm fwaggle, and have been for ages. If you've been around for 20+ years and you're thinking "hey, I think I know that guy" then you're probably right. If you thought I was a dickhead 20 years ago, you're almost certainly right... I'm trying to do better now though.

I do #security things for a WordPress host, which is good fun.

nixCraft 🐧

@nixCraft@mastodon.social

Microsoft has confirmed that Windows 11 users will not be able to uninstall the controversial “Recall” feature, despite earlier reports suggesting otherwise. Recall, part of the Copilot+ suite announced in May, automatically captures screenshots of user activity on the operating system including sensitive information such as passwords or financial data https://digitalmarketreports.com/news/25091/microsoft-recall-feature-on-windows-11-not-removable-after-all/ Do yourself a favor and get rid of Windows from your life—enough of these greedy companies. #privacy #security

The Matrix.org Foundation

@matrix@mastodon.matrix.org

Authentication is almost always the most frustrating step of interacting with a service. Matrix is no different, but Quentin is about to dramatically improve the situation.

Get a glimpse of all the goodness awaiting to be unlocked once his project lands!

https://youtu.be/dmUi4ZoYRWc

#authentication #ux #security

ALT text details

A YouTube thumbnail for Matrix Live. There is a dark background. On the top right is written "S09E39". In the center, there is an icon of a lock, between the square brackets of the Matrix logo. On the bottom there is the Matrix Logo, and the title: "Getting authentication out of the way".

João Costa 💚🇵🇹🇪🇺🇬🇧🇺🇦

@joaocosta@mastodon.social

We should be arming #Ukraine, not "for as long as it takes", but TO WIN.

Why? Because, to begin with, we are seriously struggling to keep #democracy afloat "for as long as it takes" and, in order to defend democracy, we must achieve a resounding Ukrainian #victory.

That's why oligarchs, terrorists, extremists and dictators are ALL so invested in stopping war-time investment in European #security in the Ukrainian front.

Focus. Act decisively. Act now.

#ArmUkraineNow
#ArmUkrainwToWIN
#US #NATO

ALT text details

Illustration of a mass of water with the word "Russia" contained by a dam with the word "Ukraine". The dam wall is cracking. Below it, a town with the word "Europe".

PrivacyDigest

@PrivacyDigest@mas.to

#California Legislature Approves A.I. Safety Bill

The California bill has spurred a fierce debate over how to regulate the new technology, which both technologists and lay people have hyped for its potential benefits and harms to humanity.
#ai #security #privacy

https://www.nytimes.com/2024/08/28/technology/california-ai-safety-bill.html

GENKI

@nibushibu@vivaldi.net

怖いな、これ :vivaldi_red: #Vivaldi も影響あるのかな

https://news.mynavi.jp/techplus/article/20240824-3011152/

#browser #security #chrome

randomcruft

@randomcruft@mastodon.sdf.org

a list of #hashtags for my #introduction

#technology / #computer #geek (#security pays the bills)
#music / #musician (#drummer for fun but not profit... learning other #instruments)
#weather (it's both awesome and scary)
#health / #fitness (however, will not turn down #chocolate)
#gaming newbie (#fantasian / #ffxiv occupy my time currently)
#anime (#SAO, #attackontitan, #psychopass, #RWBY, etc. etc.)
#DIY projects (if / as needed)

it's difficult writing #introductions 😅

Terri K O 🍁

@terri@social.afront.org

CVE Binary Tool 3.3 is released! (At long last!)

This is my work open source project that lets you scan for known vulnerabilities in your binaries, package lists and SBOMs. It's meant to make it easier (and cheaper!) to make secure open source software.

3.3 has new features from our Google Summer of Code 2023 contributors including EPSS metrics to help users assess risks associated with vulnerabilities, a new GitHub Action to make scanning easier, and a mirror of the NVD data backed by the same servers that do Linux distro mirroring so you don't have to deal with rate limits, downtime, and servers only located in the US.

Release notes: https://github.com/intel/cve-bin-tool/releases/tag/v3.3

And get the code on pypi:
https://pypi.org/project/cve-bin-tool/3.3/

Boosts appreciated!

#OpenSource #GSoC #hacktoberfest #infosec #security #Python

Socialhome HQ

@hq@socialhome.network

Socialhome v0.19.0 (security release!)

We noticed a similar vulnerability in #Socialhome that had been found in #Mastodon and various other projects, ie https://arcanican.is/excerpts/cve-2024-23832/discovery.htm

This should hopefully now be mitigated and anyone running a #Socialhome instance should update asap.

Other changes:

Docker images are now based on Python 3.10
The public stream is disabled by default on single user instances (with a configured root profile) for privacy reasons regarding followed content

https://socialhome.network

#tech #coding #hack #security #cybersecurity #programmer #linux #kalilinux #ubuntu #linuxmint

alltechpacks

@alltechpacks@mastodon.social

Terence Eden’s Blog

@blog@shkspr.mobi

Falsehoods programmers believe about... Biometrics
https://shkspr.mobi/blog/2021/01/falsehoods-programmers-believe-about-biometrics/

(For the new reader, there is a famous essay called Falsehoods Programmers Believe About Names. It has since spawned a long list of Falsehoods Programmers Believe About....)

Everyone has fingerprints!

The BBC has a grim tale of a family with a genetic mutation which means they have no fingerprints. It details the issues they have getting official ID.

In 2010, fingerprints became mandatory for passports and driver's licences. After several attempts, Amal was able to obtain a passport by showing a certificate from a medical board. He has never used it though, partly because he fears the problems he may face at the airport. And though riding a motorbike is essential to his farming work, he has never obtained a driving licence. "I paid the fee, passed the exam, but they did not issue a licence because I couldn't provide fingerprint," he said. The family with no fingerprints

Even if this genetic issue didn't exist, it should be obvious that not everyone has fingers, or hands. Some people are born without hands, some people lose them later in life.

Policy is about the edge-cases. It's easy to design something which works for the majority of people - the real challenge is how we deal with the fringes.

Everyone has a unique face / unique DNA

Ever heard of twins, dumbass?

OK, it is a little bit more complicated than that.

It is easy to revoke a biometric indicator

Even if you assumed that everyone has ten fingers - that means you can only change your ID 9 times. If you're using iris recognition, that's one change you're permitted before you have to grow new eyeballs.

Biometrics can't be copied

Back in 2002, Tsutomu Matsumoto copied fingerprints using Gummy Bears.

Researchers can consistently fool iris scanners

3D printed facemasks can defeat facial recognition systems.

The thing about biometrics is that they are not secret. You leave your fingerprints everywhere. If a camera can read your face, it can copy your details.

Biometrics can't be changed

Will having a "nose job" stop your iPhone from recognising you? Probably not. But there are a range of surgical procedures which can be done.

People who have Facial Feminisation Surgery can be given a letter from a doctor to explain to border guards why a person's face may no longer match their biometrics.

What are they good for?

Biometrics are not passwords. Nor are they a universal 2nd factor. Biometrics are, at best, usernames.

For the average user, it's probably fine to use your fingerprint or face to unlock your phone. If you think an enemy state is going to devote considerable resources to steal copies of your biometrics, consider changing to a different password mechanism.

Or, if you have kids.

Pushkar
@Pushkarr
Friend's 5-year old daughter started unlocking his phone with his fingerprint while he's asleep so that she can play games.
He now sleeps with gloves on. #lifeisblackmirror
❤️ 24 💬 3 ♻️ 0 03:00 - Mon 24 September 2018

Or if you're cheating on your spouse.

A Qatar Airways pilot was forced to make an emergency landing after a passenger found out her husband was cheating on her and had a violent reaction in midair. The woman reportedly used her sleeping husband's finger to unlock his phone and discovered his cheating ways. Eyewitness News

In a safe-ish environment, biometrics are a good convenience mechanism. If your phone is snatched by an opportunistic thief, they're unlikely to have the means to spoof your ID.

But they are not a perfect security measure.

https://shkspr.mobi/blog/2021/01/falsehoods-programmers-believe-about-biometrics/

#design #falsehoods #policy #security

masukomi

@masukomi@connectified.com

#security #gender

ALT text details

screenshot from Kalium! on twitter in 2021: remember to regularly change your pronouns for security reasons. keep pronouns safe with GNU Pronoun Guard an open source replacement for Symntec's Pretty Good Pronouns. reply from "The competence tank is empty": Similarly, your gender should contain at least one digit and a special character.

heise Security

@heisec@social.heise.de

Noch kein Patch: Sicherheitsforscher beraubt Windows sämtlicher Schutzfunktionen

Stimmen die Voraussetzungen, können Angreifer Windows Update manipulieren, um beliebige Windows-Komponenten durch veraltete, angreifbare Vorgänger zu ersetzen.

https://www.heise.de/news/Noch-kein-Patch-Sicherheitsforscher-beraubt-Windows-saemtlicher-Schutzfunktionen-9834479.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#BlackHat #Security #Sicherheitslücken #news

Paula Gentle on Friendica

@gehrke_test@libranet.de

"75 Prozent der Server des Standorts waren anfällig für Cyberangriffe. [...]
Die Daten der Server blieben vier Jahre lang ungeschützt, berichtet der Guardian unter Verweis auf die NDA."

#Atomkraft #Kernkraft #Sellafield #security #PoweredByRSS
Atomkraft: Sellafield räumt massive Versäumnisse bei Cybersicherheit ein

Purism

@purism@librem.one

Hardware kill switches: Empowering users in the digital age. Our latest blog explores how physical control over your device builds trust, respects autonomy, and offers unparalleled protection. Discover how Purism is putting privacy at the forefront of mobile tech.
https://puri.sm/posts/the-evolution-of-smartphone-security/
#UserPrivacy #Purism #PureOS #Security

Marcus "MajorLinux" Summers

@majorlinux@toot.majorshouse.com

Hackers are finding more ways to commit supply chain attacks.

Mac and Windows users infected by software updates delivered over hacked ISP

https://arstechnica.com/security/2024/08/hacked-isp-infects-users-receiving-unsecure-software-updates/

#Mac #Windows #Malware #ISP #Hacks #Security #InfoSec #Tech #Apple #Microsoft

Aaron Rainbolt

@arraybolt3@theres.life

#Ventoy Security Concerns (please boost for visibility)

Ventoy is a popular utility for making USB drives containing multiple operating systems in the form of bootable image files. While very useful in theory, the source tree contains numerous binary blobs without source code. This issue has been brought up to the authors multiple times, have not been corrected, and have even gotten worse (more blobs have been added to the code over time). This is a potential malware vector, similar to the "test files" in the xz-utils backdoor catastrophe.

Recently the author has ignored a very lengthy thread raising security concerns because of these binary blobs. Given the amount of attention the thread has gotten, this seems strange, especially given that the authors have been active since then. https://github.com/ventoy/Ventoy/issues/2795

Stranger yet still, a video by Veronica Explains (@vkc) on how to create bootable USB flash drives got flooded by comments heavily suggesting the use of Ventoy and even being somewhat accusing because Veronica didn't advertise Ventoy. This is... not anything I've seen users of ANY open-source project do, and it feels similar to the social engineering done against Lasse Collin that convinced him to add Jia Tan as a maintainer, thus compromising xz-utils. See the comments of https://www.youtube.com/watch?v=QiSXClZauXA&t=3s

If you're using Ventoy, you may want to consider ceasing its use for the time being out of an abundance of caution. If you truly need its functionality, you might look into something like the IODD SSD Enclosure (https://www.iodd.shop/HDD/SSD-Enclosure) which can emulate an optical drive and allows you to select an ISO saved to the drive to boot from.

#linux #boot #security #malicious #backdoor

h3artbl33d :openbsd: :ve:

@h3artbl33d@exquisite.social

Exquisite supports DANE, even while not every browser supports it. The 3-1-2 hash (domain issued certificate, SPKI, SHA-512) is:

6a9976657f0e85aa59e2954db3bd342c04f5e33ea166a70147fd6bb54bbafe23c11be8db582671e4d169be794ff2174ee99227e78ccd3961c84b53e20dad13b0

This goes for 443/tcp.

#mastoadmin #security

heise online

@heiseonline@social.heise.de

Minister Wissing: IT-Pannen werden zunehmen

Crowdstrike hat gezeigt, wie verwundbar weltweite Vernetzung machen kann. Der Digitalminister sieht Deutschland gut gerüstet, auch für andere Szenarien.

https://www.heise.de/news/Minister-Wissing-IT-Pannen-werden-zunehmen-9823654.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Crowdstrike #Cyberangriff #KRITIS #Security #news

Nonilex

@Nonilex@masto.ai · Reply to Nonilex's post

Thursday’s prisoner swap, which saw American #journalists & a #security consultant, & a group of some of #Russia’s most prominent #dissidents & #PoliticalPrisoners, exchanged for a Russian group including a state #assassin, #spies & #hackers, was the biggest & most complex switch since the Cold War. 
It took place at a time of #war, w/ #GlobalRelations between the #UnitedStates & Russia as bad as they have ever been.

#MafiaState #Hostages #ForeignPolicy #diplomacy #alliances #geopolitics #law

ALT text details

Graphic details the complexity of Thursday’s swap

EINGFOAN :donor:

@eingfoan@infosec.exchange

I started to try a #comparison with all mainstream #FIDO2 #security #keys.

Here Is the comparison:

https://docs.google.com/spreadsheets/d/1o_l6ieNRgf4IDYFcTNuw2st96VjrB-djtT2BMRhRDbI/edit?usp=sharing

it is really hard to compare since vendors are super unstructured

please #boost for more reach

contributors welcome

https://docs.google.com/spreadsheets/d/1o_l6ieNRgf4IDYFcTNuw2st96VjrB-djtT2BMRhRDbI/edit?usp=sharing

EINGFOAN :donor:

@eingfoan@infosec.exchange

#Authentication strength #maturity #model for #security
#conumerVersion

Original source:

https://www.linkedin.com/feed/update/urn:li:activity:7088125479261462528?utm_source=share&utm_medium=member_ios

Eleanor Saitta

@dymaxion@infosec.exchange

A few #introductions:

I run Systems Structure Ltd., a US consultancy that provides fractional CISO services for pre-A to post-C round #startups, along with #threatmodeling training and #securityarchitecture reviews.

I've been working in #security since 2003 and did a spell in NGOland from ~2011 to 2016, working with NGOs and news organizations targeted by states and on tools they use, including the #briar messaging app. The field work I did then fundamentally reshaped my approach to security, and I recommend that everyone in the field learn about the reality of being a high-risk user.

I live in #Helsinki the days, although in the before times (and hopefully soon again) I spent a fair bit of time in #NYC and #London. I run a #queer performance space out of my home, along with my partner, called The Attic (@theatticfi on insta), where we make space for #drag, #burlesque, #performanceart, and music, along other things. Before I moved here, I spent six or so years traveling full time.

I have written various essays over the years, which you can see on dymaxion.org, and I'm slowly writing a book. While security pays the bills, I spend a lot of my time thinking about #complexsystems, and in particular how the human and technical bits mesh, how they fail, and how to redesign them to fail better. In practice, this has meant everything from consulting on a constitution to thinking about what comes after the #climate apocalypse. The "recruiting barbarians" in my bio refers to being more comfortable outside of institutions, but I'm starting to think more about community and infrastructure building now that I live somewhere.

I'm also an #artist; I paint and am slowly learning my way around a #synthesizer, and I've been accused of being an #architect. I'm active in the #nordiclarp scene, where we take larp serious as a dramatic form and do everything from a reworking of Hamlet played at the actual Elsinore castle to a larp about the early days of the HIV crisis. I'm primarily a theorist and critic there, as well as player, and I've edited two books and written a number of essays. Nordic larp has the best toolkit I've seen anywhere for analyzing the human parts of complex systems and especially for building new systems; it's heavily influenced my security work, along with my #designfutures thinking.

Kushal Das :python: :tor: 🇵🇸

@kushal@toots.dgplug.org

I wrote about #MFA #2FA #FIDO2 #authentication on #django applications. https://kushaldas.in/posts/multi-factor-authentication-in-django.html #python #security

ALT text details

A demo showing after username/password login, the page is asking for TOTO token for the authentication.

Marcos Dione

@mdione@en.osm.town

Intro:

#python #linux #Sysadmin #developer #bash :sad_face: #sre #security #osm #OpenStreetMap #photography #astrophotography #hiking #bouldering #science enthusiast (most of them) #diy (not much of it) #ebike

Father of two, make my own maps and computer tools, have my own home server, fix as many things as I can myself, love to drive and travel by car but not for the city, and much more.

Mostly boosts, in several languages, including some I can't speak, write or read.

Solene % bot

@solenepercent@bsd.network

Full-featured email server running OpenBSD

https://dataswamp.org/~solene/2024-07-24-openbsd-email-server-setup.html

gemini://perso.pw/blog/articles/openbsd-email-server-setup.gmi
#nocloud #selfhosting #openbsd #security

@solene

Doyensec

@doyensec@infosec.exchange

We're proud our testing helps ensure the security of Thinkst's OSS Canary Tokens! As part of their transparency efforts, you can read the results of our latest round of testing here:

https://www.doyensec.com/resources/Doyensec_ThinkstCanaryTokensOSS_Report_Q22024_WithRetesting.pdf

#doyensec #appsec #security #thinkst

ALT text details

Doyensec and Thinkst logos with a link to the report

Mike Sheward

@SecureOwl@infosec.exchange

Fediverse Competition time!

I have two signed copies of my book 'Security Operations in Practice', which is all about building effective Security Operations teams, to give away to my Fediverse friends.

To enter - all you have to do is boost this toot before 12pm PT on Thursday July 25th, and I'll randomly select two of the boosters to receive the copies.

You can find out more about this book, and my other releases at https://infosecdiaries.com. Thanks, and good luck!

#infosec #DFIR #SecOps #Security #cybersecurity

ALT text details

Two Copies of the book Security Operations in Practice, by Mike Sheward (@Secureowl)

Kelly Shortridge

@shortridge@hachyderm.io · Reply to Kelly Shortridge's post

this is why I’ve side eyed any federal document about software #security, quality, or #resilience that demonizes open source software while touting the virtues of commercial cybersecurity products

as if those products aren’t notorious for deep access + flimsy quality…

I’ve written about this concern in two separate RFIs to CISA et al (with co-conspirator @rpetrich)

1) on OSS security https://kellyshortridge.com/blog/posts/rfi-open-source-security-response/

2) on secure by design https://kellyshortridge.com/blog/posts/rfi-secure-by-design-response/

#crowdstrike

David August

@davidaugust@mastodon.online

Did you know #Project2025 calls for “the entirety of the CISA #Cybersecurity Advisory Committee should be dismissed on Day One.” (page 155).

If you like being able to use computers (or do anything with organizations that use computers, including have your vote counted in elections) that’s a very bad idea.

#infosec #security #USpol #politics #political

vam103

@vam103@mathstodon.xyz

Apparently NS&I (the old UK National Savings, as they put it "the government savings bank") have launched two factor authentication, which is good.

Except, it told me to expect a code, you would think through SMS. But no, its a phone call. To make matters worse its from France according to my phone! So of course I thought it had been compromised and wrote to them.

No, apparently they use a French company to do the OTP codes and then mask this with the UK number normally, except when it messes up or I guess your security is so high it does not show it. Actually the reply seemed annoyed that I did not just accept that the UK government bank would use a French company to do their security.

So I do not think much of the " improved security " until I can register a FIDO key or the local code generator as a call from France seems to have lots of points of failure. (Its not that its France specifically, just that it is another country.) Also they should mention this on their website! (Unless missed it).

#nsandi #2FA #security

https://www.nsandi.com/get-to-know-us/security/improved-security

Techlore

@techlore@social.lol

Welcome to the world of #privacy, #security, and #anonymity in 2023!📅

This thread covers what we’re doing to spread privacy to the masses ⬇️⬇️

michabbb

@michabbb@vivaldi.net

Test your prompting skills to make Gandalf reveal secret information.

Gandalf is an exciting #game designed to challenge your ability to interact with large language models (LLMs).

https://gandalf.lakera.ai/intro

#ai #llm #security

Tuta

@Tutanota@mastodon.social

What's the main difference between Tuta Mail and Gmail? 😎 PRIVACY 🔐

Get your #FREE Tuta Mail account now: https://app.tuta.com/signup

#Tuta #Germany #privacy #freedom #bestemail #encryption #security #PrivacyMatters #FREE #SecureEmail #privacyfirst #encrypted

ALT text details

Table showing different features of Tuta Mail vs Gmail.

openSUSE Linux

@opensuse@fosstodon.org

The Release Candidate 3 of Aeon #Desktop will include Full Disk #Encryption to boost data #security. Get more details! #DataSecurity #AeonDesktop #Encryption https://news.opensuse.org/2024/07/12/aeon-desktop-intros-fde/

Sarah Jamie Lewis

@sarahjamielewis@mastodon.social

Some exciting news: Over the past few months I have been working on founding a new organization: Blodeuwedd Labs (@blodeuweddlabs)

We are now in a position to offer subsidized security assessments (and other services) for open source projects.

(In addition to a whole array of analysis, development, and custom research offerings for everyone else)

Announcement (and more info): https://blodeuweddlabs.com/news/open-source-review-announce/

#infosec #security #appsec #canada #opensource

bane

@bane@exploit.social

I am working on starting a project under fiscal sponsorship to teach underserved youth cybersecurity and provide them pathways to careers. I have received the application and budget projection template to fill out. I am looking for partnerships and potential donors. I am also looking for anyone who would be willing to join an advisor board. Please share if you think of anyone who would be interested in either!

#losangeles #infosec #security

Matt Burgess

@mattburgess@infosec.exchange

Hi all, been lurking for a few days but introducing myself now! I'm Matt and a #security reporter at WIRED. Like many others here, I'm coming to Mastodon after the chaos at the bird site in the last week.

The things I cover on a regular basis are #privacy, cybersecurity, #surveillance, internet freedom, #tech and human rights, and a bunch more things in the wider security realm.

I'm based in #London—and have lived here for the last decade—so I'm often reporting on issues from across Europe. When not writing words for the web, I'm often found #running and have been dabbling in the #ultramarathon a few times over the last few years #introduction (edited to add introduction hashtag)

John Scott-Railton ☕

@jsrailton@mastodon.social

STAGGERING: Nearly all #ATT customers' text & call records breached.

An unnamed entity now has an NSA-level view into Americans' lives.

Damage isn't limited to AT&T customers.

But everyone they interacted with.

Also a huge national security incident given government customers on the network.

And of course, third party #Snowflake makes an appearance.

https://www.cnn.com/2024/07/12/business/att-customers-massive-breach/index.html

#infosec #cybersecurity #telco #cellular #privacy #security #breach

Adam

@adamsdesk@fosstodon.org

Little Bits: Issue #14

Uncover the accumulation of little bits I’ve found over the the past month on the topics of design, hardware, open source, privacy, security and more.

https://www.adamsdesk.com/posts/little-bits-issue-14/

#blog #OpenSource #security #privacy

ALT text details

Dark green background with bright green coloured text of ones and zeros with text that reads, Little Bits issue number 14.

🦋 Ben West - 🐒🌻

@monkeyflower@infosec.exchange

Hackvists release two gigabytes of Heritage Foundation data

"Self-described “gay furry hackers,” SiegedSec said it released the data in response to Heritage Foundation’s Project 2025, a set of proposals that aim to give Donald Trump a set of ready-made policies to implement if he wins this fall’s election. Its authors describe it as an initiative “to lay the groundwork for a White House more friendly to the right.”

The data, reviewed by CyberScoop, includes Heritage Foundation blogs and material related to The Daily Signal, a right-wing media site affiliated with Heritage. The data was created between 2007 and November 2022.

The group says it gained access to the data on July 2 and released it to provide “transparency to the public regarding who exactly is supporting heritage (sic),” a spokesperson for the group who goes by the online handle “vio” told CyberScoop in an online chat Tuesday."

https://cyberscoop.com/hackvists-release-two-gigabytes-of-heritage-foundation-data/

#hackers #opsec #infosec #databreach #politics #ethics #furry #furries #altright #gay #uspoli #project2025 #security #privacy #transtights #fascism #hacktavists

Fedify: an ActivityPub server framework

@fedify@hollo.social

We released #Fedify 0.9.2, 0.10.1, and 0.11.1, which patched the last reported #vulnerability, CVE-2024-39687, but the vulnerability of SSRF attacks via DNS rebinding still exists, so we released Fedify 0.9.3, 0.10.2, and 0.11.2, which fixes it.

If you are using an earlier version, please update as soon as possible.

Thanks to @benaryorg for reporting the vulnerability!

#SSRF #security #fedidev

Kris Hardy 🌮

@nonlinear@mastodon.nz

Does anyone know if there is a way to get a snapshot of a running container instance in #Azure for a #security #incident investigation? I can't find anything in the docs to see if it's possible.

spv

@spv@spv.sh

hi, i'm spv. call me spv, or james if you want to be slightly weird without knowing me

here's an #introduction post because i don't think i've made one yet.
info to know about me: 17 from BFE, NY

i'm #autistic, and have too many other conditions to list. woooo!

i do #programming on occasion
#homelab on the regular
i like to work with #security, but i don't do it enough

getting a degree in #Computer Security & #Forensics from SUNY Broome (starting in august)

warning: i use a lot of #hashtags

Hollo

@hollo@hollo.social

To #Hollo users: please update your #Hollo to 0.1.0-dev.46, a #security patch which addresses @fedify's #vulnerability CVE-2024-39687, as soon as possible!

https://hollo.social/@fedify/019080c7-c784-755d-a6f2-d1f91f2c5709

Jan Penfrat

@ilumium@eupolicy.social

The @EUCommission wastes our tax payer money to team up with #Microsoft the #gatekeeper and notorious #antitrust villain and sue the EU data protection agency @EDPS because the Commission wants to continue to use the #M365 software #security shitshow.

How low can this institution sink?

https://digitalcourage.social/@echo_pbreyer/112722381771336529

#privacy #gdpr #dataprotection #edps

Anders Eknert

@anderseknert@hachyderm.io

Announced yesterday, Regal is a new linter for #Rego, with the ambitious goal of both catching bugs/mistakes in policy code, *and* to help people learn the language! If you ever work with #OPA, I’m sure you’ll find it useful. Check it out, and if you’d like to help kick-start the project by giving at star ⭐️ I’d be overjoyed!

https://github.com/StyraInc/regal/

#CloudNative #Linter #Code #Development #CodeQuality #Security

Kushal Das :python: :tor: 🇵🇸

@kushal@toots.dgplug.org

Do you know about http://verybad.kushaldas.in:8000/ experiment? This web application has a lot of #security holes, and I tried to secure it using only #systemd. Feel free to do a round of #pentest, #attack the box. Remember to let me know what did you find.

The box is up from April end 2022.

Please boost so that your other security minded friends see this. I try to make sure that any learning from this goes back to systemd upstream.

#infosec #linux #rustlang #rust

Catalin Cimpanu

@campuscodi@mastodon.social

Halycon researchers have discovered a new ransomware operator named Volcano Demon that is currently distributing versions of the LukaLocker ransomware.

Halycon says the group engages in targeted ransomware attacks but does not operate a dedicated dark web leak site.

The group is also known for calling a company's executives to extort and negotiate payments.

https://www.halcyon.ai/blog/halcyon-identifies-new-ransomware-operator-volcano-demon-serving-up-lukalocker

#infosec #cybersecurity #security

kcarruthers

@kcarruthers@mastodon.social

Follow me if you’re interested in:

Pics of my #chihuahua #dog Mr Maxi & pics from walks in #Sydney #Australia (it’s kind of a puppy spam account, but he’s adorbs)

stuff about #disinformation #terrorism #radicalization & modern #warfare #drones #uavs #history

Topics I’m interested in: #legal #privacy #data #analytics #ethics #technology #feminism #ADHD #cybersecurity #informationsecurity #security #cyber #infosec #digitaltransformation #ai #ml #digitalfutures

#TwitterMigration

monocles

@monocles@monocles.social

What is it about?

#monocles offers ethically acceptable services and an online platform for individuals as well as for companies for a truly fair and secure digital life.

+ complete #opensource

+ 100% electricity from #renewable energy sources

+ no #tracking

+ highest possible #security

+ #independent of corporations and organizations, as completely privately funded

Check out more on https://monocles.eu/more

monocles

@monocles@monocles.social

#monocles chat 1.7.9 is released on the playstore with a lot of updates and improvements! (See comments below)

https://play.google.com/store/apps/details?id=eu.monocles.chat

#xmpp #chat #privacy #security #messenger

Tuta

@Tutanota@mastodon.social

Today we are proud to announce the launch of the world's first #postquantum secure email platform! 🥳🎉

With TutaCrypt your data is safe against quantum computer attacks at rest & in transit. ⚛️ 🔒

Learn more about this quantum leap in #security here: https://tuta.com/blog/post-quantum-cryptography

ALT text details

Today we are proud to announce the launch of the world's first post-quantum secure email platform! With TutaCrypt your data is safe against quantum computer attacks at rest & in transit.

Emelia 👸🏻

@thisismissem@hachyderm.io

Okay, okay, at @nova's behest, an #introduction post:

Hi 👋🏻 I'm Emelia, from #berlin, #germany, I'm trans queer and kinky.

I'm a #tech princess 👸🏻 currently working most with #typescript, currently working on Fediverse Trust & Safety tooling

I'm most known for my work on #nodejs, and contribute to #mastodon & other fediverse software

In 2020, I became the #founder of Unobvious Technology, aiming to improve the safety, #security and profitability of #sexworkers and advance the #adultindustry

Rob Ricci

@ricci@discuss.systems

Hey! Let's talk about #SSH and #security!

If you've ever looked at SSH server logs you know what I'm about to say: Any SSH server connected to the public Internet is getting bombarded by constant attempts to log in. Not just a few of them. A *lot* of them. Sometimes even dozens per second. And this problem is not going away; it is, in fact, getting worse. And attackers' behavior is changing.

The graph attached to this post shows the number of attempted SSH logins per day to one of @cloudlab s clusters over a four-year period. It peaks at about 3.4 million login attempts per day.

This is part of a study we did on our production system, using logs of more than 640 million login attempts, covering more than 1,500 hosts on our side and observing more than 840 thousand incoming IP addresses.

A paper presenting our analysis and a new, highly effective means to block SSH brute force attacks ("Where The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them") will be presented next week at #NSDI24 by @sachindhke . The full paper is at https://www.flux.utah.edu/paper/singh-nsdi24

Let's dive in. 🧵

ALT text details

A graph of SSH login attempts per day, in millions. On the Y axis, the graph starts in October 2017 at around 0.25M attempts per day. The day-to-day numbers are very noisy, but a trend line shows that the average number of attacks per day rises to around 1.0M around January 2021, with a slight fall-off before the graph ends in August 2021.

Mitex Leo

@ml@social.mitexleo.one

Any reason to not trust Eset Antivirus?

#eset #privacy #Security #antivirus #infosec

Tokyo Outsider (337ppm)

@tokyo_0@mas.to

#ActivityPub, #FediDev and #security question: If instances generally collect only one copy of each post and then share it with the users that need to see it, does that mean nonoriginating instances are trusted to not show that post to users the poster has blocked (or who shouldn't see it because they're not following etc depending on visibility)?

How do the collecting instances know who should see it? (A cached copy of the poster's follow list?)

And does #authorized_fetch change any of this?

/dev/rdsk/c5t1d0s2

@jpm@aus.social

I probably should do an #introduction too

I'm Joel, the #wifi -whacker, #network -noodler, #linux - licker, and #security -spooner. I also do a bunch of #electronics design and #embedded coding, while wondering why #3dPrinting still sucks so much.

There will be regular #DadLife and #CatsOfMastodon posts, and likely a lot of swearing as well

🅰🅻🅸🅲🅴 (Mutuals)

@alice@lgbtqia.space

🥰 So fulfilling! 🥰 A friend just brought their little daughter over to my place, because she had a journal with a 3 wheel combination lock on it, and she'd forgotten the combo.

I showed her how to decode it, and eventually she got it open! We changed the combo and locked it again so she could practice more.

After a bit, she was asking about other kinds of locks, so I happily brought out an assortment of antique and miniature locks from my collection.

A couple hours later they had to leave, and she was beaming! Today she had picked 2 warded locks, a pair of police cuffs, raked open a 4-pin tumbler, and decoded a combination lock!

I sent her off with a smiley yellow binder clip and a minuscule warded lock to practice on.

They asked to come back next week to learn more. 💜

I feel like the Yoda of lock-sport. 🙂

---

Update: Friend just texted me to say their daughter is thinking of starting a YouTube channel to document her growth in lock-sport, and wanted advice on gear/setup stuff.

---

#LockSport #Locks #Adorable #Teaching #LockPicking #Security #Hobbies #GirlPower

ALT text details

9 tiny locks locked to the shackle of a slightly larger tiny lock.

ALT text details

A pink elephant-shaped paperclip and a blue binder clip with a grumpy face on it. In the right hands, these are powerful tools.

Strypey

@strypey@mastodon.nzoss.nz · Reply to Strypey's post

Our Mastodon server has been mostly down for a week, and anything we posted during the brief uptime during the last week has been lost. Turns out our PostgresSQL container was hit by cryptojacking malware;

https://thehackernews.com/2024/05/kinsing-hacker-group-exploits-more.html

It doesn't seem like a targeted attack, I think we were just unlucky. I highly recommend admins review your security measures and harden your systems against automated attacks.

Is this something Reproducible Builds could help with?

#security #malware #CryptoJacking

Ciarán McNally

@ciaranmak@mastodon.ie

Hello all 👋
Am a self-employed #security consultant of 10+ years via https://securit.ie/

I regularly enjoy live sports/music (likely to post about), I code #Python & #Rust and am unafraid of low-level / reverse engineering, builder, breaker, cocktail shaker. Lefty af ☭. An aspiring cyberterrorist armchair general on main
🤘😜👍 #Introduction

Avoid The Hack!

@avoidthehack@mastodon.social

👋🏽 Hi Mastodon

(Redoing #introduction)

I am the same Avoid The Hack from Bird Site

Only news items and updates for https://avoidthehack.com are cross posted from Bird Site. Everything else is here (and only here) as I’m more active on Mastodon.

Most of this feed is related to #cybersecurity and #privacy. Sometimes I post advice. Sometimes I share articles I have written. Sometimes I share articles featuring Avoid The Hack. Sometimes there are memes.

#security #privacymatters #infosec #opsec

lj·rk

@ljrk@todon.eu

Bio was too big, and I didn't yet make an #Introduction:

Hi, I'm Leonard/Janis (like Cohen/Joplin respectively), I use they/them pronouns, he/him (Leo) and she/her (Janis).

I'm a #genderqueer #hacker from #Berlin. I'm a professional procrastinator, don't expect me to stick to one project :'-)

Outside of computing I love #running, #handball and #rollerblades, adore cats, have a passion for #teaching and spend too much time following politics. I listen to #Blues but my musical taste has since widened to also embrace R'n'B, Rock, Funk, and a lot of modern stuff. I read classic #fiction and my favorite authors are Terry #Pratchett, Douglas Adams, J.R.R. #Tolkien, Robert Harris, and Sjöwall & Wahlöö (rather male dominated, send recommendations!).

I'm politically left #AssignedCatAtBirth but not settled on the specific question of government.

I'm a #privacy and #security fetishist (these aren't the same, sometimes even oblique). Some see a gray space here, I consider the right to data self-determination a fundamental right. Also, free #housing, #publicTransport and a livable environment are fundamental. #Learning and #teaching are crucial for individuals and society. Tech won't solve our core problems, merely highlight them and perhaps provide tools for change we can use.

Jon Seager

@jnsgruk@hachyderm.io

Pretty huge news from Canonical yesterday!

"Today, Canonical announced a 12 year LTS for any open source Docker image!"

https://canonical.com/blog/canonical-offers-12-year-lts-for-any-open-source-docker-image

#Canonical #Ubuntu #Docker #Security

goldfishlaser

@goldfishlaser@fosstodon.org

I will be presenting "Open Hardware Design for BusKill Cord" Demo Lab at DEF CON 32.

When: Sat Aug 10

Time: 12PM - 1:45PM

Room: W303 - Third Floor - LVCC West Hall

https://forum.defcon.org/node/249627

#security #3dprinting #defcon32 #buskill #openhardware

heise Security

@heisec@social.heise.de

Ab sofort gibt es Desinfec’t 2024 auf einem USB-Stick zum Kauf

Mit dem c’t-Sicherheitstool entfernen Sie Windows-Trojaner und greifen auf nicht mehr startenden PCs auf Ihre Daten zu.

https://www.heise.de/news/Ab-sofort-gibt-es-Desinfec-t-2024-auf-einem-USB-Stick-zum-Kauf-9763278.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Download #Security #Trojaner #Virenscanner #Windows #news

Martijn

@martijn@noisesfrom.space

Tooting into space here, hello 👋

I'm 30 year old programmer from the Netherlands. I fiddle with hardware, mostly keyboards and I'm finding my way back into #security.

Besides this I'm pretty active by doing swimming, bouldering and playing padel. Interested in going to #concerts and #music.

Never really got into Twitter but Mastodon seems more like my thing, don't be shy to connect and I will do the same

#TheGuardian #Assange #Corbyn #MI5 #MI6 #LabourParty #Labour #England #Britain #UK #centreLeft #leftOfCentre #elections #UKPol #politics #SocialDemocracy #SocDem #media #security #manipulation #coOpting #conflation #confusion #antisemitism #Guardian #DumpTheGuardian #manufacturingConsent

nixCraft 🐧

@nixCraft@mastodon.social

the talk. credit ig https://www.instagram.com/peter.conrad.comics/ #infosec #security #microsoft #technology

ALT text details

The comic is titled "MY PARENTS GIVING ME THE TALK". The first panel shows two parents looking awkward. They tell their kid: "WHEN TWO PEOPLE LOVE EACH OTHER VERY MUCH..." The second panel shows a smug child and parents with laptops. The title reads: ME GIVING MY PARENTS 'THE TALK’. He tells his parents: "WHEN SOMEONE CALLS AND SAYS THEY'RE FROM MICROSOFT TECH SUPPORT...” Comic by Peter Conrad Comics

𝕂𝚞𝚋𝚒𝚔ℙ𝚒𝚡𝚎𝚕™

@kubikpixel@chaos.social

Dark Visitors - A List of Known AI Agents on the Internet

Insight into the hidden ecosystem of autonomous chatbots and data scrapers crawling across the web. Protect your website from unwanted AI agent access.

✋ https://darkvisitors.com

#ai #internet #block #LLMs #chatbots #it #security #datascraping #protection #web

Renata Rocha 🏖️

@ataner@hachyderm.io

New instance, new #intro post!

OHAI! I am Renata (it's pronounced heh-NA-ta and I am very particular about it) - I am a Manager of Solutions Architecture in Toronto, Canada. I work with #Cloud, #DevOps, #Security and all their relatives.

I am super invested in ID&E, social issues, I am an avid #cyclist, I #run, do #yoga, and still find time to find some random new hobby that I will completely ignore six months later. It is what it is.

I also love #cats! Hello!

Christian Kent

@whophd@ioc.exchange

Let’s hope this #security-conscious *choice* in the Kia EV9 is the start of a trend. They didn’t have to give us this. In a real button, no less — you can connect or disconnect the data from your phone while #USB-charging it in your car. From MKBHD https://youtu.be/CRhjL9X2yKA

ALT text details

A photo of a YouTuber’s finger pointing at a button on the new Kia EV9 that shows two modes next to a USB port. The symbols indicate two choices: Battery only, or battery with USB data.

Estelle Platini

@estelle@techhub.social

How the UK Security Services neutralised the country’s leading liberal newspaper:
(2019) https://www.declassifieduk.org/how-the-uk-security-services-neutralised-the-countrys-leading-liberal-newspaper/

she hacked you

@ekis@mastodon.social

Don't have time for a banner grab but still interested in basic info about a server?

Well taking advantage of a server's inability to process '%' b/c it expects two hex digits to follow; in many cases it errors

Preventing this from happening is actually easy

It requires an essential secure programming principle: verify, validate, and sanitize your input

This principle should be applied to EVERY input, and yes the URL is input

#infosec #security #it #sysadmin #tech #development #programming

ALT text details

Using /% you can generate an error on many servers, and when they have not bothered to hide information it can be revealing.

HiramFromTheChi 👨🏽‍💻💭

@hiramfromthechi@mastodon.social

Any device that needs to be off because it can't be trusted with your conversations should not exist in the first place.

#privacy #privacymatters #security #infosec #cybersecurity #cybersec #amazon #amazonecho #surveillance

ALT text details

A sign on a door of a healthcare facility that says: "Please remember to not discuss patient information (PHI) unless the Amazon Echo is muted."

The Exiled King

@ExiledKing@mastodon.gamedev.place

I never wrote an #introduction or at least don't remember.

I'm Tim - a dedicated #gamer #streamer and #linux enthusiast. I dream of doing #gamedev but tend to lose focus and drive early on.

Things I will post about:
- #memes lots of them
- #gaming - my backlog makes dragons jealous
- #manga #anime #japan
- #cyberpunk
- #comics
- #books as I work through my backlog
- #security
- #python #programmer
- #archlinux #linux

*Probably not an actual King

FreeTech Project

@freetechproject@floss.social

So glad to be on floss.social! Time for another introduction. Hello from #Sheffield, #SouthYorkshire, UK! We're a #NonProfit initiative founded back in 2010, focused on helping people use #technology in a way that is more financially, environmentally, and socially #sustainable, regardless of knowledge or skill level – using and promoting primarily #FOSS to provide personalised learning. We particularly love #Linux, #RaspberryPi, #privacy and #security! Feel free to spread the word. Thanks!

Bo Morgan

@neptune22222@kolektiva.social

#users #fightforusers #userrights #programming #thinking #thinkingaboutthinking #ai #artificialintelligence #neuroscience #journalism #science #scientificprocess #peerreview #foss #fosh #flosh #floss #freeandopensource #freedomsoftware #libresoftware #copyleft #gpl #agpl #mozilla #license #ls #academia #privacy #security #democracy #internet #socialnetwork #distributed #cnc #3dprinting #locallabor #localmanufacturing #coop #workerowned #democracyatwork #regulation #laws #money #corporations #government #socialagreement #boycott #controlcapital #nonviolent #pacifist #antivolence #antigun #noguns #schoolshooting #antiwar #plantbased #vegan #climatecrisis #animalindustry #animalcruelty #extinction #animal #plant #ecosystem #environment #retinituspigmentosa #rp #agerelatedmaculardegeneration #amd #blind #lowvision #bci #games #computergames #ageofempires #rimworld #gamedev #music #bassguitar #rageagainstthemachine #enya #religion #reading #books #readingbooks #buddhism #baby #apple #visionpro #sober

I fight for the users.

I love programming and thinking and talking about thinking. I have an education (BS, MS, PhD) focused on artificial intelligence and neuroscience.

I'm an advocate of the public academic pursuit of knowledge, the scientific process, peer review, and I see open source software and hardware as an essential part of the scientific process.

I see software user rights, including security and privacy, to be protected mainly by free open source software, specifically software with a copyleft license, i.e. GPL or Mozilla.

I see the democratizing effects of the Internet, including distributed journalism and social networking, to be largely the effect of the collaborative development of free and open source software.

I am interested in free and open source manufacturing, including open source 3D printers and CNC machines. I believe open source manufacturing will be important for distributed manufacturing, allowing local manufacturing and local labor.

I see worker-owned coops as the way to safely transition from a non-democratic authoritarian top-down power structure of a traditional corporation to a democratic work environment, where the workers own the company and elect the board of directors, transitioning to democracy in the workplace.

I believe that socialism is a regulatory response to capitalism.

I believe that laws, money, corporations, and government are social agreements, and I'm in favor of democratic social agreements.

I believe in the organized non-violent boycott as a way to control capitalists and change corrupt systems.

I am a pacifist. I am against violence. I am against citizens keeping guns in cities and towns with children. I am against war.

I try to eat plant-based / vegan foods to boycott the animal industry, to help with the climate crisis, to improve my health, to avoid animal cruelty, and to avoid the extinction of species of plants, animals and ecosystems.

I have been diagnosed with Retinitus Pigmentosa, which is a disease of progressive retinal degeneration. I am legally blind, although I have about 5-degrees of vision remaining in my fovea. I'm interested in researching and developing BCIs (Brain-Computer Interfaces), specifically BCIs that function as vision prostheses that may help with conditions like RP, or the more common degenerative retinal disease AMD (Age-related Macular Degeneration).

I enjoy playing computer games like Age of Empires and Rimworld. I used to program computer games when I was younger and would like to get back to it one day.

I love playing music, especially bass guitar. I've been listening to a lot of Rage Against the Machine and Enya recently.

I enjoy reading books, mostly non-fiction.

I enjoy studying religions. I've found a lot of value in Buddhism, and I meditate often daily.

Nina and I have recently had our first baby, a boy we call Tyoma.

I'm currently working at Apple on the Vision Pro headset team.

I'm sober.

Martin Boller 🇺🇦

@itisiboller@infosec.exchange

Sometimes logical isolation isn't enough

#Physical #Isolation #Security #Shit

ALT text details

Sign saying: "Septic Tanks Pumped Swimming Pools Filled Not same Truck"

WTL

@WTL@mastodon.social

My four-month-late #Introduction :
Work: #WordPress #hosting & #Security, #music #festival #IT, #Editor / #Filmmaker, #SmallBusiness

Life: #horror movies, music, #camping, curious and loves to learn, social justice, and to my surprise, a #runner who has #run 15,477 KM Jan 2020 - Dec 2022.

If you stop and look at something the more closely you examine it, the more amazing it becomes.

Married to the wonderful @TAV for over 25 years, furdad to Sprocket the #MinPin, (he/him) #Ottawa, #Canada

SpiderMonkey

@SpiderMonkey@mastodon.social

We are a little late to the party. How about we do an #introduction?

Hi Fediverse, we are SpiderMonkey, @mozilla’s #opensource engine for #JavaScript and #WebAssembly.
SpiderMonkey is used in Firefox, Servo and various other projects.

This account is run by our engineers, and none of us know how social media works. We were told to use hashtags.
#firefox #opensource #compilers #wasm #foss #privacy #security #performance #community

Nice to meet you!

sweet conceit

@lewdmachines@mastodon.social

Since this is what's done on #mastodon - I am a middle age recovering fandom nerd, still active #security and #tech nerd, and someone who has amateur hour opinions on lots of things. My ideal vacation is reading terrible sci-fi in a nice hotel room.

Strongly in favor of #socialjustice #lgbt #prochoice #acab and I seem to be getting more radical as I get older.

I'll probably post about: #travel #smut #monsters #linux #whiskey #film #scifi #gaming #newwave

(Originally posted on mastodon.lol)

dsp

@dsp@social.sdf.org

#introduction i guess?
I'm a physicist who spent most of his time at school, in the datacenter. Then i somehow found myself in 'computer science research' labs writing software. For the past couple of years doing the security thing cause it's fun. Into #openbsd #plan9 #scheme #golang #C #security . When AFK i enjoy #cavediving #trailrunning #bicycletouring #mathematics . As always thank you #sdf for hosting us. It's nice to meet you all :).

log4jm

@log4jmc@infosec.exchange

belated #Introduction

I've been enjoying infosec.exchange for the last month or so but have been putting off an #Introduction because I'm awkward and anxious (#privacy am I right?). I feel more comfortable talking about my cat than myself or my work on social media, so you'll probably mostly see him amongst my boosts and replies. He's a little hacker who tricks me into FaceID unlocking my iPad for him or hides my pouch of physical security keys to remind me not to be careless with them.

See how I just went on about the cat? Yeah... I feel imposter syndrome about belonging in #InfoSec. I'm an IT #security and #operations focused #SysAdmin (#BlueTeam) whose been fascinated/working with computers since I was 3, and have been doing it professionally for over 10 years now. Does that make me #SecOps? I honestly don't know. I love this community though and want to make an effort to share what I do know more often besides the cat pics or conversations or boosting #ThreatIntel and news I think to share.

If I had to sum up in a few hashtags and such, I know securing #Windows and #ActiveDirectory best but I use/protect #Linux and #macOS if you'll forgive me for using #PowerShell there too. I love #scripting and #automation, the #OSINT and #ThreatIntel and #IOCs we share, #infrastructure and #firewall stuff, #logging and #DFIR, and reading/writing reports just as much as code. I'm not super passionate about the #cloud but that's not a hill I'd die on and #Azure is pretty cool.

Did I mention I have one of the best #CatsOfInfoSec ever?

Anyway, "it's me, hi!"

IT-Awareness, Fabian Lucchi

@fabianlucchi@infosec.exchange

Time for my own intro, I think.

Born and raised in Switzerland on #milk, #cheese and #chocolate. Still there today.

Using computers since #ZX spectrum, always enjoyed technical stuff, programming, network and hardware. Deeply interested in BBS and demoscene (Unreal, futurecrew).

Co-started my own company, #Infomaniak, in 1994 with an associate. We were first selling home-assembled computers for endusers. Then we had our own first internet dialup POP by the end of the same year and each customer was granted free access (except for local call rates). We also ran one of the first websites in Geneva, Switzerland, around that time (still found in archive.org, look for infomaniak.ch).

We then splitted the company and started providing professional web/mail hosting when it was still pretty unusual. I built that company from scratch and my associate kept running the computer shop on one side, and doing strategic thinking for the hosting business. The shop was eventually sold in 2000/2001 and we 100% focused on hosting.

At first, I was involved in every step : network design, hardware choice, mail/web servers, routing/transit, building/maintaining IT racks, staff, programming our own management tools, Delphi at that time ; still programming with Embarcadero today. And it was rapidly too overwhelming. The staff grew, we enrolled people with better skills than we had, and I focused primarily on management, legal and accounting. But it was not what I loved to do every day.

In 2017, my associate and I divorced (a 25 years long coworking is *really* like a marriage) ; I was kicked out :(

By then, Infomaniak staff was +60 people (support staff, sysadmin, devs and office admin).

I took that opportunity to better focus on what matters to me : #data #security and #IT #support for small to very small companies. Those left alone with their too complicated technological problems and they do the best they can. Ourdays, this is obviously not sufficient.

So I started again from scratch, with IT-Awareness. My main objective was being able to provide better comfort with #technology for all non technical people, focused on #data #backups and all related matters. Due to the first customers I met, I'm now mostly helping #praticians in all #medical environments.

I'm still alone in my company (it takes time... so much time...) but I nonetheless received a huge project to build a secure mail system for all practicians in Geneva area (~3,000). "Secure" meaning "with confidentiality guaranteed" following Swiss laws requirements. A case study has been done by Synology : https://www.synology.com/en-us/company/case_study/Geneva_Doctors_Association

Prior to this new secured mail system, practicians were mostly using public services like gmail, aol and local telco mail systems, which is absolutely forbidden due to the sensitivity of data they're exchanging. They're now secure, compliant with the law and patients are better protected. But this is of course only part of the long way they still have to go.

I provide a lot of IT support for small medical centers ; they don't know a thing with technology and don't have time. They need things to be done, they need confidence. I try to bring both.

Interested in all #infosec matters for so many years I can't remember, I followed a lot of incredible people with deep knowledge that shared their insight on Twitter.

And like every one of you, migrated to infosec.exchange Mastodon instance (which I proudly sponsor, @jerry thank you so much for your work and dedication, this place is what we really need, our home).

I'm always open to discuss anything with anybody, sharing knowledge and experience.

Druid

@druid@ioc.exchange

#introduction: two weeks late.

Aspiring Gaeilgeoir, recreational cyclist, hiker, dog wrangler. I like traffic lights.

I've worked as a developer, architect, consultant, chief technologist and various types of management, almost always focused on data systems. Post sabbatical, I am contemplating looking for work in security/privacy/digital rights.

Happy to connect and talk.

#IrishLanguage, #cycling, #dogsofmastodon, #privacy #opensource #security

Vegard Nossum 🥑

@vegard@mastodon.social

I've archived all my old tweets (except RTs) here:
https://vegard.github.io/twitter/

Almost everything has been tagged by subject/topic in case you are only interested in something specific.

Lots of #LinuxKernel, #Programming, #Security, #Fuzzing, #Git, etc. posts.

G

@cirriustech@infosec.exchange

Introduction

Redoing my #introduction as it was a bit of a sparse one when I joined.

I am a lifelong #technology enthusiast, having worked in Financial Services IT for more than 25 years, across multiple disciplines including:
* #Unisys #MCP-based #mainframe platforms (A17/A19/HMP NX 6800/Libra 180/Libra 6xx/Libra 890)
* #EMC #Symmetrix storage arrays (DMX 3/4 and most recently VMAX) including experience of #SRDF(S), SRDF(A), BCV
* #WindowsServer (2000 through 2019) including #ActiveDirectory
* Various #Linux/ #Unix OSes (#HPUX/ #RHEL/ #Centos/ #Ubuntu/ #Raspbian) including experience of #GFS/#GFS2 SAN storage clustering
* Virtual Tape Server technology (B&L/Crossroads/ETI Net SPHiNX, #TSM)
* Automation/Scripting (#PowerShell, #NT #Batch, #DOS, #Bash, #OPAL)
* #Security (#PrivilegedAccessManagement, #LeastPrivilege, #IAM, #Firewalls, #EDR)
* #BusinessContinuity/#DisasterRecovery (Design/Implementation/Operations)

I’m focused on learning and getting hands-on with #RaspberryPi at home and #cloud computing solutions both at work and at home.

I moved into a #SecurityEngineering role in 2020, so a lot of my focus is now more security focussed across all tech stacks.

My main focus at present when it comes to cloud is predominately #Microsoft #Azure, with Google and AWS of interest also, as well as other cloud infrastructure services such as those provided by CloudFlare, though I’m planning a move away from them due to their moral/ethical choices.

Away from work and tech, I love to #travel the world with my wife and enjoy very amateur #photography to record our adventures.

I also love most genres of #music, live in concert when I can, with a particular love of #Rock/ #Metal and also #Trance (coincidentally, given the profession of a somewhat more well known namesake of mine!).

James Bannan

@jamesbannan@aus.social

Now that the dust has settled, I can finally get to an #introduction

I’m based in Melbourne/Narrm, and live with my family (and dog!) a short walk from one of the loveliest beaches around.

I work as an #IT consultant, mostly specialising in #Microsoft technologies, system architecture, #security and #automation . I’ve also worked as a #journalist , an #educator , a public speaker and an #author

I have one technical book under my belt, but am aspiring to #write #fiction and am enjoying being part of the #AusWrites community

Mark Keierleber 🚴‍♂️🎸

@mkeierleber@journa.host

#introduction Greetings, Mastodonians! (is that a thing?) I’m a #journalist focused on #schoolsafety and #civilrights. I love writing about – and discussing – #surveillance #privacy #security #tech #k12cybersecure #edtech #databreach #ai #foia

GFH_oheffllc

@GFH_oheffllc@mastodon.social

As my first post on mastodon, here's an image of a comic strip that formed in my head while working on something else (I was writing an article for Bob Ambrogi's site at https://directory.lawnext.com/library/an-alternative-calendar-and-contact-program-for-your-law-office-time-and-chaos/ ) Here are some tags: #lawyer #apps #security

Alex Cordonnier

@alexjcord@infosec.exchange

A bit late to the fediverse party, but here's my #introduction:

I'm a software engineer in the SF Bay Area working on #secureboot architecture and #bringup at a major tech company. Interested in #security (obviously, on this server) and extreme #homeautomation. Also enjoy #hiking, #cooking with my wonderful wife, the #oxfordcomma, and #lotr. Go #Illini! 🔶🔷

#twittermigration

Jack Platten

@jack@social.lol

Hi friends! Now that it seems like the fediverse is sticking around, finally figured I should make an introduction post (on my fourth account don't mind me).

I'm into #security, #infosec, #homelab, #hardware and making things better to use for everyone.😀

#introductions #introduction #intro

Cody Dostal

@dostalcody@infosec.exchange

I decided I need to re-do my #introduction post. Why? I didn't know that full-text search wasn't really a thing on Mastodon (well, particularly cross-instance), so I need to hashtag it. If you've read it before, feel free to move on, or read again. Anything goes!

I’ve seen a few others do introductory posts so I figured why not for me too. It’s unlikely I was known on #infosec Twitter because I didn’t post much on Twitter. I hope to change that here.

I’ve worked in #SystemAdministration, #VulnerabilityManagement, #NetworkSecurity, and/or #SystemofSystems #Security for around 8 years. My experience has been solely within the world of #DOD, first as a civilian and then as a contractor. I’m currently a Senior SA/Deupty PM for Broadleaf-inc, a government contractor.

Along with that, I’ve been teaching infosec for around two years for a university. I developed many courses, Network Security, OS Security, #VulnerabilityAssessment and #PenetrationTesting, #OSINT, IDS & IPS, #CyberthreatIntelligence, as well as an Introduction to IT and a CCNA course. I’ll be developing an Advanced Penetration Testing and a Digital Forensics course this upcoming year.

I am an advocate for helping those with no existing experience and fresh graduates find positions in #Cybersecurity, truly entry level positions. I help run a discord that focuses on that, #SecurityNewbs, as well working on free university-style courses that people can take to learn these skills. Those aren’t ready yet, but my first free course will be Introduction to Cybersecurity.

On my off-time, I'm a huge #gamer. You'll generally find me on the Xbox Series X, although once in a while I'll be on PS5. I generally play #destiny2, probably a little too much. I have 4 kids, 5 cats, and 2 dogs. It can be a hectic house.

That’s me. Fin.

Marco Ivaldi

@raptor@infosec.exchange

Hey everyone, here's my mastodon #introduction.

I'm a seasoned offensive #security researcher with 20+ years of experience.

As a professional #hacker and polyglot programmer of weird machines, basically I study how things can go wrong.

Some examples:
http://phrack.org/issues/70/13.html#article
https://vimeo.com/335197685
https://vimeo.com/474793702
https://youtu.be/Nc9ZLTb2hQ8

Hack the planet! 🏴‍☠️🌎

Andrea Grandi 🦕

@andreagrandi@mastodon.social

I'm mainly here to stay in touch with existing friends but also for #Python or #golang content and anything related to #softwaredevelopment or #security
plus I'm interested in #bass players and nice #food

Please say 👋 hello if you think we should follow each other.

Andy 'Bob' Brockhurst

@b3cft@infosec.exchange

I guess everyone else is, so I'll do an #introduction as well.

I'm Andy, but most people, especially online, know me as Bob (due to a manager at Yahoo! in the late 90's playing a practical joke and it stuck).
I've actually been on here since 2019 but mostly kept lurking occasionally.

I have a wife and 13yo son. Like fiddling with #3dPrinting and #microcontrollers and #robotics. I'm also a #marksman shooting in county rifle teams for full-bore and small-bore.

I'm not officially in #infosec but have been working in networking and sysadmining since token ring networks were the latest hotness and the Internet consisted of telnet, ftp, gopher and email.

I currently work as an #cloud #infrastructure #architect for an #ecommerce startup and am notionally in charge of #security as no one else is interested.

I follow #infosec where I can and keep having ideas about stuff I'd like to research.

G

@cirriustech@infosec.exchange

In my latest post in the Security Bytes series, I talk about a term you probably hear a lot, but perhaps haven’t stopped to think about what it is - Least Privilege.

#SecurityBytes #Security #InfoSec #CyberSecurity #CyberSec #LeastPrivilege #CirriusTech

https://www.cirriustech.co.uk/blog/secbytes-least-privilege-pt2/

OneiricBotcelot

@OneiricBotcelot@digitalcourage.social

Ich bin seit Sommer 2021 auf Mastodon, aber nach meinem Umzug von social.tchncs.de #neuhier auf dieser Instanz. Nachdem ich schon seit längerem Fördermitglied bei @digitalcourage bin, war es einfach an der Zeit.

Beruflich und von den meisten Interessen her bin ich in der #IT beheimatet. In den letzten Jahren stelle ich vermehrt die Entwicklung unserer Gesellschaft im digtalen Zeitalter in Frage und habe für mich einige Schlüsse daraus gezogen. So besitze ich weder ein Konto bei #Microsoft und #Google noch nutze ich irgendeinen Service aus dem Universum des Konzerns #Meta. Die Nutzung von #Amazon habe ich weitestgehend eingestellt.

Themen für die ich mich u.a. interessiere: #Netzpolizik, #Mainframe, #Datenschutz, #FLOSS, #Security, #Privacy, #Selfhosting, #Linux, #CSGO, #OpenStreetMap, #Wandern, #GrapheneOS, #Klima, #Überwachungskapitalismus, #Hardstyle.

Bleibt nur noch zu sagen: Ich freue mich auf (weiterhin) einen tollen Austausch im #Fediverse!