@dymaxion.infosec.exchange.ap.brid.gy
Thinking about security, failure, change, art, and living. Recruiting barbarians; complicate your narratives. Fractional CISO to startups via Systems Structure Ltd […]
🌉 bridged from ⁂ https://infosec.exchange/@dymaxion, follow @ap.brid.gy to interact
@dymaxion.infosec.exchange.ap.brid.gyOh, my sweet summer child. It's always the C++ programmers, isn't it?
@hynek.mastodon.social.ap.brid.gyReposted by @dymaxion.infosec.exchange.ap.brid.gyholy shit I got a free NordVPN subscription and their macOS client installs an endpoint kernel extension that just hangs around after an uninstall. There was a constant com.nordvpn.macos.Shield process. I had to boot into recovery and disable SIP to get rid of it. Part of that is on macOS that […]
@dymaxion.infosec.exchange.ap.brid.gyAre we the baddies
@dymaxion.infosec.exchange.ap.brid.gy@sterophonick It would be amazing and terrifying to see something that could parse and respond to an http request made entirely out of discrete components
@audreypenven.netReposted by @dymaxion.infosec.exchange.ap.brid.gyEvery eviction should be seen as murder or attempted murder. Learning of #Maricarmen's death in Spain after being forcably evicted at age 87 is a reminder of this.
Thinking today of a friend lost to similar violence, and dreaming of a future in which these kinds of deaths are unthinkable. 💔
@dymaxion.infosec.exchange.ap.brid.gy@myx My god, privacy preserving technologies!? Terrifying!
Although the idea of trusting a bot anywhere near a life-critical system sure the fuck is.
@dymaxion.infosec.exchange.ap.brid.gyRemember folks, digital logic is just a lie sold to you by big transistor! Everything is actually analog!
@dymaxion.infosec.exchange.ap.brid.gyAbstraction is the original sin of technology. It's essential to do anything and we have taught two generations to treat abstractions as real, but not what's beneath the ones they use nor the implications of this lie, and we wonder why no one can see the impact the lie has on their work and world.
@five-eights.comReposted by @dymaxion.infosec.exchange.ap.brid.gyCoding agents reduce software development to a simple matter of: * specifying requirements * verifying correctness and quality * maintaining and operating software you didn't write As we all know, those have always been the easiest, most well-understood parts of the craft, so everything is fine!
@dymaxion.infosec.exchange.ap.brid.gyToday was adventures in project management. We're starting the planning and prep process for next year's dyke march. Trying YouTrack for this year, so I got that configured, added the team, and made the first hundred tickets, transcribing last year's lists plus various stuff from our after action.
@cazabon.mindly.social.ap.brid.gyReposted by @dymaxion.infosec.exchange.ap.brid.gyYesterday I saw someone say "Kubernetes is made out of attack surface" and I'm still chuckling about it.
@dymaxion.infosec.exchange.ap.brid.gyI just finished James C. Scott's last book, In Praise of Floods. It's a delightful, gentle book. I first read his Seeing Like a State something like fifteen years ago, and the way he sees the world has been a constant companion in my head and has shaped my thinking ever since. It seems weird […]
@veroniqueb99.mastodon.social.ap.brid.gyReposted by @dymaxion.infosec.exchange.ap.brid.gy
@dymaxion.infosec.exchange.ap.brid.gyNow I really want the ability to write firewall rules for my phone camera, a totally normal and reasonable thing to want. Turns out if you scan a signal device link qr code with the normal phone scanner, even outside of the add linked device flow, you'll get jumped straight to approving it.
@dymaxion.infosec.exchange.ap.brid.gyGiven that the device linking channel has been used for attacks against @signalapp users, should a user linking a new device be treated as a soft compromise, e.g. not something that undoes safety number verification, but still something that the user is notified about, possibly including the […]
@dymaxion.infosec.exchange.ap.brid.gyRE: https://mastodon.social/@wchr/117373471322177292
It's a pity they weren't in a position to extend that analysis to the business and enterprise tiers. I'm assuming they would see differences, especially at enterprise. If they don't, uh, boy do I have some auditor questions.
@paninid.mastodon.world.ap.brid.gyReposted by @dymaxion.infosec.exchange.ap.brid.gyThis.
@dymaxion.infosec.exchange.ap.brid.gyIt's interesting how much the job of a fractional CISO is coaching CTOs and CEOs on how to build good engineering teams and practices in general — often with the goal, on my side, of getting the company to the point where they can do security work, but also just so the company becomes stronger […]
@dymaxion.infosec.exchange.ap.brid.gyNice client compliment today, "Some of your guidance for me, particularly around release practices, was quite foundational about how I think about constructing the team, especially not having it spread so thin and constantly scrambling to put things together at the last minute."
@dymaxion.infosec.exchange.ap.brid.gyIt's lovely that we're at a point where any polished long form writing is assumed to be AI, doubly so if the author dares to use an em dash. This civilization is cooked. Bring on the meteorites.
