:(){ :|: };: @jgoguen@infosec.exchange

Dad, feminist, infosec, probably a dormant cyber pathogen, introvert. Chaotic Good. Toots are mine, don't blame my employer. Encrypt then MAC. RT != endorsement

94 Toots

26 Following

25 Followers

Toots Toots and replies Media

**:(){ :|: };:** · Sep 09, 2017, 04:12

:(){ :|: };: boosted

**1000%!! I USED TO GIVE A FUCK** @Elizafox@mst3k.interlinked.me · Sep 09, 2017, 04:12

stolen equifax joke Show more

**:(){ :|: };:** · Sep 08, 2017, 02:29

:(){ :|: };: boosted

**Nate Cull** @natecull@mastodon.social · Sep 08, 2017, 02:29

I'm old enough to remember when the Internet was going to decentralise the world economy and make small cities viable and attractive to work in because of telecommuting

**:(){ :|: };:** @jgoguen · Aug 12, 2017, 23:35

**:(){ :|: };:** @jgoguen · Aug 12, 2017, 23:35

Clearly avocados are the reason why millennials can’t afford home ownership. https://infosec.exchange/media/Qe7E4AylAJJeMNlRx5g

**:(){ :|: };:** @jgoguen · Jul 26, 2017, 18:27

**:(){ :|: };:** @jgoguen · Jul 26, 2017, 18:27

Facebook CSO Alex Stamos delivered the Blackhat keynote today. In his keynote, he calls out one of the, if not the single, biggest problem we have in the Information Security world: we build systems for people who have deep technical knowledge of everything they're going to encounter. Which is no one.

Security is about people. If we expect to succeed in infosec, we have to build for people.

https://www.facebook.com/security/videos/10155111383296886/

**:(){ :|: };:** @jgoguen · Jul 25, 2017, 16:12

**:(){ :|: };:** @jgoguen · Jul 25, 2017, 16:12

Adobe is killing Flash at the end of 2020! Finally, it's about time this thing gets gone! The end of 2020 can't come soon enough!

https://blogs.adobe.com/conversations/2017/07/adobe-flash-update.html

**:(){ :|: };:** · Jul 08, 2017, 12:57

:(){ :|: };: boosted

**Andrew Roach** @ajr@cybre.space · Jul 08, 2017, 12:57

@bob @maiyannah @rysiek this is totally a failure of the W3C.

And as a result, it's now up to all of us that understand what a catastrophe this is to explain it to everyone that doesn't.

We gotta make them understand, and care.

**:(){ :|: };:** · Jul 08, 2017, 13:14

:(){ :|: };: boosted

**Bob Mottram** @bob@social.freedombone.net · Jul 08, 2017, 13:14

"really, seriously, what the fuck, Tim? Are you being massively, grossly and unfairly misrepresented? Are you in fact still trying to fight for the freedoms and the openness that you always seemed to be fighting for? Or have you, like all the rest, just gone 'fuck it' and toed the big-corp line? What does that even consist of? Did you actually just take a big check? Is that how it works? Or am I really, seriously, just completely missing the deal here?"

https://lobste.rs/s/vbh2ws/timbernersleeapproveswebdrmw3c

**:(){ :|: };:** @jgoguen · Jul 09, 2017, 16:27

**:(){ :|: };:** @jgoguen · Jul 09, 2017, 16:27

In which Linus expresses his opinion on systemd in a surprisingly calm and polite manner.

"…it's also not clear that init is the right source of limits, or even which limits we'd want to copy."

"And yes, a large part of this may be that I no longer feel like I can trust "init" to do the sane thing. You all presumably know why."

https://lkml.org/lkml/2017/7/6/577

**:(){ :|: };:** @jgoguen · Jul 09, 2017, 01:57

**:(){ :|: };:** @jgoguen · Jul 09, 2017, 01:57

Remember how systemd starting as root if the username starts with a digit isn't a bug? Turns out they're technically right. It's not a bug.

It's a bug worthy of a CVE. CVE-2017-1000082, which had to be requested by third parties. Like, I suspect, every systemd CVE ever.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000082

**:(){ :|: };:** · Jul 08, 2017, 09:06

:(){ :|: };: boosted

**rysiek ✅** @rysiek@mastodon.social · Jul 08, 2017, 09:06

@maiyannah @bob hot take: EME/DRM will be just as huge, glaring, festering security problem, as Flash was.

We just got rid of Flash, why are we now opening the web up for NSA via DRM/EME?

I mean, *obviously* users' security will not be a priority for EME/DRM blobs creators.

**:(){ :|: };:** · Jul 08, 2017, 07:54

:(){ :|: };: boosted

**Maiyannah Bishop** @maiyannah@plateia.org · Jul 08, 2017, 07:54

The W3C is ded, ded, ded.
https://www.eff.org/deeplinks/2017/07/amid-unprecedented-controversy-w3c-greenlights-drm-web

**:(){ :|: };:** · Jul 08, 2017, 07:34

:(){ :|: };: boosted

**Maiyannah Bishop** @maiyannah@plateia.org · Jul 08, 2017, 07:34

None. Zero. Nil.

**:(){ :|: };:** · Jul 08, 2017, 07:33

:(){ :|: };: boosted

**Maiyannah Bishop** @maiyannah@plateia.org · Jul 08, 2017, 07:33

Any organization that would attempt to place digital handcuffs on the world-wide web has no place in a modern society.

**:(){ :|: };:** · Jul 08, 2017, 07:33

:(){ :|: };: boosted

**Maiyannah Bishop** @maiyannah@plateia.org · Jul 08, 2017, 07:33

W3C is ded.

**:(){ :|: };:** @jgoguen · Jul 02, 2017, 20:06

**:(){ :|: };:** @jgoguen · Jul 02, 2017, 20:06

@munin Watch out, systemd is coming to BSD if someone takes this patch seriously ;-)

https://marc.info/?l=openbsd-tech&m=149902196520920&w=2

**:(){ :|: };:** @jgoguen · Jul 02, 2017, 02:50

**:(){ :|: };:** @jgoguen · Jul 02, 2017, 02:50

Systemd has a bug where user names starting with a digit cause the user daemon to run with root privileges. According to the creator of systemd, this is not a bug and everything is fine. The reason everything is fine is because names like this, which are explicitly permitted by the base standards, are forbidden and tools shouldn't allow creating these names, so it's a bug in the tools for permitting names permitted by the standard.

Fsck systemd.

https://github.com/systemd/systemd/issues/6237

**:(){ :|: };:** @jgoguen · Jul 02, 2017, 01:00

**:(){ :|: };:** @jgoguen · Jul 02, 2017, 01:00

It's like PulseAudio all over again, except most packages in systemd distros depend on systemd being the init system and may depend on other systemd components. If your audio doesn't work while you swap it out for something sane that's fine. If your init/DNS/logging/cron/boot (I shit you not, systemd-boot)/user login (again, no shit, systemd-logind) doesn't work you're in for a world of hurt.

**:(){ :|: };:** @jgoguen · Jul 02, 2017, 00:47

**:(){ :|: };:** @jgoguen · Jul 02, 2017, 00:47

The question was raised on birdsite what is the opposite of the KISS principal.

It's systemd. Systemd is the opposite of KISS, and of sanity, and of basic security, and in many cases of even common sense.

**:(){ :|: };:** · Jun 25, 2017, 01:39

:(){ :|: };: boosted

**Bookchin but readabl** @HeckTheCistem@anticapitalist.party · Jun 25, 2017, 01:39

"Decentralized social network" is actually the collective noun for nerds

**:(){ :|: };:** · Jun 23, 2017, 21:41

:(){ :|: };: boosted

**Maiyannah Bishop** @maiyannah@plateia.org · Jun 23, 2017, 21:41

Really starting to appreciate my old boss at IBM's motto of "dogfood your shit or gtfo" If you aren't going to use your own stuff, how can you expect anyone else to?

Older