Paco Hope @paco@infosec.exchange

So Marcus Hutchins, of #WannaCry fame and who had been arrested in the US has pleaded guilty to writing banking #trojan software. Over on the birdsite there's lots of strong opinions. I blogged my opinion that it's a big world out there and trying to dismiss him as a criminal or pardon him because he's a hero are fundamentally misguided. https://blog.paco.to/2019/marcus-hutchins-infosec-soul-searching/

#passwords are like #underwear is a terrible metaphor. :)

I’m upgrading a server that runs #FreeBSD using iocage jails. I prefer something like xcp-ng as my hypervisor. So I can completely separate upgrading the kernel from the guest OSes. https://xcp-ng.org/

“The media reports of our security incident were wrong on several points.”
“Hi, this is Brian Krebs, the reporter who handed your ass to you. (This is your ass, isn’t it?) Which points were incorrect?”
Hilarity and sadness ensue.
https://mobile.twitter.com/gcluley/status/1118203223528169474

This is such a powerful poem. Very apropos at this junction in world history. http://theamericanjournalofpoetry.com/v2-constantine.html

The only thing I am”legendary” at in #ApexLegends is dying early.

I just spent the day in Dundee, Scotland at #Securitay2019. If you are looking for the best #infosec talent coming out of UK universities, this is the con to go to. They’re such great kids, incredibly clever, and the conference is a great time. https://securi-tay.co.uk/

After the con I always pull out a box of cigars and we have “cigar-itay”.

What’s the difference between Fyre Festival and Brexit?

Super cool and simultaneously creepy. It’s now an arms race between things like fingerprint scanners and facial recognisers and GANs. https://www.inverse.com/article/53280-this-person-does-not-exist-gans-website

I'm running a pi-hole in the house now to block ads and trackers. It's absurdly easy to setup and very effective. Plus the stats are so interesting to see all the ads blocked. The best thing is that because it works at the DNS level, it affects things like TVs, mobile apps, game consoles, and other embedded devices. https://pi-hole.net/

So... I accidentally left a DNS recursive resolver open to the Internet for a day or two. Someone noticed.

If you have a #mac and you want to forget the open #wifi access points that your mac has joined, this handly little python script does the trick. It leaves alone any wifi that has a password. Only deletes the WiFi networks that have no password. If you use #iCloud keychain, this will have the lovely side-effect of deleting them from your #iPhone/#iPad at the same time. https://github.com/mubix/osx-wificleaner
You might also want to disable the captive network assistant on your mac:
https://massimoronca.it/2015/05/20/disable-captive-network-support-in-os-x.html

Maybe I’ll put a password on this zip file. Why bother? Crypto implemented like a CS undergrad. With many eyes, all bugs are someone else’s job to find. https://twitter.com/3lbios/status/1087848040583626753