Fi, infosec-aspected

Trans techwitch, and the keeper of many curses. Abyssal domain expert. Infosec by trade. Definitely NSFW brain. Sex work is work; all workers deserve the protection of unions. She like a storm; they like a conference. Neurospicy as hell and loving it.

Pronouns: She/They
Signal: fi_nominal.80

Public Key

npub1ph0tepkx53u4kkus08rqxn6hjqnzwe0hp3ewj67reaezzj92xkvsnwdtxv

NIP-05 Address

munin_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsqmh4usmr2g72mtwg8n3srfateqf38vhmscuhfd0pu7u3pfz4rtxgtecycm

Author Public Key

npub1ph0tepkx53u4kkus08rqxn6hjqnzwe0hp3ewj67reaezzj92xkvsnwdtxv

Show more details

Last Notes

2024-09-08 20:50:22

- reply

It is absolutely physical access: current standards demand WAP auditing in the physical environment section.

2024-06-04 16:24:13

- reply

usually when software miraculously shows up on disk that's -malware-

2024-06-04 16:23:49

- reply

they're not even looking into the jewel they're looking -at- for fuck's sake
and yeah, accurate perception of reality is a lives-long process sure, but this is .......where the fuck do they think they got the linux -from-?! the concept that other people have computers that you can get shit from is -already in their workflow-

2024-06-04 16:20:21

- reply

this is more than a skills gap; this is a -basic perception of reality- gap. They cannot comprehend that life takes place outside of their laptop, and they cannot control that.

2024-06-04 16:18:01

The number of fanbois I've had showing up to my comments about how -linux will not save you from recall because other people have computers and your information- not comprehending the latter causality clause has been -really- disheartening.

2024-06-03 00:32:33

- reply

I think it's not at all coincidental that note-taking is usually regarded as femme-coded work even in ostensibly non-heierarchical spaces, and that tech seems to -have problems- with documentation.

2024-05-29 03:38:14

- reply

-HAH-
Even worse, speaking in cryptic allusions to innuendo meanings is -also- adaptive now.

2024-05-29 03:17:05

- reply

just love to live in a world where "the robots are going to steal my words, my face, and my voice, and use those to scam my friends" is now an -actual threat model- that can be addressed by things like "counting the fingers and teeth in a picture", "refusing to ever answer a phone call", "swearing constantly" which are all now -adaptive behaviors-

2024-05-29 02:58:13

- reply

wait this is just https://en.wikipedia.org/wiki/Mat_(profanity)

2024-05-29 02:54:27

- reply

"can you weaponize the scunthorpe problem"

2024-05-29 02:34:48

- reply

This cements shitposting as the most -human- of arts :3

2024-05-29 02:32:17

- reply

Y'ever think about how 'ai' posting is normalized to business-acceptable language 'cuz the lawyers won't let the robot swear?
So working blue is an effective fuckin' signal of authenticity, in a way.

2024-05-29 02:28:59

- reply

Companies do not give the weight of a possum shit on a newspaper to the likes of 'ethics' or 'civil behavior' but -compliance- means you can -force- the issue.

2024-05-29 02:27:35

One of the more convenient bits about normalizing my expectations of business operations to soc2 and other pertinent standards is that when a company's being asinine, my complaint comes with citations and footnotes to prove that they're asinine.

2024-05-25 17:37:29

Holy shit: ING bank has a means of validating, through their app - so, a trusted, mutually authenticated channel - whether or not the person who has called you is -actually a bank employee-
"If you really have an ING employee on the line, the screen shows their name or their department name. Via the green bar at the top, you can go back to the conversation."
https://www.ing.nl/particulier/english/fraud-and-safe-banking/check-the-call
This is -beautiful- and I want -every- other institution to implement this, holy shit.

2024-05-23 23:24:14

- reply

This would be one of the cases where ai-generated stuff would be -less- effective, especially if this is intended not as extortion but as SWATting.
See, all the manufacturers have this big hash database of known CSA content; if the image is available on a given system or file, you don't have to make some analyst look at it - you have the computer measure the hash, and then determine whether that known image is present or absent.
So to apply involuntary kinetic consequences to someone, using a genuine CSA image to add to their Recall record would mean that the image would then be detectable in the database by the standard tooling for this.
And since -possession- of the image is the crime, you now have involuntarily forced someone to be a criminal, and in a way which will be easily auditable.

2024-05-23 22:43:56

- reply

Next ransomware wave will be showing you CSA content and telling you it's on your Recall record, so now you're going to jail.

2024-05-23 22:42:18

So this means the "I can see what porn you watched" scam emails are now plausible extortion huh. https://cyberplace.social/@GossiTheDog/112492445214914228

2024-05-21 18:53:56

- reply

How -do- you fix this?
You do not put the capability to automate screen-scraping into the OS as a canonized feature.
Yes, this does not stop screen scraping from being possible - it's been around for years.
Disallowing it from the canonical image -of- the OS, however, means that there is an increased barrier in the way of implementing this: an abuser will need to learn how to implement this, and will need to rely on third-party software not integrated into the OS as expected functionality.
This in turn means that abuse victims are able to rely on tools already in-use to remove third-party software from the computer in order to have more assurance of private operation.
Yes, no single measure is capable of ensuring safety.
This is why it's a security -system- and not a security -item-; systemic effects require an understanding of the entire context in order to evaluate the safety or unsafety of the system.

2024-05-21 18:43:51

- reply

@npub1nrx…m4fy
Speaking from my compliance aspect, this comprehensively fails PCI and GDPR immediately and the SOC2 controls list ain't looking so good either.

2024-05-21 18:28:18

- reply

"Use Linux" is not an appropriate response.
People do not always have the agency to choose their operational environment and you cannot fix structural unsafety with individual choice.
This is not a jape nor a joke, and I am not willing to countenance this as an argument.
Do not perpetuate abusive situations by blaming a victim for the environment they are in.

2024-05-21 17:55:37

- reply

Ain't no amount of -group policy- bullshit gonna fix this,
because Microsoft -doesn't allow- the granularity of administration required to defuse this for non-corporate users.

2024-05-21 17:54:50

- reply

Like, flat-out.
This 'feature' means that someone in an abusive relationship now has a canonized part of the OS monitoring their activities that can be then invoked and studied by the abuser.

2024-05-21 17:54:15

Hey so,
This windows recall thing?
Enables domestic abuse.

2024-05-21 16:47:20

Hey remember back in the old days when van Eck phreaking was the cool threat model - how the Secret Agents across the street could point an antenna at your CRT and read back your screen image without you knowing it?
Can we have that shit back? this new "OS-integrated screen scraper" shenanigans takes all the joy out of spying.

2024-05-21 16:28:49

Windows is no longer safe to use as a corporate OS.
https://cyberplace.social/@GossiTheDog/112479974357074203

2024-05-18 14:58:40

- reply

that's where the money is right now x.x

2024-05-15 01:52:09

There's an old joke I like that kinda encapsulates the news media hype around LLMs vs how people who know how they function think.
So this city slicker's driving out in the countryside and his car breaks down by a pasture. He gets out, pops the hood to see what's going on, and after a minute he hears a voice behind him - "The trouble is with the carbuerator."
Guy looks around, sees nobody, scratches his head, figures he's hearing things, looks back down - "The trouble. Is with. The Carbuerator."
Guy whips his head up and - only living being within earshot is a bull in the pasture, looking over the fence, chewing his cud.
"sorry, what was that?" says the city slicker, wondering what's going on.
The bull snorts and then enunciates -very- clearly, "The trouble. Is. With. The. Carbuerator."
Well, that's just too much for the city slicker so he runs the -fuck- out of there, doesn't stop 'til he sees a farmhouse. Runs up, hammers on the door, farmer comes out - "Yawp?"
"The bull!" says the city slicker, "he - he said the trouble was with the carbuerator!"
"Aw, don't pay him any mind," the farmer says, "he ain't know -shit- about cars."

2024-05-09 22:37:05

'roundabouts ten years ago, I had a joking notion that length of beard was correlated with the number of root passwords someone knew.
Since then, NIST 800-207 came out and now nobody has root passwords in prod anymore, and I've lost the beard, so....huh.

2024-04-26 23:00:34

- reply

Views that deliberately contradict the system in which you are operating can - and in my opinion should - be discarded as irrelevant to the system; furthermore, if someone insists on promulgating that view, they are not operating within the scope of the system as defined - and if they aren't going to participate within the system as defined, it's not only correct to exclude them, but necessary.

2024-04-15 21:09:31

- reply

oh, a fair few of us do care. Alas, it's a bit harder to get the people who gatekeep development decisions off of the 'no maintenance, only features' mindset.

2024-04-13 17:37:37

- reply

ooh neat - any particularly fun subsystems to play with?

2024-04-12 21:05:21

- reply

....what type?

2024-04-01 17:10:27

- reply

Think about how to set up a network to induce burnout in someone trying to break in lol

2024-04-01 16:54:08

- reply

which suggests a number of blue team strategies lol