serious business :heart_cyber:

always hopeful, rarely optimistic

pronouns: he/him
lang: eng
founding organizer: [#BSidesCambridgeMa](https://infosec.exchange/tags/BSidesCambridgeMa )

Public Key

npub1nq3wk8329jxm6zmt8ersyevfetf37e5qrswswdx5w3yqjkmg4mmqnck082

NIP-05 Address

ceresbzns_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsfsghtrc4zerdapd4nu3czvkyu45clv6qpc8g8xn28gjqftd52aaspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dseunuej

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1nq3wk8329jxm6zmt8ersyevfetf37e5qrswswdx5w3yqjkmg4mmqnck082

Show more details

Last Notes

2025-05-15 13:36:51 UTC

- reply

If your job is accessible by T, it's doable. Easier with a bike. Could be a lot better.

2025-05-05 18:25:10 UTC

New OMB memo tries to execute on circustown EO in predictably clown shoes fashion
https://www.metacurity.com/trump-eo-gives-doge-access-to-all-federal-systems-targets-states-and-injects-cybersecurity-risks/
rtyi @npub1vc3…axsh
#infosec #cybersecurity #uspol

2025-05-02 15:26:40 UTC

- reply

wait, why are you *selling* your SCHF at this stage?

2025-04-25 10:32:09 UTC

~~++ VIBE CHECKPOINT ++~~
What's your vibe today?
What's the vibe you want to have instead?
~~++ VIBE CHECKPOINT ++~~

2025-04-23 01:47:24 UTC

- reply

any chance you've looked into this already?

2025-04-23 01:46:47 UTC

Trying to find data on cybercrime case closure / conviction rates
Can you recommend a place for me to look? Or better yet, a report to read?
FBI has produced a few reports on how many criminal complaints they get, but I'm not seeing any numbers on how often anyone gets charged or convicted - proportionally (well, I have found some but they're mostly puff pieces by cybershills)
#infosec #cybersecurity #ransomware

2025-03-30 18:07:21 UTC

- reply

a rambling gambol?

2025-03-29 20:10:16 UTC

- reply

And what, set a VPS as my exit node or the like?

2025-03-29 20:03:30 UTC

> program stops working
> check that the API key is still active
> keys are allowlisted to an IP
> check my WAN IP
> it's different than it was a month ago
> fucking comcast
> update allowlist
> program works again
sell me a static IP you cowards!
#python #programming #infosec

2025-03-21 13:30:13 UTC

- reply

hooray speed bumps!

2025-03-20 00:01:16 UTC

- reply

what happened?

2025-03-17 20:00:07 UTC

- reply

replace them with bollards 🔪

2025-03-17 18:19:13 UTC

- reply

Valet, personal chef, housekeeper, life coach, research assistant, IT support technician...

2025-03-14 13:10:41 UTC

- reply

phone line giving busy tone, seems like they're either getting slammed or don't have enough call lines

2025-03-09 00:51:09 UTC

TFW your wages are materially worse than a 15th century Florentine day laborer
#uspol #history #economics
CC @npub1v85…mqcs
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/129/717/568/540/160/original/24e43d4cd8b3f93c.jpeg

2025-03-02 17:52:10 UTC

- reply

I'm not going outside, it's 20F!

2025-02-25 01:43:43 UTC

Nowadays it really feels like the choice often comes down to picking between:
* open-source software that's a little bit shitty but it's completely free
or
* closed-source software that's a little bit shitty but also it costs a lot of money
Why is this still even a contest
#opensource #infosec #cybersecurity #foss #linux

2025-02-23 00:02:02 UTC

- reply

where do I get some of those?

2025-02-17 16:06:47 UTC

- reply

Speaking as someone who lived in this place, and has spent his entire adult life living under a system that has been in decline LARGELY BECAUSE OF SYSTEMIC DECISIONS MADE BEFORE I WAS EVEN VOTING AGE (Reagan, Nixon, Clinton!), I don't appreciate being blamed for this horseshit
I didn't pick to live in an authoritarian christo-fascist regime and neither did the majority of my neighbors!

2025-02-07 03:01:05 UTC

- reply

Siri is there to spy on you, sir, not be your secretary

2025-01-18 00:13:31 UTC

- reply

alright, fair enough

2025-01-17 21:57:48 UTC

- reply

I won't argue that TikTok is an instrument of Chinese state soft power
That said, your framing suggests that companies domiciled in US client states are qualitatively... better?
I think, esp given what we're seeing out of Zuckerberg and Musk lately, it's pretty clear that Meta and Twitter are essentially unaccountable instruments of *private oligarch* soft power
Which means they're ALSO conduits for Russian and Chinese soft power because the existing controls on disinfo and bots seem (deliberately) insufficient
I'm not expressing a particular stance on the ban, but your framing strikes me as, if you'll forgive me saying, kind of sinophobic

2025-01-12 03:36:24 UTC

- reply

Quick update to this story:
* I upgraded to latest version from nginx repo
* reverse proxy breaks. can't figure out what's wrong.
* I back out of all the changes and reinstall from debian stable repo
* proxy is working again
It sounds like security updates are backported (thanks all for the feedback), so I'm just gonna leave the server running the way it is now

2025-01-12 02:40:42 UTC

tldr; How common is it to find the software provided by the default Debian apt repo is out of date (maybe dangerously so) and you need to seek out a more secure version by setting apt to grab a different repo?
Long version:
OK, I have a sysadmin situation that I suspect may be fairly common, but it's the first time that I've encountered it because I'm new to all this:
* Host I'm operating is running Debian 12 Bookworm stable
* I updated my apt repo
* I installed nginx web server software from the default Debian apt repo
* Installed version of nginx is 1.22.1
* Shodan monitoring flags nginx 1.22.1 as end of life - (thank you @npub1l5l…hq7p)
* On investigation, nginx website shows a few known medium and low vulns in that version, and the latest mainline version of nginx is all the way up to 1.27.3 - so my current install is in fact five versions behind and very EOL
* obviously this is concerning because I don't want my server to get pwned
* nginx offers a way to update apt to point to their repo and pull the latest version (great service, thank you)
#sysadmin #homelab #nginx #debian #linux #infosec #cybersecurity #shodan

2025-01-04 18:42:03 UTC

- reply

I've started paying more attention to physical retail again. I've been trying to buy as little from amazon as possible

2024-12-31 00:45:55 UTC

- reply

lol my kid has that exact shirt

2024-12-28 15:50:20 UTC

- reply

what's going on now?

2024-12-21 02:33:53 UTC

- reply

what is the ominous floating sphere?!

2024-12-19 01:52:29 UTC

- reply

I pay for Kagi, which is good search that doesn't suck. That's how I find things outside of Amazon

2024-12-05 18:24:33 UTC

#unitedhealthcare #uspol
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/601/612/678/504/180/original/be33de17c67637cb.png

2024-12-05 16:03:26 UTC

holy fuck
#uspol #unitedhealthcare
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/601/056/045/289/022/original/6d02c27272e1054d.png

2024-11-22 23:32:15 UTC

lol
lmao
Sauce: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-326a
#infosec #cybersecurity #redteam #cisa
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/529/205/622/068/032/original/2dada1f09cd9e77b.jpg

2024-11-19 01:09:22 UTC

"The end justifies the means. But what if there never is an end? All we have is means."
Ursula K. Le Guin, The Lathe of Heaven

2024-11-10 19:55:00 UTC

- reply

do you think they're prepared for how bad it's going to get?

2024-11-10 19:42:02 UTC

- reply

did they just think 2016 was a fluke or something?

2024-11-07 00:47:41 UTC

- reply

what's your fave?

2024-11-05 13:57:19 UTC

Wild ass day in the Tor node operator world. Got an email from my VPS, forwarding a complaint from WatchDog CyberSecurity saying that my box was scanning SSH ports!
> Oh no, oh no, I knew I should have set up fail2ban, oh god why was I so lackadaisical!
So I remote in to the machine: no unusual network activity, no unusual processes, users, logins, command history, no sign that anything is doing anything I didn't tell it to do.
So what's up? Turns out there's been a widespread campaign where some actor is spoofing IPs to make it look like systems running Tor are scanning port 22: https://forum.torproject.org/t/tor-relays-tor-relays-source-ips-spoofed-to-mass-scan-port-22/15498/14
Operators from all over are saying they're getting nastygrams from their VPS providers because WatchDog is fingering their source IPs (which are being spoofed and NOT part of a global portscanning botnet).
@npub18ah…5v5z did an amazing writeup of the whole thing here: https://delroth.net/posts/spoofed-mass-scan-abuse/
#tor #infosec #cybersecurity #threatintel #privacy

2024-10-25 11:01:07 UTC

- reply

On the management side, unionization and eliminating the Taft-Hartley Act would definitely help. Fostering worker-owned cooperatives as legitimate business models at scale would also improve conditions.
Mistreatment by the public I'm less sure about. My understanding is that people abuse retail employees because they're perceived as "low status" and aren't allowed to retaliate, so authoritarian shitbags who need to punch down to make themselves feel better take the opportunity to abuse them because they're easy targets.
Part of this is a cultural problem, because we live in a social structure dominated by hierarchies in most arenas.
Still, giving employees the agency to refuse service or expel customers who mistreat them could be an answer here. Worker-ownership, unionization, these could help on that front.
I'm less confident about regulatory approaches directly impacting this.

2024-10-25 10:47:44 UTC

- reply

mistreatment by management, or mistreatment by the public?

2024-10-24 12:51:36 UTC

- reply

a morsel of context, please sir

2024-10-21 15:05:16 UTC

- reply

y are u on threads tho

2024-10-11 00:24:44 UTC

- reply

what a fucking goon

2024-09-24 12:14:45 UTC

- reply

Kevin it's 55

2024-09-23 18:39:26 UTC

- reply

Zoning governs a lot about what can be built where in the city. When I went to go look at the zoning regulations, what caught my eye is that there is a LOT of language about specific industries that are not allowed to operate in the City of Cambridge. Things like slaughterhouses, glue factories, smelters, etc. etc.
"Zoning because racism" is a reductive answer. Yes, there's zoning ordnances in place that reinforce racist and classist hierarchies in the city, but also, there's some amount of urban governance that happens through zoning that makes it so that we're not all constantly choking on the stench of rotting beef offal and smoke from brickyards.
Now, there's a separate discussion to be had about "Well, we need bricks, so where are they coming from if zoning says we can't make them here?" and I think that's an important discussion. Again, it's more expansive than "racism."

2024-09-23 16:16:05 UTC

- reply

I mean, listen, not to defend the NIMBYs but like, I don't want glue factories or aluminum smelters or coal-fired power plants operating next to where my kids go to school either

2024-09-12 02:29:50 UTC

- reply

Honey Pot Hill Orchard in Stow
You can get them sugar-coated or Boring For Kevin

2024-09-10 00:16:55 UTC

- reply

i think these are terrible, for ideological reasons, but probably not the one you'd expect

2024-09-09 20:40:27 UTC

This Cohost situation sounds pretty unfortunate, having been done in by Stripe changing their policies.
Listen, and I mean this sincerely, what if we started paying attention to online payment systems that aren't gatekept by a handful of processors?

2024-09-09 20:36:40 UTC

@npub1avm…dsfh are you running a single user instance?

2024-09-09 20:27:58 UTC

- reply

yeah but then you wouldn't have a lifetime supply of spindrift

2024-09-09 20:23:48 UTC

- reply

some Amazon product manager is feeling very pleased rn

2024-09-09 20:22:46 UTC

- reply

wait, is that what's going to happen?

2024-09-08 23:06:53 UTC

- reply

using hashtags just to shit on them is antisocial jackass behavior

2024-09-07 21:05:23 UTC

- reply

I2P is also interesting to me, but I don't yet know of any sites/services on I2P that would give me a specific reason to try it
Any suggestions?

2024-09-06 18:23:18 UTC

Distributed version control decentralization spectrum
GitHub - Microsoft controls it
Codeberg - a nonprofit controls it
Forgejo - I control it
Radicle - nobody controls it
Did I get that right?
#git #github #codeberg #decentralization #forgejo #radicle #software #foss #microsoft #opensource
@npub1fh7…ee83 @npub12r3…zz58 @npub1uwc…femz

2024-08-25 15:02:48 UTC

Freezing my credit with the big 3 agencies. (USian)
Experian was creepy but functional.
Equifax worked.
TransUnion is complete fucking clown shoes.
They should all be destroyed.
#credit #surveillance #finance #infosec #usa

2024-08-24 15:56:01 UTC

I realize this may start a border war, but -
I've been using XFCE on Debian because it's straightforward and comes packaged with the distro. I like it for the most part, I just haven't had much incentive to try anything else. I have GNOME on my Ubuntu machine, again, because it's there and it seems fine (though I like it less than xfce).
I keep hearing about other desktop environments tho and clearly folks have strong opinions.
Would love to hear - is there an easy summary of what each major desktop environment is good for? i.e., if I was thinking about trying something new, what should I be thinking about or looking into?
I'm specifically interested in:
* FOSS
* well-maintained
* compatible with Debian and Ubuntu distros
#kde #gnome #xfce #ubuntu #debian #linux #desktop

2024-08-22 11:13:37 UTC

Alright fedi I need help:
I WANT
* an RSS reader that
* syncs between mobile and desktop (app, firefox extension, or website is fine)
SO THAT I can read my favorite blogs without having to do a bunch of manual syncing / updating across my devices.
Acceptance critera:
* must be FOSS
* reasonably stable / maintained
* can be self-hosted
Does anything like this exist? There's a million RSS readers out there, but they either seem to be paid or don't offer any kind of sync functionality. Or is there a workaround that accomplishes the same thing, e.g., RSS to email service?
I have a nextcloud server - should I just use the News app?
#rss #foss #selfhosting #thunderbird #firefox #opensource #nextcloud

2024-08-21 18:52:27 UTC

- reply

yo dawg, we heard you like Linux, so we put Linux in your Windows, so you can
*kernel panic* while you *blue screen of death*

2024-08-18 21:43:07 UTC

I'm running a few Tor relays and a Signal proxy, partly as a reason to learn tech skills, partly as my civic responsibility as someone who believes in a free and private internet.
Any suggestions for what else I should spin up?
Here's what I've been considering doing next:
* SearXNG
* Radicle
* IPFS
#privacy #tor #signal #lunarpunk #devops #searxng #radicle #ipfs #censorship

2024-08-17 14:00:47 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/977/718/822/090/974/original/096a1a04bbbfc593.jpg

2023-01-22 15:38:32 UTC

Hey folx, realized I still owe an #introduction. So (mario voice) here we go:
My handle means "serious business." I'm always hopeful. I'm rarely optimistic.
What I'm working on:
* Studying #cybersecurity as someone without a computer science background
* Self-hosting more of the tools I use, particularly as a means of -
* Opting out of surveillance capitalism tech platforms (you know the ones)
I'm a big fan of these things and you can expect me to toot about them:
* solidarity, mutual aid, organized labor, cooperative economics, and community defense
* #privacy and privacy self-defense tools like Signal, Tor, Cwtch, and GPG / PGP
* #FOSS, especially the more accessible #linux distros like Debian
* #solarpunk and #lunarpunk as incongruent and complementary ideals
Here's some things that are a meaningful part of my life, that you probably won't see me toot about: parenting, weightlifting, software product management, firearms, PC gaming, LARP, business, finance, positive nihilism, MApoli, CambMA
Here's what I think I can offer you:
* I've worked for all different kinds of organizations, ranging from big tech, little tech, governments, to DAOs
* for better or for worse, I know a lot about #cryptocurrency, particularly #ethereum, #bitcoin, and #monero
* I've been a software product manager for a while now, which means I help teams ship software that does what users need - mostly through prioritization, facilitation, and communication
If there's anything in my background that would be useful to you, please reach out. I'm happy to share.
One last thing - a message to fascists, TERFs, dominionists, abusers, and every other variety of petty authoritarian desperate for an excuse to control others: fuck you, y'all gonna lose