Tom Bortels

Ancient Scholar, Level 80 Paladin, Finder of Lost Children. Science blah blah blah Computers blah blah blah...

Pronouns: He/him/his
Hat size: Enormous
Main: Paladin
Signal: Biggles.66
Location: Southern California
Mood: usually grumpy

Public Key

npub1rn4zj5tz68y4q4cgtw5arwlrcca8wn9h6je2qecz7cgc257pawrq2d3jhp

NIP-05 Address

tbortels_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqspe63f293drj2s2uy9h2w3h03uvwnhfjmafv4qvup0vyv920q7hpspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsaxcrc3

Publishing to

atlas.nostr.land

relay.damus.io

nos.lol

Author Public Key

npub1rn4zj5tz68y4q4cgtw5arwlrcca8wn9h6je2qecz7cgc257pawrq2d3jhp

Show more details

Last Notes

2026-05-23 03:23:04 UTC

- reply

I can't speak for other forms of credentials, but I have found AWS to be *embarrassingly* pro-active in finding plaintext AWS credentials in public repos, usually within minutes, and immediately disabling them - then telling us about it.
Some have said "ooh they should tell people first" - but I strongly disagree! "If AWS finds this token in the wild they WILL shut it off and you will have an outage and it's your own fault" is a delightful way to get engineers for whom best practice is not a priority to sit up and take notice. Being able to point at the 800-lb gorilla makes my job easier. A big, inevitable but easily avoided failure mode you can point out is one that can be used as a forcing function. Other providers should follow suit.

2026-04-24 19:03:36 UTC

- reply

Turns out here in the future we each have our own mastodon feed.

2026-04-06 16:42:43 UTC

- reply

Color me less than surprised that a child raised in poverty turns the tables and ignores the laws of the society that let him grow up in poverty.
If you want good citizens, you need to start early - food, clothing, housing, education, family.

2025-12-25 15:55:22 UTC

- reply

These devices are a symptom of a much larger issue - networks and technology designed to be flexible and resilient and run by professionals (ie. The internet) being repurposed and used by for-profit entities (both the video streaming providers and those who prey on them) with basically no regulation or protections on the technical side. Laws and regulations are insufficient with international networks. NAT ain't enough. TCP/IP wasn't designed for security or copyright - it was designed for sharing and robustness. And both law and practice lag very far behind people exploiting this openness for both innovation and profit.
When you use the wrong tools for the job, this sort of thing happens.
Since we, as consumers, are nearly always seen as prey - walking wallets to be milked and/or dupes who will willingly host a bot net - I have no moral qualms about repurposing their hardware for goodness and justice. There is a poetry in pwning the pwner and giving my family hardware that I can personally vouch for the safety of, because it's my OS and config. What we need education and tools to help the normals recognize the dangers and protect themselves from *all* of those who would exploit their very reasonable desire to not be a tech dork.
I can drive my car safely without being a mechanic - It'd be nice if my relatives could drive a set-top box safely too.

2025-12-25 01:27:55 UTC

- reply

Question is - how locked down are they? Because if they're cheap enough, they might be viable hardware to re-purpose for all sorts of fun things. If you have a sub-$100 box that can reliable stream 4k video and can be lobotomized and re-purposed, you have Pi competition.

2025-12-14 06:08:16 UTC

- reply

Two words: password manager.
Because you're right. I think I have maybe 5 good passwords memorized, but *every single service* that I use has a different, very long (20-35) heinously difficult to type password, except the ones that are so broken they can't accept a long password.

2025-11-25 14:23:42 UTC

- reply

What really fascinates me is that Walmart sells these.
That seems to introduce a tremendous liability on their part. Were I a streaming provider, buying one of these and seeing my content seems like a slam-dunk lawsuit. Do discovery, multiply by units sold - payday!
I don't see how they could claim ignorance or avoid at least partial blame, they sold me the box no matter how they got it.

2025-11-25 14:14:17 UTC

- reply

There are 2200 different streaming or pay-per-view services worldwide - and this box has pirate access to all, or at least most? I call bullshit. It's both unlikely and unnecessary.
The box is a trojan, you get to be part of their botnet and an attack proxy. In return for that and $350 profit, they no doubt stream pirated content until the heat gets too close - then your box starts working and they pick a new amazon name and different color and pop up again. It's unlikely they are doing targeted attacks against you unless you turn out to be interesting - I suspect they might scan everyone's network fishing and sell that data later, but "person too cheap or poor to buy streaming subs" isn't a prime hacking target.

2025-09-29 00:23:10 UTC

- reply

It's nice when the people who shouldn't be allowed to own pets self-identify.

2025-09-21 18:36:26 UTC

- reply

The paywall "whiners" are doing a public service - a single paywalled article from a popular poster can waste the time of thousands of people. If I see "paywall" I can adjust my expectations and decide if It's worth the effort or I should just move along.
I'd honestly rather see an automatic paywall indicator as part of the client, but that may be infeasible - the client would need to know which sites the user subs to and it could be a headache.

2025-09-07 15:38:18 UTC

- reply

"Using a password manager" and "password was 123456" means there's more to the story - likely colossal incompetence and willful ignorance. My password manager would throw up giant red flags about that insecure password, and I can think of no site I trust that would accept it as valid on signup.

2025-08-23 06:11:46 UTC

- reply

It was certainly college-level - and verbose. Maybe necessarily, given the tricky nature of cognition and how easily we see patterns in things that don't really have them - faces in the wallpaper, animals in the clouds, and what appears to be actual thought in strings of words put together based on probability rather than meaning.
But my simple point stands: aside from niche cases, if they can't solve for hallucinations - the technology is self-limiting. Natural selection will teach humanity (painfully) not to trust the LLM - some faster, some not so much. Assuming the upcoming crash doesn't sour us on the technology sooner.

2025-08-22 15:20:17 UTC

Am I the only one to be constantly, continually disappointed by AI? When I actually try basically anything non-trvivial, it quickly starts to sound like a n00b trying to BS their way through a technical discussion - just making things up that seem reasonable and ho-ing nobody checks their work.
Until/unless they can solve for the hallucination issue, I don't see how this can be useful except in niche cases where reality doesn't matter (like a writing prompt) or the output can be rigorously automatically checked.

2025-08-05 15:57:50 UTC

I really wish there was some way to detect links to subscription services I'm not subscribed to and simply hide those posts.
I follow a lot of people who post interesting things, but it seems half of them are behind paywalls I'm not interested in paying for - so every morning is a string of tiny disappointments.
("Subscription" as a revenue model is elitist and resulting in a balkanization of the web into haves and have nots - and having 40 $5-a-month leeches isn't a desirable state. Invasive ads aren't good - but paywalling off half the internet isn't an improvement. Authors: if your content is behind a subscription - I'll never see it, and eventually block it. Whereas if it's visible and there's a support mechanism - I might.)

2025-07-24 04:37:40 UTC

- reply

Heh. It was less honesty and more naivety.
My poor mother paid $6.95 an hour for that. Insane in hindsight.
Pour one out for my mom, now long passed away: she encouraged my computer monkey business and let me build skills for a viable career, even though it cost her an arm and a leg. I like to think she knew, but in reality I suspect she simply wanted to make me happy.

2025-07-24 04:05:14 UTC

- reply

This was super interesting, thank you for sharing!
At one point in the dim past I wrote an xmodem implementation for the 8-bit atari so I could download at 300 paud from compuserve, and I remember seeing "antileech" mentioned on various BBSs later - but never realized they were referring to an actual thing, I thought it was a warning to share.
In hindsight the exploit seems obvious, but it would never have occurred to me to not follow the protocol at the time. I was... innocent.

2025-06-19 21:51:17 UTC

- reply

Obligatory comic:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/712/230/829/946/537/original/8ccdfb2ef7d0a96b.jpeg

2025-06-14 16:30:29 UTC

- reply

So your dog has run after potentially dangerous wild animals twice?
For her own safety - she needs a leash until you can train her to reliably heel in an exciting situation, and you're willing to bet her life on that training. The coyote wasn't super dangerous - but the bear very much was.
I'm sorry - I hate telling anyone what to do with their pet, but this isn't for your sake, it's for hers.

2025-06-03 16:41:06 UTC

- reply

It's less about more and more about multiple buckets.
I mean - you could put all of your files in one directory, but you don't because there's utility in separating them into groups. Even on a single-user computer, root is a different account, because it does different things.
And - you could do all your social media in one account, but that means creeps who saw your youtube videos and decided you are now their special friend crop up everywhere. Eww.
Think of it as blast containment. Or an exercise in secops.

2025-06-03 16:27:51 UTC

- reply

May I suggest taking a page from my security-adjacent friends and make a brand new identity for your personal use of social media, as opposed to the account you use for things like video announcements and surveys?
You can then continue to post things for followers on your @vkc@vkc@linuxmom.net account as you do now - but use the pseudonym to be "social". Kind of the hat-and-sunglasses-to-avoid-the-paparazzi, but online, when you need to. Something very generic and non-identifying.
Some people call this a sock puppet - but it depends on how you use it. Just don't cross the streams and I see no harm. (If you mix them you run the risk of someone pairing the two up and you're back at square one)
Because hell is other people, and being popular attracts creeps, and the best solution I've seen so far is not to play their game.

2025-05-30 18:07:34 UTC

- reply

It seems to me that a standard that isn't communicated to the public in some open manner - isn't a standard. At least not one anyone sane should expect to be followed.

2025-05-04 03:03:08 UTC

- reply

No joy same error - I was asking about version because my llm is 0.24.2 - but the mlx-lm error messages include:
The conflict is caused by:
mlx-lm 0.24.0 depends on mlx>=0.25.0
mlx-lm 0.23.2 depends on mlx>=0.25.0
mlx-lm 0.23.1 depends on mlx>=0.25.0
mlx-lm 0.23.0 depends on mlx>=0.25.0
mlx-lm 0.22.5 depends on mlx>=0.24.2
mlx-lm 0.22.4 depends on mlx>=0.24.2
mlx-lm 0.22.3 depends on mlx>=0.24.1
... and many more.
Not that mlx and llm versions should be the same, but it was suggestive.
Amusingly, on ubuntu it fails *differently* so that's fun.
I'm seeing if I can get it going via ollama... If you have a sudden :haikuidea: I'm all ears, but this is very not important, I'm just messing around.

2025-05-04 02:24:50 UTC

- reply

Are you using a newer or unreleased llm or llm-mlx?
I'm getting "ValueError: Model type qwen3 not supported." using a uv-installed llm, and I am simply guessing it's out-of date - I hope. 0.24.2.

2025-05-03 21:19:55 UTC

- reply

Just go to your federated feed. If your server is fairly tolerant - boom. There they are.
The general rule of mastodon is to open an account on a server that has content you like.
Try browsing here: https://mastodonservers.net/servers/nsfw

2025-05-02 23:34:09 UTC

- reply

You aren't looking on the right servers.

2025-05-01 15:47:04 UTC

- reply

Heh - you're my point.
I tell most of my friends and colleagues - you're a good tech but a bad example. You aren't normal. You have skills and vocabulary 98% of the "normal" folks don't. That's great - but it means you can't - or shouldn't - extrapolate what normal folks can or should do from your own experience.
Which is why I'm asking - do we have real examples of a truck driver or nurse or concrete guy using a llm for vibe coding and getting any useful code out of it? I'd suggest "write a program" isn't even something they'd mostly be aware is an option, much less a viable solution for anything.
I think we might really be seeing here enthusiasm for a new paradigm and making the mistake that because we think it's pretty cool - normal folks will. But - we're bad examples to extrapolate from.

2025-05-01 15:16:06 UTC

- reply

I'm hard pressed to think of a trivial app (like "sort my shopping list") that isn't better solved by either a regular app like a spreadsheet, or frankly by simply asking the LLM to do it directly.

2025-05-01 15:06:06 UTC

- reply

Can anyone show an example of an intelligent non-coder - a lawyer or doctor or accountant or such - actually using vibe coding to make anything non-trivial?
I can absolutely see utility in an AI helping an experienced programmer with boilerplate and revisions and a lot of the busywork of coding. The leap I'm not seeing is any real utility for non-coders. For the most part, they seem to lack the vocabulary to communicate with the LLM about coding tasks. But maybe I'm wrong.
I suspect this is more projection - if I can vibe code and get something useful out of it, anyone can! But I'm ignoring I spent literally decades immersed in the art and practice of writing code - I know the languages and libraries and capabilities, and most importantly perhaps the vocabulary. And your average joe plumber is fine and smart and technical, but this isn't their wheelhouse.

2025-04-24 17:01:23 UTC

Hello mastodon. I could use some help.
TL;DR: I was laid off a while ago, and the traditional "go scour job sites and apply" is currently broken. So - let's try social media. Please boost if you are willing, or pass this along if you know someone who needs what I can offer.
I'll be brief: I'm a very experienced System Reliability Engineer, with a track record of dependability and scalability. I take people's problems - stability, uptime, scale, cost, durability, speed, security and attack resistance - and fix them. I have the dubious honor of generally costing less to employ than I save my employer. If everything is perfect - you don't need me. But if you do, you may need me badly.
I'm available. Drop me a note.
I am located in Ventura, California, and strongly prefer remote work. I don't require visas or special accommodation to work in the US.
Here's a resume: https://www.bortels.us/TBortels_Resume_2025_public.pdf

2025-04-23 17:38:45 UTC

- reply

Huh. This is great advice.
My normal weather feed comes from the Ronald Regan Presidential Library - which is on top of a big hill and consistently cooler and windier than where I live
But my closest wunderground is a house two streets over. Thank you for sharing random weather hobbyist!

2025-04-12 19:17:06 UTC

- reply

KMET in Los Angeles in the 90's played this every Friday at 5pm like clockwork.

2025-04-11 14:45:43 UTC

- reply

This is delightful.
Anyone seeing this - go check out the gist. It is wonderfully opinionated and speaks to my soul.

2025-03-17 03:47:24 UTC

- reply

Nothing on the internet should be thought of as private unless you yourself took steps to explicitly make it so - and even then I'd be careful, metadata is logged everywhere.
The way I heard it described best is to think of the internet as about as private as a public bulletin board at your supermarket or library. Even if you don't sign your notes, some people can see you put it up and who reads it.

2025-03-16 15:43:08 UTC

- reply

I spent close to a year beta-testing DVX after-hours when I worked for Quarterdeck. It was lovely - dinner plus overtime to mess with computers, which was what I was going to do anyway!

2025-02-24 04:46:26 UTC

- reply

That's fantastically random and I love it.

2025-02-15 04:02:28 UTC

- reply

My money is on bot. Not a very good one.
It uses "you" in some places and "U" in others. Real people tend to be consistent, at least in the short term. It's like it's pulling phrases out if a big collection of stock ones designed to string you along and waste your time.

2025-02-09 17:50:42 UTC

- reply

Not just them! Honestly, being on a social network exposes you to all sorts of attacks and scams. Plenty of folks in my generation grew up on newspapers ("mostly trustworthy") and so tend to believe what they see in print or on the web, including bullshit. A bit of chat and suddenly they're looking at timeshares...

2025-02-09 17:36:45 UTC

- reply

It's just good op-sec, especially important nowadays.
And yes, I'm using my real name here. Probably a mistake, but I'm old now so I care less and less about someone upset at me on the internet as time goes by.

2025-02-06 19:08:05 UTC

- reply

https://www.agingcare.com/articles/things-people-with-dementia-say-155103.htm

2025-02-02 00:12:24 UTC

- reply

100% this.
A LLM will answer a question. Sometimes even correctly! But it won't tell you "there's a better way to accomplish your goal" or talk incidentally about related subjects that give you an epiphany about the whole thing. Serendipity is an important thing.

2024-12-18 17:17:39 UTC

- reply

So much silliness because someone was too cheap to spend $50 on a proper fido2 hardware key. (I like the yubi, but there are other options)
Word to the wise: your cellular phone is a horrible MFA factor. Just horrible. If someone wants you to use your cell for MFA - add a heaping helping of mistrust there, because it means they don't listen to (or maybe have) security folks.

2024-12-11 17:50:35 UTC

- reply

This is why my "new car" plan is an older VW bus and an EV conversion package.
If someone sells a non-connected "dumb car" - I might reconsider. There's certainly a market.

2024-12-03 07:29:06 UTC

- reply

I made a feed to see first hand if the app and carefully chosen follows would give me a tolerable feed. So yes, I'm there, but have yet to post, and don't intend to unless there's some good reason.
Oh, the results: well, it's better than twitter... but really, not that much better. The sudden influx of recent refugees have brought with them their adversarial posting and "I'm going to re-post this bullshit so I can rebut it" habits, resulting in a feed that's honestly just unfriendly. A side effect of no easy quote-tweeting on mastodon has been a significant lack of jerk reposts, and I'm kind of used to it now. I can go days and days here without seeing anything from certain individuals, and it's a pleasant change from EVERYWHERE ELSE.

2024-11-20 18:47:06 UTC

- reply

I'm an optimist, in that while you're right that they'll always try, I think we might be able to work out mechanisms where it just isn't worth the effort. Bullies always seek weak targets, and if they get muted/blocked will move on.
We have a weak form of that in mastodon - if a troll causes problems, they can get the entire server blocked, and so server ops are encouraged to ban them locally to preserve their server's rep. And - it seems to help? If we could find a way to tie reputation to users and have it affect their visibility...

2024-11-20 18:37:02 UTC

- reply

See, that's it.
A few weeks back, I was hearing about how great bsky was because you didn't need blocklists. Now - you do. And the reason is the twitter bullies and trolls are following their prey.
I don't blame bluesky for any sort of failure. When you put everyone in one bucket, you include the assholes. It seems in social media too much popularity attracts the trolls. Reactive moderation only goes so far.

2024-11-12 19:14:25 UTC

- reply

"Read the source" has always been elitist gatekeeping.
Hell - I don't even grok my own undocumented source sometimes. Other people's may as well be greek.

2024-11-08 21:35:56 UTC

- reply

It's a crutch that keeps you from learning and internalizing the bits you need to know going forward. I can (and do) see it used by experienced coders to speed up process - but I also see (and do) something similar with a rubber duck.
To quote the ancients: there ain't no such thing as a free lunch.

2024-11-02 15:05:34 UTC

- reply

I got 99 problems, but shitty google custodianship of chrome extensions isn't one of them.

2024-10-22 04:15:12 UTC

- reply

Ubuntu server LTS running on a refurb corporate desktop, ebay SAS controller card, ZFS. As boring and unspecial as possible. SMB file sharing, but I tend to use ssh and rsync for most actual transfers.
It's one of (counting) 6 computers on/under my desk. I have a small problem.