Eleanor Saitta

Thinking about security, failure, change, art, and living. Recruiting barbarians; complicate your narratives. Fractional CISO to startups via Systems Structure Ltd. HEL/NYC/LON

Work Me: https://structures.systems/our-team
Personal Me: https://dymaxion.org

Public Key

npub15zykay2ktrxph2lpf7y0eqpahhj9s5lp7pyjxfu9y006x62pjmcqnu6py0

NIP-05 Address

dymaxion_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs2pztwj9t93nqm40s5lz8usq7mmezc20slqjfry7zj8hard9qeduqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds4kj838

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub15zykay2ktrxph2lpf7y0eqpahhj9s5lp7pyjxfu9y006x62pjmcqnu6py0

Show more details

Last Notes

2026-04-06 09:17:05 UTC

- reply

One of the things I've learned over the past eight years of fractional CSO work is that the judgment call work is useless or impossible without enough time maintaining your working context of the system. The judgement time doesn't provide nearly enough context to perform well without supplemental time, and that knowledge goes stale surprisingly quickly. The real product of a software team is a group of people who understand the system deeply.

2026-03-17 09:40:43 UTC

- reply

None

2026-03-15 08:14:06 UTC

I'm looking for places where a capability system is exposed to users (not developers) in an understandable, well-designed way in non-experimental systems. Anyone have suggestions?

2026-03-14 18:52:24 UTC

So a bunch of anti-trans hate groups sent a citizen's petition to the FDA demanding regulatory action around "cross-sex" use of estrogen. Although the language is somewhere heated and while we have no indications as to the FDA's intent with respect to this petition, I have no reason not to believe the authors of this article when they describe its potential impact if adopted: https://theneedlenews.com/anti-trans-hate-groups-petitioning-fda-for-registry-of-trans-women-crackdown-on-transition-newly-revealed-document-shows/
The short version: the creation of a registry of all trans women in the US, a federal regulatory requirement for a significant set of gatekeeping steps before estrogen can be prescribed, and authorization to seize any estrogen used without that process having been followed.
The original document can be read here: https://www.regulations.gov/document/FDA-2025-P-7321-0001
They apparently did not see the need to go after trans men here.

2026-02-27 08:43:40 UTC

- reply

@npub1l0q…7r2w Floating point math is lossy and thus non-associative. Modern GPUs have complex optimizers running and will change the order in which they do e.g. matrix multiplication depending on the layout of data, what else is happening on the GPU, etc. When you iterate repeatedly, results diverge.

2026-02-26 21:31:00 UTC

Today I've been told that C is memory safe if you're just very neat, that code is documentation, and that expecting protocol specs is a form of bias?
I didn't realize it was 90s week; I'll go get a flannel.

2026-02-26 11:16:48 UTC

Many, many years ago, at school for CS and before that interning at NASA Ames, I learned to take programming seriously as engineering work, and also the level of rigor that engineering work requires. In the intervening thirty years, I have had to come to terms with the degree to which this attitude is rare in theory and vanishingly rare in practice again and again. Tooling has gotten better, but the rigor applied to the average line of code has gotten worse.
I would hope that safety-critical systems would be different, and in some cases they really are. However, the number of people who want to build secure communications systems that they want to be safety critical and who expect thousands of people to literally use in a case where a breach of the threat model means the users will die and who as developers cannot bother to meet the basic design rigor requirement of 2006 — have a fucking threat model that is accurate and up to date — will never cease to shock me.

2026-02-26 00:40:31 UTC

Probably mostly not my audience here, but I'm currently looking for a business-side/CEO cofounder for an encrypted radio startup. There are solid funding options, but while I can build the team to make the product happen, I'm not the person to navigate the money side of things. I'm looking for a cofounder with previous startup CEO experience and executive-level experience (although not necessarily CEO) in a hardware startup specifically. EU citizen and resident, although it'll be a remote team, so where is less important.

2026-02-25 23:54:53 UTC

RE: https://infosec.exchange/@briankrebs/116133059957749811
If This Then That wasn't iffy enough
#note19p9…4lmh

2026-02-24 08:15:31 UTC

- reply

They are definitely underselling the space escalation line, given that it goes up to "intentional permanent orbital denial via Kessler"

2026-02-19 16:18:08 UTC

As if the rise of AI bug bounty spam wasn't enough, we also have well-intentioned, sensible people falling onto AI derangement and building castles in the air of imagined vulnerabilities.

2026-02-09 10:29:53 UTC

At a certain point, one must look at well-funded mainstream 'activist' organizations that have a lot of reach and never support anything so radical that it might actually cause a meaningful change in the causes they claim to support and wonder why.

2026-02-01 11:35:34 UTC

- reply

I know wood baton rounds are a thing (used similar to beanbag rounds), but I don't think they look like that. Might be the backer for a foam round the with foam missing?

2026-01-30 21:56:51 UTC

Huh. So Ronald Lauder, the billionaire who owns Estee Lauder, is apparently the guy who convinced Trump that he should destroy NATO by invading Greenland.
Maybe don't buy shit from them? Here's a convenient list of their brands: https://www.elcompanies.com/en/our-brands
And sources:
https://en.wikipedia.org/wiki/Ronald_Lauder
http://web.archive.org/web/20251107131250/https://www.nytimes.com/2022/09/14/us/politics/trump-greenland.html
https://www.theguardian.com/us-news/2026/jan/15/ronald-lauder-billionaire-donor-donald-trump-ukraine-greenland

2026-01-27 22:57:27 UTC

Investigative journalism funded via litigation driven by their research and a hedge fund is a new business model to me: https://hntrbrk.com/ubiquiti/

2026-01-27 10:28:31 UTC

RE: https://mastodon.social/@sbrunthaler/115928978574847952
The funny thing about this piece is that it strongly places exploits in the category of spam messages — they don't have to be correct, robust, or legible, they just have to generate the desired result enough of the time. Given that, I'll say that I do actually see a serious use for AI code generation in the development process for the first time: as a fuzzing tool to run against human-written code that does need to be correct, robust, and legible.
Amusingly, I predict that this use case is, in a decade or two if these tools are still used, significantly slow progress in the art of exploitation. You don't get brilliant exploit writers without a large pool of folks spending years honing their craft, not at the highest tiers but at the lowest. Sure, we have a bunch of folks already at the top of the field who will keep working for another twenty years, but no one will be coming up after them. Eventually, stagnation and likely with it, a resurgence in poorly thought out mitigations just complex enough that the reasoning work required to create novel exploitation techniques will be forever out of reach of LLM-category models.
That said, there's a useful lesson and incentive structure shift for development teams here too, coming from the new assumption that all exploitable vulnerabilities will have readily available exploits, regardless of whether or not creating them would otherwise be economically viable. That should, hopefully, push teams toward development styles that prioritize affordable guarantees of functional correctness — memory- and type-safety, use of parser and state machine generators and type-based functional correctness checks, and strong test suites.
Sadly, the appeal of much lower-effort generated code of unknowable correctness will likely steer most development teams in the opposite direction; hopefully strict liability regulations for commercial software can correct this pressure.
#note12hf…l2n7

2026-01-25 19:34:44 UTC

- reply

@npub1ucv…5a8g The funny thing is that this is like my personal minimum bar for feeling comfortable saying to a person "hey, I know some first aid, I'm going to try to help you ok?" — especially if it's something serious. I didn't think this was a high bar.
What I'd like to see, personally/for groups I work with, is a semi-wilderness version of the UK 3-day, i.e. operating on the assumption that help is at least four hours away. That, taught to the depth (in terms of procedure complexity) of the US DoD Combat Lifesaver course, plus a bit more detail around mental health, mass casualty triage, and scene and information management, feels like it would be a solid bar if one was expecting to need these skills in a context where one night be prevented from receiving medical care.
In practice, the 3-day can usually be two days of primary training if your class is at all smart, and I'm guessing you could fit this curriculum into three weekends with plenty of time for drills and refreshers. Sadly, nothing like that here as a standard thing either.

2026-01-25 11:33:38 UTC

Americans, if you have not done first aid training in the last five years, I strongly recommend getting a refresher now, and starting to carry a trauma kit with you when you leave the house.
It looks like most of the US Red Cross first aid courses are very superficial, so you'll have to go digging for local resources. The syllabus I recommend is the one offered by the UK and most EU Red Cross groups, including their optimal mental health response unit, and ideally something on using Narcan and Epi pens. You can find it here: https://www.redcrossfirstaidtraining.co.uk/courses/first-aid-training/first-aid-at-work/
If you're piecing together a course from other offerings, you definitely want to make sure that you're doing CPR basics, massive hemorrhage/bleed stop, and shock/stroke at least. If you can find a trainer who can also add to the UK curriculum a treatment protocol for tear gas and pepper spray, that's great. You're going to receive a ton of information in these courses, so please take good notes (and hopefully you'll get the training slides to take home). Make up your own cheat sheets for the core diagnostic procedures — ADCDE/MARCH, AVPU etc. and keep them in your kit. Better yet, also go with some friends — it's always more fun that way and you'll retain more when you're comfortable and having fun — and then spend an evening every month or so going through some basic drills to keep each other fresh.

2026-01-20 21:05:17 UTC

RE: https://mstdn.social/@rysiek/115928819688964301
Given the creative circular accounting practices we see around AI companies, slopholder does sound like the correct term for anyone in the unfortunate position of having spent hard currency on these stocks.
#note1xvn…cal9

2026-01-15 16:47:58 UTC

Anyone know if there's a proof-validsted parser combinator for Rust, a la Hammer? Bonus points if it can work in a no_std context.

2026-01-09 00:31:37 UTC

- reply

While it's primarily aimed at journalists, this guide for dealing with secondary trauma from media exposure, which is to say a lot of us right now: https://theselfinvestigation.com/fact-checkers-toolkit/vicarious-trauma-moral-injury/

2026-01-08 13:33:26 UTC

Some decade, we will collectively learn that watching traumatic video doesn't teach people things about the world or effectively inspire them to work to change it, and in fact is likely to leave them less capable of action.
Not this year, though, apparently.

2026-01-03 18:40:12 UTC

The first protest I ever went to was against American overseas military adventures driven by oil money. That was in middle school in 1992, three years before the first UN Climate Change Conference of Parties (COP1 in Berlin in 1995). 33 years later, nothing has changed.

2025-12-26 16:48:48 UTC

The documentation for this image processing library is one of the most interesting things I've read in weeks:
https://github.com/celoyd/potato/blob/main/docs/personal.md
https://github.com/celoyd/potato/blob/main/README.md
https://github.com/celoyd/potato/blob/main/docs/concepts.md
Philosophical discussion of the nature of seeing and what am image is vs a map, fascinating technical details about how satellite imaging works and why it looks as bad as it often does, a lot of really thoughtful conversation about engineering and aesthetic process, and even an amusing unit of measurement — grams per terrapixel.

2025-12-24 11:45:23 UTC

RE: https://mas.to/@kissane/115771219606234540
This piece is a great exploration of a corner of how we collectively know things, told via the metaphor of the 1964 Valdez earthquake. More specifically it's about the process of figuring how to think about the way that our way of knowing things is changing and why.
#note1h8s…ej4d

2025-12-17 09:02:23 UTC

RE: https://mastodon.social/@zackwhittaker/115731387253612546
Now do you get why you want an ad blocker?
#note1jkz…cfrv

2025-12-13 21:41:15 UTC

- reply

I don't know how people live like this

2025-12-07 20:34:18 UTC

Still really genuinely angry at how much the passkey rollout has fucked up the flows for anyone using a security key.
Fuck forcing people to set pins on hardware tokens. Fuck defaulting to allowing a hardware token to log in without the password. Fuck making every mobile device you own a first class token and making login attempt spam a thing again.
I get that passwords are broken. I don't have a problem with the idea behind passkeys as such for less-technical users (although fuck vendor lock-in and non-portable credentials), but do not fuck over technical users trying to protect critical systems by breaking their workflows or destroying basic security primitives.

2025-11-27 14:28:48 UTC

Companies, don't try to stiff your consultants for work they've already done. It's a terrible look and it's likely to cost you more than you think you're going to save. Also usually illegal and always immoral, should shame be a feeling you experience.
Consultants, I strongly recommend having language requiring changes to the contract to be put in writing to your non-client email address, having at least a 10% late fee for delayed payments (with no exception in cases where the customer disputes the bill but not the work), and being very particular about how contracts may be terminated, especially if you work on long, open-ended engagements.

2025-11-24 10:18:25 UTC

I've been instituting exactly this kind of cooldown/delay on dependency updates at all of my clients for four or so years and I'm glad to see more people talking about it: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

2025-11-06 12:25:05 UTC

I'll take a break from the politics now for a brief word from our sponsors:
If you're a startup beginning your security journey and you're interested in help building a security program — not just from a technical security architecture perspective but also in terms of structure, hiring, and governance, I've got some availability right now. Over the past eight years, I've helped fourteen companies start their security journeys or validate their strategy, and I'm looking forward to a few more.
"I've always really enjoyed our discussions - focused and properly able to get into the details, but always pragmatic and able to keep it light, which not all leaders manage very well."
"Because of your work and the confidence it gave our investors, we were able to add another $150 million to our existing $300 million funding round."

2025-10-22 10:21:57 UTC

Hilarious side effect of the OpenAI pivot to porn plus the Swedish ban on online pornography purchases: Paying for ChatGPT in Sweden may be a criminal act soon.

2025-10-16 17:46:04 UTC

- reply

So, I've had some time to start digging into this properly. Unfortunately, this has been going on longer than I realized — after a couple of abortive attempts in 2020 and 2021, this stuff started getting rammed through as soon as the new government took office, and some ugly things have already passed. Stuff is weird, too — six week long public comment periods on incredibly dense legislation timed over summer vacation when literally the entire country is on holiday and long and dense pro-surveillance comments from a men's sexual health association?
The weirdest part to me, though, is the fact that almost no news organization considered completely upending the landscape of citizen privacy and police authority newsworthy — a few pieces in Hessari, but that's it. Combined with outlawing political strikes by unions — brought in by the same government at the same time — this is a massive authoritarian power grab.

2025-10-15 07:23:52 UTC

- reply

More details tk, but here are the links to the legislative proposals:
https://intermin.fi/hankkeet/hankesivu?tunnus=SM047:00/2023
https://intermin.fi/hankkeet/hankesivu?tunnus=SM048:00/2023#lainvalmistelu
https://intermin.fi/hankkeet/hankesivu?tunnus=SM046:00/2023#lainvalmistelu
https://intermin.fi/hankkeet/hankesivu?tunnus=SM040:00/2024#lainvalmistelu
https://intermin.fi/hankkeet/hankesivu?tunnus=SM023:00/2025#lainvalmistelu
https://intermin.fi/hankkeet/hankesivu?tunnus=SM061:00/2023
https://oikeusministerio.fi/hanke?tunnus=OM067:00/2024
These clowns must be stopped while there's still a Finnish civil society

2025-10-15 07:23:35 UTC

- reply

The official explanation for these changes is something something Russian hybrid warfare (a military intelligence issue that they already have tools to handle) and some unhinged waffle they've been trying to feed the press about gang violence — and remember, this is happening at the same time as they've thoroughly destroyed almost everything that remained of the Finnish social welfare system, which shockingly means there are a lot more desperate folks around, and even still they have to make nonsense up about crime.

2025-10-15 07:23:16 UTC

- reply

Finland, for historical reasons, is a country where most (white) people (with Finnish passports) trust the police, despite most of the police belonging to the fascist party. There is no organized digital rights work happening in this country (Effi technically exists and is for all purposes completely useless; if you're reading this and from Effi, prove me wrong). While Finland has historically had a strong reputation for freedom of the press, but this is only because the press have never wanted to publish anything the state doesn't like. When they do (a few years ago with a piece about a military research center), the police just show up without warrants, steal hard drives, and charge all the individual journalists with treason, despite none of them being e.g. party to an official secrets act.

2025-10-15 07:22:55 UTC

So last night I just found out that the far right Finnish government is planning on gutting limits to police use of malware, wiretaps, undercover infiltration, and police/military intelligence data sharing, and eliminating some or all of the constitutional protections around personal communication and the safety of the home and allowing tools now only used in the context of treason and terrorism investigations to be used much more widely. This will include investigations where not only has no crime happened yet, but no crime is expected to happen in the future.

2025-10-07 14:25:22 UTC

- reply

This is a solid summary: https://harris-sliwoski.com/chinalawblog/faq-what-foreign-companies-need-to-know-about-chinas-2025-anti-unfair-competition-law-aucl/

2025-10-07 13:04:18 UTC

Delighted to see China getting ahead of the game and banning scraping that circumvents technical restrictions and some kinds of deceptive advertising and monopolistic platform practices. Them claiming global enforcement scope (enforced by among other things market access bans) is also an interesting move; curious to see how it plays out in practice.

2025-08-19 14:12:02 UTC

A client of mine in the UK is looking for an experience contract IT support engineer. Initially, they'll be handling a few specific projects — Google Workspace hardening, macOS hardening via Kandji, a Yubikey rollout, deployment of MDM for mobile devices, etc. There will be some additional ongoing business as usual IT support on the side and also continuing after the initial project work is done. Company is in London, can be mostly remote though. DM if you're interested and feel free to pass it on to folks who you know are qualified. #getfedihired

2025-08-12 12:14:02 UTC

If you've worked with SDRs professionally, either at the hardware level or at the e.g. RF protocol implementation levels, I'd love to buy an hour of your time for a validation conversation about a potential project. DM if you're interested; boosts welcome.

2025-07-13 09:01:08 UTC

- reply

At some point, I went to a pretty interesting seeming security and usability academic conference, breaking my general rule of not bothering with that sort of thing. Basically all the work presented was useless because folks had only studied the work, not done it, and no one in the room had context to call bullshit. Not to mention, of course the general sort of academic ritual of ignoring bad work instead of calling it out, which only helps if you already know what's bad.

2025-07-13 07:13:56 UTC

New worst idea ever for geo engineering just dropped. We're speed running the 50s now:
https://arxiv.org/abs/2501.06623

2025-07-03 18:37:36 UTC

One of the most reliable things I learned, early on in my years of watching politics and working with organizations, is that when someone tells you that they believe, what they want to do, or who they are, it saves a ton of time if you just believe them and assume they're completely serious until proven otherwise.

2025-07-03 12:25:00 UTC

As far as I can tell, there is effectively no such thing as an activist lawyer in Finland. This is a bit of a shock and a real disappointment, but then again, I guess pretty unsurprising given the state of politics and protest in the country. Happy to be proven wrong, of course.

2025-07-01 09:55:00 UTC

When this case first came out, I was talking to a relatively senior Finnish journalist about freedom of the press in Finland. We came to the conclusion that Finland's then best in the world ranking on press freedom was entirely down to the fact that the press had never wanted anything that the government wasn't ok with having in the papers. This decision is broadly incompatible with freedom of expression. Prosecuting folks who agreed to keep state secrets is one thing. Accusing journalists of treason, let alone convicting them, for publishing material that in their professional opinion was newsworthy is completely unacceptable. The Finnish national security bureaucracy does and must not be above the constraints of international human rights law, and must not be permitted to either constrain a priori or decide post hoc what is in the national interests. I assume this will be appealed and that the Finnish Supreme Court (or, failing them, the European Court of Human Rights) does the right thing. This case has already caused a significant chilling effect on Finnish journalism — already not in a great position — and this is happening at a time when Finland's national security position and responsibilities are changing rapidly. We need transparency and accountability in the national security bureaucracy now more than ever.
https://yle.fi/a/74-20170451

2025-06-29 01:42:21 UTC

- reply

I should add, your honor, that when I say "tried to kill me", I mean pulled out from behind a taxi-van that was stopped talking to one of our march stewards and intentionally accelerated towards me until what felt like at least the speed limit if not more, while I was standing directly in the path of the vehicle wearing a neon vest and carrying a large "road closed" sign in such a manner that I had to move out of the way, passing close enough to me that if I had moved the ~500mm long sign in my hand to project away from my body, without extending my arm, it would have intersected with and likely removed the passenger side mirror of the car. He then proceeded to drive at and similarly scatter both our second and third steward teams, thankfully both without incident and without intersecting the body of the march. If he had intersected the march, regardless of whether or not people attempted to move, it is very likely there would have been deaths. As it was, only a little adrenaline. I should also note, your honor, that he chose to do this while both his (presumptive) wife and young child were in the car. And when I identify this car, I mean that I have a clear photograph of the license plate in context and that the police have seen the photo and been informed of what happened, and that we have at least five specific known witnesses.

2025-06-28 17:49:40 UTC

- reply

Oh, and by the way, you missed your safety inspection and that car isn't legal to be driving in the first place.

2025-06-28 17:42:55 UTC

- reply

One of the funny things about Finland is that by default, registration details for vehicles are public. So, Turo Jaakko Levänen and your beige Mercedes S-class, license plate EPC-493, nice to meet you!

2025-06-28 17:32:02 UTC

It's pride this week in Helsinki, and despite all of these fuckers who want us in the ground, we are in fact still fucking here and still fucking queer.
This week I ran a play party (oh, you think kink shouldn't be at pride? Fuck you, cop, we're gonna do more of it), the Pride edition for our drag and variety show (the last show of year seven!), and the safety team for the second ever Helsinki Dyke March. In that march, someone tried to kill me with a car, but you fucking missed, asshole. We're still fucking here, and we're still fucking queer.

2025-06-19 07:19:55 UTC

- reply

Where is this in settings? I've spent about 20 minutes looking through all the settings menus a half dozen times. Autofetch missing messages and autoload remote media are both off.

2025-06-18 17:15:29 UTC

@npub14kx…urew
The per-message dotted menu is no longer present in thread view, so I can't e.g. edit replies without re-finding them in my account view.

2025-05-23 23:53:58 UTC

- reply

I can't imagine a model fed all the fanfic in the world would possibly match a trope like that as being salient in a scenario blatantly constructed to evoke such a response. My god, the matrix multiplication must be self-aware and emotionally intelligent.

2025-05-19 07:00:13 UTC

- reply

Many of those forms are failing to keep up with main or to release fixes in a timely manner. Some of them are keeping alive old code no longer in the main browser and thus not maintained.
And if you don't want to use Firefox, well, back to Chrome it is.

2025-05-18 21:41:39 UTC

- reply

(and sure, yes, experiments are great! Projects that might eventually turn into something cool are great! Just, you know, don't actually rely on them to keep you safe, or to keep the machine you run them on safe, especially if you're in a context where there are actual threats and risks.

2025-05-18 21:37:55 UTC

When I say that I can't recommend third-party forks of either Firefox or Chrome for real world use, this kind of thing is why. *This* is the bar for what the security team for a browser needs to be able to do. A fork where the entire technical team is ten people that can't even keep up with upstream patches is sadly not in the running.
https://blog.mozilla.org/security/2025/05/17/firefox-security-response-to-pwn2own-2025/

2025-05-16 09:53:16 UTC

- reply

Yeah. If you operate from a starting point that you do not want to create a global search engine, but rather a collection of small, opinionated, topic-specific indexes focused largely on dedicated sites without picking up, e.g. single posts on otherwise-unrelated blogs and using direct or indirect human curation as the primary ingest mechanism, you might well succeed. There are a few domains I care about where I'd be very happy to use such a thing. 95% of my search traffic would never go there, but 5% is better than nothing.
The thing that makes global search useful is that it has a genuine claim to be both global and authoritative. At its best, it lets you, with some work, say "this piece of information is not generally known to exist". That property is irreplaceable and invaluable.
@npub1axd…s6u4 @npub105n…85x4 @npub1lhc…h9l6

2025-05-16 09:29:37 UTC

- reply

If your have topic recognizers for queries and for crawlers and they are a) always right, and b) never change, you could shard the index below that point. Crawlers could still be distributed and indexes wouldn't need to reference/communicate, but every crawler would need to update every index index shard. However, A is improbable and B is impossible.
You might be able to hack something together that could somehow meaningfully federate, but the level of computational inefficiency would be staggering. If we don't have a nonprofit that could run a single centralized web scale search engine, we definitely don't have ten thousand nonprofits that could together spend two orders of magnitude more to run a federated one.
@npub1lhc…h9l6 @npub105n…85x4

2025-05-16 07:57:29 UTC

- reply

Not to discourage folks from creating specific little bespoke indexes like that, but the beauty and utility of search has always been its global nature, which does not decentralize, unfortunately.
@npub1lhc…h9l6 @npub105n…85x4

2025-05-15 18:52:36 UTC

Does anyone know if Apple changed how iOS stores notification content after iOS 16?

2025-05-14 07:27:09 UTC

- reply

Do you know how security works at scale? This isn't news and among the majors, MS was mostly late to the party. That said, "spies" is doing a lot of work here. If you mean "collaborates specifically around threat intelligence", sure. If you mean "provides the US with general purpose intelligence outside the digital security space above and beyond the cooperation that the US can compel with statutory powers", no, we have no reason to believe that.
Also, with CISA dead, it's unclear that anyone on the USG side is still listening.

2025-04-18 09:11:10 UTC

Man, internet purity politics sure are bad at helping people build broad collations.

2025-04-16 15:15:07 UTC

- reply

One of my favorite old ones. Also now apparently American governance strategy.

2025-04-09 20:25:49 UTC

Does anyone have the actual list of retaliatory tariffs the EU passed today? Like, in full detail?

2025-04-07 11:06:23 UTC

It would be nice if signal would let users import and export lists of users, complete with nicknames and verified keys.
It would also be nice if, like on mastodon, we could leave notes about users to remember the context for them.
It would be even nicer if the notes could include some kind of structured data — hashtags would be fine — and the group system would let you set a hashtag filter that would soft-stop you from adding people without the hashtag to that group. Bonus points for integrating the chat folder system with hashtags as well.
This would go a long way toward helping the system scale for organizations.

2025-03-27 18:17:53 UTC

It would be really nice to have ad hoc group calls in signal, even if it's just syntactic sugar for creating a temp group and then auto deleting it.

2025-03-20 22:19:52 UTC

It's really nice that signal has "mute all" for chat folders. It would be nice if they also had "unmute all".

2025-03-14 12:04:35 UTC

- reply

This guy appears to be the sole original source; one can only assume a misinformation operation, at this point: https://www.linkedin.com/posts/serhii-demediuk-a383521aa_signal-activity-7303700457040809984-5dWZ

2025-03-14 11:29:23 UTC

- reply

(I didn't tag her because I assumed that if there could be an official comment from the org there already would be)
[@Mer__edith](https://mastodon.world/@Mer__edith )

2025-03-14 09:52:24 UTC

Anyone have any meaningful additional detail on this? It's widely enough reported that it seems to be real, but it does not make any particular sense and the implications are profound.
https://therecord.media/signal-no-longer-cooperating-with-ukraine

2025-03-12 07:20:08 UTC

By extension, this means that we also have a name for folks who work on design and development in these spaces: kleptographers!
https://antarian.social/@nsgeek/114139645751032693

2025-03-10 18:44:01 UTC

- reply

(and I guess, like, look, if you're gonna have large-scale use of torture, which solitary confinement is, things that reduce the direct harm done to victims are not in and of themselves bad. But also Jesus fuck and could we just not?)

2025-03-10 13:51:09 UTC

"We're happy to announce version 1.0 of the Torment Nexus, as popularized by the science fiction book 'Don't Invent the Torment Nexus'! Our innovative product breaks new ground in..."
https://www.theguardian.com/technology/2025/mar/08/vr-prison-california

2025-03-04 22:27:42 UTC

- reply

Also, I should say that I really do appreciate cis allies and folks reminding people to think about the trans folks (and immigrants!) who are first in the crosshairs, and yes, social privilege is very much a thing. That said, understand also that we still have agency, and that regardless of whether or not we are scared, a lot of us are also burning with a cold anger. Yes, please jump in front of the bullets aimed at us, but also, keep the hell up with us.
If you live in the US and you're not seriously mobilizing for direct action and resistance, what exactly are you waiting for? An angel from on high?

2025-03-04 20:02:24 UTC

- reply

And to be clear, that's the number from the 2021 census. It's almost certainly an undercount, both given that many folks have come out since then and that many folks will not have felt safe or ready to answer honestly. And even as an undercount, we're talking about the entire population of Houston. A more accurate number is probably somewhere between Chicago and Los Angeles.
Do you seriously fucking think we're going to die quietly? We've read our history. If we go, y'all coming with us.

2025-03-04 19:57:03 UTC

Are you familiar with the phrase "death before detransition"?
I'm just curious if folks understand the stakes for 2.3 million Americans right now.

2025-03-02 15:20:05 UTC

I feel like at this point, any country whose department of state etc does not issue a blanket "Do Not Travel" warning for the US is professionally negligent: https://www.kpbs.org/news/border-immigration/2025/02/28/german-tourist-held-indefinitely-in-san-diego-area-immigrant-detention-facility
Any professional organization, conference, or company expecting third-country nationals to travel to the US is negligent at best. The only ethical way to do this is to provide all travelers with on-call lawyers for their arrival and to post a bond for extraction expenses and physical and mental trauma damages.

2025-02-27 16:14:00 UTC

French Parliament go fuck yourself
https://tuta.com/blog/france-surveillance-nacrotrafic-law

2025-02-26 07:34:35 UTC

- reply

Also very pretty when a bunch of us in different colors decide to dance around together in a room with a little fog in it and occasionally useful for pointing at things

2025-02-20 23:46:21 UTC

So, because I'd previously boosted, I want to mention that the 'moving company' @npub1ets…l9u9 mentioned as providing free moves to trans folks in US red states is not in fact a moving company at all, and definitely not a licensed and insured one. They claim it is an SF Bay Area trans community project, but I haven't seen anything to validate this. I cannot recommend in good faith taking these folks up on this offer without a lot more information.

2025-02-15 14:43:29 UTC

@npub1prs…eh8y
Hey, do you know if there's a solution for Flickr legacy accounts? We had a pretty important and prolific photographer in the larp scene die a couple of months ago. Next of kin have control over the account and are keeping it paid up, but it's not a great longer-term option.

2025-02-15 12:51:17 UTC

The Lemkin Institute for Genocide Prevention and Human Security issued a second red flag alert for trans genocide in the US on Thursday: https://www.lemkininstitute.com/_files/ugd/58db98_c860c149ef554206b65db5569cb43213.pdf

2025-02-13 20:52:24 UTC

- reply

Here you go: https://infosec.exchange/@dymaxion/109928153037765084

2025-02-08 11:27:20 UTC

So, you've (I hope) actually read the Project 2025 document and thus know a big part of the stated policy objectives of this US government, if you're impacted by them. If you have, you're probably also confused as to where the hell the rest of the chaos that's clearly not in that plan came from.
Here's the rest of the owl: https://www.thenerdreich.com/reboot-elon-musk-ceo-dictator-doge/

2025-02-05 00:29:06 UTC

With the "shutdown" of USAID, the State department has ordered an emergency evacuation of all staff from over a hundred countries by Saturday. In their wake they will leave massive chaos. USAID feeds 53 million people a year, among other things. Many, many people are dying because of this, and many countries will never trust the US again.
USAID is a major part of American international soft power. The damage that this is causing can only be described as treasonous, even ignoring the human cost.
To be clear, this evacuation is impossible. Doing it from one country is very hard. Doing it everywhere all at once, even with all available military airlift assets, cannot happen. Regardless, on whatever schedule they do do this, this is not a normal international move. They are telling staff who in some cases have been in country for decades or who expected to be their for the rest of their careers that they have 48 hours to pack suitcases and leave everything else they own behind, to return to a country where they have no where to live and no job.
But then, that's the point.

2025-02-04 14:55:27 UTC

- reply

It only took the Atlantic fifteen days to call a coup a coup. Impressive!

2025-02-04 09:57:38 UTC

I do not understand how the futures people are still futuring right now

2025-02-02 10:26:38 UTC

When Quinn showed this to me before it went up, I thought it was a pretty sensible summary of the position we were obviously in — hopefully, really, looking for the positive things to think about in the longer-term, and well-written, but not actually surprising. Now that it has become somewhat more obvious to folks that the US is more or less finished, it might be a good time to think a little now about what comes after America: https://www.emptywheel.net/2020/11/03/what-comes-after-america/
And yes, we still have to get through this fascist coup and out the other side, and it's likely to be pretty awful. It helps to have something to fight for, though, not just against.

2025-02-02 02:02:17 UTC

I guess it's a nice distraction from everything else being shit to get an Android security update that completely breaks my house audio distribution system in a way that's going to require hardware purchases to fix.
Phones were an even bigger mistake than the web was.

2025-02-01 18:16:26 UTC

So, how long is it going to take any of the (likely non-US) mainstream media to start talking about this as a coup?

2025-01-22 14:15:14 UTC

- reply

So, there seems to be a lot of uncertainty and a lack of clear efficacy around TransRescue right now. I'm looking for alternate orgs to suggest, but there's nothing else in exactly that space.

2025-01-21 17:00:40 UTC

- reply

If you at all can, this is a really great time to donate or otherwise assist with https://transrescue.org/

2025-01-21 10:12:15 UTC

So, cis Americans, you're now living through the first day of a federal genocide against trans people, as defined by the Lemkin Institute for the Prevention of Genocide. As happens almost without exception unless stopped, it is both likely to proceed to mass murder and to expand to include additional social groups, possibly including you.
What are you going to do about this? Are you going to take up arms and fight to prevent your friends and neighbors from being murdered by the state? Are you going to harbor fugitives, get them medical care, and help them leave the country? Are you going to disrupt the function of state offices and destroy records to make their work impossible?
Or are you just going to hunker down and go along with what's asked of you, in hopes they don't get around to killing people like you? Are you, in other words, going to be a good Nazi?
If you think you're going to maybe go on a few big nonviolent protests and be angry on social media, like you did last time, but you know money is tight and you just started a new job and... congrats on failing to understand the situation and choosing to be a good Nazi.
History is unfortunately quite clear here. There are no other options left. Either you literally, physically fight this, or you collaborate.
If you think this is extreme, well, you've made your choice. See you in hell.

2025-01-15 11:40:04 UTC

- reply

Honestly, this is the first I've heard of it, and hopefully the last. If it's even dumber in other ways too.... Yeah. Lolsigh.

2025-01-15 11:30:28 UTC

Could people just stop trying to "improve" things they don't understand?
https://soatok.blog/2025/01/14/dont-use-session-signal-fork/

2025-01-10 00:17:49 UTC

- reply

To be fair, wireless printing is a black art
@npub1ffa…r8hz

2025-01-09 12:46:38 UTC

Do (software) emulators/VMs exist for Sharc DSPs? How performant are they on, say, modern macOS ARM?

2025-01-08 01:13:28 UTC

- reply

State censorship works

2025-01-07 18:25:29 UTC

Having just read a bit about the impact of the "business as usual" bias among German Jews in the runup to WW2 and the lack of meaningful resistance that it led to, is pretty terrifying watching the same bias today.

2024-12-19 19:18:52 UTC

When Silicon Valley talks about meritocracy, this is what they mean: https://mastodon.social/@grimalkina/112205399028342839
It's obviously never been about merit, but it also doesn't work for anyone — even the people who have enough privilege that they get held to a lower standard.