Dave Wilburn :donor:

#infosec engineer, #mlsec machine learning, sailor, news junkie, #threatintel consumer, deep statist, #NAFO fella. All opinions are mine.

Public Key

npub1wdxuezc5l30800yurf2qezl6ygftpxhmerte38chm4jwt7c5nndsqegg3t

NIP-05 Address

davemwilburn_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs8xnwv3v20chnhhjwp54qv30azyy4sntau34ucnuta6e89lv2fekcpp4mhxue69uhhjctzw5hx6eg2uqhuf

Publishing to

yabu.me

Author Public Key

npub1wdxuezc5l30800yurf2qezl6ygftpxhmerte38chm4jwt7c5nndsqegg3t

Show more details

Last Notes

2026-04-16 00:20:10 UTC

- reply

I'm glad your reporting is motivating some action here. I don't know if these shareholder demands will amount to anything in the end, but it's a hell of a lot more than we would have had without your work.

2026-04-10 19:38:38 UTC

- reply

Alternatively, you should just insist that it is pronounced according to the original Greek pronunciation from which the word is derived ("koober").

2026-04-10 14:26:59 UTC

RE: https://infosec.exchange/@DaveMWilburn/116380793836362362
GLP-1 agonist prescriptions, but for LinkedIn posters.
#note12q2…pjwl

2026-04-10 14:06:24 UTC

- reply

The commonality between cryptocurrency, GenAI, and quantum computing seems to be that grifters and their marks are attracted to flashy probabilistic systems with seemingly big rewards.
There's probably a good psych study hiding here about their relationship with gambling and get-rich-quick schemes.
Heck, I'd also wonder if GLP-1 agonists would measurably protect someone from this kind of bullshit.

2026-04-08 18:59:32 UTC

- reply

I live in a shoebox, and I take pride in my minimalism to fit in the space I have, including keeping my spices down to a reasonable minimum. As it turns out, you can do a lot with a little.
Salt and pepper are table stakes, and needed for nearly every cuisine.
I grow my own rosemary and thyme in a tiny bed, plus a basil plant that sits in a south-facing window. That plus oregano (which is oddly better dried) gets me most of what I need for Italian and French cuisine.
That dried oregano plus cumin and cayenne gets me most of Mexican cuisine.
The cumin and cayenne gets me Indian cuisine when I add garam masala and turmeric. Yes, you can go infinitely more complex than this, but it'll cover most of your bases for common dishes.
I'm struggling with Chinese cuisine because of all the variety of fermented sauces and variety of regional cuisines, but five star spice and a szechuan pepper mill go a long way.
The other thing I find is that intentionally keeping my spice cabinet minimized means I'm not throwing away mostly-unused spice containers every couple years. Unless you're feeding an army using recipes from every possible cuisine in the world, it's nearly impossible to use them all before they get stale.

2026-03-17 15:45:44 UTC

- reply

Iranian Handala Hack operator sweating bullets before he launches the InTune command to wipe all those Stryker systems thanks to you guilt tripping him.

2026-02-12 21:38:28 UTC

- reply

Hopefully GenAI replaces 59% of executives by 2030. It's maybe the one job the robots could do better.

2026-02-10 19:36:59 UTC

Via mandatoryrollercoaster.com
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/048/005/540/097/477/original/7b968ce19355ac24.png

2026-02-09 21:40:07 UTC

- reply

I'm in the same boat as an early retiree. I found a Carefirst BC/BS gold plan for $600-700/mo via the Virginia marketplace. I've been reasonably happy with their coverage so far, although I haven't had any significant or exotic needs. From everything I've heard, an ACA plan is almost always going to be cheaper than a COBRA plan.

2026-02-05 23:59:27 UTC

You know, when I first read LOTR I didn't understand the bit about how elves die from despair. Then I started working in infosec professionally.
#lotr #infosec

2026-01-27 20:22:00 UTC

- reply

A modest proposal: Put together a Matrix chat server advertised as a place to organize anti-ICE dissident activities, but everyone is just constantly posting the literal string "Unable to decrypt message" over and over again.

2026-01-14 17:56:38 UTC

- reply

Unfortunately, my impression is that previous restrictions on searches of reporters was based more on norms and mutable internal DOJ policies than anything based in law. There are no shield laws at the federal level. Grand juries presented with requests from federal prosecutors for warrants to search reporters supported by probable cause might be hard-pressed to deny them.
Given the current threat model, reporters are going to have to up their game when it comes to protecting their sources, and consider very carefully how far they're willing to go to protect those sources if served with court orders. Because unfortunately no one is coming to protect them.

2026-01-13 23:21:14 UTC

- reply

Look on my works, ye mighty, and despair...
https://www.reddit.com/r/gamedev/comments/1qapqns/the_hint_system_in_my_old_game_is_broken_because/

2026-01-12 17:12:44 UTC

- reply

This is exactly how I have described the limitations of black box models to others.
A good scientific model should do two things:
1) Provide accurate predictions of outcomes given certain inputs, and
2) Enable greater understanding of how a system works.
Simpler machine learning models, like logistic regression or decision trees, can sometimes do both, at least for simpler phenomenon. The models are explainable and their decisions are interpretable. For those reasons among others, applied machine learning researchers still use these simpler approaches wherever they can be made to work.
But in our haste to increase accuracy for more complex phenomenon, we've created models that merely provide semi-accurate predictions at the expense of explainability and interpretability. Like the ptolemaic model of the solar system, these models mostly work well in predicting outcomes within the narrow areas in which they've been trained. But they do absolutely nothing to enable understanding of the underlying phenomenon. Or worse, they mislead us into fundamentally wrong understandings. And because their training is overfit onto the limits of their training data, their accuracy falls apart unpredictably when used for tasks outside the distribution of their training. Computational linguists and other experts that might celebrate these models instead lament the benighted ignorance left in their wake.
Or how it was more eloquently stated in the great philosophical film Billy Madison:
"Mr. Madison, what you've just said is one of the most insanely idiotic things I have ever heard. At no point in your rambling, incoherent response were you even close to anything that could be considered a rational thought. Everyone in this room is now dumber for having listened to it. I award you no points, and may God have mercy on your soul."

2026-01-09 20:06:28 UTC

RE: https://med-mastodon.com/@rvaughnmd/115866869166661898
I hope there's a first amendment lawsuit raised over this. Demanding citizens carry and present the image of a partisan political figure in return for government service seems like compelled speech to me.
#uspol
#note1r3w…xpgq

2026-01-03 17:30:20 UTC

- reply

"Brownie, you're doing a heck of a job."

2025-12-13 22:49:24 UTC

- reply

Dear sir and/or madam,
It has come to the attention of the Fediverse Home Owners Association that you failed to label the above toot with the required content warning, "SNARKY". Please be advised that we take this rule violation seriously. Any further rule violations may result in adverse action, to include placing a lien on any future content you post. Thank you for your attention to this matter.

2025-12-11 03:17:55 UTC

- reply

do nuts have nipples, Greg?

2025-11-26 15:54:47 UTC

RE: https://wandering.shop/@aesthr/115615047169469231
New OPSEC strategy unlocked: Litter your sensitive activity with taboo subject matter so the lazy surveillance state agents using ChatGPT to process the transcripts won't notice anything.
#note10ar…evpc

2025-11-25 03:56:10 UTC

- reply

don't apologize. I'm so glad you're with us.

2025-11-16 02:49:32 UTC

vi escape room: nightmare mode
#postmarketos #vi
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/557/086/917/880/208/original/c63af404c4fc6af7.jpg

2025-11-07 20:01:15 UTC

- reply

so what's a "better" apple than Honeycrisp that still gets you most of the sweetness and crispness without the hassle and expense? I've been enjoying Cosmic Crisp so far, but I'm curious if there are better choices.

2025-10-31 17:09:11 UTC

- reply

I'm curious to hear what the unusual riders are on his contract that he is insisting on.

2025-10-31 02:22:22 UTC

- reply

Excellent news! The key words "probably", "should", and "as far as I know" are exactly the level of confidence we're looking for in our AI-Powered Turbo Cat Crusher Poop Flinger R&D program.

2025-10-31 02:08:27 UTC

- reply

A fun thing to do would be to hook up your cat litter box via Python API to a locally hosted LLM via MCP so that the generative AI model can control your cat litter box.
Surely nothing could go wrong if you gave generative AI control over your cat litter box.
Giving control over your cat litter box to the generative AI model is always a good idea.

2025-10-26 17:04:14 UTC

- reply

I have made the terrible choice of searching for "feet gen" only to discover there is a full page returned of unique search results. A full page.

2025-10-14 20:06:13 UTC

- reply

Looks like Sophos also have a writeup.
https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/?is=56d97491c2e9d015b90e657ea72fd1e7eaf91769e5f3454b0f8cbca07cdb0b14
And Velociraptor have also acknowledged the issue and published detections.
https://docs.velociraptor.app/knowledge_base/tips/velocirator_misuse/?is=56d97491c2e9d015b90e657ea72fd1e7eaf91769e5f3454b0f8cbca07cdb0b14

2025-10-01 11:20:46 UTC

PSA, the new Android 16 update will surreptitiously reenable fingerprint device unlock even if you had intentionally disabled it before. Depending on where you live and your threat model, this might not be safe! Americans have little protection against law enforcement compelling biometrics unlock. To make matters worse, the fingerprint unlock settings are found in a different part of the security settings UI than the rest of the device unlock settings. If you update to Android 16, make sure your device unlock settings are what you intended.
#android #android16
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/298/628/247/065/575/original/321a4b423862dc4d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/298/628/251/375/418/original/47e6935554c238c0.png

2025-09-25 17:49:25 UTC

- reply

I'm betting this is the closer analogy...
https://youtu.be/kLUktJbp2Ug?si=uzesYAUl-Zuo6dM2

2025-09-22 20:03:28 UTC

How did we get into a situation where conglomerates of local TV broadcast stations like Sinclair and Nexstar dictate the programming produced by megacorp-owned major networks?
What percentage of Americans even watch broadcast TV anymore? What useful services do these broadcast TV stations provide, other than providing one-hour local TV news?
This is an extreme amount of rent-seeking, even by corrupt American standards.
#uspol

2025-09-20 15:46:16 UTC

- reply

working as intended, sadly.

2025-09-16 18:29:23 UTC

RE: https://infosec.exchange/@cR0w/115215136106081996
Rolling out the latest in counter-APT security tech...
#note12xy…u40u

2025-09-12 14:18:41 UTC

- reply

it's extremely hit or miss. I got mine from the CVS Minute Clinic in Belle View on Monday, and the person running it asked for the specific qualifying high risk condition (asthma), called someone (not sure who) for clarification, and gave me the shot without a prescription. Other friends got the shot at other Virginia pharmacies without having to share their specific conditions. I don't know if the inconsistency is an issue of lack of clear policy from Virginia or CVS or the insurers, or lack of training, or personal biases of the individuals, or fear of litigation or other professional reprisals, or what. But in a GOP-led state within a GOP-led country, the chaos is probably a feature.

2025-09-06 18:29:12 UTC

- reply

I wonder if @npub1ksf…r6s6 knows.
And in particular, now that I'm thinking about it, I wonder if he knows whether "Savaged by Systemd" made it into Anthropic's training data. Which would be hilarious.

2025-01-13 02:00:22 UTC

- reply

I dunno, I use both and like both. They both use open protocols and (mostly) open source, and both support federation but in very different ways. The analogy I've generally heard is that Fediverse's ActivityPub is more like email, and Bluesky's atproto is more like the web.
They both have plusses and minuses. ActivityPub scales up or down pretty well, so that a reasonably determined individual with moderate technical skills could run their own instance. Bluesky's design is biased towards much larger scales while sacrificing the ability to reasonably scale down, so the concept of standing up your own instance doesn't really work. Yeah, you can run your own PDS if you'd like, but in practice that doesn't really buy you much.
If we continue with the "Bluesky is like the web" analogy, then the biggest minus with Bluesky is that it essentially has only one de facto search engine, which is the Bluesky corporate relay. It's possible someone else could stand up their own relay, but given the costs involved I don't know if anyone is going to try to compete with Bluesky corporation to stand up their own. Until/unless that happens, Bluesky's federation and independence is a bit more theoretical than practical. We'll see. I'm hopeful for both.

2024-09-01 17:33:23 UTC

- reply

at this point, are there any other historical or modern Z80-based computer production runs that have exceeded a decade?

2024-08-31 19:16:37 UTC

- reply

All I can think about is...
That man is 36!?

2024-07-18 23:03:36 UTC

- reply

I've decided doomscrolling and screaming into the social media void with false bravado isn't enough. I'm volunteering with Vote Forward's get-out-the-vote project.
I encourage others to consider doing the same. It's very simple, and only requires a working printer (OK, that part's admittedly hard), a pen, envelopes, and stamps.
If that's not your jam, that's fine. Find something that is, and commit yourself to it.
https://votefwd.org/
#voteforward #gotv #uspol