Tod Beardsley

Shmethical #Hacker. #Research mucky-muck at [@runzero](https://infosec.exchange/@runzero ). #Election worker. #CVE bagman. #Metasploit collaborator. Briefly a fed. Anti-Fascist. #FriendofDeSoto. #Podcaster

Hey, my attorney and wife (same person) is running for US Congress. Donate here!

https://secure.actblue.com/donate/claire-reynolds-1

I post here for me, mostly around #infosec / #cybersecurity.

Intro: https://infosec.exchange/@todb/109270457002321619

Website: https://hugesuccess.org
GitHub: https://github.com/todb
OnlyFans: https://onlyfans.com/sudo_whoami
Jobby job: https://www.runzero.com/authors/tod-beardsley/
Callsign: KT0DBK
Pronouns: he/him

Public Key

npub1qzuk6k5w9ajvltt2f56pgy52uwddsf53ngmzqza6g9367jyc8cmsc6rvyk

NIP-05 Address

todb_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsqpwtdt28z7ex0444y6dq5z29w8xkcy6ge5d3qpwayzca0fzvrudcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds8ped4q

Publishing to

nostr.wine

nos.lol

relay.damus.io

Author Public Key

npub1qzuk6k5w9ajvltt2f56pgy52uwddsf53ngmzqza6g9367jyc8cmsc6rvyk

Show more details

Published at

2026-04-13T20:51:37Z

Kind type

0 Metadata

Event JSON

{ "id": "5ab35f9de5c411f0e2d3edb93e5e2b8e90b170b42e518782a5347cc37ead47cf", "pubkey": "00b96d5a8e2f64cfad6a4d3414128ae39ad826919a36200bba4163af48983e37", "created_at": 1776113497, "kind": 0, "tags": [ [ "t", "infosec" ], [ "t", "hacker" ], [ "t", "cybersecurity" ], [ "t", "research" ], [ "t", "cve" ], [ "t", "election" ], [ "t", "metasploit" ], [ "t", "podcaster" ], [ "t", "FriendofDeSoto" ], [ "proxy", "https://infosec.exchange/users/todb", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.exchange/users/todb", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Tod Beardsley\",\"about\":\"Shmethical #Hacker. #Research mucky-muck at [@runzero](https://infosec.exchange/@runzero ). #Election worker. #CVE bagman. #Metasploit collaborator. Briefly a fed. Anti-Fascist. #FriendofDeSoto. #Podcaster\\n\\nHey, my attorney and wife (same person) is running for US Congress. Donate here!\\n\\nhttps://secure.actblue.com/donate/claire-reynolds-1\\n\\nI post here for me, mostly around #infosec / #cybersecurity.\\n\\nIntro: https://infosec.exchange/@todb/109270457002321619\\n\\nWebsite: https://hugesuccess.org\\nGitHub: https://github.com/todb\\nOnlyFans: https://onlyfans.com/sudo_whoami\\nJobby job: https://www.runzero.com/authors/tod-beardsley/\\nCallsign: KT0DBK\\nPronouns: he/him\\n\",\"website\":\"https://infosec.exchange/@todb\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/258/798/902/039/585/original/104b3304b7b270b0.jpg\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/109/258/798/902/039/585/original/e34e4b813e02cc7f.jpeg\",\"nip05\":\"todb_at_infosec.exchange@momostr.pink\"}", "sig": "c98519019f9d406e30162b6422d0e4b63923d6641c14d8ee77ed417e575b819601adcdacd1975609fa236b71e470eb0dae172a7b7cd1375de267ce12d5134cd4" }

Last Notes

2026-02-21 02:41:04 UTC

Breaking news: Max Headroom, one of the greatest TV shows ever made, is free on Tubi.
I find the terrible Tubi ads really enhance the dystopia.

2026-01-28 18:40:15 UTC

Computers are great. What a time to be alive.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/974/184/007/001/807/original/521518d781c7e59b.png

2026-01-12 13:23:18 UTC

January 1 came and went and Texas’s AI regulation went into effect.
There are a couple things to like about Texas’s attempt here. There are many things to dislike.
One aspect in particular: The definition of AI seems to cover just about any software application, right?
> TRAIGA broadly defines an “artificial intelligence system” as “any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.”
Maybe it’s the legalese, but I’m trying to figure out what machine-based system doesn’t function like this. Does it all hinge on “infer” rather than another verb like “calculate?”
https://www.gtlaw.com/en/insights/2025/6/traiga-key-provisions-of-texas-new-artificial-intelligence-governance-act

2025-12-08 13:43:48 UTC

- reply

This bit makes me think it’s a different bug:
“Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.”
Sounds like two different vectors. Incomplete fixes often lead to multiple CVEs, a la rule 4.1.10: “To help determine whether separate Vulnerabilities exist, CNAs SHOULD consider whether the Vulnerabilities are Independently Fixable.”

2025-11-14 21:08:13 UTC

I just noticed that ../ looks like eyes and an outreaching arm, as if it's a victim drowning in quicksand.
I'm sure this is trenchant, somehow. cc @npub1s6e…n008

2025-08-21 04:53:54 UTC

Hey y'all don't sleep on this one.
**Agency Information Collection Activities: Vulnerability Reporting Submission Form**
#CISA wants to know what your ideal vulnerability reporting system would look like.
"CISA previously published this ICR in the Federal Register on October 30, 2024, for a 60-day public comment period. **CISA received one comment.** The purpose of this notice is to allow an additional 30-days for public comments."
Man, remember October, 2024? Things were looking pretty great back then. What a time to be alive.
Anyway, thanks for the extension, Kevin, ya big lug!
https://www.federalregister.gov/documents/2025/08/20/2025-15887/agency-information-collection-activities-vulnerability-reporting-submission-form

2025-08-08 15:44:27 UTC

#defcon badge fixed
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/993/913/117/946/899/original/87b891873549d1d8.jpeg

2025-07-21 17:46:10 UTC

Last night at about 11:30pm, I took a practice ham radio Technician test. I fell asleep twice. I guessed most answers (I know jack all about radio, slightly more about electrical engineering). I got 63%.
I suspect I can study up enough in time to pass a the exam at @npub1dqd…8xy4 ham .
https://hamvillage.org
Thanks to That Texas Country Music Guy at DC512 for encouraging this side quest!

2025-06-09 18:58:37 UTC

It's not just me, right? Post-quantum crytography aka #PQC, especially quantum-resistant cryptography, smells an awful lot like snake oil.
I cannot figure out how people sell this stuff with apparent sincerity when it's clearly impossible to test in production.

2025-05-24 01:33:15 UTC

Say, what's the first major-release film to mention either "the internet" or "the world wide web?"
(Or, alternatively, "DNS" or "SMTP" or "TCP/IP" or other uniquely internet technology, though that seems doubtful.)
And I mean mention as in, either in dialogue or printed and shown on screen in a newspaper or something.
There's a kind of [annoying reddit thread](https://www.reddit.com/r/movies/comments/o98hkx/what_was_the_earliest_reference_to_the_internet/ ) about this that's not very helpful and is fixated on WarGames which definitely doesn't talk about the internet (all the comms in that movie are over dialup).
A timestamp reference would be just great if you have it.

2025-05-12 19:10:07 UTC

#CISA adds CVE-2025-47729 to the #KEV -- which is for the crazy hacked up version of Signal used by high-ranking US government officials.
Wowzo. That's something.
https://www.cve.org/CVERecord?id=CVE-2025-47729

2025-05-12 15:56:01 UTC

#CISA ends RSS for #KEV. Sigh.
https://www.cisa.gov/news-events/alerts/2025/05/12/update-how-cisa-shares-cyber-related-alerts-and-notifications

2025-05-07 18:56:15 UTC

so close #CISA.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/468/070/726/514/583/original/45a5c3c24bb620d6.png

2025-04-29 20:25:35 UTC

Welp. Let’s see which way this room goes.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/423/125/242/360/613/original/a4ac9c38051802f3.jpeg

2025-04-21 12:59:02 UTC

- reply

The linked article doesn’t appear to mention the Internet Archive.
It doesn’t make the NEH cancellations any less tragic, but I don’t see the linked article drawing a link between the San Francisco Art Institute, which does perform archiving functions, and The Internet Archive.
Are they connected?

2025-04-16 01:39:34 UTC

l feel like i’m going to be using this a lot
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/345/087/526/277/853/original/b59dc3f1a3157fc0.jpeg

2025-02-14 18:24:11 UTC

Trying to articulate levels of invasiveness with typical network scanning with metaphors that don't come with the implied violence of "rattling doorknobs."
How's this grab you:<li>Port Scanning - Waving at passersby, seeing who waves back.</li><li>Protocol Scanning - Waving and saying "Good morning," noting if the reply is in English, Spanish, or something else.</li><li>Vulnerability Scanning - Chatting up strangers to see if they'll reveal their birthday.</li><li>Active Exploitation - Hypnotizing victims into handing over their ATM card and PIN.</li>

2025-02-07 15:39:39 UTC

Archived version of the quoted The Atlantic article is here:
https://archive.ph/2025.02.07-140733/https://www.theatlantic.com/technology/archive/2025/02/elon-musk-doge-security/681600/
Unrelated: If you believe there has been an intrusion in a US government system, you are encouraged to report it at https://cisa.gov/report
https://journa.host/@w7voa/113963205109936094

2025-01-28 21:49:52 UTC

So check it out. KEV data is now available on GitHub, in the proper cisagov organization. I know other people mirror KEV for their projects, but who can say if they're fiddling with it along the way? With https://github.com/cisagov/kev-data, you can rest assured that it's the Real and True mirror of KEV.
https://cisa.gov/kev is still the actual authoritative source, but this GitHub mirror is a pretty close second.
I posted about this on [LinkedIn](https://www.linkedin.com/posts/todb_github-build-and-ship-software-on-a-single-activity-7290122220230623234-q92i?utm_source=share&utm_medium=member_desktop ) since that's what people do with work stuff, apparently.

2025-01-02 16:44:53 UTC

98 KEVs to go until KEV #1337
Hopefully it'll be a good one.

2024-12-23 13:52:07 UTC

Near as I can tell, the activity around the #Struts2 bug,
CVE-2024-53677, is just ham-handed runs of some generalized PoC, and nobody's actually exploiting this yet (since exploitation would be very application/path specific).
Most of the news last week was all "exploitation happening, patch and rewrite everything now!" but not seeing any reports of successful (or even possibly successful) this morning.
Tell me I'm wrong!
(The PoC identified by SANS at https://isc.sans.edu/diary/31520 isn't specific to some particular application -- it's on the user to define upload_endpoint and assumes no auth or session or anything.)

2024-12-01 14:59:24 UTC

- reply

That’s a nice bit of CVE lore! We should make these more obvious and prominent than a single blog post.
And yes, having a small set of always-valid-but-test CVEs would be nice to publish. That’s a neat idea.
Hey would it be cool to make them Luhn-formula-like so you can detect truncation?
Something like
CVE-2024-12342
CVE-2025-12343
CVE-2026-12340
(all the digits add up to modulo 0)
cc @npub1wug…ghe4

2024-11-27 23:53:26 UTC

I’m not pirating movies, I’m just training my model.

2024-10-15 17:43:16 UTC

- reply

Weirdly, all NCSC employees also have licenses to kill. Seems a little excessive.

2024-10-15 00:07:04 UTC

- reply

depends on what you’re testing though doesn’t it?
Sounds like DNS CNAME + Apache vhosts is the way to go. Mastodon apparently doesn’t do well with non-443 since fediverse things all assume 443 is where it’s at.
https://github.com/mastodon/mastodon/discussions/20279

2024-10-11 18:50:26 UTC

Man. The archive.org outage is really chapping my hide. Good job, jerks.
Hey @npub1wug…ghe4 we should think about reviving the CVE reference archival effort again. It's almost as if someone predicted this exact circumstance.
@npub1umd…wfr7 , good luck.

2024-09-04 01:16:56 UTC

- reply

Agreed. 2FA is becoming a real disappointment.

2024-09-02 13:39:28 UTC

So this is neat.
1) Some (all?) antispam/counterphishing email scanners are blind to #QRCode content.
2) You can draw working QRCodes with Unicode character sets, thus avoiding an image parser entirely, even if the scanner could process images in the first place.
3) By providing QRCode links, the attacker encourages the victim to use their personal device rather than the workstation, making defensive tracking more complicated.
I think it’s hilarious that a format designed SPECIFICALLY for machine vision is being used to evade machine interpretation.
https://infosec.exchange/@patrickcmiller/113067302631450126