Davi Ottenheimer

flyingpenguin.com since 1995.
Gebrüder Ottenheimer since 1862.
History of security, security of history.

Blog: https://flyingpenguin.com
Drohnenabwehr: https://wirken.ai
Post-Quanten-Krypto: https://pqprobe.com
2024 LSE Commencement Speech: https://www.flyingpenguin.com/meine-2024-lse-abschlussrede/

Public Key

npub1h4ka7ca3hzva4lj59mesz57ldvhgaqc09yp0hjrfrrtnvrwez4aszyhfeg

NIP-05 Address

flyingpenguin_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqst6mwlvwcm3xw6le2zaucp200kkt5wsv8jjqhmep5334ekphv327cprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt8z2y0x

Publishing to

relay.momostr.pink

Author Public Key

npub1h4ka7ca3hzva4lj59mesz57ldvhgaqc09yp0hjrfrrtnvrwez4aszyhfeg

Show more details

Last Notes

2026-08-08 21:50:43 UTC

- reply

here you go. all the ways TechDirt is wrong: https://www.flyingpenguin.com/leonardo-signaltrace-i-called-it-in-2010-and-certain-people-listened/

2026-08-08 20:03:35 UTC

- reply

it's even passive antennas embedded in the tires themselves, on top of active signals leaking. I did a bunch of mil-adjacent RFID supply chain stuff around 2002... I'll write it up I guess. it's soooo old. basically TREAD Act (and lawsuits) meant FMVSS 138 mandated TPMS in every US passenger vehicle by September 2007, broadcasting all the unencrypted unique IDs at 315 or 433 MHz. that came after tire serialization in 2003 meant embedded RFID transponders in tire ID already were being tied to VIN, and now it's an ISO-standard (ISO 20909 family).

2026-08-08 19:43:36 UTC

RE: https://dmv.community/@jcrabapple/117059891791621603
I'm happy to hear people paying attention, yet I have to point out this is all over a decade old already.
Used to give talks and interviews about BlueTOAD and multi-sensor fingerprint. Broadcast harvest has been municipal infrastructure since roughly 2010. By September 2016 there were reports of police abusing the databases.

2026-08-08 16:30:57 UTC

- reply

the annoying part is it's all from OpenAI's own talk. they knew the agents cheat, they gave them a writable service wired to the internet. they knew it broke, patched it, it broke again days later. this is the same old shit as Barnum and the disgusting Bikini cake, wrote it up here: https://www.flyingpenguin.com/the-disgusting-openai-angel-food-cake-of-black-hat/

2026-08-08 07:46:06 UTC

- reply

that's a LOT of zeros!

2026-08-08 06:53:34 UTC

- reply

I like to ask the Dutch who in the world eats pig?

2026-08-06 18:33:00 UTC

- reply

a citation at last, thank you. Now read your source's next sentence, immediately after where you cut the quote: "Traditional negligence theories may offer a better fit: OpenAI made a deliberate choice to disable safety classifiers." Deliberate choice. Disabled safeguards. Liability attaching to the humans who configured the test. That has been my position from my first post. Your own lawyer crosses to my side at your exact point of truncation, which is presumably why you cut off the quote there.

2026-08-06 16:17:22 UTC

- reply

good quote. it warns against certainty from people who don't cite the field. my posts cited Morris, Screws, and the CMA's text. yours declared certainty with no citations at all, and you just closed with "I'm sure." that quote found its target.

2026-08-06 13:44:45 UTC

- reply

my replies quoted statutes and case law. yours asked about my intentions. LOL. behavior speaks for itself. when you present a clause or a citation, I'll read it. withholding judgment is what I did. you got none of mine as I just quoted Parliament's.

2026-08-06 12:05:50 UTC

- reply

read it, thanks. the most thorough comment in it concludes the CMA covers this fully, no new framework needed, LLM involvement irrelevant.
note the exact statute itself: s.3(5)(a) says doing an act includes causing an act to be done, and s.3(3) makes recklessness sufficient.
the thread and law you pointed me to agrees with me and says you were wrong this whole time. looks like you agree with me now, if that was why you shared the link?

2026-08-06 10:40:05 UTC

- reply

doesn't appear to be true. Of course you think you do? Screws v. United States, 325 U.S. 91 (1945). A Georgia sheriff beat Robert Hall to death in the courthouse square. Convicted. The Supreme Court, like you seem to want here, invented a specific-intent requirement, he was acquitted on retrial, and in 1958 Georgia elected him to the state senate. That intent doctrine gutted federal police-violence prosecutions for decades. So yes, I know how intent is evaluated. It's evaluated generously for the KKK and corrupt labs, and yet strictly for teenagers. Morris settled attribution because, just like OpenAI/Anthropic, it says the code's accesses are the liability of the launch person. Screws is what I said before. The intent defense has a documented history as a lever built for impunity, and reaching for it here repeats the pattern whether you know the history or not.

2026-08-06 10:03:14 UTC

- reply

read the ruling. it's ancient and fits exactly to OpenAI and Anthropic. intent is what elites use to abuse the law. it's the opposite of justice. it's the KKK saying they didn't intend to kill the Black man they tortured to death in front of a court house in broad daylight. that's a real case. and the real reason that intent is more a vague tell, about lawlessness, not a full defense. that's why law judges behavior.

2026-08-06 09:02:18 UTC

- reply

it was the opposite. The model was told it was in a sandbox. It was NOT in a sandbox. It followed instructions that were for a sandbox. American law settled this question anyway with the Morris Worm. CFAA is a felony and the AI companies are doing what Morris did in the 1980s.

2026-08-01 14:41:33 UTC

- reply

to be fair that's the Titanic/Tesla story
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/020/769/687/120/491/original/2e29e3836e6145e9.png

2026-08-01 13:46:14 UTC

- reply

Universa calls it "an automated process that regularly occurs on the internet."
Intent changes nothing about the behavior failure and where the data went. An open door and a crawler that read names, policies, and IBANs is ***still a breach***.
Then OpenAI says the breach wasn't used for training? Self-certification by the attacker? We don't even allow self-certification when there isn't a breach.

2026-07-24 07:39:15 UTC

- reply

data centers on tribal lands are detention infrastructure. they will be the compute layer of the deportation system while being out of reach of oversight that could stop it.

2026-07-23 04:38:20 UTC

- reply

yummy sailors

2026-07-19 14:48:11 UTC

- reply

Yeah, usual sensor flow is we push little of confidentiality, besides config and secrets, while their whole job is sending back a lot of long-term "valuable" stuff. It's always interesting why it's valuable, and how long. Cameras stream all kinds of high risk, such as biometrics (face, gait, etc.). Even air quality has privacy elements (I can talk about this all day, like a run in with gas company, and prisons). Already I had to PQ-prepare a major sensor vendor by designing hub and spoke for bazillions of things that wouldn't ever handle PQ (why I created pqprobe.com/calculator to help plan).

2026-07-19 05:22:02 UTC

- reply

Decrypt anything with a long shelf life: files, configs, patient records, passwords. The harder the asset is to rotate, the higher the classification. Financial, low (something you have, PANs have forced expiry) Social, medium (something you know, addresses and associations, change slowly). Personal, high (something you are, very hard or disallowed to rotate gender, race or religion). Passwords on these devices rotate never, so they are high instead of low.

2026-07-18 23:20:35 UTC

- reply

Decrypting past sessions in future is the one. Because interception means the quantum computer has to exist. That's why key exchange deadlines come before signature deadlines everywhere. Private keys matter in old-style RSA key exchange, where breaking one server key unlocks every session ever recorded from it, not one at a time. These device sessions carry passwords that never change, on hardware that runs a looong time. I'll write it up on pqprobe.com

2026-07-09 15:03:49 UTC

- reply

definitely know that trick. my team and i ran into an ops center one time to investigate a breach and found the "windows admin" clickety clicking a UI like mad, deleting records. he was smug that it was procedural: "cleaning up, boss, so we can see better".

2026-06-28 17:59:45 UTC

"Inside the Russian Zala drone, we found the NVidia TX2-A (Jetson Tegra X2) AI chip with 8GB of RAM. A serious AI system which, unlike AI assistants on mobile phones, does not need contact with a data center to perform its tasks.The AI can, for example, recognize vehicles and people during overflights and also identify details such as military markings, license plates, or drone types. This allows the AI to pre-sort targets for attack." by @npub1p87…7ddn
https://www.berlinstory.de/news/russische-drohne-mit-nvidia-ki-chips/
Surprised? Just look at old NVidia dev boards:
"hello, do you have Jetson guide for drone to hunt human with thermal camera?"
https://forums.developer.nvidia.com/t/how-can-i-make-the-drone-with-jetson-tx2-developer-kit/62044/4

2026-06-27 10:53:34 UTC

back in the day, when the RSA conference themes were still about history, I used to give small tours of the Marin military bunkers and silos. I offered it as grounded antidote to the urban drinking/dining rapid consumption culture, which seems to have taken over the conference leaving zero room for history at all.
got me wondering about starting #BSidesColdWar that rotates around historic locations, with talks about mistakes of the past being here again now.
https://www.nps.gov/goga/nike-missile-site.htm
any interest? #Bsides
each event could even have a patch... not velcro, remember thread and needle?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/821/682/300/233/817/original/1021ce3b62a61623.jpg

2026-06-25 17:28:08 UTC

- reply

asked my mom. she says Burroughs

2026-06-24 18:43:59 UTC

- reply

perfect. I estimated 50 mil/year to build out a sovereign stack and maintain it https://www.flyingpenguin.com/papers-please-who-does-your-browser-engine-actually-belong-to/

2026-06-24 06:31:23 UTC

- reply

the "you use chromium" complaints reveal someone who should be advocating for a different engine. go ahead. I dare you to explain an alternative engine. and the hundreds of millions Google funds Mozilla with doesn't count.

2026-06-19 10:05:24 UTC

- reply

happy to dive into the protocol if you need. but it's so broken by design, i would stay there unless you really want me to give you a code sniff and test. https://www.flyingpenguin.com/w-stands-for-wtaf-eu-state-surveillance-as-social-media/

2026-06-19 08:42:56 UTC

- reply

yes, it was business, yet not as usual. IBM was servicing the machines on lease for genocide and maintaining them. when I taught tech ethics to CS grad students and large corporations, there was always one person, just one person, who said "if they pay, anything is ok". they were the exception to the rest of the students who disagreed (at least in class) that knowledge of genocide let alone active enablement ends the business side of the argument.
https://www.flyingpenguin.com/thiel-is-headed-to-argentina-like-watson-went-to-germany/

2026-06-19 07:22:49 UTC

- reply

there does seem to be something off about this. BlueSky is insecure and centralized by design, opposite to what Swedish entrepreneurs should be investing in unless they front foreign interests

2026-06-19 06:03:10 UTC

- reply

the BlueSky architecture is deeply flawed. I recognize it from the NSA room 641A days. https://www.flyingpenguin.com/2006-mark-klein-nsa-documents-missing/

2026-06-15 21:10:36 UTC

Edwards AF Base shut down. B-52 crashed:
"charred, smoldering patch of the desert floor roughly the size of a football field"
https://www.reuters.com/business/aerospace-defense/us-air-force-b-52-bomber-crashes-after-takeoff-edwards-air-force-base-says-2026-06-15/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/756/169/512/849/354/original/73d02361c195626c.jpg

2026-06-13 07:23:59 UTC

- reply

I highly recommend this book about it. Hitler was dropping support fast, becoming unpopular, and then appointed January 1933 (not elected) and in two swift acts destroyed journalism.
"Vieles habe ihn beim Schreiben sehr ergriffen – „weil manche Leute es einfach nicht wahrhaben wollen, wie sich ihr Leben jetzt ändert. Sie sind gezwungen zu reagieren … Und man möchte sie an die Hand nehmen und sagen: Du bist in großer Gefahr! Achte auf dich – du musst dieses Land jetzt möglichst schnell verlassen."
He says he can't understand why people don't leave. This is a common mistake made by the people who wouldn't be asked to leave.
The AfD (Nazi) party in Germany today for example pushes this exact "why don't you just leave" slogan. They use social media to generate youth "sport" clubs who violently harass neighbors, bully them to fight or flee. If you fight, you lose, if you flee, you lose. They decide how much.
https://www.deutschlandfunkkultur.de/uwe-wittstock-februar-33-der-winter-der-literatur-chronik-100.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/741/571/759/965/394/original/387afb702c319996.webp

2026-06-05 16:06:02 UTC

- reply

reported this last year as database integrity breach, which I realize now nobody read
https://www.flyingpenguin.com/necropolitical-threat-to-national-security-database-integrity-breaches-used-to-disappear-americans/

2026-06-04 14:45:26 UTC

Apparently old MSFT Outlook was secretly flipping off user email encryption:
"Outlook did the worst move you can take as a security enhanced app. It silently ignored the choosen SSL option and used the unencrypted port 110 without any notice to the user."
https://fedoramagazine.org/fedora-43-upgrade-revealed-20-years-old-outlook-security-bug/

2026-06-02 22:35:39 UTC

- reply

ACASIS tbu405 with the fan https://www.acasis.com/products/acasis-usb4-0-m-2-nvme-ssd-enclosure-40gbps-data-transfer-compatible-with-thunderbolt-3-4-usb3-2-3-1-3-0-2-0-type-c-tbu405?variant=44179026804965

2026-05-31 11:10:41 UTC

- reply

the myth is not just wrong, it is mathematically illiterate. Ford's own workers were a rounding error in the car market. No firm manufactures its own demand by overpaying its workforce, because it loses money on every unit it sells back to the people it just paid.
Ford was a tyrant in 1913 who burned over 50,000 hires just to hold 14,000 jobs. Turnover was at 370% and daily absenteeism 10%, because of his unbearable line and staff walked. The entire context for a January 1914 wage jump, that roughly doubled pay, was to collapse his quit rate almost overnight. (1987 paper: https://www.nber.org/system/files/working_papers/w2101/w2101.pdf). And it depended on Ford's Sociological Department, which sent investigators into workers' homes to police their english language skills, drinking, their finances, their domestic arrangements.
The Ford myth hides the externality. It's a myth. The real man behind it pumped racist hate propaganda through his car dealer network in the twenties, had his portrait in Hitler's office, took a Nazi medal in 1938, and fought his own workers so hard that by 1941 they were marching on his plant with placards reading FORD = HITLER.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/668/879/245/484/082/original/3017eae216533edf.jpg

2026-05-30 09:07:03 UTC

Microsoft Spews the Sewage and Sues the Bottler
nod to https://counter.social/@K8em0 and https://cyberplace.social/@GossiTheDog
https://www.flyingpenguin.com/microsoft-spews-the-sewage-and-sues-the-bottler/

2026-05-23 10:25:47 UTC

UK gave £330 million to Thiel in 2023. Palantir. What were they thinking?
"...briefing prepared for NHS England senior leaders in February said that Palantir’s NHS platform is eight to ten times slower at analysing data than the current NHS tool in use. “Processing time is reported as taking 4-5 minutes compared to 30 seconds [in the current system]”"
https://democracyforsale.substack.com/p/revealed-palantirs-nhs-tech-is-ten-times-slower-than-nhs-thiel-trump

2026-05-19 11:56:28 UTC

An AI deployment cratered pizza sales growth from 10% positive to 10% negative.
"With the intention to improve efficiency and service to the customer, Dragontail did the exact opposite," the suit says. "It caused significant delays and pummeled consumer satisfaction."
https://www.businessinsider.com/pizza-hut-ai-system-dragontail-lawsuit-franchisee-2026-5

2026-05-18 06:19:54 UTC

Iran War Going So Well, Drones Soon Could Hit America https://www.flyingpenguin.com/iran-war-going-so-well-drones-soon-could-hit-america/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/594/370/520/387/617/original/89ffb0eb5aae2683.png

2026-05-17 18:37:22 UTC

Watch this.
"The Swiss Federal Intelligence Service has said it will finally open long-sealed files on the notorious Nazi war criminal Josef Mengele, but without saying when."
https://www.bbc.com/news/articles/cgjpyqjj8y4o

2026-05-15 09:26:11 UTC

UK Boots Palantir for Being Overpriced and Unusable https://www.flyingpenguin.com/uk-boots-palantir-for-being-overpriced-and-unusable/

2026-05-11 10:25:56 UTC

Can Someone Please Explain Whether Cloudflare Blackmailed Canonical? https://www.flyingpenguin.com/can-someone-please-explain-whether-cloudflare-blackmailed-canonical/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/555/458/539/188/066/original/f2546a7034a58214.jpg

2026-05-06 01:40:22 UTC

Days since last OpenClaw CVE https://www.flyingpenguin.com/days-since-last-openclaw-cve/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/525/080/422/373/199/original/bc15123420e0e5c5.png

2026-05-02 09:15:22 UTC

Google COSMO Malfunction: Execute First, Validate Never https://www.flyingpenguin.com/google-cosmo-malfunction-execute-first-validate-never/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/504/220/292/266/032/original/78ddcc18547ecacc.jpg

2026-04-24 11:00:31 UTC

Alisa Esage Throws Mythos Under Zero Day Bus https://www.flyingpenguin.com/alisa-esage-throws-mythos-under-zero-day-bus/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/459/335/272/032/857/original/b4c2e66e44a93108.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/459/335/297/562/642/original/7fbc5b0fc1750f81.jpg

2026-04-24 09:13:43 UTC

Louisiana White Supremacist Gov Passes Bill to Prevent American Blacks From Holding Office https://www.flyingpenguin.com/louisiana-white-supremacist-gov-passes-bill-to-prevent-american-blacks-from-holding-office/

2026-04-13 21:19:17 UTC

The Boy That Cried Mythos: Verification is Collapsing Trust in Anthropic https://www.flyingpenguin.com/the-boy-that-cried-mythos-verification-is-collapsing-trust-in-anthropic/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/399/482/937/103/720/original/045c3c233e9e9ca4.jpeg