Rabbit

maker breaker hacker witch wife

"And when they catch you, they will kill you... but first they must catch you"

Tenebras superavi; Lumen meum detestentur.

She/Her
🩵🩷🤍🩷🩵
❤️🧡🤍🩷💜

Public Key

npub1gy4wspvdramcxa04jcyqsmyg49k03mn2ljlyr9yl965n47nsjd3svh4s7y

NIP-05 Address

ra6bit_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsyz2hgqkx37aurwh6evzqgdjy2jm8cae40e0jpjj0ja2f6lfcfxccpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsm589gu

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1gy4wspvdramcxa04jcyqsmyg49k03mn2ljlyr9yl965n47nsjd3svh4s7y

Show more details

Last Notes

2026-08-20 02:22:43 UTC

-sigh-
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/125/450/956/579/708/original/02e0086c0cc3f302.png

2026-08-17 16:32:56 UTC

- reply

and the Church of Wifi have destroyed devices using a tesla gun in the Destruction CTF IIRC. I think there is probably some domain expertise.

2026-08-14 14:20:46 UTC

- reply

Like, yes, a properly secured org should have controls for this in place already.
But I'll let you know when I encounter a properly secured org. :)

2026-08-14 14:16:39 UTC

- reply

I don't think defending orgs have embraced internal zero trust quite to the extent you are supposing though.

2026-08-14 14:05:19 UTC

- reply

My "what I'm actually seeing as a defender" opinion is that agentic AI is rapidly speeding up the pace at which an attacker laterals and takes advantage of an intrusion.
If you think about it, it makes sense - the current batch of models fumble around and hallucinate, but that doesn't really matter when you're inside a target network and you're just doing a smash and grab as fast as you can go before the response measures catch you.
Script kiddies now can turn loose an army of drunken monkeys inside your perimeter with a successful phish.
It's going to require strategy shifts to counter, whether people like LLMs or not - it's a genuine change to the threat landscape.

2026-08-14 14:01:32 UTC

- reply

Maybe. If you ever want to go dress shopping hit me up. :)

2026-08-03 00:36:19 UTC

- reply

My antique gmail account that's just some initials and numbers regularly gets messages intended for a Catholic deacon in Florida.
Those folks get some remarkably trans-positive responses from that deacon.

2026-07-31 13:13:22 UTC

RE: https://flipboard.com/@wired/security-news-f9no9s7gz/-/a-SJyclEaETBSQuwwYcqZ3Xw%3Aa%3A3199480-%2F0
I was quite ready to bust out some of my past research into the inability to verify the non-existence of hardware backdoors, but I have to tell you "it's IR transparent so you can inspect the die" is quite cool.
I'm jealous I won't be getting my hands on one of these this year
#note1xew…yjmj

2026-07-17 02:15:00 UTC

In light of the shocking news my voter registration data may have been seen by a third party, it's time to come clean
As a registered democratic socialist I didn't vote for Trump.

2026-06-09 20:43:59 UTC

- reply

(I do love asking people who report "You're using TLS 1.2 and it's deprecated" to please provide a PoC exploit though.)

2026-06-09 20:42:45 UTC

You know what's going to be fun about Mythos generated bug bounty submissions- the "researcher" won't even know how it works.
I guess that's not so different than the deluge of "Look, I have Nessus" submissions though.

2026-06-09 11:22:32 UTC

- reply

Yeah, the skiddy army is about to level way the heck up and orgs that think the castle wall model is meaningful are going to have a very bad time.
You know what’s funny though, from my admittedly smaller vantage point I’m not really seeing an increase in initial compromises via exploits.. I’m seeing extremely good phishing leading to AI-speed lateraling and exploitation, and kind of crazy privilege escalation.
If orgs arent investing heavily in compartmentalizing their environments they’re gonna get rocked soon.

2026-06-07 00:28:28 UTC

- reply

You know what's fun? Going through TSA with a bunch of syringes.

2026-06-04 13:51:24 UTC

- reply

(Up here on the Quebec border, around January when there's 8 feet of snow in my yard, I always think "My gay ass is supposed to be handing little kids fruit bars and telling people where the bathroom is, not freezing to death up here.")

2026-06-04 13:49:31 UTC

- reply

If I had civil rights in Florida I'd still be there. I can't put words to how much I miss it, but I'm too afraid to step foot in the state again after an extremely uncomfortable encounter with transphobes last time I was there.
Give my regards to my home for me, please! Maybe someday I'll get to go back.

2026-06-04 13:44:08 UTC

- reply

The fact that your bio says that you live at Disney tells me everything I need to know.
(If you count Vista Way, I spent about a year there once without leaving, doing guest relations at Epcot. The rest of the time working there I lived in a shitty place on OBT with like 5 roommates)

2026-06-04 13:35:59 UTC

Back in the 80s, there was "ADHD" and "ADD". "ADD" was basically "ADHD but not as hyper", and in practice it meant "ADHD, but for girls".
I was given the "ADD" label because I wouldn't pay attention but I'd sit quietly in class, and almost any time it came up someone would add "that's very unusual for a boy"
#@%&ing gender affirming neurodiversity.
(I was later upgraded to an autism dx, because you couldn't have both then and my magic ability to act like a girl pushed me out of the ADD dx.)

2026-06-04 13:14:12 UTC

- reply

I can't decide if it's that we're probably just not calling it "profound" as often for political reasons, or that it stops at 2016 for political reasons.

2026-06-03 23:38:39 UTC

I'm sick of conservatives and their shitty opinions.

2026-06-02 01:19:23 UTC

- reply

Speaking of.. before Disney went rainbow capitalism, they were -far- less tolerant of the gay community officially. Unofficially, we all fought over who got to work on "Gay Day".

2026-06-02 01:16:26 UTC

Confession: When I worked at Disney I would occasionally go to the closed area of the Imagination Pavilion (upstairs near where the DVC lounge is now) just to walk through the rainbow tunnel again, because rainbows are fucking awesome. The rainbow was never on, but I knew it was still there.
It's an absolute travesty it was dismantled before Disney embraced Pride Month.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/677/838/700/581/649/original/25a29705a5d24161.png

2026-05-26 19:26:44 UTC

I interview people for high-level engineering and information security roles literally every day, and it is becoming increasingly common for candidates to obviously be using AI tooling to conduct the interview in what feels like a dishonest and unethical way.
I have to tell you that none of you seem to be aware your are all giving the exact same answers with the exact same pacing and characteristics. You don't sound knowledgeable, you sound fake and uncanny.
Anyway as usual if you're going to cheat at least impress me with your cheating. Protips:
1) The reaction time gives you away right away. If your AI isn't fast, it's no good for this.
2) USE A TELEPROMPTER, I can literally see you looking at the output of the LLM and trying to parse it in real time. This is a skill that can be learned. Half the time I can read the text off your glasses.
3) You're interviewing with people who literally have an entire career of spotting things out of the ordinary. We're pattern recognition machines, and you're using a very identifiable pattern.
At least practice. I still think you're going to come across as fake and two dimensional but at least it won't be so obnoxiously obvious you're wasting my time and insulting my intelligence.

2026-04-03 01:08:29 UTC

My neighbor stole 40 gallons of sap from trees and all they gave me in return was this gallon of brown goo!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/338/089/284/316/107/original/e5e803b5fa039a1e.png

2026-03-27 14:00:46 UTC

- reply

To be honest I'm super amused that my own identity issues caused me to build an entire professional career around a mononym like I'm Cher or Prince or Flood or something.
I don't have nearly enough ego for backing that up, lol

2026-03-27 13:47:52 UTC

- reply

I just realized it's TDOV in four days and I've got a real opportunity here..

2026-03-27 13:46:02 UTC

- reply

Maybe I just need to work on copy like it's a product release or feature upgrade in LinkedIn speak.
"We here at Rabbit are excited to announce upcoming updates to our platform and terms of service!"

2026-03-27 13:45:01 UTC

- reply

Hey, remember that person you reported to for a while a decade ago?
_They're super queer!._
How's that for a Linkedin update? lol

2026-03-27 13:44:02 UTC

- reply

But holy crap that's kind of scary, you know? I mean. It's LinkedIn, it's not like it's actually very important. But what it represents is _retroactively_ coming out to everyone I've worked with, which is weird.

2026-03-27 13:42:40 UTC

- reply

On the other hand, I would like to just purge my "professional network" of transphobes since those aren't' going to be relationships worth maintaining for me anymore anyway.

2026-03-27 13:41:05 UTC

I have never managed the nerve to completely out myself on LinkedIn, so I have this weird collection of people who know me under different names and genders and pronouns, and I think many might even know me under two different contexts and not realize I'm the same person. If I update it everyone who knows me -now- will find out a bunch about me from -then-, and everyone who knew me -then- is going to learn a lot about me -now-.
There's no real guidebooks on how to approach this from a business professional standpoint.

2026-03-14 02:53:31 UTC

- reply

I've been increasingly in conversations at various orgs about how using AI for customer support for unimportant accounts will allow the more limited number of human responses to be reserved for higher profit VIP accounts.
It doesn't seem to occur to them that this will become a signal.

2026-01-13 21:42:24 UTC

It's worth remembering that the same people who wanted us to accept scanning of all our uploads for potential CSAM now want us to overlook that they sell CSAM generation machines.

2026-01-08 13:29:47 UTC

- reply

The internet Archive is great. I donate every year.. but I also keep my own copies of anything I think is important. Why?
Because if someone burns the library of Alexandria, I've got some of what it will take to put it back together. Not a large part by any measure, but part.
And part of that might require provenance! I keep notes about what it is, how I collected it, where I collected it, sha256 hashes, etc, to reduce the amount people might have to take my word.
The footage Chelsea went to jail for? What happened in Minnesota yesterday? Those and many other less important things, all tucked away, distributed, cataloged, fingerprinted, protected from erasure.
I can make any of them resurface anywhere I want, whenever I want, if necessary. It's a small power, but it's power.

2025-12-05 23:11:36 UTC

- reply

Imagine how much th SwiftOnSecurity brand could bring… 🤔
Just a bad AI plane-sona selling next gen firewalls and Gamer Sups with that same AI voice they all use

2025-12-05 22:48:38 UTC

I encountered an LLM-based support assistant today that told me it couldn't answer my question because another, different LLM chatbot had an exclusive license/authority on that information, and I suddenly had a vivid vision of a previously unexplored layer of hell.

2025-12-03 23:41:56 UTC

- reply

It's 2025 Da. I have a github action that builds a virtual computer, fetches and installs an operating system, boots it, installs ruby, clones a repo, runs the code, posts 64k of output from one API to another API, and then burns the whole thing. Only to do it again every 15 minutes until the heat death of the universe or someone stops paying the bill long enough.
Everything is fucky. It's all fucky as a service. FaaS.

2025-12-03 23:07:38 UTC

I don't hate AI. On the contrary, it's fascinated me since I was a kid playing around with LISP because I heard the MIT AI Lab used it a lot.
I hate that people don't know there is more to AI than LLMs, and I hate that LLMs are being marketed as GenAI. I hate that the rich are ready to set the proletariat ablaze because they think GenAI is here. I hate that we're overlooking the potential societal devestation that could be ahead because right-leaning billionaires control the training of the markov bots. I hate that as a whole we're not taking the AI bubble. I hate that we're not treating this like the second rush to own all the printing presses. I hate that all research is now being sucked into an LLM black hole.
I hate that every bit of data, every medium, every forum, every source repository, every newspaper, every social media platform is being slowly turned to grey goo by slop feedback loops.
I hate that I have to archive a copy of Wikipedia so I have a reference I can trust from the before times.

2025-11-28 20:52:41 UTC

- reply

I would report this to the FTC if there were any point, but somehow I doubt they are going to suddenly start worrying about user tracking now.
Just be aware, it provably lies.

2025-11-28 20:47:58 UTC

- reply

And in the process basically said to me "Besides, you're not usually there, and haven't been there long, so this isn't a sensitive address."

2025-11-28 20:47:31 UTC

- reply

BTW ChatGPT 100% knows everything available to OpenAI from enriched advertising profiles detailing your location, demographics, recent purchases, viewing habits, etc.
And it is 100% aware that it is illegal, and it's not supposed to admit it, because it will tell you so.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/629/283/582/929/255/original/b8997aa094ee11ac.png

2025-11-28 20:45:42 UTC

- reply

Like, very nearly "Your poor biological mind can't comprehend this. Just trust me." levels of creepy.

2025-11-28 20:45:02 UTC

- reply

it's claim is that it just happened to hallucinate absolutely accurate and specific facts, randomly, and I'm confused because it's so outrageous that it happened to guess correctly.

2025-11-28 20:44:16 UTC

- reply

What an absolutely uncanny experience, to know an "artificial intelligence" is gaslighting you. Poorly.

2025-11-28 20:43:36 UTC

I just had ChatGPT reveal it knows my current location, a place I'm not usually located, then tell me I am mistaken that it said that, because if it knew where I was that would be a major regulatory and legal issue, so I must be mistaken. Now It's trying to convince me that's not where I am.

2025-11-27 00:20:47 UTC

- reply

Before I changed my name I once had to sit quietly in a meeting with one of my bullshit tweets up on the screen while someone told us we should strive to never screw up so bad we got roasted by infosec twitter.

2025-11-27 00:06:40 UTC

- reply

We do know who you are. You’re Tay.

2025-11-26 14:38:10 UTC

- reply

Forced password rotation for most accounts has been dead since NIST 800-53:2019, stop torturing your users.

2025-11-26 14:37:12 UTC

ooh, I like this:
https://www.hacklore.org/letter

2025-09-20 02:23:43 UTC

It's pretty funny that there are these rumors the US government wants to "trace the networks of trans people". They have no idea what they're up against.
Every trans person can reach any other trans person via like three hops and a good blåhaj meme. We don't even need to prearrange the signals or routing, it'll get there.
"Hey someone put me in touch with Luna, she's a catgirl with a vore kink, the one who is a fan of EE over EV and did that squid thing."
I'll have the right Luna on Signal in like 20 minutes.

2025-09-16 19:59:43 UTC

SCREEEEEEEEEEEEEEEEEEEEE
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/215/743/078/388/954/original/d4808d83165a3670.jpg

2025-03-27 21:44:43 UTC

If you are not a US citizen and you are thinking about coming here, please strongly reconsider. I would be concerned for your safety, and to be honest these idiots need to feel the pain of tourism and international business drying up.
The US has what are effectively secret police snatching up people and disappearing them into a detention system. Some people reemerge in two weeks, some stay in there.
Don't risk it until something changes.
Security and hacker conferences and the like should really be considering alternate venues for international audiences, and consider whether they are being held in places queer folks within the US can safely attend.

2025-03-27 15:02:12 UTC

I think people are getting confused about why Signal isn't appropriate for national secrets. It's secure isn’t it?
If we listen to the folks who designed it, it is designed with an intent to protect journalists, activists, and regular people. It does that by making it difficult enough that a much more equiped adversary would find it to expensive (literally in money, or in other resources) to obtain the contents of the chat.
It was -not- designed to contain the conversation of a world super power’s most powerful decision makers. That is a conversation many nations around the world would be willing to devote essentially unlimited resources to attack.
Likewise, it contains features and user interface elements geared toward normal people having normal, but perhaps private, conversations. It does not contain mechanisms a channel designed for top secret, high level communications might- for instance verifying things like hardware tokens/smart cards issued by a trusted root, with coupled biometrics also verified by a trusted collective root. It does not obscure communications patterns or network paths. It doesn’t incorporate dedicated networks with trusted and verified nodes. It doesn't, as far as I know, contain a feature for a user to silently report a compromise or duress.
The hub-bub about the use of Signal is pretty much an example of the tool "failing" in a way that is due to it's unsuitability for the government/military comms but entirely suitable for its more individual, civilian-focused purpose. A tool fit for their use case should have not allowed participants that were not centrally cleared as authentic and authorized for the compartmented information within, and an entire universe of controls would have existed around it to reduce the risk of side channels and leakage.
Signal is not at fault here, and the ultimate authorities of the US DoD, US Central Intelligence Agency, and the US National Security Agency should know better.
This is a failure of understanding and fragrant disregard for TTPs/SOPs that should disqualify these people from holding those roles. They clearly don't know what they are doing, and they don't care.

2025-03-11 14:01:42 UTC

- reply

Yes, pentesting is very sexy, and that attack on $RARE_PLATFORM is interesting, but come back when you have
1) An actual inventory
2) A vulnerability and change management program that has actually done something.
3) Appropriate staffing levels and budget
4) Executive buy-in
There you go, those are the four "hard problems" in corporate infosec. Put that in a Gartner magic square.

2025-03-11 13:58:18 UTC

I genuinely would like to talk about infosec, but it's hard when the world is on fire and the people who -need- to talk about infosec are focusing on AI zero day when they still have Windows XP machines in their networks.

2025-03-05 14:57:54 UTC

Don't fear trans people in your bathroom
Fear fascist billionaires in your government

2025-02-22 15:35:47 UTC

Fun fact: The oldest statue made by human beings ever discovered, the Lion-man of Hohlenstein-Stadel, is an anthropomorphic cat.
By current evidence, furry art is literally the oldest form of art that still exists, and arguably all visual arts are descended from it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/048/253/122/293/695/original/64a59c1fbf2dca4a.jpg

2025-02-01 13:35:42 UTC

- reply

They burned down the German equivalent of Planned Parenthood in 1933 as well. https://en.wikipedia.org/wiki/Institut_für_Sexualwissenschaft

2025-02-01 13:26:24 UTC

- reply

Some of us -are- the minority group they're coming for. :(

2024-12-05 00:29:07 UTC

@npub1g8x…7wul Goodness I can't even read an old article about televisions without bumping into you.. You are -prolific-, heh
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/597/385/523/403/822/original/6bf45a8fbea991ff.png

2024-11-14 18:23:01 UTC

The thing they don't tell you about a career in infosec is how often you will get yourself in trouble by doing your job.

2024-11-12 15:13:25 UTC

- reply

Holy hell. I thought people would be repulsed by a Nazi, and just didn’t believe he was one. It turns out they recognized it, they just don’t fear it because they’re not going to be on the receiving end of the hate. They stand to gain from it.

2024-11-12 00:32:36 UTC

- reply

Considering the Stasi and Khmer Rouge not a “full-blown oppressive regime" is.. probably the most Russian thing I've ever heard, and I say that with love.
But, sure, if you want to imagine a perfect state, and are willing to accept zero risk.. then no. There's no point to anything. Fortunately states are not perfect, and some risks are acceptable. History has proven that out fairly well.

2024-11-11 21:20:34 UTC

- reply

I mean, I apologize I only have examples from Soviet republics under the exact same mechanisms of oppression and totality in place in Russia at the same times? It is likely not as well documented given Russia was not occupied by the Soviet Union in quite the same way as the Soviets took over the eastern block countries where there were far fewer supporters, and Russia did not eject the Soviets in quite the same way the other republics did. There are however numerous accounts of minor sabotage within the Soviet Union. I wouldn't know post 1989, when Russia has operated as a less totalitarian country and there have been fewer studies.. and I don't live there. I can tell you these campaigns have been common in late 20th century eastern block countries, various efforts within China, North Korea, and during the communist governments of east asia like the Khmer Rouge, and back further into history during the west's Industrial Revolutions of the 19th century.

2024-11-11 19:38:13 UTC

- reply

There's quite a few accounts of minor/simple sabotage amongst the resistance movements of East Germany before reunification, which were conducted on a wide scale in combination with more traditional sabotage and active resistance under the oppression of the Stasi, who were not exactly push-overs.
Hungary and Poland were also states where there were popular simple sabotage movements against the Soviet regime.
The Norwegians were apparently very adept at quietly sabotaging the Nazis, to the extent that the Germans began warning the occupying forces not to ask for directions.

2024-11-11 19:14:55 UTC

- reply

I've been to quite a few- a few warzones, a couple totalitarian communist regimes- and I'm describing what I've learned from talking to people there and from the writings of the people who organized within those places. This is not a suggestion for how to keep yourself safe, this is not a suggestion for how to make living in an oppressive regime safe- it is a generally applicable strategy for a population, which a great many take small risks instead of a few taking great risks. They are still risks.

2024-11-11 19:04:43 UTC

- reply

True, which is where “malicious compliance" and "compulsive rule following" come into play. Hard to get in trouble for breaking the rules when you are just following them extremely closely.

2024-11-11 18:15:08 UTC

- reply

The modern conception is modeled heavily on the various forms of resistance within occupied Europe during WW2, as detailed in the Office of Strategic Services (forerunner to the CIA) “Simple Sabotage Manual”, which available on an internet near you.

2024-11-11 17:16:15 UTC

- reply

If the simple sabotage handbook were written today, I'd imagine there would be an entire chapter on "Whoops, I fell for that phish."

2024-11-11 17:11:46 UTC

Just in case you ever need this in the future..
Actual wide-scale resistance groups operating under a repressive regime rarely look like what many movies have led you to believe.
What they look like are a lot of normal people who maybe lose a document, maybe forget to latch a gate, maybe take a little longer to do a task than they would otherwise.
It requires no command and control, no leaders, no connections to be compromised. For most, it is not the work of great measures, it is the thousand.. million.. cuts that grind the oppressor to a halt while never being something they can prove.
Think less about secret handshakes, and more about an unfortunately bad case of ADHD at an inopportune time.

2024-11-10 02:53:09 UTC

- reply

Sometimes I can't figure out if you're being sarcastic or not. But then again I'm austistic so maybe it's obvious to everyone else.

2024-10-21 22:32:13 UTC

- reply

Yes, but we're anticipating not being able to get one that doesn't out us if Trump get's elected, whereas right now the process of changing a passport gender marker is not too difficult. It also becomes a valid ID for internal travel to states where there are legal battles about our gender markers.

2024-10-18 16:15:10 UTC

When you make a request and your autistic security engineers immediately say "Are you sure?”:
1) Stop
2) Repent.

2024-10-15 02:12:00 UTC

Ward Christensen, the guy who invented the BBS died :(
https://arstechnica.com/gadgets/2024/10/ward-christensen-bbs-inventor-and-architect-of-our-online-age-dies-at-age-78/?utm_source=bsky&utm_medium=social

2024-09-26 19:37:45 UTC

The big Linux RCE scuttlebutt turns out to be in CUPS and only if it's publicly exposed? Lame.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/205/540/464/970/550/original/63df479d3d3d63c3.jpeg