Bill

I break software.

Blog: https://sempf.net
OWASP: https://owasp.org/www-chapter-columbus/
Github: https://github.com/sempf
Amateur Radio: KE8PCT
POINT: https://pointweb.net
Header: Medeco Biaxial

Public Key

npub19qjlalzvwsy6jeg99nd8hl7a9v80rv7qjmagla3g624fhcc33m0qvmeda3

NIP-05 Address

sempf_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqszsf07l3x8gzdfv5zjeknmllwjkrh3k0qfd7507c5d925muvgcahspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dszazfms

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub19qjlalzvwsy6jeg99nd8hl7a9v80rv7qjmagla3g624fhcc33m0qvmeda3

Show more details

Last Notes

2026-09-02 23:38:07 UTC

- reply

did you see that the Department of Justice is announcing an investigation as if they discovered it themselves?

2026-08-03 03:41:33 UTC

HAHAHAHAHA<gasp>HAHAHAHAHA!!
Really now? Y'all think that's the answer? Creative, I'm sure.
https://securityaffairs.com/196453/ics-scada/cisa-urges-utilities-to-remove-internet-exposed-plcs-after-minnesota-attacks.html
#cisa #ics

2026-07-15 23:12:17 UTC

- reply

I have a friend testing Mac. I can test Linux later.

2026-05-22 23:14:16 UTC

- reply

No, it's UNIX.

2026-05-22 19:44:46 UTC

I got to say testing on a Mac with its crappy Windows management really makes you look like a hacker. You have little teeny halves of Windows sitting all over your screens and they're all moving most of the time. It looks like a movie hacker honestly.

2026-05-21 03:41:48 UTC

The GitHub breach last night was worse than reported. 4000 or so private repos for sale on Tor. LAPSUS$ is claiming it's for sale already but it isn't on their release site.
https://thehackernews.com/2026/05/github-investigating-teampcp-claimed.html?m=1
#github #breach

2026-05-20 23:29:17 UTC

First Apple harvest! #gardening
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/609/495/824/131/955/original/edaddd2fbe4c514c.jpg

2026-05-19 19:53:11 UTC

- reply

I've had that happen on tests just because of a misconfigured http server.

2026-05-19 15:45:26 UTC

- reply

Oh yeah, that would make it unclear. Not particularly unexpected, though. Open AI is not exactly stellar at marketing.

2026-05-19 11:10:51 UTC

- reply

Oh BRUCE'S headline. Roger that. Yeah, it's likely he meant to do that. Didn't think of it that way!!

2026-05-19 02:44:27 UTC

- reply

I guess I've lost the thread here. Who is owning who in the title?

2026-05-15 23:46:42 UTC

- reply

What, you didn't hear?

2026-05-15 20:11:10 UTC

- reply

Ok, FINE.

2026-05-15 19:02:29 UTC

- reply

So what you all are telling me is that I need to go on LinkedIn, make a new post, and just simply put in the meme of the guy sitting in front of the park with the sign hanging on the table that says "AI agents are just fancy cron jobs. Change my mind." Is that what you're telling me to do?

2026-05-15 17:36:14 UTC

Ok. I have a request.
I would like a pro AI person (I know there are not very many people on here like that), but I'm going to try, before I go to LinkedIn (which I don't want to do), to explain to me why an AI agent isn't just a fancy cron job. I made the joke the other day about getting thrown out the window when I made that phone call, and that joke wasn't a joke. That phone call happened, and it was an unpleasant conversation. Honestly, I want an actual answer to how an AI agent differs from Systemd, Windows Service, anything like that, aside from the fact that it's connected to an LLM.

2026-05-15 16:56:13 UTC

- reply

Well shit.

2026-05-15 16:55:59 UTC

- reply

Да, но необходимо.

2026-05-15 16:22:24 UTC

Huh, the translation service is borked.

2026-05-14 17:10:15 UTC

- reply

That is also not wrong.

2026-05-14 17:05:03 UTC

- reply

And they aren't wrong. That's the kicker.

2026-05-14 14:28:20 UTC

- reply

And @npub12as…yvvc for spices, we are golden.

2026-05-14 14:25:15 UTC

- reply

my goat farm is already on order.

2026-05-14 14:24:57 UTC

- reply

roughly translated as "Please buy our stock so our executives actually get paid."

2026-05-13 11:21:14 UTC

- reply

Damn this is well written.

2026-05-13 01:52:58 UTC

Fuck cancer.

2026-05-12 13:53:50 UTC

- reply

Hmm.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/561/937/911/768/360/original/0c443b0a7d34e3c1.png

2026-05-12 13:43:40 UTC

- reply

Birds are friends. Unless they are food.

2026-05-12 13:23:42 UTC

Good morning from the Sempf Compound. Go outside today, it's good for you.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/561/817/067/452/763/original/56dd8dec7d891dff.jpg

2026-05-12 11:05:56 UTC

- reply

Aww come on.

2026-05-12 03:48:38 UTC

AI Agents are not programs. They are digital workers.
Discuss amongst yourselves.
https://stateofsecurity.com/ai-agents-are-already-working-for-you-whos-managing-them/
#agenticai #identity

2026-05-11 14:32:21 UTC

- reply

Now that I think about it, with you being a crow, it wouldn't be that big of a deal!

2026-05-11 14:29:52 UTC

- reply

🪟

2026-05-11 14:27:47 UTC

Woo. Don't call AI agents "cron jobs" in a meeting of AO bros. They will throw you out the window like on that one web comic meme.

2026-05-08 02:26:17 UTC

Do I know anyone at Halock?

2026-05-05 14:48:12 UTC

#copyfail
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/522/513/990/834/833/original/03f5e928a7eada44.jpg

2026-05-04 03:11:25 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/514/111/945/358/083/original/1598fcf35e879618.jpg

2026-05-02 14:13:18 UTC

My township makes announcements and whatnot on Facebook. If it is a long post, you can only see so much before logging in. So, if I want to get information about my local government, I have to ask Mark Zuckerberg.
Something is very, very wrong with that.

2026-05-02 13:55:39 UTC

- reply

I know a guy.

2026-05-02 13:53:42 UTC

You know it is gonna be a good day when it starts off with a hot steaming mug of sudo apt update -y && sudo apt upgrade -y

2026-05-01 20:23:14 UTC

- reply

Hell yeah. 4:19 check-in, 4:20 check out.

2026-04-30 12:27:32 UTC

- reply

I think it is less malice and more disorganization.

2026-04-27 19:28:58 UTC

Any appsec people looking for a BIG job? Fidelity Investments is looking for an appsec lead. If anyone is interested, I can shoot you their email.
#getfedihired

2026-04-23 18:54:35 UTC

In other news, Amazon Music has a builtin playlist called "Intense angry rock music to fuel your rage." No, not kidding.

2026-04-23 02:14:41 UTC

- reply

Baratza Encore. Only way to fly.

2026-04-22 20:39:29 UTC

- reply

finger -m gayint

2026-04-22 02:40:56 UTC

Does anyone know if what CISA is putting out post-Jen is worth looking or is just like the rest of the anal flem this administration produces? I mean, for realz inside knowledge?
https://thehackernews.com/2026/04/cisa-adds-8-exploited-flaws-to-kev-sets.html
#cisa #kev

2026-04-20 15:24:31 UTC

- reply

Ermagerd. That's a name I haven't heard in a long long time.

2026-04-18 13:28:41 UTC

- reply

Hey, at least you spelled meathead right.

2026-04-17 18:05:22 UTC

- reply

It's been nice knowing you.

2026-04-17 15:56:08 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/420/860/819/378/014/original/0ef4634e5fd8ab18.png

2026-04-16 16:46:54 UTC

My daughter just came home with a strawberry plant. We don't have terraces set up or anything. Anyone got any quick n dirty tricks? #gardening

2026-04-16 03:46:41 UTC

A design flaw in the MCP protocol. Whoda thunk. Honestly even back when they were first discussing MCP in 2024 I worried about that. Supply chain is enough of a mess, now this?
https://www.securityweek.com/by-design-flaw-in-mcp-could-enable-widespread-ai-supply-chain-attacks/
#mcp #vulnerability

2026-04-13 15:14:44 UTC

Bloomberg is covering Mythos. The journalists are VERY skeptical, and the AIBros are all like "THIS SHOULD BE A GLOBAL LAW EVERYONE SHOULD TEST WITH THIS AAAH WE ARE ALL GONNA DIE."
OH man they have Kara Sprague on and she is speaking truth. THANK goodness.
And now it's kreiger "OH NOT THIS IS REALLY GOOD YOU SHOULD USE IT YOU DON'T WANNA GET HACKED DO YOU?"
Kara: "Um, that's not how any of this works."
God I'm loving this. And she's just so polite.
I would not be so polite. That's probably why I am not on Bloomberg. Or a CEO. Or, well, yeah.

2026-04-10 17:42:20 UTC

- reply

And that begs the question as to whether the problem is with the technology or the problem is with the shitty way that people use it. I think we both agree that the latter is a more significant problem.

2026-04-10 16:15:02 UTC

- reply

https://www.lindau-nobel.org/blog-nobel-prize-in-chemistry-2024-protein-folding-and-ai/

2026-04-10 14:40:57 UTC

- reply

"spices"

2026-04-09 18:47:44 UTC

- reply

But out of curiosity, are you getting questions from your management? None of my clients have said a word one, and several of them are very AI focused.

2026-04-09 18:45:29 UTC

- reply

I believe that is exactly correct. As I mentioned somewhere, open up a developer console on any browser on any website of any size and significance, and you'll see 7,000 vulnerabilities in the JavaScript. Absolutely none of them are exploitable for anything useful at all. They don't really matter, and I would imagine that 99.997% of the things that are showing up in this magic report are going to be exactly like that.

2026-04-09 18:42:04 UTC

- reply

You should start a blog. Oh, wait.

2026-04-09 18:28:36 UTC

- reply

When you say your risk models remain unchanged, does that mean you are not receiving pressure from management to change them due to Glass Wing, or that you already have and you're not changing them back?

2026-04-09 18:11:07 UTC

For those getting questions about Glasswing from their executives, give them this article.
https://tryaether.ai/blog/anthropic-glasswing-frontier-attack

2026-04-09 16:49:45 UTC

- reply

A microwave. A microwave deletes the messages.
Or a 38. That works ok too.

2026-04-09 01:27:06 UTC

- reply

/me peeks in the door.

2026-04-08 14:16:07 UTC

Oh look. I need to not be on social media today.

2026-04-08 03:10:08 UTC

Good writeup on @npub12xh…zxeq's recent efforts.
https://securityaffairs.com/190400/breaking-news/experts-published-unpatched-windows-zero-day-bluehammer.html
#0day #microsoft

2026-04-07 19:45:46 UTC

- reply

“”::

2026-04-03 02:30:46 UTC

Anyone feel the under boomer in the bay area?

2026-04-02 15:31:39 UTC

- reply

Let me guess. It was vibe coded, right?

2026-04-01 19:18:07 UTC

- reply

All you can do now is share the joy.

2026-03-26 20:45:42 UTC

- reply

Well, if you wanna be really picky sure. Honestly find me a mail app that doesn't fit that, broadly.
But outlook actively prevents the user from doing good work, and that's inexcusable. I don't think you can say THAT about Eudora or Thunderbird. Outlook just tries to do too much.

2026-03-26 19:33:25 UTC

Outlook needs to die in a fire. It has become unusable.

2026-03-24 20:08:36 UTC

- reply

You can do that? With a partial string match like that? Zesty.

2026-03-17 19:53:30 UTC

Oh look, the creator of OpenClaw is going to speak at Microsoft Build!
Not often they feature malware authors but there ya go.

2026-03-14 21:25:04 UTC

With @npub1tnw…dc6y at Fan Expo. Looking at some fandom knockoffs. Funnier than hell.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/229/628/182/321/810/original/1609488694ba3b57.jpg

2026-03-07 17:42:00 UTC

Tank, I need an exit.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/189/104/742/344/321/original/30b29b100bbb7e5c.jpg

2026-03-06 22:13:30 UTC

Uhyup
#claude #orly
h/t @npub19tz…epzc
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/184/520/223/163/968/original/1343e7db2575d159.png

2026-02-25 16:42:55 UTC

- reply

moldy ...
cumbubble ... ?

2026-02-18 17:29:57 UTC

- reply

Well stated.

2026-02-18 16:54:12 UTC

- reply

It is far easier to write junk than write good code with AI consoles. I'm not sure what's gonna happen with that. But remember VB4? How EASY it was to just generate unmaintainable shit? Now we have that on a logarithmic scale. Yay?

2026-02-17 04:48:05 UTC

Bring out yer path traversal memes!!
https://seclists.org/fulldisclosure/2026/Feb/10
#linksys #vulnerability

2026-02-16 19:33:57 UTC

- reply

that is really nice! Did you build the store, or is it an open source product? It's very easy to use.

2026-01-30 04:41:01 UTC

The @npub1m24…d9a3 is setting up a push for e2e encryption. Worth doing.
https://encryptitalready.org/
#eff #privacy

2026-01-14 03:46:41 UTC

Mr. Schneier has a salient reminder from the Hackers' Manifesto.
https://www.schneier.com/blog/archives/2026/01/1980s-hacker-manifesto.html
#hacking #philosophy

2026-01-10 13:29:55 UTC

At the time, I knew @npub1nrx…m4fy was right to leave the US. I did not, however, expect the turning point showing how right she was to be this swift, egregious, and devastating.

2026-01-02 22:56:30 UTC

You know when you have that one piece of firewood that you can't get a grip on? This one took me a while to get right.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/827/970/036/278/472/original/8ee2a665097eaf6d.jpg

2025-12-29 14:39:56 UTC

- reply

And she isn't wrong. But things are moving at a remarkable pace, and sometimes what goes around, comes around.

2025-12-29 14:37:31 UTC

- reply

In general, I love the idea of "parental controls" are for the mid-aged to control what their parents can see online.

2025-12-24 05:07:58 UTC

"Bringing back LimeWire to illegally rip copies of reporting suppressed by the government is definitely some cyberpunk shit."
https://arstechnica.com/tech-policy/2025/12/yo-what-limewire-re-emerges-in-online-rush-to-share-pulled-60-minutes-segment/
#censorship #uspol

2025-12-18 03:47:56 UTC

I just got a recipe from my stepmom. Vanilla strips, they are good, maybe I'll post it if she's OK with it.
It is an emailed photo of a laptop screen with a facebook post that has an image which is a photo of the index card it was written on in '62.
Archeologists are gonna be so confused when they open the vault.

2025-12-13 21:47:50 UTC

- reply

You are glad you aren't watching. President Yamtits is there.

2025-12-13 21:36:55 UTC

- reply

Are you watching the game? You gotta see the uniforms. I mean they are amazing and cool as art but SCREAM 1939 Germany.

2025-12-13 21:27:04 UTC

Someone posted a funny meme about the department of defense following Marco of times new Roman fame and changing the font to some ornate gothic font.
And then I see the army uniforms for the army navy game.
#cfb

2025-12-10 22:11:13 UTC

🏈 Goddammit Michigan #cfb

2025-12-08 13:00:27 UTC

- reply

Sorry, slow morning.

2025-12-01 03:43:43 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/642/243/498/441/640/original/57cfaf0cd30a3e81.jpg

2025-11-27 04:42:30 UTC

Threat intel is utterly impossible. Look at this. All from a fake browser update. One person, just clicking on a website causes all of this. How do you create a threat model for this shit?
https://thehackernews.com/2025/11/romcom-uses-socgholish-fake-update.html?m=1
#threatintel #blueteam

2025-11-24 19:25:47 UTC

- reply

Saw that. I don't even know what we are going to do.

2025-11-24 19:24:17 UTC

- reply

My father in law has one of those. I'll go sniff traffic and report back.
Can we not catch a break ANYWHERE?

2025-11-15 04:41:19 UTC

Bruce stretches his anthropology chops.
The Role of Humans in an AI-Powered World
https://www.schneier.com/blog/archives/2025/11/the-role-of-humans-in-an-ai-powered-world.html
#ai #philosophy

2025-11-09 16:11:53 UTC

Old farts of mastodon, unite. I'm looking for replacements for my Merrills. Their quality has just gone to shit. I need something that slides on, has the same toughness as Merrills, I can fit my orthotics in them, and that are still fairly warm.
#shoes