Taggart :ifin:

Displaced Philly boy. Threat hunter. Educator. :ifin: Executive Director. #infosec, #programming #rust :rust:, #python :python: #haskell :haskell:, and #javascript :javascript:. #opensource advocate. General in the AI Resistance. Runs The Taggart Institute (npub1mgl…z233). Made https://wtfbins.wtf. Not your bro. All opinions my own. Dad. #fedi22 #searchable

Pronouns: He/him.

The Taggart Institute: https://taggartinstitute.org
Blog: https://taggart-tech.com
Codeberg: https://codeberg.org/mttaggart
YouTube: https://youtube.com/taggarttech
GitHub: https://github.com/mttaggart
Keyoxide: aspe:keyoxide.org:G4ADJFWICZZZXGR4STZQVMBJNM

Public Key

npub1yg8lnapwc8yyd0m32jcfdp7k28hwmsvtsqc59rsj6d6d0m3mynqs7tccz0

NIP-05 Address

mttaggart_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqszyrle7shvrjzxhac4fvykslt9rmhdcx9cqv2z3cfdxaxhacajfsgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds56mwxf

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1yg8lnapwc8yyd0m32jcfdp7k28hwmsvtsqc59rsj6d6d0m3mynqs7tccz0

Show more details

Published at

2026-05-27T21:27:34Z

Kind type

0 Metadata

Event JSON

{ "id": "831f6e9c108c639a9162eca92a4749a5d1ee020e1d36e9d1b9b779ec7aff9595", "pubkey": "220ff9f42ec1c846bf7154b09687d651eeedc18b8031428e12d374d7ee3b24c1", "created_at": 1779917254, "kind": 0, "tags": [ [ "emoji", "ifin", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/663/935/original/d4a896a001495b7f.png" ], [ "emoji", "rust", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/029/155/original/c0a6c76c4e012ab5.png" ], [ "emoji", "python", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/029/197/original/3a384cedbffde920.png" ], [ "emoji", "haskell", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/028/818/original/35ece0354386bf51.png" ], [ "emoji", "javascript", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/029/136/original/02529a2e0c7ee0f6.png" ], [ "t", "infosec" ], [ "t", "programming" ], [ "t", "opensource" ], [ "t", "python" ], [ "t", "haskell" ], [ "t", "javascript" ], [ "t", "rust" ], [ "t", "searchable" ], [ "t", "fedi22" ], [ "proxy", "https://infosec.exchange/users/mttaggart", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.exchange/users/mttaggart", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Taggart :ifin:\",\"about\":\"Displaced Philly boy. Threat hunter. Educator. :ifin: Executive Director. #infosec, #programming #rust :rust:, #python :python: #haskell :haskell:, and #javascript :javascript:. #opensource advocate. General in the AI Resistance. Runs nostr:npub1mglxsy2zlzkshk8876h5jg5we6gutx8gwu56futa3wrz4pdm885s4ez233. Made https://wtfbins.wtf. Not your bro. All opinions my own. Dad. #fedi22 #searchable\\n\\nPronouns: He/him.\\n\\nThe Taggart Institute: https://taggartinstitute.org\\nBlog: https://taggart-tech.com\\nCodeberg: https://codeberg.org/mttaggart\\nYouTube: https://youtube.com/taggarttech\\nGitHub: https://github.com/mttaggart\\nKeyoxide: aspe:keyoxide.org:G4ADJFWICZZZXGR4STZQVMBJNM\\n\",\"website\":\"https://infosec.exchange/@mttaggart\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/108/196/880/698/187/602/original/0cef8947c107a7a8.jpg\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/108/196/880/698/187/602/original/1a834b355f8a1f41.jpg\",\"nip05\":\"mttaggart_at_infosec.exchange@momostr.pink\"}", "sig": "19e9b7aaeaae997a1dde8df25fc27ea3aeb84cf33c997c41d38b351cbc28ae99f2c85bb6f38d89fc84f00165a096482e119b1fbd0b3c6ab3248d0c1504e25189" }

Last Notes

2026-05-14 13:46:35 UTC

If you think folks are going to let things like this get built in their communities and operate with impunity, you have another thing coming. I'm not saying they *should* be sabotaged; I'm saying they positively *will* be.
https://www.yahoo.com/news/articles/ai-data-center-bigger-2-124356503.html

2026-05-11 16:53:57 UTC

Truly phenomenal work from @npub1h4k…hfeg here. A breakdown of the timeline of the Ubuntu attack, the business behind the booter service, and Cloudflare's problematic role.
https://www.flyingpenguin.com/can-someone-please-explain-whether-cloudflare-blackmailed-canonical/

2026-05-05 00:21:15 UTC

- reply

The login page for the service is protected by Cloudflare, and the pages/API are as well. Ironically Cloudflare is doing more to protect Beamed than Ubuntu.

2026-05-04 19:45:29 UTC

Hey @npub1ufh…mjqv, how come you're protecting beamed[.]st, the DDoS service that's attacking Ubuntu? It's an obvious criminal enterprise that literally advertises botnet access.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/518/022/518/570/386/original/f50b1d79e2610926.png

2026-04-24 21:58:23 UTC

Been a while since I've gotten to do real malware analysis. That was fun!
https://discourse.ifin.network/t/winos-4-0-holdinghands-expanding-beyond-asia-an-opportunistic-analysis/316

2026-04-23 19:23:06 UTC

Call me a fake fan if you must but my daughter's formative memories of the Phillies cannot be...this

2026-04-22 05:39:05 UTC

- reply

Lmaooo
> Using Chronicle increases risk to prompt injection attacks from screen content. For instance, if you browse a site with malicious agent instructions, Codex may follow those instructions.
One wonders how many things it will OCR into a prompt injection. Utter clownshow of a technology.

2026-04-22 01:47:31 UTC

Oh my god, OpenAI reinvented Recall, but for macOS.
"Chronicle" is an opt-in feature that scans your screen, saves screenshots temporarily, and sent to OpenAI's servers.
https://developers.openai.com/codex/memories/chronicle

2026-04-22 01:26:46 UTC

- reply

Lotta "Well he's not *actually* a Nazi" replies. Look:
The term is loaded. It absolutely is. But if, in this age, someone has vociferously advocated for
*checks notes*
racial purity in their public writing, I think they surrender the benefit of the doubt. And I'm not waiting for them to line people up before I decide it's a problem.
More simply: racist scum don't need your advocacy.

2026-04-21 19:31:21 UTC

- reply

Listen, I have a Framework. It's a great laptop—maybe the best I've ever had. But I can't support a company that funds, in any form, an actual real-life Nazi like DHH. I also need them to, y'know, take ownership of the massive misstep doing so is/was.

2026-04-21 19:27:28 UTC

- reply

https://gardinerbryant.com/the-omarchy-framework-thing/

2026-04-21 19:20:15 UTC

Yo did we forget about the Framework-funding-fash thing or

2026-04-20 16:56:32 UTC

What happens when you must wonder if *everything* you read is synthetic, meaningless, intentionless wordloaf? What happens when most of the text around you actually is?
This is not about economics. It's not even about climate. It's about the damage to the metaphysical fabric of human existence.
https://www.mississippifreepress.org/editors-note-we-unknowingly-published-an-ai-column-by-a-fake-author-heres-what-happened/

2026-04-20 15:07:29 UTC

RE: https://mastodon.social/@kepano/116437577915147647
Honestly hard to tell who hates their customers more: Atlassian or Broadcom, but this is a strong entry from the former.
#note178z…zxwf

2026-04-20 14:22:12 UTC

Some exciting news! #Ringspace finally has browser extensions in browser stores! This means folks operating Ringspace webrings and member sites can use these extensions to validate their membership and standing.
Chrome: https://chromewebstore.google.com/detail/ringspace-extension/dhnifdbjepgpcnhoofjfeieimlaaomea
Firefox: https://addons.mozilla.org/en-US/firefox/addon/ringspace-extension/

2026-04-20 13:20:58 UTC

I've been seeing this extension all over and wasn't sure exactly what folks were doing. Turns out, they weren't doing anything. Claude for Desktop is secretly installing this thing that activates when one of three other extensions are also present.
https://www.thatprivacyguy.com/blog/anthropic-spyware/

2026-04-19 14:35:08 UTC

Useful explainer on the latest Citrix shenanigans, including verifying exposure and hunting/forensics recommendations
https://www.picussecurity.com/resource/blog/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread

2026-04-19 02:55:44 UTC

- reply

To yet again borrow from G.K. Chesterton, the perfectly disciplined software development process has not been tried and found hard, it has been found hard and never tried.

2026-04-19 02:55:39 UTC

I wonder what the overlap is between developers who think there's nothing wrong with C/C++ because "if you're good" you can write memory-safe code at scale, and developers who believe you can make generative code safe and secure with the "right guardrails."

2026-04-17 22:39:19 UTC

More coherent than IPv8
https://www.ietf.org/archive/id/draft-meow-mrrp-00.html

2026-04-17 15:50:02 UTC

- reply

and @npub1s6e…n008, this is your callup

2026-04-17 15:41:58 UTC

Persona is handling this "feature." They're not being subtle about telling you who they are!
https://support.claude.com/en/articles/14328960-identity-verification-on-claude

2026-04-17 05:04:36 UTC

Because of the outage, I had the Bluesky tab in my browser closed most of the day.
Turns out, I missed it not at all. And I felt better.
Maybe it's my own feed curation, but that place has just become a concentration of misery for me. It's not really making me more informed, just more upset. I don't really need that.
I'll still post, but I don't think I'll keep checking it regularly.
This still feels like home. Still glad I found my way here.

2026-04-16 13:46:53 UTC

- reply

Hey not to be that guy but this feels like maybe a human didn't write this.

2026-04-16 11:55:17 UTC

Imagine testifying in court that you relied on a forensic tool known to make stuff up.
Defense attorneys are gonna love this one.
https://www.autopsy.com/autopsy-4-23-0-release-claude-ai-assistant-mcp-cyber-triage-integration/

2026-04-15 13:45:05 UTC

RE: https://social.coop/@cwebber/116408556882122186
I wrote a bit about the CA law, and I am of the opinion that it's silly and unenforceable as written, but not the end of the world. I also think it was important that the Governor (who sucks) basically begged for amendment before it went into effect. I suggest an exemption for open source. The text of the Congressional Bill has yet to be published, but if your reps are on the Energy and Commerce Committee, now's the time to make noise to them.
https://taggart-tech.com/ab-1043/
https://energycommerce.house.gov/representatives
#note106z…mh0l

2026-04-15 13:36:14 UTC

- reply

FWIW, the California legislation was *opposed* by big tech's lobbying firms. IMO what we have here is a fundamental disconnect between technical people and non-technical people in understanding how to address a perceived issue (the internet is scary for kids). Polling consistently shows broad support for this issue, which is in part why this is a bipartisan bill.
I'm not agreeing with it; I'm just saying the motivations might not be from Big Tech itself.

2026-04-14 19:18:30 UTC

I'm immune to LLM sycophancy because I'm terrible at taking a compliment.

2026-04-13 18:52:53 UTC

- reply

I mean I think the point was that this is a pattern observed in the past by specifically these actors, and that in this moment, it's worth reconsideration.
Now granted, CISA does not cite their sources, but the claim was this exploitation was happening anew. And if it was similar to the CyberAv3ngers situation, they wouldn't be shy about claiming credit.

2026-04-13 15:57:10 UTC

- reply

Yes, better solutions can take time to implement. I don't know why you're discounting the harms of age verification regimes, which are no less onerous and destructive to privacy/supportive of surveillance states, etc. And worse: they just don't work for the intended purpose, which was my original point.

2026-04-13 14:40:13 UTC

- reply

When it comes to social media (and AI for that matter), there is a galaxy of regulatory options besides outright banning and age verification. Exploring those benefits all, not just minors. As an example, severe penalties for designs found to promote addictive usage.

2026-04-12 21:37:51 UTC

It was my job for a decade to try to keep tweens and teens safe online. Let me tell you what you already know: no law or technology can do it. There are no lengths kids won't go to to talk to friends without prying eyes. The harder you try to lock it down, the dodgier their solutions will be.

2026-04-11 22:10:54 UTC

If you're forced to use gen AI at work, there's a really useful government manual from the 1940s that might be worth a read. I'm sure you can find it.

2026-04-11 15:50:56 UTC

RE: https://mastodon.social/@AltTextHealthCheck/116318070750735303
Pretty disappointing, i.e. We can do better.
#note17w4…3q9j

2026-04-10 19:40:33 UTC

- reply

That's how we got koobernoodles
@npub1wdx…gg3t @npub1ppq…vmcz @npub1hq3…pxge

2026-04-10 13:35:02 UTC

- reply

I can already see it happening, and it's already driving me crazy. For people so interested in math, counting (qubits) seems remarkably challenging for them!

2026-04-10 13:23:07 UTC

When AI pops, I'm looking forward to watching LinkedIn eat itself alive searching for a take.

2026-04-10 06:17:40 UTC

RE: https://infosec.exchange/@mttaggart/116376758524364249
A demo/production Ringspace server is finally live!
https://ringspace.taggartinstitute.org
I'm actively looking for infosec blogs who'd like to join. I have a feeling I know some folks...
#note19pq…adlp

2026-04-09 21:00:10 UTC

Believe it or not, I am still working on #Ringspace. And here's a new release!
This version of the protocol employs JWKS format for key exchange, and uses Base64URL formats for all encoded data. Plus.env support and resources for Docker deployment!
https://codeberg.org/mttaggart/ringspace/releases/tag/v0.2.2
What's Ringspace? It's a proposal for a human web protocol that combines mutual trust and reputation.
https://ringspace.net

2026-04-09 17:26:18 UTC

Near as I can tell, this is all very good news. More things should take advantage of secure enclaves, and this **open standard** protects against one of the hardest current defense surfaces.
https://security.googleblog.com/2026/04/protecting-cookies-with-device-bound.html

2026-04-09 00:34:08 UTC

Yeah so let's refocus on the real perspective here. It doesn't matter *at all* how good these models are at code or finding vulnerabilities if we destroy our ability to seek and share knowledge.
https://futurism.com/artificial-intelligence/google-ai-overviews-misinformation

2026-04-08 16:22:24 UTC

- reply

No but I am crabby 🦀

2026-04-08 16:16:13 UTC

Hey for what it's worth, I've been writing my own Rust for the past three days getting Ringspace ready for production use. I don't want a sticker or anything, but, y'know.
I can still do it.

2026-04-08 15:56:58 UTC

RE: https://tldr.nettime.org/@tante/116369383743382637
I agree with this framing wholeheartedly. This is a succinct and accurate description of the assumed externalities when you *choose* these tools.
#note184l…jgr5

2026-04-07 17:55:16 UTC

Aww yiss, @npub1qm4…h363 logos available here on infosec.exchange! Thanks @npub17cv…9jd4 !
:ifin: :ifin_i:

2026-04-07 15:32:03 UTC

RE: https://infosec.exchange/@ifin/116364140515996363
This has been a year in the making. As Executive Director of IFIN, I'm very excited for what's coming. Join us!
#note1k7v…zeep

2026-04-07 13:46:52 UTC

- reply

Here's another gem. I was unprepared for modern cameras to capture this and what it would do to me.
https://images.nasa.gov/details/art002e009285
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/363/730/005/000/950/original/5d3d80d0b0734057.png

2026-04-07 13:21:52 UTC

- reply

Oh my. On the other hand, here's an eclipsed sun with VISIBLE GALAXIES
https://images-assets.nasa.gov/image/art002e009301/art002e009301~orig.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/363/631/688/521/835/original/7e5eced1fa4c362e.png

2026-04-07 13:17:10 UTC

This is the one.
Although I would have preferred it not be called "Earthset," good grief.
https://images.nasa.gov/details/art002e009288
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/363/613/331/709/915/original/d18dadb8744c41f4.png

2026-04-06 16:57:39 UTC

I am *begging* AI researchers trying to study human impact to get very rapidly better at methodology so I don't constantly read halfway through these papers only to find some ridiculous experiment design that will throw the conclusions into the air.

2026-04-05 22:14:33 UTC

My wife and I have created the Realist's Blessing:
"May your suffering be expected."

2026-04-04 21:47:27 UTC

- reply

It's very possible I would experience the tool that way were I to grip the thing a little more loosely. I wanted to maximize scrutiny in this experiment so I understood the process as granularly as possible, which absolutely contributed to the tedium.
For me though, I have to say that going faster would, while less annoying, be no more *enjoyable*, if that makes sense. Slow is fine as long as I'm enjoying the process. A dull process that is not creative (at least to me) is unappealing. I also suspect it's still a great way to fall into dangerous patterns. And while I understand there's six or seven different ways to hold it more correctly to avoid those patterns, they are not default, and we know where most users will land.

2026-04-02 22:22:07 UTC

Listen, they called the ship Integrity, not Availability; what do you want from a government contract?
https://www.404media.co/artemis-2-astronauts-microsoft-outlook-livestream/

2026-04-02 16:39:13 UTC

- reply

Ah yes, that's correct; I misspoke. It's not a fork, although it aims to be "compatible with WordPress functionality."
Although I don't think it is entirely fair to equate this to stripping GPL the way chauvet did. That felt materially different.

2026-04-02 16:33:25 UTC

- reply

Hunh. I'm deeply conflicted about a WordPress hard fork of this nature.

2026-04-02 16:24:44 UTC

- reply

Ah, so it is! Takes some reading, but "Payment method" is basically a crypto wallet. It accepts USDC, which is a dollar-indexed stablecoin, but that's as close as you get.
Sheesh.

2026-04-02 15:05:31 UTC

- reply

No wait, it's worse than you thought!
> Membership [of the x402 governing body] will be comprised of participants from multiple verticals with initial intent and support being expressed by Adyen, Amazon Web Services, American Express, Ampersend.ai, Base, Circle, Cloudflare, Coinbase, Fiserv Merchant Solutions, Google, KakaoPay, Mastercard, Merit Systems, Microsoft, Polygon Labs, PPRO, Shopify, Sierra, Solana Foundation, Stripe, thirdweb, and Visa.
This is a list of people I don't want in charge of my money. And yes, I am forced to use some of them. Doesn't mean I trust them.

2026-04-02 14:03:47 UTC

The Linux Foundation getting in bed with Coinbase to develop a web payments standard.
No thanks very much
https://www.linuxfoundation.org/press/linux-foundation-is-launching-the-x402-foundation-and-welcoming-the-contribution-of-the-x402-protocol

2026-04-01 13:49:39 UTC

*Looks at calendar*
*Lifts glasses, rubs bridge of nose*
Can we just...not

2026-03-31 13:31:24 UTC

- reply

Uhhhh in case I have to say this, **don't run code you don't trust on your system**, ya ding dongs.

2026-03-31 13:20:41 UTC

Claude Code's source was apparently leaked via a source map inclusion in NPM? Oh NPM, you're the gift that keeps on giving.
Here's a link to what appears to be the source: https://github.com/abubakarsiddik31/leaked-claude-code
And here is an insta-Python port of the same code: https://github.com/instructkr/claude-code
Honestly, kinda silly it wasn't open source already.

2026-03-31 04:49:14 UTC

This is a big deal. Already seeing evidence of this by way of OpenClaw installations.
https://opensourcemalware.com/blog/axios-compromised
https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

2026-03-30 21:54:47 UTC

When we fight, we win
https://www.theregister.com/2026/03/30/github_copilot_ads_pull_requests

2026-03-30 15:30:12 UTC

As a research project, I built a needed tool with Claude Code. I thought it would be a disaster, but It wasn't. I have some complicated feelings about it.
https://taggart-tech.com/reckoning/

2026-03-27 15:07:22 UTC

Feeling good about the security posture of the federal government during a war.
https://www.reuters.com/world/us/iran-linked-hackers-claim-breach-of-fbi-directors-personal-email-doj-official-2026-03-27/

2026-03-26 20:04:27 UTC

Another great day to post this for no reason
https://taggart-tech.com/migrate-to-codeberg/

2026-03-25 16:44:59 UTC

Aww yiss another critical Citrix vuln under active exploitation:
https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-netscaler-flaws-as-soon-as-possible/
Detection/remediation details here: https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/remediate-vulnerabilities-cve-2026-3055

2026-03-25 16:24:00 UTC

Oh good, more pointless quantum hype.
Once again, totally fine to get to PQ if you can. It ain't happening in 2029; the qubit math doesn't add up.
https://arstechnica.com/security/2026/03/google-bumps-up-q-day-estimate-to-2029-far-sooner-than-previously-thought

2026-03-24 15:04:35 UTC

Heads up: LiteLLM, a very popular AI model wrapper, has been compromised. See the attached issue for details and recommended actions.
https://github.com/BerriAI/litellm/issues/24518

2026-03-23 16:35:43 UTC

Hot on the heels of C&Ding the agent that logs into Canvas and does work for students, Instructure releases an agent to do teachers' work for them.
Even in this early form, it's clear that the desire is to make as much of teaching as possible an automated system. That is an anti-human agenda, and should be rejected out of hand.
I'm not against automating (or just, y'know, abolishing) busywork. This ain't that.
https://www.instructure.com/press-release/instructure-delivers-its-agentic-ai-promise-launch-igniteai-agent

2026-03-19 13:48:14 UTC

Oh COME ON.
I really like uv. This sucks.
https://astral.sh/blog/openai

2026-03-16 16:54:08 UTC

Office 365 and Copilot are down.
Run. Now's your chance. Don't look back; just GO

2026-03-16 05:50:34 UTC

Lmaooo
Now that is what I call free advertising
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/237/286/406/581/417/original/91b0a27e8f1e0e56.png

2026-03-15 20:56:10 UTC

Too many bangers in this paper to list, but as a whole this is a comprehensive rebuke to those who claim anything resembling cognition of large language models.
https://arxiv.org/html/2512.19466v1

2026-03-15 04:11:51 UTC

Significant W as of this week: 100% of @npub1mgl…z233's course material, including *The Homelab Almanac*, has been ported over to our new home on Discourse. Learners can enroll, study, connect with others, and even purchase the book for lifetime access—all from a self-hosted forum space.
If you want to see what a post-Discord, post hypercapitalization internet looks like, I invite you to join us. https://beta.taggartinstitute.org.

2026-03-12 13:23:30 UTC

- reply

Yo, this looks shockingly like what I'm attempting with [Ringspace](https://ringspace.net )!

2026-03-11 19:28:12 UTC

"If you want to improve the model's output, you can write skill files with more specific instructions!"
"Oh wow so like a file that tells the computer to do exactly what you want?"
"Yep!"
"You're never gonna believe this."

2026-03-10 03:14:53 UTC

RE: https://fosstodon.org/@carlrichell/116201429639953387
Hey hey! This is great to hear, and exactly what I suggested for California here:
https://taggart-tech.com/ab-1043/
(Comes with links and a template to contact your local reps if you're in CA)
#note1aya…ssdc

2026-03-08 22:27:12 UTC

Holy crap this story knocked me over. It is everything I'm feeling about the machines right now.
https://sightlessscribbles.com/the-colonization-of-confidence/

2026-03-08 21:07:32 UTC

What a nightmare. If you can read this and still think autonomous agents like OpenClaw are worth the risk, you're beyond help.
https://www.researchgate.net/publication/401123335_Agents_of_Chaos

2026-03-08 19:08:54 UTC

Listen,
It is possible to criticize something without abjectly despising it. 404 can have bad takes; I'm still paying for their journalism because it's usually very good.
Proton's marketing and social team are kind of yutzes, but the service is very good for what it is, and much better than the normative choice.
Seeking infallibility will eat all your time and get you nowhere.

2026-03-06 17:03:45 UTC

Oh hey are you looking for a Vim alternative?
Helix has replaced Vim/Neovim for me almost entirely. I install it first-thing on new devices.
And the devs, far as I can tell, are not using AI, nor adding first-party support for it.
https://helix-editor.com
https://github.com/helix-editor/helix

2026-03-05 06:12:46 UTC

Regrettably moved my blog off of Codeberg Pages. I have all the respect and sympathy in the world for the team over there dealing with these constant attacks, but I need my site more available than they can provide.

2026-03-04 18:19:39 UTC

RE: https://infosec.exchange/@mttaggart/116168638948762892
Yeah so add PCWorld to the list of outlets you can't trust anymore. This report was bogus.
https://www.windowscentral.com/microsoft/windows-11/no-an-ai-focused-windows-12-is-not-coming-this-year-false-report-gets-the-facts-completely-wrong
#note186u…tas6

2026-03-04 02:52:37 UTC

Sounds like we're about to get a lot more Linux users!
https://www.pcworld.com/article/3068331/windows-12-rumors-features-pricing-everything-we-know-so-far.html

2026-03-03 20:41:25 UTC

Just some unadulterated good news!
https://www.heise.de/en/news/Setback-for-the-Commission-EU-MEPs-let-chat-control-fail-11197237.html

2026-03-03 05:22:28 UTC

Claude is down again and I am seeing people basically go through withdrawal.
If you are feeling it, recognize it for what it is.

2026-03-03 03:25:51 UTC

As of 2026-03-02, the state of the art in quantum decryption has cracked a:<li>22-bit RSA key</li><li>6-bit elliptic curve key</li>
https://forklog.com/en/quantum-computer-cracks-tiny-cryptographic-key
The IBM QC that cracked the 6-bit key uses 133 qubits.
Some new research suggests that RSA-2048 could be cracked with as "few" as 100,000 qubits.
https://www.newscientist.com/article/2516404-breaking-encryption-with-a-quantum-computer-just-got-10-times-easier/
([Paywall-free](https://archive.ph/EWdnI ))
Such a machine...is not feasible to build any time soon.
So when your CISO or a vendor starts going off about "post-quantum" security, feel free to use this to remind them that we still have SMB1 in some places and Telnet in others. Plenty of work to do around the house.

2026-03-02 15:39:45 UTC

I dunno it seems pretty sus that y'all have to keep making "It's just an experiment, bro" excuses for the glaring security issues in your vibe code.

2026-03-02 14:21:44 UTC

Claude is down so developers: this is a "take your brain to work" day.

2026-02-27 21:39:29 UTC

When I talk about reality and truth getting fundamentally corrupted, it goes beyond how you retouch your photo and it goes beyond how much spam you get. This is the kind of attack against society itself that is now trivial to execute.
https://phys.org/news/2026-02-southern-california-air-board-pollution.html

2026-02-26 06:52:20 UTC

They want to tell you that the models train themselves now. That it's clean. It's pure.
It never is, is it? There's always a damnable human cost.
https://www.theguardian.com/global-development/2026/feb/05/in-the-end-you-feel-blank-indias-female-workers-watching-hours-of-abusive-content-to-train-ai

2026-02-25 21:57:46 UTC

Boost if AI is making your job suck so bad you want to quit.

2026-02-24 23:53:41 UTC

- reply

Remember kids, any promise from corpos to stop doing a thing that is making money is a bald-faced lie.

2026-02-24 23:53:36 UTC

Anthropic is different because they're committed to safety.
...I'm being told they are no longer committed to safety.
https://time.com/7380854/exclusive-anthropic-drops-flagship-safety-pledge/

2026-02-24 20:31:43 UTC

- reply

I think we need to distinguish between getting a service up and running and maintaining/securing it. Because yes, getting up and running is doable. *Staying* up and running, maybe less so.
Plenty of services exist to do what you're saying. Understanding the tech debt and security tradeoffs of them does not come easily. Sorry, no two ways about that.
You want to make a tool that automates the hard parts? Great! You want to have that deploy VPSes for people? Great! Such tools do exist, but guess what: you've made IaaS or SaaS.
Also, FWIW, there is nothing whatsoever "sustainable" about everyone having their own VPS. I would contend that that isn't even self-hosting in the sense that matters for this conversation. While I too use cloud VMs as reverse proxies, I recognize that doing so is a liability I accept to keep attackers off my home IP. And I do so knowing how to maintain and secure the machine. I could also pay a service to do so for me, but then we're back at the original problem.

2026-02-24 20:06:07 UTC

- reply

My fellow outlier, please consider:
https://xkcd.com/2501/

2026-02-24 18:42:37 UTC

Yes, #SelfHosting is hard. It can be an enjoyable hobby, *and* it can be cost-effective, depending on what you're hosting. But if you aren't going into it with prior experience as a system administrator, it's going to hurt.
I wrote a [whole book](https://taggartinstitute.org/p/the-homelab-almanac ) about how to do this the hard way. It's written that way so you learn how much work it all takes, but also how to do it well.
In my view, the primary purpose of a home *lab* is learning and experimentation. That's a different goal than self-hosting to avoid the cloud.
But honestly, this is just a very nerdy iteration of the fundamental rationale for communities: the pooling of resources to benefit all.
We could imagine a world in which communities (defined however you like) entrust their data to stewards they know, and all invest in the maintenance of equipment and services. We can imagine such a world, but of course the human effort required to build it is far greater than simply paying for a service with a modest monthly fee—and your privacy.
So both things are true. We cannot expect everyone to manage their own digital infrastructure to build a better world, but managing *our* digital infrastructure is probably necessary to build a better world.

2026-02-23 18:50:55 UTC

I spent my education career pushing back against crap like this, so let me clue you in on something:
When a tech company invests in schools, it's never for the benefit of student learning. It's always, always for creating loyal customers out of the students and teachers.
(h/t @npub1vu6…vcka)
https://www.the74million.org/article/exclusive-new-google-partnership-a-sizable-investment-in-ai-for-teachers/

2026-02-23 16:05:25 UTC

OpenClaw is indistinguishable from malware and should be treated as such in enterprise networks.
Do what you want with your own data and gear, but bring that garbage onto my network and I am locking all phaser banks.
https://www.404media.co/meta-director-of-ai-safety-allows-ai-agent-to-accidentally-delete-her-inbox/