Ian Campbell 🏴

Security ops engineer for DomainTools, DT Investigations threat researcher, writer, voracious reader. he/him. Fan of good trouble. Opinions here mine only. No LLM content from me, all flaws detected are human-generated. Autistic/depressed/anxious/hungry.

#infosec #cybersecurity #privacy #actuallyautistic #neurodivergent

Public Key

npub155t0ydv2yz5sc4sta5jmxnannmjm6y48rpur0huvj6seuqrseekszdnysn

NIP-05 Address

neurovagrant@masto-deoan-org.mostr.pub

Profile Code

nprofile1qqs229hjxk9zp2gv2c976fdnf7eeaedaz2n3s7phm7xfdgv7qpcvumgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsy9ssmk

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub155t0ydv2yz5sc4sta5jmxnannmjm6y48rpur0huvj6seuqrseekszdnysn

Show more details

Last Notes

2026-08-16 23:28:55 UTC

Just had a terrible thought.
Can you imagine dating someone entirely dependent on LLMs?
“Let’s go out to dinner, just text my agent what you’re in the mood for.”
“This bookshop cafe is nice but do you have to read the whole time? Why not ask chatgpt to explain the books to you?’
“I’m so excited to see you tonight. My friend swears by this agent that gives you technique advice mid-coitus, I got the silk-lined Meta Ray Ban models and the advice pops up in the corner.”

2026-08-06 14:40:37 UTC

I might be a little too unhinged for social media rn, given hacker summer camp and all.

2026-08-04 08:10:59 UTC

The more I use it and the more I learn about it, almost every LLM use case in enterprises does one thing well:
it signals exactly where the company that’s deployed it is intent on underspending.

2026-07-30 00:18:20 UTC

Palworld update:
I kinda started counterfeiting gold coins.
This caused the cops to raid my base.
I had forgotten to log out and just left it running,
but luckily my base is ringed with a series of .50 caliber machine guns crewed by witches
as well as several dinosaurs wielding rocket launchers.
And that’s Palworld.

2026-07-29 11:29:20 UTC

My paid sub to Psylo continues to help me sleep at night

2026-07-28 12:25:54 UTC

- reply

@nprofile…h2qw i could use a vacation

2026-07-27 16:22:28 UTC

- reply

@nprofile…dd4h Yep! Zanjani going from death row to international jet-setting regime money launderer actually triggered a ton of protests in Iran.

2026-07-27 14:56:26 UTC

We've worked on this investigation for more than a year, and it led us from a single domain to a multi-billion dollar IRGC sanctions evasion network. Please enjoy the report!
#infosec #cybersecurity #threatintel #iran
https://dti.domaintools.com/research/the-zedxion-corporate-nexus

2026-07-25 17:21:03 UTC

- reply

@nprofile…fn63 75% of the *single-context, specialized* deployments that I've encountered can't understand basic requests (think: restricted-context customer environments for a specific business).
911 dispatching is the definitional opposite of a restricted context. It requires deep general knowledge across a number of contexts that have to be integrated and lead to correct inference *the first time.*
Suggested reading: https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

2026-07-25 13:25:04 UTC

- reply

@nprofile…asjv The latter. You are not entitled attention or consideration simply because you have a text predictor at hand - life will be easier once you recognize this.
Good day.

2026-07-25 12:09:15 UTC

- reply

@nprofile…asjv Suggested reading: https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

2026-07-25 11:45:44 UTC

- reply

@nprofile…phzw nah, this is re: 911

2026-07-25 11:43:52 UTC

- reply

It is amazing how one single prompt can immediately make up for ten years of field experience in AI bro minds.

2026-07-25 11:40:31 UTC

- reply

@nprofile…asjv Please do not mistake your prompt for 10 years of field experience.

2026-07-25 11:40:18 UTC

the AI bros have come for me, lol

2026-07-24 22:03:50 UTC

I was a 911 dispatcher for a decade.
To really understand how absolutely terrible an idea it is to have AI answer 911 calls, I'll present you with a single real-life call:
Upon answer, the caller calmly began ordering a pizza. Large, pepperoni. Side order of chicken wings. To be delivered promptly.
The only sign the caller gave that things were amiss? She rather ignored the first few questions from the calltaker.
Because she was being physically abused, had already been beaten, and her abuser was *IN THE ROOM* listening to her order pizza.
Tell me how your AI is going to read between those lines.
#nevent1q…l76v

2026-07-19 21:46:46 UTC

is there some kind of game going on or something, i can't tell

2026-05-13 20:49:40 UTC

Aged, recycled domains available for rent via a Chinese / Southeast Asian reseller market.
Registrar: Metaregistrar BV
NS: share-dns[.]com
AS36352 ("Sally Wang")
#nevent1q…qdfj

2026-03-26 18:19:49 UTC

US or EU, Remote - Wiz - Threat Intelligence Researcher (Cloud)
Wiz has been doing some great work around TeamPCP lately, among other things.
According to LinkedIn ( https://www.linkedin.com/posts/benjamin-read-41817121_im-continuing-to-build-the-threat-intel-share-7442969734645608448-Gu-n?utm_source=share&utm_medium=member_desktop&rcm=ACoAABIZhqYBjXCQuV7JX7N_3xlpxZY6alHZ77o ) it's posted for US but open to EU. They're looking for two roles, one Cyber Crime and one Cyber Espionage.
(I am not affiliated with Wiz or at all involved in this hiring process.)
https://www.wiz.io/careers/job/4658917006/threat-intelligence-researcher-cloud

2026-02-26 16:39:41 UTC

- reply

@nprofile…29kj Good luck!
maybe i should take my toot down so less other people apply 👀

2026-02-26 15:49:51 UTC

USA, multiple offices - Amazon Cyber Threat Intelligence - Sr. Technical Program Manager
(I am not affiliated with Amazon or at all involved in this hiring process.)
USA, TX, Austin
USA, VA, Arlington
USA, WA, Seattle
USA, NY, New York
USA, MD, Annapolis Junction
USA, VA, Herndon
https://www.amazon.jobs/en/jobs/3189668/sr-technical-program-manager-amazon-cyber-threat-intelligence

2026-01-03 00:00:06 UTC

'“Tinder for Nazis” hit by 100GB data leak, thousands of users exposed'
Also exposed: it's a sausage fest, with almost no women. Shocker.
I'm coining it now: "Fashley Madison."
https://cybernews.com/security/investigator-exposes-white-supremacist-sites-users/

2025-10-28 15:07:28 UTC

- reply

"let's make our mailservers and internal documentation all vulnerable to cognitive attacks"
utterly deranged

2025-10-28 15:00:02 UTC

the funniest part about LLM vulnerabilities is that we've essentially opened up our deterministic systems to techniques honed in centuries of disinformation operations, like an accelerated epistemology purposely weak to cache poisoning.
https://infosec.exchange/@mttaggart/115446376556227026
https://masto.deoan.org/system/media_attachments/files/115/452/368/357/727/267/original/db5cad7e95796e4b.jpeg

2025-10-20 23:43:38 UTC

“Don’t forget, Family Meeting on Friday night to enroll everyone’s fingerprints in the toilet camera!”
#privacy
https://www.theverge.com/news/802727/kohler-health-dekoda-toilet-camera-optical-sensors

2025-10-13 21:00:58 UTC

The image below, as well as other recent examples, form part of an information operation meant to make my generation and older feel prematurely aged and infirm.
In this closed-door briefing i will….
https://masto.deoan.org/system/media_attachments/files/115/368/862/393/241/937/original/17dd541526a17b9f.jpeg

2025-10-12 23:06:12 UTC

So
not only this excellent graphic
but this graphic on this server name. https://toad.social/@amyedge/115363451499320006

2025-09-08 16:22:36 UTC

This is too good.
https://masto.deoan.org/system/media_attachments/files/115/169/594/749/659/184/original/e5aba7420452dd92.jpeg

2025-09-05 21:49:05 UTC

This is a hilariously harmless “fucked around and found out” story.
https://masto.deoan.org/system/media_attachments/files/115/153/891/629/362/909/original/4551a688edb4a5db.jpeg

2025-09-05 15:59:50 UTC

- reply

@nprofile…85tn It's Friday, might as well let that one go too...
https://masto.deoan.org/system/media_attachments/files/115/152/514/252/274/842/original/5b08eed32166f1ea.gif

2025-09-04 23:30:02 UTC

- reply

As a global operator, when you opt hundreds of millions of users into inherent overtrust without monitoring the explicitly engineered transparency mechanism for mistakes or abuse you are failing your users.
Full stop.

2025-09-04 23:25:36 UTC

Surprises me (kinda) that there's pushback about Microsoft bearing any responsibility over deciding to trust Fina CA without engaging in transparency log monitoring.
I'm with this guy:
"The story here is less the 1.1.1.1 certificate and more why Microsoft trusts this carelessly operated CA," Filippo Valsorda, a Web/PKI expert, said in an interview.
https://arstechnica.com/information-technology/2025/09/the-number-of-mis-issued-1-1-1-1-certificates-grows-heres-the-latest/

2025-08-26 22:27:55 UTC

There is a keen autistic adult frustration in having worked so hard to learn how to express yourself in difficult circumstances only to realize that it’s not your inability to express that was the blocker but a genuine desire on the part of most of humanity to not listen.

2025-08-18 20:58:19 UTC

splitting my office from my gaming area. should've done this ages ago but didn't really have the space before.

2025-08-16 18:39:20 UTC

- reply

@nprofile…82k3 Yeah, discovering them was a bit of a revelation for me!
"A service that still lets me download non-expiring MP3s? What's the catch?!?!?!"

2025-08-16 16:45:02 UTC

Doing some thinking about AI. Still skeptical, still think it will eventually be hazardous to any production workflow it's introduced into. And still hate the resource drain, bias encoding, and other things. But I also think that my initial "Hell No" stance made the same mistake as all the hype.
What I'm finding is that my initial stance on its utility dismissed AI because of the non-deterministic nature of the output, which includes a lot of bullshit, yes.
But...
(1/n)

2025-08-16 16:08:17 UTC

- reply

@nprofile…6k0x Congrats on the new gear! I am jealous as hell

2025-08-16 15:45:17 UTC

- reply

@nprofile…9a3s who's the "they" here?
also, not saying we're just as bad, just that we've done it too. tends to cut down on reply guys.

2025-08-16 15:39:35 UTC

- reply

@nprofile…9a3s Always has been; admittedly we fudge 'em here too in all sorts of ways.

2025-08-16 15:37:16 UTC

- reply

@nprofile…9a3s So China adopting those methods requires believing their own numbers and PRC have been lying bastards about that.
R&D has thrived in the US at academic institutions, which is why you saw China either sending their best or trying to replicate the systems.*
That being said, R&D in the US has been crushed by Trump & Co, so that's all changing swiftly.
(*Academia is still completely fucked here, to be clear; but still miles ahead of PRC.)

2025-08-16 12:40:29 UTC

ok just saw someone unironically mention China out-innovating everyone else on technological IP.
please keep in mind a large proportion of that IP is simply stolen from the rest of the world via espionage and redistributed domestically to Chinese companies.
look askance at anyone not including that in their pronouncements.

2025-08-16 12:22:46 UTC

- reply

In case you want a recent rec or two:
Divergent Mind, by Jenara Nerenberg, is an excellent read about neurodivergence and especially autism, primarily in women (who are an under-researched class). https://libro.fm/audiobooks/9780062877499-divergent-mind
Just picked up Donella Meadows' "Thinking in Systems" which I've read before, but was such a good and influential book I want an audio copy too. https://libro.fm/audiobooks/9781603588478-thinking-in-systems

2025-08-16 12:15:58 UTC

- reply

Adding my referral URL *in case* you want to sign up and use one, but no pressure here. I'd much rather folks use it as their comfort levels demand.
I have no connection to Libro.fm other than as a happy customer - approaching my 2 year anniversary, and zero problems over 32 purchases. I'm a member of their monthly plan ($15/mo for a book credit) to keep myself reading regularly, but it's 100% not necessary either.
https://libro.fm/referral?rf_code=lfm534571

2025-08-16 12:13:07 UTC

Audiobooks are a 100% valid way of reading, and if it's your primary way, I hear & honor ya.
Your irregular reminder that if you enjoy audiobooks Libro.fm is an incredibly good replacement for Audible.
Libro.fm provides DRM-free downloadable MP3 versions of the book (in addition to having an app you can use). They've had at least 90% of the books I've looked for.
They're also an employee-owned social corporation that allows you to support local independent bookstores with your purchases.

2025-08-15 13:50:53 UTC

If DNS is one of your interests, make sure you're following @nprofile…y9me. From about my first day long ago at Farsight Security to current day at DomainTools, he continues to be an oft-mentioned and highly-regarded subject matter expert who regularly finds and shares awesome things.
#infosec #DNS
https://infosec.exchange/@pgl/115033093601740459

2025-08-15 02:29:25 UTC

Just got an ad on LinkedIn for wastewater sterilizing systems.
Pals that’s not what I mean when I say “sanitize your inputs.”
https://masto.deoan.org/system/media_attachments/files/115/030/423/156/300/060/original/32b4f388cd2b8db1.jpeg

2025-08-15 00:50:03 UTC

- reply

Am I misunderstanding this kind of feedback, or is there a unique condition about LLM use that exempts it from the bottom-rung standard of “blaming the user is lazy and unreflective”?

2025-08-15 00:45:33 UTC

Something grinding my gears about AI adoption in tech: seeing a resurgence of otherwise great folks responding to criticism of AI output with “it sounds like you’re not prompting it right.”
As professionals we’ve been consciously trying to move away from blaming the user, but the natural language component of LLM use seems to have undone quite a bit of progress there.

2025-08-14 13:28:41 UTC

- reply

@nprofile…5kdd yeahhhhhhhh i chose to interpret that as sarcasm, if only for the sake of my own sanity

2025-08-14 12:42:25 UTC

Incident Response company Profero on "AI-induced destruction" - a new incident category that they say now makes up 25% of their calls in which AI coding assistants deployed by legitimate insiders wreak havoc.
#infosec #RiskManagement
https://profero.io/blog/new-attack-vector--ai-induced-destruction

2025-08-14 01:02:20 UTC

- reply

@nprofile…7mte Makes me wanna watch They Live again too

2025-08-14 00:51:48 UTC

- reply

@nprofile…7mte oh that clip is a blast from the past

2025-08-14 00:39:40 UTC

bought groceries.
including vegetables.
i request applause.

2025-08-13 00:35:53 UTC

- reply

@nprofile…z22s
https://masto.deoan.org/system/media_attachments/files/115/018/652/033/269/891/original/c36e22d0d8a77bb0.jpeg

2025-08-12 15:32:27 UTC

- reply

@nprofile…9ghe I WANT IT

2025-08-12 15:28:14 UTC

- reply

@nprofile…9ghe ...wait what the hell is this

2025-08-12 14:26:55 UTC

- reply

me trying to be less adversarial towards AI and then they specifically enable noclick DNS exfil
https://masto.deoan.org/system/media_attachments/files/115/016/257/520/876/258/original/e4a08ba850f6db52.mp4

2025-08-12 13:58:03 UTC

- reply

i mean who could've expected a yearslong, deeply researched, regularly used method of data exfiltration COULD BE ABUSED BY REMOVING NECESSARY USER INTERACTION

2025-08-12 13:49:56 UTC

This is some really smart digging: realizing that Claude Code does not require user interaction for certain bash commands, they discovered that DNS lookups were specifically allowlisted, clearing a trivial path for well-known DNS exfiltration methods.
So when I say “all these implementations are ignoring years and decades of lessons learned the hard way” it’s not hyperbole. Anthropic 100% cleared the path for DNS exfil here.
h/t to @nprofile…s6wl - thank you!
#infosec #genai
https://embracethered.com/blog/posts/2025/claude-code-exfiltration-via-dns-requests/

2025-08-11 13:24:51 UTC

- reply

@nprofile…9a3s yup. cursed portmanteau for it.

2025-08-11 05:37:15 UTC

Just realized we’re gonna have vibe thrunting now

2025-08-10 23:26:28 UTC

- reply

@nprofile…l4qk thanks - was this recorded? If so i’d love to see it

2025-08-10 21:22:09 UTC

Thinking about talk submissions for next year already, and wondering if people would be interested in aging stuff.
“Hackers With Declining Loved Ones: What To Expect When Your Expectation Management No Longer Means Anything”
#infosec

2025-08-10 17:04:49 UTC

- reply

Nevermiiiiiind, PEBKAC.

2025-08-10 17:00:22 UTC

Neat.
Bought a pair of earbuds at the airport on a whim and they appear to be duds.

2025-08-09 17:24:58 UTC

@nprofile…6k0x admittedly, no idea what ya look like. You in hackers.town at the moment for me to say hi?

2025-08-09 01:25:36 UTC

My most desired research talk:
“We performed fMRI on experienced threat hunters and investigators while they worked. These are the results.”
#infosec

2025-08-08 16:27:50 UTC

- reply

@nprofile…r5r2 @nprofile…9t9r yep, deck will be out, and we may end up doing an open rerun of the talk for those that couldn’t be there if it’s not recorded. Will keep ya posted.

2025-08-08 16:22:22 UTC

Just a reminder - @nprofile…9t9r and I talk malware in DNS later today!
If we get time, we might even read y’all in on a brand new mystery we’re trying to track down.
#defcon #infosec #malware
DEF CON 33: Attending Plain TXT, Malicious Context: Uncovering DNS Malware on Aug 8, 2025 at 15:10 in LVCC - L1 - Exhibit Hall West 1 - 303 (Malware Village)
#hackertracker

2025-08-08 13:48:06 UTC

i’m tellin ya, DEF CON merch shop needs to have some branded ibuprofen and joint rub, because these days by this point in the week I’m all aches.

2025-08-08 13:44:07 UTC

y’all I don’t often yell “CRITICAL READING” btu after seeing @nprofile…yvvj ’s talk this post is VERY CRITICAL READING for anyone in or adjacent to infosec.
the context is the thing.
https://infosec.exchange/@knitcode/114993430547292582
https://blogs.infoblox.com/threat-intelligence/vextrios-origin-story-from-spam-to-scam-to-adtech/

2025-08-08 03:22:36 UTC

- reply

Of the security ecosystem supernodes that *aren't* strictly people, the ones I have identified are:
-DNS
-Shitposters
-The Furry/Infrastructure Engineer overlap that keeps everything running
-The occasional eldritch being that's mostly too tired at this point to care about eating you
Let me know what I'm missing in this list.

2025-08-08 03:19:44 UTC

- reply

What I didn't understand from the outside, but have had great role models to learn from, is that security is an ecosystem of ecosystems, and most of the supernodes are people.
Treat it like a silo or a bunker and you just make your own systems more brittle.

2025-08-08 03:07:37 UTC

- reply

@nprofile…2ulp also relatable.

2025-08-08 03:07:08 UTC

- reply

@nprofile…2ulp BTW, you're not in Vegas this week are you?

2025-08-08 03:06:48 UTC

- reply

@nprofile…2ulp I miss the old Panasonic Toughbooks.
The real falling damage you had to worry about if they slipped out of your grasp was damage to the earth's crust.

2025-08-08 03:03:44 UTC

- reply

@nprofile…2ulp yeap. relatable. I'll leave some shifts open in the crying room for ya, it doesn't make it better but it does help.

2025-08-08 02:31:11 UTC

I tell you what, I moved to security partly to talk to people less, and that has not worked out how I thought it would.

2025-08-07 17:15:08 UTC

- reply

@nprofile…pwwf Not that I expect any different, but JESUS CHRIST THESE MOTHERFUCKERS WITH NO CONCEPT OF USER SAFETY

2025-08-06 21:24:51 UTC

An autistic’s guide to Las Vegas cons, FAQ #1:
“How do you get away from the lights and noise?”
https://masto.deoan.org/system/media_attachments/files/114/983/927/039/076/973/original/d24aaa559c6a7cc0.jpeg

2025-08-06 20:46:08 UTC

There is an abominable snowman furry with the runZero logo running around and I’m choosing to believe it’s @nprofile…psa7 in the suit.
Honestly thought he’d be taller.

2025-08-06 13:51:38 UTC

- reply

@nprofile…t638 @nprofile…rtth Brother, same. It took me years and still isn’t a sure thing for any year.
Keep pushin’.

2025-08-06 13:43:06 UTC

- reply

@nprofile…2pe8 I hear ya.
Are you out in Vegas this week?

2025-08-06 13:40:37 UTC

If you’re at #BlackHat and at or near the Cosmopolitan, @nprofile…rtth has shuttles running from the Cosmo to the Mandalay Bay on Aug 6 & 7.
Gotta give up your deets, but otherwise free.
https://www.domaintools.com/events/black-hat-2025-shuttle/

2025-08-06 13:03:40 UTC

- reply

Also, I sing the sad song of an east coast early-riser at a western con.

2025-08-06 13:02:46 UTC

Too many good talks scheduled at BlackHat and I’m mad about it!
(Also, reach out if you want to grab coffee and talk shop. No sales pitches in either direction, please.)

2025-08-01 20:08:47 UTC

- reply

@nprofile…6k0x @nprofile…hflv May your week be safe-ish and joyful.
The communities you both support are so very necessary, and your work and approaches are so very appreciated.

2025-08-01 19:45:29 UTC

"The Dam Seems To Be Breaking" - and not in good ways.
This was a grim but good read from Fred Cohen.
#cybersecurity #GenAI #RiskManagement
https://managementanalytics.substack.com/p/the-dam-seems-to-be-breaking
PDF Link: http://all.net/Analyst/2025-08.pdf

2025-07-30 23:59:43 UTC

FUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUCK

2025-07-30 23:03:30 UTC

- reply

@nprofile…5h0r Dave why do you have radioactive wasps on your Amazon wishlist?

2025-07-30 22:41:18 UTC

Anybody have “radioactive wasps” on their 2025 bingo card? Anyone?
https://chaos.social/@jonty/114944079822906204

2025-07-29 22:40:19 UTC

Time to update RFC1149, the one about packet transmission over avian carriers
https://masto.deoan.org/system/media_attachments/files/114/938/925/306/182/021/original/b8980a7c437849b7.jpeg

2025-07-29 13:27:55 UTC

vibe for today
(Snagged from elsewhere, source unknown)
https://masto.deoan.org/system/media_attachments/files/114/936/741/095/439/257/original/a4d71dad99f9654a.jpeg

2025-07-29 13:02:06 UTC

- reply

@nprofile…hg5k @nprofile…c8kq I moved from Feedly to Inoreader a few months ago, and the latter has some great monitoring options beyond RSS that I've been digging for both regular reading and investigations (as long as I don't care about active recon).

2025-07-29 10:39:30 UTC

- reply

@nprofile…c8kq Out of curiosity, at that point do you use a monitoring tool on the site itself, or just stop watching the vendor directly? Or something else?

2025-07-28 21:21:40 UTC

- reply

my memory is a bit hazy on this but I think @nprofile…6r7m surfaced Vercel for me first a few months ago, and it turns out that was a bit prophetic.

2025-07-28 21:16:58 UTC

Hey folks, catching up on my reading and wanted to give defenders a cheat code.
The below-linked article from Okta on July 1 talks about threat actors using the AI-powered v0 tool from Vercel to create replica phishing pages.
Most Vercel creations are actually domains or subdomains CNAMEd in DNS to vercel[.]com subdomains. Additionally, many use vercel-dns[.]com nameservers. Might be worth adding some detections around this.
#threatintel #infosec #DNS
https://www.okta.com/newsroom/articles/okta-observes-v0-ai-tool-used-to-build-phishing-sites/

2025-07-24 13:20:34 UTC

Least convincing newly registered domain so far this year:
fixpassword[.]ru
(DON'T. GO. HERE.)
#infosec #threatintel

2025-07-23 18:43:43 UTC

fucking love LLMs.
Gemini: "I do not have an OCR component to analyze text in an image for you, I truly apologize."
delete chat
new chat
Gemini: "Sure, here's the translation..."

2025-07-22 16:51:38 UTC

- reply

@nprofile…hn3y WAN. where it is now is not where it was before, and despite overwriting it etc it's still calling out to the previous DNS resolution settings.
(not looking for advice, to clarify, just complaining to the universe)