Matt Palmer

Recovering sysadmin, technology lover, crypto(graphy!) nerd, he/him.

Public Key

npub177393nfzja40flzatw2q5rja7kumlz6slsmp6dl9jftkcfn0grgsuunjnw

NIP-05 Address

womble@infosec-exchange.mostr.pub

Profile Code

nprofile1qqs00gjce53fw6h5l3w4h9q2pewltwdl3dg0cdsaxljey4mvyeh5p5gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds3shlu7

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub177393nfzja40flzatw2q5rja7kumlz6slsmp6dl9jftkcfn0grgsuunjnw

Show more details

Last Notes

2026-04-15 04:29:01 UTC

- reply

@nprofile…equ9 the main reason I don't do well as a pentester is that I never try a lot of things simply because I think "nah, nobody would be that stupid". And then reality proves I am waaaaaaay too optimistic.

2026-04-10 04:36:17 UTC

The ferry terminal is definitely not where I remember it being.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/378/552/046/189/665/original/e7884866f83df41c.png

2026-04-05 02:40:17 UTC

I feel like at least 80% of the work of a small engine mechanic could be handled by a large can of carburettor cleaner and an air compressor.

2026-04-03 20:10:58 UTC

- reply

@nprofile…2pg0 the limit of tainting is that it can only say a string is "safe" or "unsafe", without answering the question "safe for *what*?". If you untaint the value with a "safe for HTML" regex, but then it gets eval'd instead, Unpleasantness will result. The solution is to have separate "safe for HTML" and "safe for eval" data types, and the only values accepted by methods that construct HTML or eval code are the relevant "safe for" types. Yes, it's more faffing around, but far more secure.

2026-04-03 09:33:12 UTC

- reply

@nprofile…2pg0 I'm sure if it were actually used by the common entry points for untrusted data, like rack, it would have been kept and maintained, but if nobody's using it, the need to account for it in all new interpreter dev is just overhead. For my money, the kinds of type confusion that a single "tainted" flag prevents are only a subset of the available sources of vulns; if you actually want to kill that whole bug class you need a proper, enforced type system.

2026-04-03 05:52:07 UTC

- reply

@nprofile…2pg0 it was a source of bugs, and common libraries (eg rack) didn't use it. https://bugs.ruby-lang.org/issues/16131

2026-03-31 10:08:27 UTC

- reply

@nprofile…fwps the "chi-squaredatops" broke me. Outstanding work by Tamara.

2026-03-29 12:34:49 UTC

- reply

@nprofile…nthd public-private partnerships are when you write "privatise the profits, socialise the losses" into the contract.
@nprofile…h0ll

2026-03-28 23:34:27 UTC

- reply

@nprofile…3e6m her new hubby's garage is stocked with jerry cans of petrol, so you got off lightly.

2026-03-28 00:44:33 UTC

- reply

@nprofile…njza have you become numb to official statements that just straight up lie to your face? I could never be a journalist, if only because my head would explode at being sent such bald faced untruths as "all necessary steps".

2026-03-27 10:47:07 UTC

- reply

@nprofile…c4eh sounds like it's colonising programming, which is quite a good phrase, really.
@nprofile…c2nm

2026-03-25 19:58:47 UTC

- reply

@nprofile…h8rr "we choose to do these things, not because they are easy, but because they are gross."

2026-03-24 23:13:49 UTC

- reply

@nprofile…0rz0 but girls in red dresses...

2026-03-23 23:45:44 UTC

- reply

@nprofile…mhaj by which he means "A Guy Instead".

2026-03-23 23:45:22 UTC

- reply

@nprofile…mhaj that's always a great sign.

2026-03-23 22:08:57 UTC

- reply

@nprofile…e5jr that justification document must have been a doozy.

2026-03-20 19:50:01 UTC

- reply

@nprofile…f8x8 nathan4hotdogs, surely?
@nprofile…3qha

2026-03-20 08:14:22 UTC

Every single step of the experience trying to start using Odoo feels like they started with the premise, "what if we attempted to create the platonic ideal of a bait-and-switch scheme?" I strongly do not recommend.

2026-03-19 11:39:09 UTC

- reply

@nprofile…3e6m to be fair, it does kinda sound like he was in a food competition with you.

2026-03-18 21:15:05 UTC

- reply

@nprofile…xdda I thought that's what ps (1) did. Doesn't that stand for "personal space"?

2026-03-08 23:41:20 UTC

- reply

@nprofile…vdqu sometimes you just gotta let FOMO become FAFO.
@nprofile…hlkw @nprofile…3qha

2026-03-06 21:04:05 UTC

- reply

@nprofile…3e6m finish this famous quote: "the only thing necessary for the triumph of evil is..."

2026-03-05 21:03:18 UTC

Are we using "slopkiddies" to refer to the low-skill, depressingly-high-impact threat actors who punch "hack the Gibson" into an LLM prompt? If not, why not?

2026-03-04 20:29:56 UTC

- reply

@nprofile…2pg0 possibly the smartest thing I ever put in a conference talk is the sentence "observability is just printf debugging at webscale".

2026-03-03 20:28:13 UTC

- reply

@nprofile…vxu2 was it, in fact, amore?

2026-03-02 11:52:05 UTC

- reply

@nprofile…eh0u the most generous view I can come up with is that it is a deceitful attempt at getting students to "network", since that is how jobs are mostly obtained.
@nprofile…3qha

2026-03-02 11:47:00 UTC

- reply

@nprofile…a2ht 1:1 scale save icon.

2026-03-01 19:47:00 UTC

- reply

@nprofile…f6mu if I decide to take up bartending as a new career, that will be my title.

2026-03-01 19:36:33 UTC

- reply

@nprofile…ydzz Zero Cool would like a word.

2026-02-25 12:01:40 UTC

- reply

@nprofile…4xpq not enough existing practitioners are willing to take on apprentices, for starters. There is projected to be a deficit of 300,000 skilled tradespeople by 2027 in Australia alone (https://www.abc.net.au/news/2025-11-13/construction-workforce-needs-to-double/106002738). A training model that doesn't produce enough workers isn't a good one, regardless of any other benefits it might have.

2026-02-25 11:50:22 UTC

- reply

@nprofile…a6hr looking at industries where apprenticeships have traditionally been how people were trained (eg trades) does not bode well for an apprenticeship model for software development.

2026-02-24 23:46:39 UTC

- reply

@nprofile…6kmh it's a job for as long as you can maintain the will to live.

2026-02-20 23:18:53 UTC

They prefer to be called "candidates".
Cockroach numbers surge in Adelaide during warm, humid weather https://www.abc.net.au/news/2026-02-20/cockroach-numbers-surge-adelaide-warm-weather/106369934

2026-02-19 20:53:31 UTC

- reply

@nprofile…4xpq full contact baseball would be really something.

2026-02-19 20:45:43 UTC

- reply

@nprofile…ydzz Linux is communism, after all.

2026-02-19 20:37:08 UTC

- reply

@nprofile…snss narrator's voice: it was for AI features.

2026-02-09 20:30:52 UTC

- reply

@nprofile…c99e well you should put it away after you've finished with it.

2026-02-09 19:59:28 UTC

- reply

@nprofile…g4vn it's one of those irregular verbs. I'm an astute businessperson, you have influence, he's doing a five year stretch for breaching the FCPA.

2026-02-08 21:40:44 UTC

- reply

@nprofile…f2ay the perfect metaphor does not exi-

2026-02-07 07:59:47 UTC

- reply

@nprofile…vuvh is the dead husband cookbook a title of cause or effect?

2026-02-05 21:08:33 UTC

- reply

@nprofile…tr8y the kids are, as always, all right.

2026-02-05 20:13:46 UTC

- reply

@nprofile…u6p6 "this is as close as we can get without embarrassing someone important"

2026-02-04 10:01:04 UTC

- reply

@nprofile…xqe8 nor does watching something else do the work.

2026-02-04 08:26:22 UTC

- reply

@nprofile…3e6m so not a big Anita Ward fan, then?

2026-02-04 02:28:54 UTC

- reply

@nprofile…kand clearly I need to make my sarcasm less subtle.

2026-02-03 21:37:20 UTC

- reply

@nprofile…4xpq for a people's utopia, the Chinese communists seem to play the capitalist game very well.

2026-02-03 19:49:51 UTC

- reply

@nprofile…g4vn one million percent tariffs for France!

2026-02-03 08:22:14 UTC

- reply

@nprofile…g4vn too many people were calling it slop. That's the only possible explanation.

2026-02-02 06:18:46 UTC

I just saw a vehicle with the number plate L34KY, and it did not appear to be a plumber. The only possible explanation is that it is instead owned by a C programmer.

2026-02-02 05:06:32 UTC

- reply

@nprofile…6kmh I should get a copy before it's banned as a terrorist training tool.

2026-02-01 22:02:12 UTC

- reply

@nprofile…2pg0 Google's drop in search quality long predates the introduction of Gemini, so while the plan *now* may very well be as you suggest, I doubt it was the original intention.

2026-01-30 09:10:27 UTC

- reply

@nprofile…2ffv yes, I've personally observed that happening. I gave an LLM a URL on a site I had the access logs for, asked it for advice on how to improve the content on the page, it gave vague advice based on the words in the URL, but demonstrably did not access the server, despite telling me it had.

2026-01-27 21:52:17 UTC

- reply

@nprofile…k9xn we're all just cost centres to the capitalist class. You get treated as valuable for only as long as they haven't figured out a way to get by without you.

2026-01-27 21:25:07 UTC

- reply

@nprofile…gu7x if there's one thing that the entire history of humanity has taught us, it's that as a species we are great at making nuanced, highly context-specific decisions with incomplete information. I foresee that this is going to turn out great.

2026-01-27 06:39:54 UTC

- reply

@nprofile…hq4d I would definitely try to pat it, all while knowing it was a terrible idea.

2026-01-24 20:36:25 UTC

- reply

@nprofile…3e6m have you considered a career in politics?

2026-01-22 10:39:09 UTC

- reply

@nprofile…lpx7 to a certain segment of the US population, the constitution consists solely of the second amendment.

2026-01-21 23:45:15 UTC

- reply

@nprofile…g4vn it's all Nazi starter packs at X The Everything App.

2026-01-21 21:50:57 UTC

- reply

@nprofile…9g8s a reasonable idea, although I question the wisdom of putting it under a .gov domain. Whoever has edit privileges on the house.gov zone file is probably going to get Instructions in the near future.

2026-01-21 04:46:36 UTC

- reply

@nprofile…qgsk even in the Greatest of All Britains, people don't go to jail for talking to their spouse.

2026-01-20 22:42:07 UTC

- reply

@nprofile…3e6m only one possible solution: fake a robbery and collect the insurance. Couldn't possibly say anything to your life partner, that's right out.

2026-01-20 21:14:18 UTC

- reply

@nprofile…tm9a it is the 11831st of September, 1993.

2026-01-20 21:12:56 UTC

- reply

@nprofile…g4vn gotta respect the classics.

2026-01-19 21:42:38 UTC

- reply

@nprofile…23rk they've been running a protection racket for a long, long time.

2026-01-19 07:58:12 UTC

- reply

@nprofile…5md8 as an aside, if the surveillance state didn't want to be belittled with clever word play, they shouldn't have named it the punopticon.

2026-01-18 23:40:34 UTC

- reply

@nprofile…5md8 be careful, doing subversive activities like holding police accountable might land you on a "watch" list...

2026-01-18 04:57:36 UTC

- reply

@nprofile…hpem I completely fail to be surprised that the Toongabbie sports club is a literal Nazi bar.

2026-01-17 00:34:05 UTC

- reply

@nprofile…fk93 based on some of the things Hamsun wrote, I'm somewhat underwhelmed by the Nobel committee giving him the thing in the first place. He seems to have been an extremely unpleasant person his whole life.

2026-01-16 20:06:37 UTC

- reply

@nprofile…tpfq I'm exactly the same: my phone is doing a good job of letting me know what I'm in for, and I consider it a job well done if I can save a few other people from getting harassed.

2026-01-16 19:12:00 UTC

- reply

@nprofile…tpfq I haven't paid any attention to the spam rate, but yeah, where have all these phone calls suddenly come from? I got four this week, each for different domains. Even if they're just slop dropping the work, I have trouble imagining that the success rate on the calls (which I'm pretty sure are human, given the abuse I received when one of them realised I was just deliberately wasting his time) is going to produce enough work to be profitable.

2026-01-15 12:14:43 UTC

- reply

@nprofile…mdpk you're right, if they did nothing we'd all be much better off.

2026-01-15 12:13:16 UTC

- reply

@nprofile…k2gv they don't keep inventing trains, they're not nearly smart enough for that. They just invent ways to keep make public transport private and keep all the money for themselves.

2026-01-15 11:05:18 UTC

- reply

@nprofile…g4vn monetising incels harassing people has been Xitter's business model since the day apartheid emerald Karen took control.

2026-01-15 11:03:16 UTC

- reply

@nprofile…vwhj making a high profile example of Xitter, by costing them real money and putting a few executives in prison, would go some way to discourage others.

2026-01-14 21:45:01 UTC

- reply

@nprofile…ydzz phew, glad that's been sorted now.

2026-01-14 11:29:32 UTC

- reply

@nprofile…vxu2 https://en.wikipedia.org/wiki/Liquid_Ass

2026-01-14 10:27:01 UTC

- reply

@nprofile…g4vn it's always the coverup that gets you...

2026-01-14 10:26:37 UTC

- reply

@nprofile…xpag get enough CISOs using LLMs to write their reports, and soon enough there will be a number of open positions...

2026-01-13 21:58:28 UTC

- reply

@nprofile…r0y2 to the billionaire class, that isn't a list of harms, it's what gives them a rush.

2026-01-12 19:56:01 UTC

- reply

@nprofile…9a9a one can only hope...

2026-01-11 22:18:41 UTC

Can anyone explain why Kentucky fried chicken is so keen on sponsoring Brazilian butt lifts?

2026-01-11 11:08:31 UTC

- reply

@nprofile…3e6m which do you think will win this year? What are your grape expectations?

2026-01-11 02:12:35 UTC

- reply

@nprofile…04xh it takes a special kind of confidence to call your shot on that scale, and the fact they're succeeding is extremely saddening.

2026-01-10 22:47:24 UTC

- reply

@nprofile…vt3g that would seem to be an argument in favour of the "LLMs are replacing workers" narrative, though. Incompetently and temporarily, perhaps, but still causing layoffs.

2026-01-09 11:53:26 UTC

- reply

@nprofile…3e6m to be fair, it sounds like there almost was a kitchen fire...

2026-01-09 08:09:45 UTC

- reply

@nprofile…3tsk I greatly prefer artistically hand crafted analog Ms, the tones are so much richer.

2026-01-07 23:45:28 UTC

- reply

@nprofile…g4vn one step closer to being the everything app apartheid emerald Karen has always wanted.

2026-01-07 23:10:01 UTC

- reply

@nprofile…a2ht slopocalypse.

2026-01-06 22:14:46 UTC

- reply

@nprofile…g4vn it's not an invasion, it's a well-armed freedom visit.

2026-01-05 22:40:58 UTC

- reply

@nprofile…9kzl right there with you, Hope. Homophones are the *worst*.

2025-12-30 20:46:19 UTC

- reply

@nprofile…scce I feel like there's enough data on what happens as soon as a patch drops, from what has happened every previous time, that the consequences of Mongo dropping a patch on the 23rd were pretty easy to predict.

2025-12-27 09:49:46 UTC

- reply

@nprofile…scce I do *not* want to smoke what they're smoking.

2025-12-23 21:55:09 UTC

- reply

@nprofile…qfxw it's a pity that Bernie Madoff popped his clogs a few years ago, he'd have been the ideal Fed chair for the Trump administration.

2025-12-21 03:59:32 UTC

One thing I have never seen mentioned in any parenting book: for a period of several years, you will spend approximately 14% of your waking hours collecting, or causing to be collected, crockery and cutlery from your child(ren)'s bedrooms.

2025-12-20 23:30:06 UTC

- reply

@nprofile…jr73 yikes. As an aside, what a strange way to colour code an outage map, based on number of customers impacted in an area.

2025-12-19 11:42:26 UTC

- reply

@nprofile…59g0 amusing that it still just produces text that agrees with your position.

2025-12-17 09:07:23 UTC

- reply

@nprofile…0hrd I'm afraid you'll need to be *far* more specific.

2025-12-16 09:44:17 UTC

- reply

@nprofile…997t that is truly inspired evil.

2025-12-11 09:41:25 UTC

- reply

@nprofile…72ye there would be no way I could stop myself from giggling.

2025-12-01 20:56:31 UTC

- reply

@nprofile…tsvd when governments mandate things, especially authoritarian governments, you know it's not being done in the public interest. If the app were truly a good thing, people would install and use it voluntarily.