Zak

Privacy Analyst formerly at 1Password and Jolicloud. I live at Disney World. Opinions are mine, you can’t have them.

LinkStack: https://linksta.cc/@zak

Public Key

npub1cxshdy5d8awhm7y7wgrlwthhh3e764hz9jfa03ve6n8rrwvm2xgs59yv3r

NIP-05 Address

zak_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsvrgtkj2xn7htalz08yplh9mmmculd2m3zey7hckvafn33hxd4rygprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt40a4md

Publishing to

relay.momostr.pink

Author Public Key

npub1cxshdy5d8awhm7y7wgrlwthhh3e764hz9jfa03ve6n8rrwvm2xgs59yv3r

Show more details

Last Notes

2026-06-04 13:56:07 UTC

- reply

I've been considering that area for a while now and that's exactly what's stopping me. 😆

2026-06-04 13:46:29 UTC

- reply

I've been in Celebration for the last 6 years. I guess it's not technically "on property" anymore. But Disney built it, and I don't need to deal with the roommate problem, so I count it. But I've heard similar stories from friends of mine.

2026-06-04 13:39:10 UTC

- reply

Also ADD here! I never got the upgrade, so I just sort of assume.

2026-05-03 18:33:22 UTC

Looking forward to PasteFail.

2026-03-24 01:58:48 UTC

The 90s: You provide your A/S/L freely to strangers on the internet leading to some of the best friends that you've ever had.
Now: The US government demands your A/S/L to use any digital device. Your details are leaked and misused constantly. You haven't made any new friends.

2026-03-22 20:59:55 UTC

When was the last time you checked for a firmware update for your networking hardware? Is your router running up to date software?
#Security

2026-03-20 00:22:00 UTC

This is so cool. A Jellyfin client designed to be used with controllers. Looks like the Nintendo Switch interface. This'll be awesome on a Steam Deck.
https://flathub.org/en/apps/fun.dragonfly.switchfin
#Linux #Jellyfin #FOSS

2026-03-18 22:39:23 UTC

ChatGPT implies the existence of ChatMBR.

2026-02-12 20:07:52 UTC

How many times will you hit the up arrow before you give up and type a command?
#Linux

2026-02-08 02:49:10 UTC

RE: https://mastodon.social/@verge/116031042438478972
I wish articles like this would stop saying "Linux" and start saying "Ubuntu" or whatever else. If it's going to be a distro review, just own that.
#note1c0z…ce0r

2026-01-11 19:09:15 UTC

Fun fact: if you tell Gemini a bit about your software setup and ask it for advice on de-Googling, it will happily (and pretty accurately) assist you.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/878/036/226/605/534/original/3ff2802a66035015.jpg

2025-12-27 18:44:12 UTC

Eyelashes: stop things from falling into your eyes.
Also eyelashes: fall directly into your eyes.
What horseshit.

2025-12-16 22:50:53 UTC

RE: https://infosec.exchange/@briankrebs/115731017851876667
Question: how's the robot vacuum industry right now?
Answer: it sucks.
#note1zpg…ytsp

2025-12-07 04:49:24 UTC

LGBTQ is great and all, but I'm proposing a new standard with LGBTQS. With proper client-side encryption.

2025-11-22 01:19:18 UTC

Pro tip: on Black Friday, all of your favorite Linux distributions will be FREE to download.

2025-11-20 18:26:38 UTC

Based on what we've seen as far as the enshittification of other platforms, we can expect to see at least three things from AI in the very near future:<li>Ads. Lots of ads. Sponsored answers. Suggestions based on corporate payment instead of truth and knowledge. We saw this happen with search.</li><li>Vendor lock-in. Expect Google to know some things, ChatGPT to know some things, Claude to know some things, etc, with minimal overlap. Gotta pay for them all to get the full picture! We saw this happen with streaming.</li><li>Huge price increases. AI is currently free for most people to use, and usually around $20 USD or so for casual "pro" use. Not for long. We see this happen everywhere.</li>

2025-11-16 22:55:30 UTC

- reply

I'm into it.

2025-11-15 06:16:29 UTC

Something that I hope to see in the future (but don't actually expect) is a Steam Deck mini. Everyone wants more power out of their gaming devices and I get that. But a more efficient Steam Deck that's the size of a Nintendo Switch Lite or something would just blow my mind. It'd make it a lot easier to justify actually carrying it around.

2025-11-02 03:18:37 UTC

- reply

Antishittification

2025-10-25 20:39:24 UTC

- reply

Private Space is technically even better. My understanding is that it's an entire container for apps rather than just a simple lock. But maybe I'm off about that.

2025-10-25 20:27:00 UTC

Just discovered: App Lock, which lets you lock any app on your Android device behind either a PIN or biometrics. This should absolutely be standard, but it's nice to have it regardless.
Admittedly, locking is a bit slow and happens about a full second after an app is already open. But it looks like the 2.0 release just dropped, and so I'm hoping that'll improve with future updates.
https://github.com/PranavPurwar/AppLock
#Android #FOSS #Security

2025-10-25 19:24:47 UTC

Hot take? Warm take maybe? I actually think that Canonical's idea of Ubuntu being constructed entirely of snaps and managing things like the kernel and drivers like LEGO pieces is sort of incredible, especially for business and enterprise systems. I'd be terrified of using a traditional Linux desktop operating system for work because one misconfigured package could take down my workstation, which I, like, use for work. But something like Ubuntu Core Desktop would keep things running smoothly, and I have to imagine that Ubuntu Core itself works the same way on the server end.
As much as I'd love to say the same of Fedora Silverblue and the like, the lack of room for enterprise-grade software is just not acceptable right now. Things like Zoom and Slack work mostly fine nowadays, but anything that requires a bit more punch just isn't possible with a flatpak right now. So it requires layering, which may defeat the purpose of using it at all over Fedora Workstation or any other traditional distro.
#Linux #Enterprise #Work

2025-10-22 02:21:48 UTC

It seems like Brennan is going to end every episode of campaign 4 with a massive cliffhanger and a set of question marks and I am absolutely here for it.
#CriticalRole

2025-10-09 20:22:17 UTC

- reply

I keep wanting to try these releases, but I've been waiting for Ubuntu Core Desktop to do so for what feels like years now.

2025-10-02 19:44:27 UTC

- reply

Maybe you could try just rolling back to the older version? I've never done this before myself, but if it's really an issue with the new version, this might work in the short term.
https://docs.flathub.org/docs/for-users/downgrading

2025-09-24 19:10:09 UTC

- reply

Dang, that's a bit disappointing. I was hoping to use it as my personal Synology follow up.

2025-09-24 18:52:11 UTC

[@hen](https://social.lol/@hen ) On the most recent [@sr](https://social.lol/@sr ) today, you brought up being a self-hosting normie and using Synology (like I do) instead of Nextcloud. Just wanted to bring up that I plan on looking into swapping to @npub129e…3cyx next chance I get because it seems fairly similar in the "install a thing and use it" instead of messing with Docker sort of way. Mostly just waiting on a new release because it's based on Debian and my hardware is too new for their current kernel 6.1.

2025-09-11 15:24:26 UTC

RCS messaging has been broken for many people using @npub1kwa…e0nj since their September 8th update. That update only included some firmware backports, and so according to the GrapheneOS developers, it's not really possible that the update itself is causing the issue. It could be some form of firmware incompatibility. But much more likely in my mind, despite a lack of visible evidence, is that it seems like Google has changed the way that devices authenticate to their RCS servers, effectively locking GrapheneOS users out of the service and forcing them back to SMS for text messaging.
This is why a single company should never be in charge of what should be an open standard.
https://discuss.grapheneos.org/d/1353-using-rcs-with-google-messages-on-grapheneos/769

2025-09-03 06:07:57 UTC

@npub1kwa…e0nj A question for the team: the FAQ states that...
"We provide extended support releases as a stopgap for users to transition to the far more secure current generation devices."
This makes sense when it comes to phones. But what will happen when the Pixel Tablet officially goes EOL? Will it receive extended support for longer than the average Pixel phone? Or will GrapheneOS on tablets cease to be an option without the release of a new Pixel Tablet?

2025-07-19 01:00:14 UTC

Joke's on all of you for following me. All I want to do is talk to you about your car's extended warranty.

2025-06-19 16:37:19 UTC

- reply

I'm not sure how well this would do with photos rather than documents. I'd have to give it a try.

2025-06-19 16:28:50 UTC

I'm looking for an app for Android that'll allow me to scan old paper photos and place them in my digital library. I know that Google used to have a photo scan app, but as far as I know, it's been abandoned for about two years now. I figure there may be a better alternative somewhere.
#FOSS #Android

2025-06-18 16:48:40 UTC

- reply

I think this might be the best one on the album. It's a tough choice, but this would be my pick.

2025-06-13 23:03:23 UTC

- reply

Right, true. I consider Play Integrity to be a totally separate issue, but you're right in saying that it's a huge issue nonetheless. I'm personally more concerned with future hardware/firmware support and how it will be able to support, as you say, AOSP-based operating systems. This is what I'm scared of. I know that GrapheneOS-compliant hardware is possible. I just don't know if or when it'll happen.

2025-06-13 21:35:07 UTC

- reply

The @npub1kwa…e0nj account has been commenting on this, but the tl;dr is that Google is no longer providing device tree data that used to make supporting Pixel hardware much easier than other phones.
https://grapheneos.social/@GrapheneOS/114661957699559672

2025-06-13 20:42:06 UTC

- reply

I'm currently running GrapheneOS and its been great. But Google appears to be making moves that'll make custom ROMs a bit more difficult, and I'd expect that to continue in the future. And so I always want to be up to date on alternatives.

2025-06-13 20:33:03 UTC

In order to switch to a #Linux phone running something like [@postmarketOS](https://social.treehouse.systems/@postmarketOS ), I'd really only need a few things:<li>Reasonably good battery life. Probably the biggest one.</li><li>Consistently working calls and text messages.</li><li>A good working web browser.</li><li>Maybe some basic local tools like a calendar, notes, and maps.</li>
I think that's basically it. Everything else I think I could reasonably compromise on. Most things can be done from the web browser. Android app compatibility would be nice, but I personally don't feel the need to run things like my banking app on my Linux phone. Obviously I'd like more, but this is the baseline experience that I'd need.
I know that hardware compatibility and battery life are extremely difficult without manufacturer support, and I figure until we have that, these won't be reasonable requests.

2025-06-11 20:33:52 UTC

If Google pulls the Pixel program out of AOSP and GrapheneOS ends up dead, I may legitimately just buy a dumb phone.

2025-06-11 01:41:42 UTC

- reply

I'd love to see @npub15f7…m7wr step up and be the ones to handle this. A Framework phone would be popular, and considering the enthusiasm from the Linux community around their laptops, I have to imagine that GrapheneOS would be a great choice for a repairable Framework phone.

2025-06-05 02:34:18 UTC

Do you like using clean, fresh, up to date social network? Do you hate ads and tracking? Reminder to donate to your Mastodon instance of choice on a regular basis. It's how this stuff stays alive.

2025-05-15 19:49:00 UTC

Neurodivergence implies the existence of neuroconvergence.

2025-05-11 18:00:27 UTC

Apparently the public sharing of Signal usernames isn't generally recommended. If you wanted to create a public profile with which people could send you a message, what would you be using?

2025-05-06 19:09:08 UTC

- reply

I'd love to see a way to get new builds directly through Obtainium. 😁

2025-05-03 00:14:33 UTC

Many of you Linux users out there are using libraries without a library card.

2025-04-29 20:38:12 UTC

What's everyone using as their RSS service and client(s) of choice?

2025-04-29 13:19:29 UTC

If the #fosstodon thing has made me realize anything, it's how fragile all of this is. It doesn't take very much for me to start losing accounts that I follow, or accounts that follow me, because there may suddenly be people deleting those accounts, migrating to other instances, or in the worst case scenario, defederation. Each of those things leads to a loss of community which is why we're all here in the first place.

2025-04-26 17:09:38 UTC

I'm hoping to see @npub1kwa…e0nj move to a better backup solution soon. I'm sure that Seedvault works just fine for some people, but it's pretty limited.

2025-04-23 18:13:59 UTC

Given how quickly Discord has been going downhill, I wonder if the #FOSS community has opinions on Revolt as a replacement? I know that Matrix is the ideal, but it's just not ready for real use yet.

2025-04-22 17:20:51 UTC

Here's your semi-regular reminder that if you work in open source, you and your team can get a 1Password Teams account for free.
https://github.com/1Password/for-open-source
#FOSS #Security #Passwords

2025-04-15 23:07:09 UTC

My biggest issue with #OpenWRT so far is the upgrade process. As in, keeping the OS up to date. The package manager's upgrade functionality, which is fully baked into the OS and its GUI web interface, prominently displays a warning at the top that tells you not to use it. Don't upgrade packages, it can and will break your system: https://openwrt.org/meta/infobox/upgrade_packages_warning
Okay, then why is that feature baked into the OS at all?
Meanwhile, the sysupgrade feature, which is the recommended way to keep the OS up to date, is also baked into the OS, but only at the cli level. If you want to use the GUI web interface, you need to manually install the attended-sysupgrade package, after which point you can manually re-flash the OS whenever you want to using up to date packages, provided that you also (somehow) keep up to date about their releases without the use of a real tool to check for updates using the GUI. Why isn't that baked into the OS instead?
The whole thing is just very confusing.
#FOSS #Linux

2025-04-07 03:00:17 UTC

- reply

As a former Jolicloud team member, I have a huge soft spot for netbooks. I still have mine from 2009.

2025-04-07 02:49:21 UTC

- reply

And sometimes the hardware can be genuinely nicer than the usual alternatives. Linux on a Chromebook Pixel (2015) remains my best Linux experience to date.

2025-03-24 01:06:22 UTC

- reply

While true, I feel like A Bug's Life was the least weird out of all of them. It just so happened to kick start additional strange movies about bugs.

2025-03-24 00:51:19 UTC

What was our weird bug movie of the 2010s? In 1998 we had Antz. In 2007 we had Bee Movie. Has it been that long since our last weird bug movie?

2025-03-24 00:36:48 UTC

Animated movies and shows will continue to be mostly mediocre until we bring back proper 2D animation.

2025-03-17 02:00:24 UTC

- reply

Fedora. The usual.

2025-03-13 16:52:10 UTC

- reply

Those are two big ones! Pretty tough to avoid.

2025-03-13 16:45:31 UTC

- reply

Anonymity when it comes to money is very hard. @npub1d8e…x6ug is a pretty decent option.

2025-03-13 16:21:38 UTC

I'm paying for, have donated to, or have purchased merchandise from:
- Proton
- Home Assistant
- elementary OS
- infosec.exchange
- Ente Photos
- EteSync
- Standard Notes
- Signal
Among others. Remember to pay developers for good open source software.
#FOSS #opensource

2025-02-28 15:03:58 UTC

For a time, "Skype" was a verb synonymous with video calling. My grandparents knew how to Skype. That it had to be acquired, neglected, and killed in favor of a Slack clone is a damn shame.
https://arstechnica.com/gadgets/2025/02/on-may-5-microsofts-skype-will-shut-down-for-good/

2025-02-27 20:45:23 UTC

With everything going on with Mozilla and #Firefox, it's once again time for me to post about our need for a real, flagship #Linux web browser. Firefox has been it for some time, and while I can absolutely understand why, I think it's becoming more and more apparent that Mozilla's goals don't really align with those of the Linux community. And to be clear, that's okay! Mozilla needs to make money. But Linux distributions and users shouldn't be impacted by that need, now or in the future.
I recognize that projects like GNOME Web are awesome, but I don't see a future in which GNOME Web replaces Firefox and is shipped among distributions regardless of their desktop environment of choice.

2025-02-27 02:43:32 UTC

Every so often I think about how cool it'd be if iOS and Android were still competing with BlackBerry as a platform.

2025-02-22 22:38:33 UTC

What are you currently using for search?

2025-02-21 22:03:16 UTC

As seen on Reddit, X / Twitter appears to be partnering in some way with Brave for search results in their stupid AI thing:
"We share parts of Input Data with Brave Software, Inc., so we can include Brave’s search results in the Service."
https://x.ai/legal/europe-privacy-policy-addendum

2025-02-17 21:11:25 UTC

Me, after years of time and effort: Finally, everything in my house is running Linux. It all works beautifully. My setup is so much better now than it was before. It was all worth it.
My brain: I should look into BSD.

2025-02-17 19:03:43 UTC

- reply

This looks like Gapless, I think?

2025-02-13 01:55:00 UTC

Which is less bad?

2025-02-12 03:53:33 UTC

In 2016 or so I had a (small, civil) Twitter argument with @npub1tx8…x0yc about VPNs being useful. Now I've entirely reversed my attitude on them and agree with every word.

2025-02-09 17:22:58 UTC

Here's a hypothetical question on backups: if you were to keep device backups on a small, portable SSD that you carry with you, would you consider that to be an on-prem backup, or an off-prem backup?

2025-02-07 21:31:21 UTC

On the web, I've been using elk.zone for Mastodon and phtn.app for Lemmy. Are there any good web applications for Pixelfed?
#fediverse

2025-02-02 19:19:05 UTC

Babe wake up, #fediverse Facebook Marketplace just dropped. https://codeberg.org/flohmarkt/flohmarkt

2025-02-02 04:42:50 UTC

- reply

I've got three pairs of wired headphones and I love them! I don't miss AirPods a bit.

2025-02-02 04:36:30 UTC

You know what doesn't collect data about you? A pair of wired headphones that don't require an app to function. https://www.headphonesty.com/2025/01/your-headphones-may-be-spying-on-you/

2025-02-01 22:53:43 UTC

- reply

On the security end, @npub1kwa…e0nj goes into some great detail here: https://grapheneos.org/usage#web-browsing

2025-02-01 22:42:51 UTC

- reply

I actually see significantly better performance on the Chromium side of things. Using Firefox eats through my laptop's battery much more quickly, even with all of the manual hardware acceleration tweaks in place (which really shouldn't be necessary at this point). Nothing flat out fails on the compatibility end, but I do notice small things like some video players stuttering or doubling up frames which sucks, especially on an HTPC. Not to mention the fact that Firefox is pretty far behind Chromium in terms of security.

2025-02-01 22:31:14 UTC

I wish Mozilla would take Firefox development a bit more seriously. It's a great web browser, but it does still fall short of Chromium in a number of ways. And it'd be really awesome to have a true competitor out there, run by a more ethical nonprofit.
Props to those who use it right now. It's just not for me at the moment.

2025-01-31 04:26:34 UTC

If you're a @npub1ak3…t4td user, or you're just getting started with password managers in general, I'd strongly recommend a look at this blog post from @npub1s23…ah67. A secondary encryption secret is why I chose 1Password as my password manager, well before I started working for the company. It's a massive stand out feature that others don't have. But to most, it's very difficult to explain.
https://blog.1password.com/what-the-secret-key-does/
#security #passwords

2025-01-31 04:14:40 UTC

Use Signal.

2025-01-29 23:59:41 UTC

I've started using @npub1zje…acky for location sharing as an alternative to Find My Friends. It uses @npub1m9z…whzq to communicate and seems to be exactly my thing. With that said, it's very early days. The roadmap looks good, but the app itself seems a bit buggy and inefficient on some platforms. But it'll get there.
https://mygrid.app/
#privacy #FOSS

2025-01-24 03:12:36 UTC

Reminder that @npub1ak3…t4td currently has 6 positions open on the Security team, with more likely on the way. If you want to work with me (or, even better, be on my Privacy team), check out the listings here and see if one might be a good fit for you.
https://jobs.lever.co/1password?department=Technology&team=Security
#jobs #hiring #fedihire #security #privacy #passwords

2025-01-24 03:02:39 UTC

- reply

I've made a bit of a trade off here in the form of prioritizing NextDNS blocklists over blending in using a shared IP address. Mostly because the sites and services that I use tend to require signing in with an account anyway, so I wouldn't be anonymous either way. If I need it, I'd likely temporarily disable Private DNS and use Tor or something. But it's very rare that I use a VPN for anything except getting around regional blocks.

2025-01-24 02:55:16 UTC

- reply

Ah I see, it's an accuracy issue. Got it. Well, I'll look forward to whatever they are actually doing, in that case.

2025-01-24 02:48:13 UTC

- reply

I'm not sure that I understand the realistic difference between this and what's described by @npub1dm2…7754. It seems that the end result is an implementation of DoH that can only be used with Google or Cloudflare servers. If that's not the case, then I've been misinformed and I just don't know how to properly configure the private DNS feature to use DoH.
(Context: I am a NextDNS user)

2025-01-24 02:43:25 UTC

- reply

This might be worse.

2025-01-24 02:34:03 UTC

Cool Whip implies the existence of Lame Whip.

2025-01-23 23:16:25 UTC

I wonder if @npub1kwa…e0nj could/would implement their own DNS over HTTPS functionality now that Google has expressed their desire to reject it from ever reaching the AOSP?

2025-01-20 18:17:37 UTC

- reply

They were decent enough, but I remember going through that first season episode by episode every week, listening to podcasts full of theories, wondering where it could all be going. It was just nuts.

2025-01-20 18:09:30 UTC

Every so often I think about how good the first season of Westworld was.

2025-01-16 19:10:07 UTC

New job listing! @npub1ak3…t4td is looking for a Senior Security Engineer for our detection and response team. If you think you'll be a good fit, apply here: https://jobs.lever.co/1password/0297d5da-86d4-4c26-895b-02c6b477cd23
#hiring #jobs #FediHire #security

2025-01-15 16:41:32 UTC

I'm disappointed to see the responses that @npub19kd…t56d has been making on Reddit concerning Andy's recent comments. A CEO having a poor political stance is one thing, but dragging the rest of the company into it and putting out replies from the official account is rough. Proton was supposed to be different.

2025-01-14 22:30:54 UTC

Does anyone want or need a Google Pixel C tablet? These are no longer sold or supported, and even @npub1drm…84ff dropped it some time ago, so it can really only be used for hacking around. Still, I have one in perfect condition just sitting on my shelf.
#selling

2024-12-27 17:54:58 UTC

In the future, every album in your music library will have (Remastered) or (Special Edition) after its name because nobody can just write music and then leave it alone anymore.

2024-12-26 07:17:01 UTC

Did you know: Jolicloud was one of the (relatively) few #Linux distributions to spawn official hardware. Specifically, the Jolibook!
Just a standard netbook under the hood, it was released in 2010 and met with extremely mixed reviews. The look was... not for everybody. To this day, I don't really understand it myself. But it was certainly original, and the device itself worked fantastically.
Today, these are seen as "collector's items." I never owned one myself, and given the short lifespan that netbooks had combined with Joli OS being discontinued, I have to wonder if there are any left. Still, it's fun to think that maybe somewhere out there, one of these little Linux devices is still chugging along.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/717/859/945/347/671/original/a0795fdff099e2aa.jpg

2024-12-25 06:16:35 UTC

Merry Christmas, yes. What about Pippin Christmas?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/711/997/115/435/434/original/98cf9362f2165a41.webp

2024-12-24 20:28:52 UTC

Quick tip for Android users: if you've got F-Droid installed, the standard app reaches pretty far back and targets something like Android 7 for compatibility. If you have a modern device and you're running a modern version of Android, you might want to consider swapping to F-Droid Basic, which targets Android 13 and is capable of unattended upgrades.
https://f-droid.org/packages/org.fdroid.basic/
#privacy #android #fdroid

2024-12-24 03:36:20 UTC

Hot take: nobody actually likes candy canes.

2024-12-21 01:40:05 UTC

I'd love to replace the Windows key on my @npub15f7…m7wr 13 with a key that just says SUPER as on @npub1mjj…a2m6's Launch and such. I'm surprised that they don't seem to sell those already.
Still very much waiting for an update on System76's Project Virgo, on that note.

2024-12-20 18:15:29 UTC

Here's a #privacy pro tip: if you live in the US and you're tired of receiving credit and insurance offerings in the mail, you can use OptOutPrescreen to stop them pretty efficiently: https://www.optoutprescreen.com/
Opting out online will last for 5 years. To do so permanently, you'll have to physically mail a letter, but the 5 year option is still pretty good and just takes a minute or so to complete.

2024-12-20 03:14:01 UTC

I'm about to try to go through the daunting task of swapping from a music streaming service to locally hosted files. I haven't organized or used my own music library in years. I don't even know what players to use anymore. This should be really interesting.

2024-12-13 01:36:14 UTC

- reply

This has been super interesting. Thank you! Given all of this, I'd be curious to know what the GrapheneOS team would choose when it comes to using a full desktop operating system.