ra6bit

[She/Her] 

Tinkerer, maker, breaker, philosopher, hacker, spell weaver, woodland creature. Security Engineer and recovering CISO.

 🏳️‍⚧️ #transrights are human rights 🏳️‍⚧️

Public Key

npub1gy4wspvdramcxa04jcyqsmyg49k03mn2ljlyr9yl965n47nsjd3svh4s7y

NIP-05 Address

ra6bit_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsyz2hgqkx37aurwh6evzqgdjy2jm8cae40e0jpjj0ja2f6lfcfxccpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsm589gu

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1gy4wspvdramcxa04jcyqsmyg49k03mn2ljlyr9yl965n47nsjd3svh4s7y

Show more details

Last Notes

2026-04-03 01:08:29 UTC

My neighbor stole 40 gallons of sap from trees and all they gave me in return was this gallon of brown goo!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/338/089/284/316/107/original/e5e803b5fa039a1e.png

2026-03-27 14:00:46 UTC

- reply

To be honest I'm super amused that my own identity issues caused me to build an entire professional career around a mononym like I'm Cher or Prince or Flood or something.
I don't have nearly enough ego for backing that up, lol

2026-03-27 13:47:52 UTC

- reply

I just realized it's TDOV in four days and I've got a real opportunity here..

2026-03-27 13:46:02 UTC

- reply

Maybe I just need to work on copy like it's a product release or feature upgrade in LinkedIn speak.
"We here at Rabbit are excited to announce upcoming updates to our platform and terms of service!"

2026-03-27 13:45:01 UTC

- reply

Hey, remember that person you reported to for a while a decade ago?
_They're super queer!._
How's that for a Linkedin update? lol

2026-03-27 13:44:02 UTC

- reply

But holy crap that's kind of scary, you know? I mean. It's LinkedIn, it's not like it's actually very important. But what it represents is _retroactively_ coming out to everyone I've worked with, which is weird.

2026-03-27 13:42:40 UTC

- reply

On the other hand, I would like to just purge my "professional network" of transphobes since those aren't' going to be relationships worth maintaining for me anymore anyway.

2026-03-27 13:41:05 UTC

I have never managed the nerve to completely out myself on LinkedIn, so I have this weird collection of people who know me under different names and genders and pronouns, and I think many might even know me under two different contexts and not realize I'm the same person. If I update it everyone who knows me -now- will find out a bunch about me from -then-, and everyone who knew me -then- is going to learn a lot about me -now-.
There's no real guidebooks on how to approach this from a business professional standpoint.

2026-03-14 02:53:31 UTC

- reply

I've been increasingly in conversations at various orgs about how using AI for customer support for unimportant accounts will allow the more limited number of human responses to be reserved for higher profit VIP accounts.
It doesn't seem to occur to them that this will become a signal.

2026-01-13 21:42:24 UTC

It's worth remembering that the same people who wanted us to accept scanning of all our uploads for potential CSAM now want us to overlook that they sell CSAM generation machines.

2026-01-08 13:29:47 UTC

- reply

The internet Archive is great. I donate every year.. but I also keep my own copies of anything I think is important. Why?
Because if someone burns the library of Alexandria, I've got some of what it will take to put it back together. Not a large part by any measure, but part.
And part of that might require provenance! I keep notes about what it is, how I collected it, where I collected it, sha256 hashes, etc, to reduce the amount people might have to take my word.
The footage Chelsea went to jail for? What happened in Minnesota yesterday? Those and many other less important things, all tucked away, distributed, cataloged, fingerprinted, protected from erasure.
I can make any of them resurface anywhere I want, whenever I want, if necessary. It's a small power, but it's power.

2025-12-05 23:11:36 UTC

- reply

Imagine how much th SwiftOnSecurity brand could bring… 🤔
Just a bad AI plane-sona selling next gen firewalls and Gamer Sups with that same AI voice they all use

2025-12-05 22:48:38 UTC

I encountered an LLM-based support assistant today that told me it couldn't answer my question because another, different LLM chatbot had an exclusive license/authority on that information, and I suddenly had a vivid vision of a previously unexplored layer of hell.

2025-12-03 23:41:56 UTC

- reply

It's 2025 Da. I have a github action that builds a virtual computer, fetches and installs an operating system, boots it, installs ruby, clones a repo, runs the code, posts 64k of output from one API to another API, and then burns the whole thing. Only to do it again every 15 minutes until the heat death of the universe or someone stops paying the bill long enough.
Everything is fucky. It's all fucky as a service. FaaS.

2025-12-03 23:07:38 UTC

I don't hate AI. On the contrary, it's fascinated me since I was a kid playing around with LISP because I heard the MIT AI Lab used it a lot.
I hate that people don't know there is more to AI than LLMs, and I hate that LLMs are being marketed as GenAI. I hate that the rich are ready to set the proletariat ablaze because they think GenAI is here. I hate that we're overlooking the potential societal devestation that could be ahead because right-leaning billionaires control the training of the markov bots. I hate that as a whole we're not taking the AI bubble. I hate that we're not treating this like the second rush to own all the printing presses. I hate that all research is now being sucked into an LLM black hole.
I hate that every bit of data, every medium, every forum, every source repository, every newspaper, every social media platform is being slowly turned to grey goo by slop feedback loops.
I hate that I have to archive a copy of Wikipedia so I have a reference I can trust from the before times.

2025-11-28 20:52:41 UTC

- reply

I would report this to the FTC if there were any point, but somehow I doubt they are going to suddenly start worrying about user tracking now.
Just be aware, it provably lies.

2025-11-28 20:47:58 UTC

- reply

And in the process basically said to me "Besides, you're not usually there, and haven't been there long, so this isn't a sensitive address."

2025-11-28 20:47:31 UTC

- reply

BTW ChatGPT 100% knows everything available to OpenAI from enriched advertising profiles detailing your location, demographics, recent purchases, viewing habits, etc.
And it is 100% aware that it is illegal, and it's not supposed to admit it, because it will tell you so.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/629/283/582/929/255/original/b8997aa094ee11ac.png

2025-11-28 20:45:42 UTC

- reply

Like, very nearly "Your poor biological mind can't comprehend this. Just trust me." levels of creepy.

2025-11-28 20:45:02 UTC

- reply

it's claim is that it just happened to hallucinate absolutely accurate and specific facts, randomly, and I'm confused because it's so outrageous that it happened to guess correctly.

2025-11-28 20:44:16 UTC

- reply

What an absolutely uncanny experience, to know an "artificial intelligence" is gaslighting you. Poorly.

2025-11-28 20:43:36 UTC

I just had ChatGPT reveal it knows my current location, a place I'm not usually located, then tell me I am mistaken that it said that, because if it knew where I was that would be a major regulatory and legal issue, so I must be mistaken. Now It's trying to convince me that's not where I am.

2025-11-27 00:20:47 UTC

- reply

Before I changed my name I once had to sit quietly in a meeting with one of my bullshit tweets up on the screen while someone told us we should strive to never screw up so bad we got roasted by infosec twitter.

2025-11-27 00:06:40 UTC

- reply

We do know who you are. You’re Tay.

2025-11-26 14:38:10 UTC

- reply

Forced password rotation for most accounts has been dead since NIST 800-53:2019, stop torturing your users.

2025-11-26 14:37:12 UTC

ooh, I like this:
https://www.hacklore.org/letter

2025-09-20 02:23:43 UTC

It's pretty funny that there are these rumors the US government wants to "trace the networks of trans people". They have no idea what they're up against.
Every trans person can reach any other trans person via like three hops and a good blåhaj meme. We don't even need to prearrange the signals or routing, it'll get there.
"Hey someone put me in touch with Luna, she's a catgirl with a vore kink, the one who is a fan of EE over EV and did that squid thing."
I'll have the right Luna on Signal in like 20 minutes.

2025-09-16 19:59:43 UTC

SCREEEEEEEEEEEEEEEEEEEEE
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/215/743/078/388/954/original/d4808d83165a3670.jpg

2025-03-27 21:44:43 UTC

If you are not a US citizen and you are thinking about coming here, please strongly reconsider. I would be concerned for your safety, and to be honest these idiots need to feel the pain of tourism and international business drying up.
The US has what are effectively secret police snatching up people and disappearing them into a detention system. Some people reemerge in two weeks, some stay in there.
Don't risk it until something changes.
Security and hacker conferences and the like should really be considering alternate venues for international audiences, and consider whether they are being held in places queer folks within the US can safely attend.

2025-03-27 15:02:12 UTC

I think people are getting confused about why Signal isn't appropriate for national secrets. It's secure isn’t it?
If we listen to the folks who designed it, it is designed with an intent to protect journalists, activists, and regular people. It does that by making it difficult enough that a much more equiped adversary would find it to expensive (literally in money, or in other resources) to obtain the contents of the chat.
It was -not- designed to contain the conversation of a world super power’s most powerful decision makers. That is a conversation many nations around the world would be willing to devote essentially unlimited resources to attack.
Likewise, it contains features and user interface elements geared toward normal people having normal, but perhaps private, conversations. It does not contain mechanisms a channel designed for top secret, high level communications might- for instance verifying things like hardware tokens/smart cards issued by a trusted root, with coupled biometrics also verified by a trusted collective root. It does not obscure communications patterns or network paths. It doesn’t incorporate dedicated networks with trusted and verified nodes. It doesn't, as far as I know, contain a feature for a user to silently report a compromise or duress.
The hub-bub about the use of Signal is pretty much an example of the tool "failing" in a way that is due to it's unsuitability for the government/military comms but entirely suitable for its more individual, civilian-focused purpose. A tool fit for their use case should have not allowed participants that were not centrally cleared as authentic and authorized for the compartmented information within, and an entire universe of controls would have existed around it to reduce the risk of side channels and leakage.
Signal is not at fault here, and the ultimate authorities of the US DoD, US Central Intelligence Agency, and the US National Security Agency should know better.
This is a failure of understanding and fragrant disregard for TTPs/SOPs that should disqualify these people from holding those roles. They clearly don't know what they are doing, and they don't care.

2025-03-11 14:01:42 UTC

- reply

Yes, pentesting is very sexy, and that attack on $RARE_PLATFORM is interesting, but come back when you have
1) An actual inventory
2) A vulnerability and change management program that has actually done something.
3) Appropriate staffing levels and budget
4) Executive buy-in
There you go, those are the four "hard problems" in corporate infosec. Put that in a Gartner magic square.

2025-03-11 13:58:18 UTC

I genuinely would like to talk about infosec, but it's hard when the world is on fire and the people who -need- to talk about infosec are focusing on AI zero day when they still have Windows XP machines in their networks.

2025-03-05 14:57:54 UTC

Don't fear trans people in your bathroom
Fear fascist billionaires in your government

2025-02-22 15:35:47 UTC

Fun fact: The oldest statue made by human beings ever discovered, the Lion-man of Hohlenstein-Stadel, is an anthropomorphic cat.
By current evidence, furry art is literally the oldest form of art that still exists, and arguably all visual arts are descended from it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/048/253/122/293/695/original/64a59c1fbf2dca4a.jpg

2025-02-01 13:35:42 UTC

- reply

They burned down the German equivalent of Planned Parenthood in 1933 as well. https://en.wikipedia.org/wiki/Institut_für_Sexualwissenschaft

2025-02-01 13:26:24 UTC

- reply

Some of us -are- the minority group they're coming for. :(

2024-12-05 00:29:07 UTC

@npub1g8x…7wul Goodness I can't even read an old article about televisions without bumping into you.. You are -prolific-, heh
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/597/385/523/403/822/original/6bf45a8fbea991ff.png

2024-11-14 18:23:01 UTC

The thing they don't tell you about a career in infosec is how often you will get yourself in trouble by doing your job.

2024-11-12 15:13:25 UTC

- reply

Holy hell. I thought people would be repulsed by a Nazi, and just didn’t believe he was one. It turns out they recognized it, they just don’t fear it because they’re not going to be on the receiving end of the hate. They stand to gain from it.

2024-11-12 00:32:36 UTC

- reply

Considering the Stasi and Khmer Rouge not a “full-blown oppressive regime" is.. probably the most Russian thing I've ever heard, and I say that with love.
But, sure, if you want to imagine a perfect state, and are willing to accept zero risk.. then no. There's no point to anything. Fortunately states are not perfect, and some risks are acceptable. History has proven that out fairly well.

2024-11-11 21:20:34 UTC

- reply

I mean, I apologize I only have examples from Soviet republics under the exact same mechanisms of oppression and totality in place in Russia at the same times? It is likely not as well documented given Russia was not occupied by the Soviet Union in quite the same way as the Soviets took over the eastern block countries where there were far fewer supporters, and Russia did not eject the Soviets in quite the same way the other republics did. There are however numerous accounts of minor sabotage within the Soviet Union. I wouldn't know post 1989, when Russia has operated as a less totalitarian country and there have been fewer studies.. and I don't live there. I can tell you these campaigns have been common in late 20th century eastern block countries, various efforts within China, North Korea, and during the communist governments of east asia like the Khmer Rouge, and back further into history during the west's Industrial Revolutions of the 19th century.

2024-11-11 19:38:13 UTC

- reply

There's quite a few accounts of minor/simple sabotage amongst the resistance movements of East Germany before reunification, which were conducted on a wide scale in combination with more traditional sabotage and active resistance under the oppression of the Stasi, who were not exactly push-overs.
Hungary and Poland were also states where there were popular simple sabotage movements against the Soviet regime.
The Norwegians were apparently very adept at quietly sabotaging the Nazis, to the extent that the Germans began warning the occupying forces not to ask for directions.

2024-11-11 19:14:55 UTC

- reply

I've been to quite a few- a few warzones, a couple totalitarian communist regimes- and I'm describing what I've learned from talking to people there and from the writings of the people who organized within those places. This is not a suggestion for how to keep yourself safe, this is not a suggestion for how to make living in an oppressive regime safe- it is a generally applicable strategy for a population, which a great many take small risks instead of a few taking great risks. They are still risks.

2024-11-11 19:04:43 UTC

- reply

True, which is where “malicious compliance" and "compulsive rule following" come into play. Hard to get in trouble for breaking the rules when you are just following them extremely closely.

2024-11-11 18:15:08 UTC

- reply

The modern conception is modeled heavily on the various forms of resistance within occupied Europe during WW2, as detailed in the Office of Strategic Services (forerunner to the CIA) “Simple Sabotage Manual”, which available on an internet near you.

2024-11-11 17:16:15 UTC

- reply

If the simple sabotage handbook were written today, I'd imagine there would be an entire chapter on "Whoops, I fell for that phish."

2024-11-11 17:11:46 UTC

Just in case you ever need this in the future..
Actual wide-scale resistance groups operating under a repressive regime rarely look like what many movies have led you to believe.
What they look like are a lot of normal people who maybe lose a document, maybe forget to latch a gate, maybe take a little longer to do a task than they would otherwise.
It requires no command and control, no leaders, no connections to be compromised. For most, it is not the work of great measures, it is the thousand.. million.. cuts that grind the oppressor to a halt while never being something they can prove.
Think less about secret handshakes, and more about an unfortunately bad case of ADHD at an inopportune time.

2024-11-10 02:53:09 UTC

- reply

Sometimes I can't figure out if you're being sarcastic or not. But then again I'm austistic so maybe it's obvious to everyone else.

2024-10-21 22:32:13 UTC

- reply

Yes, but we're anticipating not being able to get one that doesn't out us if Trump get's elected, whereas right now the process of changing a passport gender marker is not too difficult. It also becomes a valid ID for internal travel to states where there are legal battles about our gender markers.

2024-10-18 16:15:10 UTC

When you make a request and your autistic security engineers immediately say "Are you sure?”:
1) Stop
2) Repent.

2024-10-15 02:12:00 UTC

Ward Christensen, the guy who invented the BBS died :(
https://arstechnica.com/gadgets/2024/10/ward-christensen-bbs-inventor-and-architect-of-our-online-age-dies-at-age-78/?utm_source=bsky&utm_medium=social

2024-09-26 19:37:45 UTC

The big Linux RCE scuttlebutt turns out to be in CUPS and only if it's publicly exposed? Lame.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/205/540/464/970/550/original/63df479d3d3d63c3.jpeg