Tod Beardsley

Shmethical #Hacker. #Research mucky-muck at [@runzero](https://infosec.exchange/@runzero ). #Election worker. #CVE bagman. #Metasploit collaborator. Briefly a fed. Anti-Fascist. #FriendofDeSoto. #Podcaster

Hey, my attorney and wife (same person) is running for US Congress. Donate here!

https://secure.actblue.com/donate/claire-reynolds-1

I post here for me, mostly around #infosec / #cybersecurity.

Intro: https://infosec.exchange/@todb/109270457002321619

Website: https://hugesuccess.org
GitHub: https://github.com/todb
OnlyFans: https://onlyfans.com/sudo_whoami
Jobby job: https://www.runzero.com/authors/tod-beardsley/
Callsign: KT0DBK
Pronouns: he/him

Public Key

npub1qzuk6k5w9ajvltt2f56pgy52uwddsf53ngmzqza6g9367jyc8cmsc6rvyk

NIP-05 Address

todb_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsqpwtdt28z7ex0444y6dq5z29w8xkcy6ge5d3qpwayzca0fzvrudcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds8ped4q

Publishing to

yabu.me

nos.lol

relay.damus.io

Author Public Key

npub1qzuk6k5w9ajvltt2f56pgy52uwddsf53ngmzqza6g9367jyc8cmsc6rvyk

Show more details

Published at

2026-08-12T21:31:26Z

Kind type

0 Metadata

Event JSON

{ "id": "8bed2a468d2c81016527ddc38c15719b9c68feb47af77edccd28dcbb504932f9", "pubkey": "00b96d5a8e2f64cfad6a4d3414128ae39ad826919a36200bba4163af48983e37", "created_at": 1786570286, "kind": 0, "tags": [ [ "t", "infosec" ], [ "t", "hacker" ], [ "t", "cybersecurity" ], [ "t", "research" ], [ "t", "cve" ], [ "t", "election" ], [ "t", "metasploit" ], [ "t", "podcaster" ], [ "t", "FriendofDeSoto" ], [ "proxy", "https://infosec.exchange/users/todb", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.exchange/users/todb", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Tod Beardsley\",\"about\":\"Shmethical #Hacker. #Research mucky-muck at [@runzero](https://infosec.exchange/@runzero ). #Election worker. #CVE bagman. #Metasploit collaborator. Briefly a fed. Anti-Fascist. #FriendofDeSoto. #Podcaster\\n\\nHey, my attorney and wife (same person) is running for US Congress. Donate here!\\n\\nhttps://secure.actblue.com/donate/claire-reynolds-1\\n\\nI post here for me, mostly around #infosec / #cybersecurity.\\n\\nIntro: https://infosec.exchange/@todb/109270457002321619\\n\\nWebsite: https://hugesuccess.org\\nGitHub: https://github.com/todb\\nOnlyFans: https://onlyfans.com/sudo_whoami\\nJobby job: https://www.runzero.com/authors/tod-beardsley/\\nCallsign: KT0DBK\\nPronouns: he/him\\n\",\"website\":\"https://infosec.exchange/@todb\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/258/798/902/039/585/original/104b3304b7b270b0.jpg\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/109/258/798/902/039/585/original/e34e4b813e02cc7f.jpeg\",\"nip05\":\"todb_at_infosec.exchange@momostr.pink\"}", "sig": "1ba0b7486690e658d74bd6c50cd7517e3c3371071d1e708955098530023370dcc6f25cbbce83e0a95b3fca076f0022bd7e939b25e956227e24f5e443302cedf9" }

Last Notes

2026-08-03 20:16:41 UTC

hey i’m collecting questions for our #CVE panel over on the lunatic site. Throw in if you have some mystery you want solved at @npub1r5v…l2tv on Wednesday. Or, reply here.
https://www.linkedin.com/posts/todb_bsideslv-cve-share-7490067904449699841-MP_I/?utm_source=share&utm_medium=member_ios&rcm=ACoAAAAn7RAB44xlLRNsfdYsGsDX40Om9-sbjVk

2026-07-29 13:32:08 UTC

RE: https://infosec.exchange/@runZeroInc/116998080051088489
And now tomorrow is today! Should be a fun chat.
#note1ann…u83p

2026-07-20 23:16:15 UTC

- reply

“homeopathic fraction of a penny,” I’M DYING

2026-07-20 23:14:44 UTC

If you’re super fan and watch all of @npub1fdr…lvhs’s videos and interviews, you’re going to hear maybe a dozen of his best turns of phrase.
If you read his books, you’re getting like the top 100.
Reverse Centaur’s Guide is really witty. We got ourselves a Candimericlish Oscar Wilde up in here.

2026-07-17 01:50:43 UTC

- reply

Apparently these declassified documents do exist. Somewhere. I'd love a link!
CNN is reporting they don't address what the president claimed.
https://www.cnn.com/2026/07/16/politics/what-trumps-newly-declassified-documents-do-and-dont-tell-us-about-threats-to-us-elections

2026-07-17 01:43:32 UTC

There continues to be no evidence of hacking in any election resulting in changing an outcome in any US election, by China, Russia or anyone else.
I checked whitehouse.gov (at 8:42pm Texas time). There are no declassified documents there describing tampered ballots or results.

2026-06-14 21:50:31 UTC

- reply

I suspect the idea is to juice MTTP rates with, idk, making AGI do it.
Fact is, there are vulnerabilities, on internet-exposed gear, operated by USG, that are under active attack. It's hard for anyone to say "well okay, patch whenever you get around to it." I get that's also a bad response.
I just worry about the process effect of missing a deadline making missing it forever more attractive.
And I really want some (public) data on this. A/B test it? Give some comparable agencies short vs long deadlines, see what effects the deadline itself has on patch rates a month out?

2026-06-11 11:50:35 UTC

- reply

unfortunately, nothing public. Yet. It would be great if CISA (or OMB) published a case study. Not for shaming federal agencies, but to inform on how mean-time-to-patch rates are affected by short vs long deadlines.

2026-06-10 21:03:54 UTC

Hey, I wrote a thing about #CISA's brand new BOD 26-04.
Alas, poor BOD 22-01, I knew it, Horatio.
Was my first draft title. My second one was somehow worse. Here's what we went with at @npub1jsz…ghgq.
https://www.runzero.com/blog/bod-26-04/

2026-05-02 18:02:52 UTC

Woah, that’s unexpected. #NetHack 5.0.0 released today.
https://github.com/NetHack/NetHack/releases/tag/NetHack-5.0.0_Released
cc @npub1tje…h8ea

2026-02-21 02:41:04 UTC

Breaking news: Max Headroom, one of the greatest TV shows ever made, is free on Tubi.
I find the terrible Tubi ads really enhance the dystopia.

2026-01-28 18:40:15 UTC

Computers are great. What a time to be alive.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/974/184/007/001/807/original/521518d781c7e59b.png

2026-01-12 13:23:18 UTC

January 1 came and went and Texas’s AI regulation went into effect.
There are a couple things to like about Texas’s attempt here. There are many things to dislike.
One aspect in particular: The definition of AI seems to cover just about any software application, right?
> TRAIGA broadly defines an “artificial intelligence system” as “any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.”
Maybe it’s the legalese, but I’m trying to figure out what machine-based system doesn’t function like this. Does it all hinge on “infer” rather than another verb like “calculate?”
https://www.gtlaw.com/en/insights/2025/6/traiga-key-provisions-of-texas-new-artificial-intelligence-governance-act

2025-12-08 13:43:48 UTC

- reply

This bit makes me think it’s a different bug:
“Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable.”
Sounds like two different vectors. Incomplete fixes often lead to multiple CVEs, a la rule 4.1.10: “To help determine whether separate Vulnerabilities exist, CNAs SHOULD consider whether the Vulnerabilities are Independently Fixable.”

2025-11-14 21:08:13 UTC

I just noticed that ../ looks like eyes and an outreaching arm, as if it's a victim drowning in quicksand.
I'm sure this is trenchant, somehow. cc @npub1s6e…n008

2025-08-21 04:53:54 UTC

Hey y'all don't sleep on this one.
**Agency Information Collection Activities: Vulnerability Reporting Submission Form**
#CISA wants to know what your ideal vulnerability reporting system would look like.
"CISA previously published this ICR in the Federal Register on October 30, 2024, for a 60-day public comment period. **CISA received one comment.** The purpose of this notice is to allow an additional 30-days for public comments."
Man, remember October, 2024? Things were looking pretty great back then. What a time to be alive.
Anyway, thanks for the extension, Kevin, ya big lug!
https://www.federalregister.gov/documents/2025/08/20/2025-15887/agency-information-collection-activities-vulnerability-reporting-submission-form

2025-08-08 15:44:27 UTC

#defcon badge fixed
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/993/913/117/946/899/original/87b891873549d1d8.jpeg

2025-07-21 17:46:10 UTC

Last night at about 11:30pm, I took a practice ham radio Technician test. I fell asleep twice. I guessed most answers (I know jack all about radio, slightly more about electrical engineering). I got 63%.
I suspect I can study up enough in time to pass a the exam at @npub1dqd…8xy4 ham .
https://hamvillage.org
Thanks to That Texas Country Music Guy at DC512 for encouraging this side quest!

2025-06-09 18:58:37 UTC

It's not just me, right? Post-quantum crytography aka #PQC, especially quantum-resistant cryptography, smells an awful lot like snake oil.
I cannot figure out how people sell this stuff with apparent sincerity when it's clearly impossible to test in production.

2025-05-24 01:33:15 UTC

Say, what's the first major-release film to mention either "the internet" or "the world wide web?"
(Or, alternatively, "DNS" or "SMTP" or "TCP/IP" or other uniquely internet technology, though that seems doubtful.)
And I mean mention as in, either in dialogue or printed and shown on screen in a newspaper or something.
There's a kind of [annoying reddit thread](https://www.reddit.com/r/movies/comments/o98hkx/what_was_the_earliest_reference_to_the_internet/ ) about this that's not very helpful and is fixated on WarGames which definitely doesn't talk about the internet (all the comms in that movie are over dialup).
A timestamp reference would be just great if you have it.

2025-05-12 19:10:07 UTC

#CISA adds CVE-2025-47729 to the #KEV -- which is for the crazy hacked up version of Signal used by high-ranking US government officials.
Wowzo. That's something.
https://www.cve.org/CVERecord?id=CVE-2025-47729

2025-05-12 15:56:01 UTC

#CISA ends RSS for #KEV. Sigh.
https://www.cisa.gov/news-events/alerts/2025/05/12/update-how-cisa-shares-cyber-related-alerts-and-notifications

2025-05-07 18:56:15 UTC

so close #CISA.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/468/070/726/514/583/original/45a5c3c24bb620d6.png

2025-04-29 20:25:35 UTC

Welp. Let’s see which way this room goes.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/423/125/242/360/613/original/a4ac9c38051802f3.jpeg

2025-04-21 12:59:02 UTC

- reply

The linked article doesn’t appear to mention the Internet Archive.
It doesn’t make the NEH cancellations any less tragic, but I don’t see the linked article drawing a link between the San Francisco Art Institute, which does perform archiving functions, and The Internet Archive.
Are they connected?

2025-04-16 01:39:34 UTC

l feel like i’m going to be using this a lot
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/345/087/526/277/853/original/b59dc3f1a3157fc0.jpeg

2025-02-14 18:24:11 UTC

Trying to articulate levels of invasiveness with typical network scanning with metaphors that don't come with the implied violence of "rattling doorknobs."
How's this grab you:<li>Port Scanning - Waving at passersby, seeing who waves back.</li><li>Protocol Scanning - Waving and saying "Good morning," noting if the reply is in English, Spanish, or something else.</li><li>Vulnerability Scanning - Chatting up strangers to see if they'll reveal their birthday.</li><li>Active Exploitation - Hypnotizing victims into handing over their ATM card and PIN.</li>

2025-02-07 15:39:39 UTC

Archived version of the quoted The Atlantic article is here:
https://archive.ph/2025.02.07-140733/https://www.theatlantic.com/technology/archive/2025/02/elon-musk-doge-security/681600/
Unrelated: If you believe there has been an intrusion in a US government system, you are encouraged to report it at https://cisa.gov/report
https://journa.host/@w7voa/113963205109936094

2025-01-28 21:49:52 UTC

So check it out. KEV data is now available on GitHub, in the proper cisagov organization. I know other people mirror KEV for their projects, but who can say if they're fiddling with it along the way? With https://github.com/cisagov/kev-data, you can rest assured that it's the Real and True mirror of KEV.
https://cisa.gov/kev is still the actual authoritative source, but this GitHub mirror is a pretty close second.
I posted about this on [LinkedIn](https://www.linkedin.com/posts/todb_github-build-and-ship-software-on-a-single-activity-7290122220230623234-q92i?utm_source=share&utm_medium=member_desktop ) since that's what people do with work stuff, apparently.

2025-01-02 16:44:53 UTC

98 KEVs to go until KEV #1337
Hopefully it'll be a good one.

2024-12-23 13:52:07 UTC

Near as I can tell, the activity around the #Struts2 bug,
CVE-2024-53677, is just ham-handed runs of some generalized PoC, and nobody's actually exploiting this yet (since exploitation would be very application/path specific).
Most of the news last week was all "exploitation happening, patch and rewrite everything now!" but not seeing any reports of successful (or even possibly successful) this morning.
Tell me I'm wrong!
(The PoC identified by SANS at https://isc.sans.edu/diary/31520 isn't specific to some particular application -- it's on the user to define upload_endpoint and assumes no auth or session or anything.)

2024-12-01 14:59:24 UTC

- reply

That’s a nice bit of CVE lore! We should make these more obvious and prominent than a single blog post.
And yes, having a small set of always-valid-but-test CVEs would be nice to publish. That’s a neat idea.
Hey would it be cool to make them Luhn-formula-like so you can detect truncation?
Something like
CVE-2024-12342
CVE-2025-12343
CVE-2026-12340
(all the digits add up to modulo 0)
cc @npub1wug…ghe4

2024-11-27 23:53:26 UTC

I’m not pirating movies, I’m just training my model.

2024-10-15 17:43:16 UTC

- reply

Weirdly, all NCSC employees also have licenses to kill. Seems a little excessive.

2024-10-15 00:07:04 UTC

- reply

depends on what you’re testing though doesn’t it?
Sounds like DNS CNAME + Apache vhosts is the way to go. Mastodon apparently doesn’t do well with non-443 since fediverse things all assume 443 is where it’s at.
https://github.com/mastodon/mastodon/discussions/20279

2024-10-11 18:50:26 UTC

Man. The archive.org outage is really chapping my hide. Good job, jerks.
Hey @npub1wug…ghe4 we should think about reviving the CVE reference archival effort again. It's almost as if someone predicted this exact circumstance.
@npub1umd…wfr7 , good luck.

2024-09-04 01:16:56 UTC

- reply

Agreed. 2FA is becoming a real disappointment.

2024-09-02 13:39:28 UTC

So this is neat.
1) Some (all?) antispam/counterphishing email scanners are blind to #QRCode content.
2) You can draw working QRCodes with Unicode character sets, thus avoiding an image parser entirely, even if the scanner could process images in the first place.
3) By providing QRCode links, the attacker encourages the victim to use their personal device rather than the workstation, making defensive tracking more complicated.
I think it’s hilarious that a format designed SPECIFICALLY for machine vision is being used to evade machine interpretation.
https://infosec.exchange/@patrickcmiller/113067302631450126