:rainbowCrow:

Analyst

Public Key

npub1z3sfut2znnrtgl0qt4q6npq8zmjd9c97ck0gh0me44ua6lzaaajq6cp45m

NIP-05 Address

cR0w@infosec-exchange.mostr.pub

Profile Code

nprofile1qqspgcy794pfe3450hs96sdfssr3dexjuzlvt85thau667wa03w77eqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dszl0yfh

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1z3sfut2znnrtgl0qt4q6npq8zmjd9c97ck0gh0me44ua6lzaaajq6cp45m

Show more details

Last Notes

2026-08-18 14:37:38 UTC

AI has changed how we browse. Full stop.WE'VE FUCKING NOTICED.
https://blog.mozilla.org/en/firefox/firefox-exa-partnership/

2026-08-10 14:47:15 UTC

tech companies doing incident response
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/071/752/191/734/503/original/46d68fa65d046bc6.jpg

2026-07-23 14:16:22 UTC

HIGHLY ISOLATED WITH GUARDRAILS
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/969/705/695/120/202/original/f07e80a827458b28.jpg

2026-07-22 21:51:26 UTC

Remember kids: If you are doing incident response, the first step on every run book should be to ensure business continuity with Payroll. Everything else comes second.

2026-07-20 17:03:45 UTC

- reply

@nprofile…44dh Yeah, I was just trying to make a dumb acid / base joke. I still can't tell if "based" is a good thing or bad thing.

2026-07-20 17:00:56 UTC

- reply

@nprofile…44dh So to be clear, this would not count as based, right?

2026-07-14 02:27:51 UTC

You know how there are weird tricks with computer stuff that you think everyone knows but they don't? I live learning and teaching new things like those when they come up.
Today's was the carat substitution in bash. It probably works in other shells too but IDK, I'm too old to learn a new shell.
The way it works is fairly similar to the / in sed or similar. You can use them to run the previous command but with a string substitution.
For example, let's say I entered this command:
dig A cascadiacrow.org
When it fails to resolve, I realize it was a .com domain. Rather than retyping the command, or hitting the up arrow to change the previous command, you could do this:
^org^com^
And it would run:
dig A cascadiacrow.com
Kind of cool with those one liners you spend way too much time on and find a typo.
Anyway, I used it and someone thought it was magic so if it's new to you too, happy Monday.

2026-06-10 20:26:05 UTC

- reply

@nprofile…mej2 I mean... yeah.
The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter.
How is that not straight up reckless, if not malicious?

2026-05-20 13:29:02 UTC

Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices.
I know people here probably don't want to rehash the disclosure discussion for the 683,547,329th time, but fuck Microsoft and this passive aggressive bullshit trying to frame their own interests as "best practices" in a vuln mitigation publication. Your shit is getting torn apart. Act like you've been there before because we all know you have.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585

2026-05-15 01:07:29 UTC

Occasional reminder to donate to your Mastodon admin if possible. They're enabling us to hang out here and shitpost without ads and weird corpo crap. :heart_cyber:

2026-04-21 20:04:33 UTC

OH from my partner in the other room, who is not in IT: Teams is not a document repository!
It's not just nerds fighting that shit. 😆

2026-04-14 00:22:32 UTC

- reply

@nprofile…g8yt @nprofile…vuvh or a super secure CH752

2026-04-10 13:42:12 UTC

- reply

@nprofile…44dh I've been getting more and more questions about it lately too, specifically what preparations we need to make before "Q-Day." My recommendations are still asset inventory and network segmentation. Then we'll talk.

2026-04-10 13:30:34 UTC

- reply

@nprofile…44dh The experienced grifters will naturally and smoothly migrate into quantum for their next phase. The rest will learn from them and follow suit. That's my guess at least.

2026-04-09 16:17:16 UTC

#GAYINT #IFIN
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/375/636/056/111/677/original/535a70b7b1b74c55.png

2026-04-08 21:25:57 UTC

Inside you there are two MUAs.
They're both Outlook.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/371/193/065/352/591/original/a2b5d8a1782488c8.png

2026-04-08 16:25:22 UTC

- reply

@nprofile…44dh @nprofile…qml3
🎶
how could something so darn cute try to pinch me through my boot
scootin around in your birthday suit (go go pretty crabby)
🎶

2026-04-07 19:30:11 UTC

#GAYINT #IFIN
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/365/075/470/043/101/original/57ebc75f34bc4f8d.png

2026-04-07 13:19:21 UTC

- reply

@nprofile…44dh Earthset feels a bit foreboding given gestures vaguely

2026-04-07 02:15:15 UTC

- reply

@nprofile…vvez evergreen

2026-04-07 01:22:57 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/360/785/565/487/746/original/e8db5f2e54e9888e.png

2026-04-07 00:40:10 UTC

#GAYINT
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/360/625/245/266/620/original/2b557720c27f575a.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/360/625/648/520/863/original/3b8f7fe7a8a08125.jpg

2026-04-06 22:12:57 UTC

- reply

@nprofile…y4qv
How’s my echo chamber doing this fine evening?
How’s my echo chamber doing this fine evening?
How’s my echo chamber doing this fine evening?
How’s my echo chamber doing this fine evening?
How’s my echo chamber doing this fine evening?
How’s my echo chamber doing this fine evening?
How’s my echo chamber doing this fine evening?

2026-04-06 16:50:02 UTC

I forgot to post my Easter Bunny yesterday.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/358/786/009/117/582/original/5863bb8581d7d7c7.png

2026-04-06 15:35:32 UTC

- reply

@nprofile…q2xw @nprofile…44dh @nprofile…c2pe @nprofile…scke Truly the modern Peugeot.

2026-04-06 15:24:02 UTC

- reply

@nprofile…44dh Wait that was supposed to be a secret?! :brdPeekWingHyper:

2026-04-06 12:50:32 UTC

bnuy
I was out of bananas so there's a toy ball for scale.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/357/840/440/411/316/original/9efb7193755e9949.png

2026-04-04 13:20:11 UTC

- reply

@nprofile…4xpq The difference is that a group of humans, dumb as they may be, still possess the ability to think, create, and empathize. That leads to growth and advancement of abilities. LLMs are speculative text generating algorithms. Their entire function is to be digital yes-men whose responses are entirely based on whatever sets of information the creators scraped from the work of others. Computers are still stupid, but in this context, it's a different kind of stupid than I intended in my original toot.

2026-04-03 20:21:43 UTC

- reply

@nprofile…44dh So I took a quick look and while I admit my RF knowledge is well below the general level of fedi, but it seems to me that those might not be very effective. Maybe Dr Blaze needs to do some testing like the Faraday bags.

2026-04-03 13:50:21 UTC

- reply

@nprofile…4xpq glares at the AI hype
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/341/090/426/686/266/original/72da7c106d93d7f0.png

2026-04-03 04:23:47 UTC

Computers are fucking stupid.

2026-04-02 21:41:31 UTC

I am not looking forward to whatever fresh Hell tomorrow's news cycle delivers.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/337/282/311/525/901/original/f5ef1b3d8ad05787.png

2026-04-01 18:14:48 UTC

I'm so fucking pissed about this.
https://www.fs.usda.gov/about-agency/reorganization
https://www.usda.gov/about-usda/news/press-releases/2026/03/31/usda-prioritizing-common-sense-forest-management-moves-forest-service-headquarters-salt-lake-city
RESEARCH & DEVELOPMENT FACILITY CLOSURES
Alabama: Huntsville
Alaska: Anchorage
Arkansas: Monticello
California: Anderson; Fresno; Chico; Fort Bragg; Mt. Shasta; Hat Creek
Connecticut: Ansonia; Hamden
Florida: Tallahassee
Hawaii: Hilo; Volcano
Illinois: Evanston
Kentucky: Lexington
Louisiana: Tioga / Pineville
Massachusetts: Westfield
Maryland: Baltimore
Michigan: East Lansing; Houghton; L’Anse; Wellston
Minnesota: Grand Rapids; Ely
Mississippi: Leland; Oxford; Saucier; Starkville; Stoneville
Montana: Bozeman; Hungry Horse
Nevada: Reno
New Hampshire: Bartlett
New York: Cortland; Lakeville; New York City
Ohio: McArthur
Oregon: Portland
Pennsylvania: Irvine; Long Pond; Williamsport; York
South Carolina: Clemson; Huger
South Dakota: Rapid City
Texas: Nacogdoches
Vermont: Burlington
Virginia: Blacksburg
Utah: Cedar City; Logan; Ogden
Washington: Seattle ; Wenatchee
West Virginia: Princeton
Wisconsin: Prairie du Chien; Wisconsin Rapids

2026-04-01 13:39:46 UTC

- reply

@nprofile…44dh I think all we have to do is look at what the oil companies have been doing for decades and we'll have a pretty good idea what some of the larger tech companies will be, or have already been, doing.

2026-04-01 13:36:16 UTC

This is my April Fools toot::sm64_i: :sm64_n: :sm64_f: :sm64_o: :sm64_s: :sm64_e: :sm64_c:
That's the joke. It works on multiple levels.

2026-04-01 13:28:14 UTC

- reply

@nprofile…44dh You mean as direct hires instead of their current contracting?

2026-04-01 13:16:29 UTC

Cisco listed by Shinyhunters.
3 breaches (UNC6040, Salesforce Aura, and AWS accounts). Total over 3M Salesforce records containing PII, Github repositories, AWS buckets and other internal corporate data have been compromised.
#ransomware
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/329/624/350/052/724/original/36b83f1d4228af88.png

2026-04-01 02:22:10 UTC

This whole Anthropic things is funny as fuck but I think we all know it's going to change very little about anything. Haters still hate, bros still bro, and the function is still shit. But at least now we can all point to the various reasons it's shit so I guess that's something.

2026-03-31 22:20:26 UTC

When you have to use Ubuntu for a project and your software is managed with apt, flatpak, and snap.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/326/110/856/175/846/original/3d52561a9634c15b.png

2026-03-31 20:25:54 UTC

- reply

@nprofile…44dh Can't wait to see those in the front row of tech conferences.

2026-03-31 13:35:48 UTC

- reply

@nprofile…44dh stares aggressively at systemd

2026-03-30 21:13:26 UTC

Naughty ASN of the day: AS215125

2026-03-27 15:10:55 UTC

- reply

@nprofile…44dh I think signing him up for Cat Facts is good enough. I won't do it, but I'm sure someone will.

2026-03-27 15:09:25 UTC

- reply

@nprofile…44dh I like that his phone number and address are in the proof pics. :blobcatpopcorn:

2026-03-26 14:54:17 UTC

You know what would be cool? If people would acknowledge that Microsoft has no fucking idea how their own shit works and stop giving them the benefit of the doubt, especially with things like consent and AI.

2026-03-26 02:58:11 UTC

- reply

@nprofile…z2cq LinkedIn

2026-03-25 18:48:33 UTC

- reply

@nprofile…44dh VPNs at least provide some function.

2026-03-25 18:46:41 UTC

allowing html emails is still the largest risk that pretty much every org is intentionally accepting send toot

2026-03-24 23:14:19 UTC

- reply

@nprofile…44dh Huh. I thought programmer socks were required for Rust. Fursuit required in public. And trans is optional but encouraged. I admit that maybe my circle is a bit skewed though.

2026-03-24 23:06:21 UTC

- reply

@nprofile…44dh Your socks aren't high enough then.

2026-03-24 17:41:07 UTC

- reply

@nprofile…44dh In their defense, I have seen my website. I hate it too.

2026-03-24 14:55:31 UTC

I made a design for a pink pony patch for someone but he changed his mind so I figured I'd share it here in case anyone else wanted to make patches or stickers with it. Nothing fancy but I thought it was fun.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/284/722/633/600/865/original/9716f93a7c6d4fde.png

2026-03-23 16:48:41 UTC

- reply

@nprofile…44dh @nprofile…f8cg Agreed. Just pointing out that much like with cops, there are options for teachers to make money elsewhere without a major career change. It certainly wasn't a counter to da's point as that was completely valid.

2026-03-23 16:46:02 UTC

- reply

@nprofile…f8cg @nprofile…44dh Salaries definitely vary by location. These are Elementary teacher salaries in public WA State schools.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/279/493/652/159/385/original/f4be155ae5b98445.png

2026-03-22 22:36:34 UTC

:guillotine: :brdRobe:

2026-03-19 18:25:02 UTC

Agentic. Access. Management.LMAOOOOOOOOOOOOOOOO

2026-03-19 12:58:29 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/255/951/921/358/518/original/b195971cf7029f4b.png

2026-03-13 15:40:22 UTC

"AI is giving attackers a huge advantage!"
"Yes, it is. It's amazing how quickly it has destroyed dev, sec, ops, management, company missions and priorities, regulations, information literacy, and civil society, making everyone more vulnerable."

2026-03-10 00:07:39 UTC

- reply

@nprofile…a0ad @nprofile…ut9d Those are very cool, and I would definitely hang those on the wall with pride. There's a perfect opening above my monitors. :brdHappy:

2026-03-04 14:36:11 UTC

Wasn't there a bot here that you could tag with a DNS query and it would resolve it in a reply? I thought I saw that here but it might have been somewhere else.
Edit: It's https://infosec.exchange/@DNSresolver@mastodon.gougere.fr
Thanks for the replies.

2026-03-03 21:11:25 UTC

- reply

@nprofile…44dh
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/167/295/223/813/358/original/b5be629d1e8cabfc.png

2026-03-01 02:50:15 UTC

Fucking LMFAO #FURINT
#nevent1q…7sha

2026-02-28 18:00:23 UTC

Imagine INFOSEC
but like
fun

2026-02-26 18:26:21 UTC

Hi, yes, welcome to Mozilla Burger. It's true our burgers come with asbestos but the good news is you can pick it off yourself. Look how easy that is. No we can't make a burger without it and let you add it yourself later. Why would we do that?

2026-02-25 14:01:48 UTC

I am strangely aroused.
#nevent1q…c6uh

2026-02-22 16:14:06 UTC

- reply

@nprofile…h3hp
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/115/165/131/848/556/original/9a43c37f15ee24fa.jpg

2026-02-20 14:33:21 UTC

- reply

@nprofile…ds0l
that’s it. that’s the crack. copy the files. they work on any machine because there’s no license check in the actual product.
whoopsie lmao

2026-02-19 13:58:50 UTC

- reply

@nprofile…y4qv I assume this is the Andrew formerly known as Prince?

2026-02-11 14:09:27 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/052/363/719/240/348/original/9527b90e06171d90.png

2026-02-04 04:26:23 UTC

- reply

@nprofile…44dh Literally yesterday, actually. But good reminder nonetheless.

2026-02-02 15:44:20 UTC

- reply

@nprofile…44dh Thanks I hate it.

2026-02-02 15:33:31 UTC

- reply

@nprofile…44dh IPFS...
takes long drag of cigarette
...haven't heard that name in years.

2026-02-02 15:20:58 UTC

- reply

@nprofile…44dh inb4 you get a bunch of "evidence" that's actually just links to conspiracy theory YouTube channels.

2026-01-29 22:02:42 UTC

Americans: Don't forget to push to prod today so you can strike tomorrow.

2026-01-29 21:32:18 UTC

- reply

@nprofile…4xpq AI systems might uncover new vulns but they should not uncover new vuln types or attack vectors, at least not until we see AI actually do something new and novel.

2026-01-29 21:29:29 UTC

Fuck it. Feeling stabby today. Again.
#nevent1q…sa9h

2026-01-27 22:58:27 UTC

- reply

@nprofile…y4qv Pretty sure it's a middle child thing.

2026-01-25 01:54:43 UTC

- reply

@nprofile…44dh Nope. Don't like it. Someone please init 6 this country.

2026-01-21 03:44:04 UTC

- reply

@nprofile…44dh Ah. Yeah, even Shodan, Census, FOFA, etc. surprised me. I know it's not all legit but still more than I expected on the Internet without getting broken by now.

2026-01-21 03:37:43 UTC

- reply

@nprofile…44dh If you have telnet and don't know it, I'm not very confident that it getting popped will enlighten them until a third party notifies them. And even then, my experience is they'll still deny it. 🫠

2026-01-15 17:28:35 UTC

- reply

@nprofile…44dh And that's exactly why you get good faith counterpoints.

2026-01-15 17:23:01 UTC

- reply

@nprofile…44dh The change cost is also high but the benefit comes in the form of things like disallowing NTLMv1 in standards for future projects. It's a slow win but so is everything in utilities. And rarely happens unless it's either a compliance requirement or a demonstrated risk.

2026-01-15 17:10:43 UTC

- reply

@nprofile…44dh Nothing beyond anecdotal experience. In utilities at least, there tends to be a lot of "it's theoretical until you show me" when risk is discussed. By making it easier for the security teams to demonstrate the vulnerability, the lower resourced teams can better make their case. It's a valid question for sure but for at least my experience, I believe it's a net good in this case.

2026-01-15 16:56:27 UTC

- reply

@nprofile…44dh Honestly, I think the ones to benefit are going to be the security teams. Attackers in general are already ahead of the game here so I'm all for this, and not for my normally chaotic reasons.

2026-01-15 05:31:58 UTC

- reply

@nprofile…44dh The Internet was a mistake.

2026-01-15 05:28:36 UTC

- reply

@nprofile…44dh It'll never work. Unless you allow it to connect to the Internet.

2026-01-14 19:38:18 UTC

- reply

@nprofile…l9z3 BGPSEC over HTTPS

2026-01-14 14:33:45 UTC

- reply

@nprofile…44dh I hadn't thought about the marketing angle of that mess until now.
xAI trains on classified data, or people assume it does.
Curious nerds start prompting xAI to try to get it to leak classified data.
Usage numbers go up.
Ad revenue goes up.

2026-01-13 23:52:25 UTC

- reply

@nprofile…44dh @nprofile…y4qv The worst part is how many people would call that a brilliant idea. :lolsob:

2026-01-13 21:56:47 UTC

- reply

@nprofile…44dh Congrats! I think?

2026-01-13 19:35:41 UTC

- reply

@nprofile…44dh Is the Gadsden snek an ouroborus? :aneobot_explode:

2026-01-13 19:29:08 UTC

- reply

@nprofile…44dh It's wild how none of them seem to even try to learn from others. They just keep stepping on the same rakes, almost like it's intentional.

2026-01-13 19:24:14 UTC

Go hack more MCP shit.
https://github.com/orval-labs/orval/security/advisories/GHSA-mwr6-3gp8-9jmj

2026-01-12 22:26:44 UTC

- reply

@nprofile…y4qv I mean, they did win the war on drugs so...

2026-01-12 22:02:00 UTC

- reply

@nprofile…44dh It's maddening. That's why I didn't even bother putting the link.

2026-01-12 17:04:15 UTC

- reply

@nprofile…29kj Gotta have that boogey man for the FUD for their followers though.

2026-01-12 16:51:31 UTC

- reply

@nprofile…29kj That's what the people in waiting want though. The response will be extreme if he gets got and no one will stop them.

2026-01-12 16:44:19 UTC

- reply

@nprofile…z6kv So like the Seattle area where you get the worst of both worlds: Billionaires in the community but they don't help support the community.

2026-01-10 01:43:43 UTC

- reply

@nprofile…z5ql I'm not far from taking that approach at this point.

2026-01-09 20:23:23 UTC

- reply

@nprofile…4xpq Are those little teefs too?