Matt Nordhoff
mnordhoff@infosec.exchange
<p>He/him. Previously twitter.com/mnordhoff.</p>
Posts
-
View post
Oh hey, Discord automatically categorized me as an adult. I didn't know whether they'd go "this person runs Linux and doesn't understand half the features, they must be a Boomer" or "insufficient data, assume baby".
-
View post
https://blog.cloudflare.com/containers-cross-tenant-vulnerability/ Cloudflare did the ol' "configure your cloud platform not to zero unintialized disk blocks" vulnerability. :blobfacepalm:
-
View post
Normal free software people with morals really missed out. It turns out if you had made "libc but extremely racist and with NFTs" in 2020 and started DMing tech CEOs on Twitter you would've got like $50 million in funding overnight. https://www.phoronix.com/news/Omarchy-Alibaba-3M
-
View post
Certbot 5.8.0 was recently released, which upgraded pinned dependencies, which upgraded the Cryptography library, which upgraded pinned dependencies, which upgraded the rust-asn1 library, and now it can't parse OCSP responses from Sectigo for ECDSA certificates. Certificate renewal still works, and ARI should deal with revoked certificates, but it does break the informational "certbot certificates" command. I'm starting to think it's a miracle any of this ever works. ht...
-
View post
OMG I was trying to use a couple stretched-out old hair ties and one of them DISINTEGRATED. The elastic turned into tacky goop IN MY HAIR. I did not know that could happen! Do not let "old rubber bands" happen to you! (I had ALMOST got a new hair tie out but didn't want to bother...)
-
View post
Issues with the Los Angeles stratum 1 NTP server gpstime.la-archdiocese.net since yesterday. 🙏 (It's stratum 3 and was down for a while.) Absolutely no criticism, of course, but I hope things work out.
-
View post
Recently saw two tech company blog posts—the two companies do business, so it might not be a coincidence—say "people don't install software anymore, their AI agents install software for them". I don't even know what to say. (I'm not a customer!)
-
View post
Either something happened to my eyes (unlikely) or web browser (very possible), or GitHub changed the merged PR icon in the dark protanopia theme to gray. I'm so confused, I think every PR has been closed without merging now.
-
View post
sent 666.51M bytes received 1.48M bytes 1.31M bytes/sec The rsync of the beast could have more bandwidth.
-
View post
https://domainnamewire.com/2026/07/23/com-verisign-record/ Revenue is up at the wallet inspector! Some of their plans for .web are discussed.
-
View post
https://www.nytimes.com/2026/07/12/magazine/data-center-heist.html?unlocked_article_code=1.xFA.Kjgt.3iZRJd-SnQk4 OK you know what maybe the data center segment of 007: First Light was more realistic than I thought.
-
View post
RE: https://mastodns.net/@diffroot/116966621989680532 Afilias (later Altanovo) and Verisign blew a couple hundred million dollars fighting over .web for like 10 years. *checks Wikipedia* "The ICANN auction of last resort that started on July 27, 2016, and was completed on July 28, 2016." Literally precisely 10 years?? Wtf is this milestone celebration? I guess Verisign's sense of spite temporarily overwhelmed their corporate priority to jettison any business except .com. I won...
-
View post
RE: https://social.nlnetlabs.nl/@nlnetlabs/116963672862487532 1 of the vulnerabilities was reported by 4 different people/groups, 1 by 3 parties, and... I lost count but several were reported by 2. Wow.
-
View post
Iran claims to have bombed AWS in Bahrain again. Amazon has not yet confirmed it. https://www.datacenterdynamics.com/en/news/irans-islamic-revolutionary-guard-corps-claims-fresh-hit-on-aws-data-center-in-bahrain/ Amazon's last public status posts were 30 April. https://health.aws.com/health/status
-
View post
Hrm, after the price gougers increase the price of .com domains 2026-11-01, .com domains will be more profitable to Verisign than .net domains, though .net will still be more expensive for registrants because its ICANN fee is bigger. .com $10.97 (Verisign) + $0.20 (ICANN) = $11.07 .net $10.91 (Verisign) + $0.75 (ICANN) = $11.66 https://www.icann.org/en/registry-agreements/details/com https://www.icann.org/en/registry-agreements/details/net
-
View post
https://www.theregister.com/networks/2026/07/17/ntp-server-that-traveled-back-in-time-caused-massive-aussie-mobile-outage/5274059 *pained expression*
-
View post
Several years ago, AWS sent out a billing projection that had clearly used the wrong time unit: it was multiplied by 30 or 720 (24 × 30) or something like that. Luckily it was not a big number, and it was not the real estimated bill, so I didn’t drop dead from shock. IIRC, they sent out an apology a few days later.
-
View post
"I'm DeeMV your personal AI and I'm glad you are here." Punny LLM (anti-)"assistant" names have gone too far. And this website isn't even for the DMV, which isn't even called "the DMV" in this state anyway!
-
View post
RE: https://infosec.exchange/@mnordhoff/112814601208026927 This was my favorite toot. It's too bad half of it is gone, but it does seem to have been archived. https://web.archive.org/web/20240719135222/https://piaille.fr/@LaurentChemla/112812800979426563
-
View post
Seeing https://federate.social/@jik/112812825679959416 and https://piaille.fr/@LaurentChemla/112812800979426563 may or may not be revealing about the American and French mindsets.
-
View post
Logged in to a website using... only my email address. Zero factor authentication. They must've used cookies to automatically log me in except not, or some sort of hack to trick password managers into filling in a hidden form field. Weird.
-
View post
https://domainincite.com/31803-cybercrime-link-as-t-me-gets-taken-down
-
View post
https://www.nytimes.com/2026/07/13/us/politics/israel-mahmoud-ahmadinejad-iran.html :blob_neutral_face:
-
View post
Hikaru Utada started a 24/7 music video radio stream about a week ago (in Pride Month!) https://www.youtube.com/watch?v=IJqlho9qJIw
-
View post
Meanwhile at the Priestly Fraternity of Saint Pius X, everyone is in schism and everyone is excommunicated. https://www.vaticannews.va/en/vatican-city/news/2026-07/holy-see-decrees-excommunication-lefebrians-consecrations.html
-
View post
Imagine telling the Pope 100 years ago that one day they would run websites and they would have cookie banners and they would only have an OK button.
-
View post
I think rendering someone stateless is maybe the most evil thing a government can do? I mean, also murder, but deciding who lives and who dies, and killing people, is one of the jobs of the government. Making people stateless is rejecting the fundamental nature of the state. If one of your citizens is an asshole, and they don't even have citizenship somewhere else, sucks to be you! You have a whole law enforcement system, maybe you forgot. Use it. Any politician who even thinks about maki...
-
View post
Why does Amazon own the domain name com.be