@WPalant@infosec.exchange

Wladimir Palant @WPalant@infosec.exchange · Aug 04, 2026

One really has to wonder how some decisions were made. So somebody at #BMW thought: “You know, those suckers who paid $50,000 or more for our cars? We should really milk them some more. They probably get bored waiting for their car to start up anyway, let’s show them some ads! We’ll call it a special surprise for the drivers, no way they’ll object then.” Yes, totally reasonable.

Way to destroy a brand’s reputation…

https://www.theautopian.com/bmw-is-showing-commercials-on-their-cars-dash-screens-and-they-want-you-to-think-its-a-treat/

5

0

5

1

Wladimir Palant @WPalant@infosec.exchange · Aug 04, 2026

Replying to on social.woefdram.nl

@hans I thought cracking encryption involves typing on a keyboard really fast? 🤔

0

Wladimir Palant @WPalant@infosec.exchange · Aug 04, 2026

Hollywood has some weird obsession with computer displays. A spy needs to copy data? They attach some fancy device to the display. Need to shut down a computer? They shoot the display of course. And never mind that a computer virus will always produce visible glitches on the display.

8

10

1

0

Wladimir Palant @WPalant@infosec.exchange · Jul 30, 2026

Replying to @freddy@social.security.plumbing

@freddy@social.security.plumbing Ja, ich habe auch schon alles gesehen (https://github.com/elk-zone/elk/issues/1877#issuecomment-2440130547 😬). Es gab ja mal diesen Standardisierungsversuch, aber jemand (John Gruber) meinte, dass es der Idee zuwiderlaufe und deswegen unnötig sei. Nun ist wieder ein Jahrzehnt vergangen, und das Chaos ist definitiv nicht besser geworden.

1

0

Wladimir Palant @WPalant@infosec.exchange · Jul 30, 2026

Replying to @freddy@social.security.plumbing

@freddy@social.security.plumbing Strange that “high pain tolerance” isn’t listed as a requirement. 🤔

1

0

Wladimir Palant @WPalant@infosec.exchange · Jul 30, 2026

Replying to @freddy@social.security.plumbing

@freddy@social.security.plumbing Ein vernünftiger Markdown-Konverter wäre besser. Sternchen mitten im Wort hat in Markdown eigentlich keine Bedeutung.

0

1

0

Wladimir Palant @WPalant@infosec.exchange · Jul 29, 2026

Replying to @evacide@hachyderm.io

@evacide@hachyderm.io I’ve learned about the concept of checks at school. Still, the only time I’ve actually seen one was when I was sent one from the US. The bank wanted 20€ just for processing it.

0

Wladimir Palant @WPalant@infosec.exchange · Jul 29, 2026

LLMs are quickly eroding the concept of truth.

I’m sure that more known people have had to refute claims about them for a while but now it happened to me as well. A researcher from a respectable university contacted me asking for an interview regarding “my position” on a particular topic. The issue: the cited position is the exact opposite of what I’ve always said, and I’m pretty sure that there are zero online sources confirming it to be mine. But whichever LLM they’ve consulted constructed a bullshit controversy where there never was one.

I can refute it this one time of course, and I assume that no such claims will make it into their final publication. But the tendency to rely on LLM-generated “information” is there, even in academia. And once they publish unverified bullshit it becomes “the truth” that LLMs will prioritize in their training and other people will refer to as proof that LLM claims are correct. This is going to be really bad.

8

0

4

0

Wladimir Palant @WPalant@infosec.exchange · Jul 27, 2026

Replying to @WPalant@infosec.exchange

It gets even “better.” Tesseract dev shut down the project and removed the repositories. They are said to have posted a farewell message which contained JavaScript code that was sending 2000 requests to the Lemmy instance of the user who uncovered their secret blocking list (that message is no longer online). Not really enough for a DDoS attack but probably an attempt to drive up traffic costs. https://lemmy.dbzer0.com/post/72962926

lemmy.dbzer0.com

Tesseract dev injects malicious code into browser to illegally DDOS the dbzer0 instance - Divisions

FYI admins cross-posted from: https://quokk.au/c/fediverse/p/1066667/tesseract-dev-injects-malicious-code-into-browser-to-illegally-ddos-the-dbzer0-instance [https://quokk.au/c/fediverse/p/1066667/tes

9

0

5

0

Wladimir Palant @WPalant@infosec.exchange · Jul 24, 2026

#OperaBrowser sending me spam to an address that I definitely didn’t give them, asking me to promote their ad blocking feature? Because … checks notes … I wrote an article about malicious ad blocking extensions that has the necessary keywords. “Since your site already covers tools and tips that help people have a better time online.” Not even mentioning my name because why would they bother finding it, I’m just some random blogger from the internet that their automated tools brought up. That’s quite something. I wonder whether they realize that their product still enjoys some trust and respect which is probably undeserved since their owner change. And how such tactics affect this trust.

3

0

Wladimir Palant @WPalant@infosec.exchange · Jul 23, 2026

That’s some really evil shit: https://lemmy.world/post/49794261 So Tesseract (an alternative Lemmy client) downloads a blocking/filtering list from its servers, something that most people likely weren’t aware. This “feature” was introduced November last year (version 1.5.0) and is described as “Tesseract attempts to filter out as much baseline toxicity as possible” in the settings option allowing it to be disabled. The list currently contains 544 (!) individual users and 2282 (!!) regular expressions applied to user names. Among the expressions censored in user names are: Democrat, Republican, Israel, ElonMusk, trump, amerika and billionaire. There is also the regular expression usa?(.*)?terrorist which seems to be intended for the phrase “USA are a terrorist state.” The list also contains 97 censored communities and 32 regular expressions applied to community names. Finally, there are 352 (!) “forbidden” domains and 296 filtered phrases including proletariat, epstein class, Jesse Welles and “Hi, I’m an AI engineer based in Japan”. The author also disliked 👉👈 emoji. Judging by the project’s issues some people only just found out that they are being censored and are wondering why. #tesseract #lemmy

13

2

10

1

Wladimir Palant @WPalant@infosec.exchange · Jul 23, 2026

AI concerns, Linux Hover or focus to reveal Sensitive

Some very good points on Linus Torvalds’ problematic AI take: https://drewdevault.com/blog/AI-in-Linux/ Yes, Linux is an extremely influential project, and simply denying the responsibility that comes with this influence is very cheap.

3

0

2

0

Wladimir Palant @WPalant@infosec.exchange · Jul 19, 2026

Replying to on gnusocial.jp

@simsa03@gnusocial.jp Other people’s mental health is not up to you to decide. That’s an even worse take than your first post, you are blocked.

0