@cynicalsecurity@bsd.network

@cynicalsecurity@bsd.network · Jul 24, 2026

Replying to @dch@bsd.network

@dch@bsd.network @mwl@io.mwl.io I understand, but so many of my friends at Sun lost their jobs back then, or in later “restructuring”. Oracle is soulless and heartless, working there can only ever be temporary at the whim of some manager :(

0

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jul 24, 2026

Replying to @dch@bsd.network

@dch@bsd.network @mwl@io.mwl.io and we shall dance with joy until the Sun goes nova…

0

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jul 20, 2026

Replying to @RoganDawes@infosec.exchange

@RoganDawes@infosec.exchange the bottom line is that we are persecuted by PC designs from the 1980s and we will never be able to reproduce the simplicity and reliability of a workstation or server console of the same period. @mischa@exquisite.social @dartov@hachyderm.io

0

1

2

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jul 20, 2026

Replying to @mischa@exquisite.social

@mischa@exquisite.social @dartov@hachyderm.io “actually”… what fixes it is… As an old Unix greybeard I slightly threw up when it worked.

0

3

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jul 20, 2026

Replying to @dartov@hachyderm.io

@dartov@hachyderm.io seriously? Where does one find such a plug, please?

0

3

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jul 20, 2026

OK, these #Protectli systems are getting on my nerves. Can anyone suggest a reason why they would not cold boot into #OpenBSD unless the serial console cable is connected *and* live (i.e. I actually connect both ends of the cable)? They reboot fine, but cold boot hangs until I connect a serial cable. The Protectli runs Coreboot and is set to use the serial console.

0

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jul 09, 2026

Should anyone need to be reminded, once again, from someone who has been doing offensive security for 40yrs: we hack the endpoints, we have always hacked the endpoints, we shall continue doing so. Why? It is this incredibly simple concept called ROI, return on investment, it is cheaper, much cheaper, to get the endpoint. Whether it is the phone, the app, the headphones, the microphone, the user being socially engineered. Nobody in his sane mind wakes up and goes "we need to crack the double ratchet", literally nobody. That we have been unable to communicate this to the EU parliament is an incredible defeat of common sense.

0

cynicalsecurity

@cynicalsecurity@bsd.network · May 13, 2026

Will you please stop wasting time on Mythos-associated FUD and try to understand that you need to build reliable and dependable software, not stuff which changes weekly, to get security?

Mythos & LLM only bring breadth and depth to automated searching, they find nothing conceptually new, if no-one had come up with buffer overflows there would be no buffer overflows coming out of Mythos.

There will be a flood of issues, as if suddenly thousands of people were dedicated to finding bugs, then it will stop.

It is an excellent chance to ask yourselves "why?" and realise that no, we don't need software like it is being built now, you need software like it was built back when downtime mattered.

0

cynicalsecurity

@cynicalsecurity@bsd.network · May 08, 2026

Replying to @aristot73@infosec.exchange

@aristot73@infosec.exchange what did I tell you?

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · May 05, 2026

Replying to @jpmens@mastodon.social

@jpmens "oops"

0

cynicalsecurity

@cynicalsecurity@bsd.network · May 04, 2026

Replying to @mattblaze@federate.social

@mattblaze I have always wanted to take a picture like that, the way it “captures” the blizzard is incredible and the children playing is wonderful touch.

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 30, 2026

Replying to @jpmens@mastodon.social

@jpmens@mastodon.social ah, thank goodness, I thought that there might be something serious about it. Now that there's a logo I know my initial evaluation was correct. The first FIPS-140 certified local root exploit via the cryptography framework.

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 26, 2026

So, I was recently involved in the IR for a cloudy cloud issue… and thinking it over I realised that the attackers really haven't moved into the LLM age.

Why do attackers against M365 actually _look_ for files so that they land in the logs?

If they have obtained valid credentials then they can use Copilot, set it to the whatever-it-is-called-not-Web mode, and go and hunt. They could even use a "Research" agent to find which documents the user has access to which contain juicy bits, find out what it can see, etc.

Everyone goes on about Mythos but the real danger are companies putting everything in the cloud, without ACLs or with ACLs which don't work, and then letting Copilot loose on it.

Forget lateral movement, just abuse the "collaborative, everyone must see everything to be productive with AI" myth!

:flan_molotov:

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 19, 2026

Replying to @th@social.v.st

@th I cannot resist pointing out that the bottom left hand corner of the railing towards the bridge does not carry a signpost. A clear gap in notifications.

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 16, 2026

Replying to @jgamblin@infosec.exchange

@aristot73 "There are lies, damned lies, and CVSS"™

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 16, 2026

I have to say the #OpenBSD patch 031¹ is rather subtle… I wonder how it was discovered.

__
¹ https://ftp.openbsd.org/pub/OpenBSD/patches/7.8/common/031_pgrp.patch.sig

bsd.network

#openbsd - BSD Network

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 14, 2026

Replying to @miodvallat@hostux.social

@miodvallat enfin la Terre retrouve son équilibre.

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 13, 2026

Replying to @joern@threatactor.club

@joern now is a good time to figure out how to litter your source code with "things" which cause LLMs to hallucinate, or worse. The game could even become hallucinating LLMs to get them to insert backdoors as part of their bug fixing. It will be so much fun. Same war, different targets, and we know who wins :)

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 08, 2026

Replying to @dchest@mastodon.social

@dchest@mastodon.social the keyboards were so good that I don't recall that ever happening. Those were days in which workstations were built to last and there was no PC crap pollution yet...

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 08, 2026

Replying to @jonny@neuromatch.social

@jonny which is why I am really uncomfortable with their "vulnerability hunting" partnership which looks a lot like a closed club where "responsible disclosure" could well mask "no disclosure" or "only to the right US people disclosure"...

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 08, 2026

Replying to @dchest@mastodon.social

@dchest@mastodon.social as a Lisp Machine user let me tell you those were wonderful days.

1

2

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 08, 2026

Replying to @mattblaze@federate.social

@mattblaze don't think it ever was… you might have missed the perennial war rhetoric whenever there's an England-Germany match, football has been a replacement for warfare in Europe for quite some time. There was never any "peace" in FIFA-run competitions.

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 06, 2026

Lessons learned from the Artemis 2 mission:

1. some genius thought sending Outlook to space was a good idea,
2. some other genius thought that Bluetooth in space was a good idea,
3. plumbers are in demand, even in space.

:flan_molotov:

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 04, 2026

Replying to @th@social.v.st

@th "but the error propagation"...

0

cynicalsecurity

@cynicalsecurity@bsd.network · Mar 30, 2026

Replying to @hagbard@corteximplant.com

@hagbard title: "No need to think". Band name left as an excercise for the reader… @aristot73

0

cynicalsecurity

@cynicalsecurity@bsd.network · Mar 24, 2026

Replying to @th@social.v.st

@th oh the number of times I have done that… pencils, pens, whatever pushed that ground in to "free" the socket. @ErinRose

0

cynicalsecurity

@cynicalsecurity@bsd.network · Mar 23, 2026

Replying to @spacerog@mastodon.social

@spacerog one wonders where those records end … and who wants to make sure "they match"…

0

cynicalsecurity

@cynicalsecurity@bsd.network · Mar 21, 2026

Replying to @sophieschmieg@infosec.exchange

@sophieschmieg couldn’t they be given the FIFA Computing Award? @jrose

0

cynicalsecurity

@cynicalsecurity@bsd.network · Mar 18, 2026

Is there a _good_ course on Azure forensics I can attend?

Serious question, please don't reply with "Meditation" or "Become a Monk", etc.

P.S. Please not a beginner's course, assume I've been messing around in Unix kernels since 1986 and have a pretty decent forensic skill set in civilised operating systems and networks. I just appreciate the subtleties of the VMS heritage of the NT kernel but little above it :)

0

cynicalsecurity

@cynicalsecurity@bsd.network · Mar 02, 2026

Replying to @robpike@hachyderm.io

@robpike ah, the old British Airfix way, the true love of models… I thought that they had long gone. I used to send letters from Italy and get back said pouches months later (Italian post office was, and is, uniquely gifted in delayed delivery). You get the same incredible service from Peco (UK model rails manufacturer).

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Mar 01, 2026

A colleague and good friend of mine, with whom I have worked for 32 years (seriously), is looking for a job in one of The Netherlands, Belgium, Germany and Switzerland. They are fluent in English, German and Dutch, speaks French too! German nationality.

They have been managing complex IT projects for decades, are an excellent programmer and used to managing large development teams. Was doing "agile" when it was still called XP and pair programming (I used to make fun of them calling it 🍐 programming ;P … geek humour, sorry).

If you have anything I can send their way I'd be grateful. Please don't bother if you are ageist 'cos they're somewhat older than me and I am a greybeard (yes, they speak FORTRAN).

#fedijobs #getfedihired

0

cynicalsecurity

@cynicalsecurity@bsd.network · Feb 23, 2026

An interesting research paper on bitflips in SRAM: Laurent Pichon. Laurent Le Brizoual, Edna Ferrucho Alvarez, Ludovic Claudepierre, "Electrical modelisation of a bitflip in SRAM cell memory induced by laser fault injection"¹, Microelectronics Reliability, Vol. 179, April 2026. An electrical model of the bitflip in SRAM under laser illumination simulating laser fault injection is proposed. This model is based on a bipolar phototransistor responsible of the amplified induced photocurrent resulting to the Off/On switching of MOSFET in CMOS inverter. In this model a photodiode is connected between the collector(drain)/base(bulk) of the parasitic bipolar transistor. In this configuration the photodiode acts as photocurrent generator and the bipolar transistor as amplifier. The ability of this model to simulate the laser fault injection is first shown in CMOS inverter and then in SRAM cell memory. __ ¹ https://www.sciencedirect.com/science/article/pii/S0026271426000569 (#OpenAccess)

0

cynicalsecurity

@cynicalsecurity@bsd.network · Feb 19, 2026

Replying to @stroughtonsmith@mastodon.social

@stroughtonsmith@mastodon.social that's the problem with models which don't keep up with voting fraud ;P

2

0

cynicalsecurity

@cynicalsecurity@bsd.network · Feb 13, 2026

Replying to @aristot73@infosec.exchange

@aristot73 how does that even begin to comply with GDPR? Who do you ask to exercise your right to be forgotten? The owner of the glasses? @SteveBellovin

0

2

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jan 25, 2026

Replying to @whitequark@social.treehouse.systems

@whitequark@social.treehouse.systems "it is not possible to use multiple computers at the same time" seems to be the little angel on my shoulder while the devil on the other says "yes you can, moar computers!"

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jan 12, 2026

Replying to @dk@tldr.nettime.org

@dk funny that… I have been calling "Ptolemaic security" the current security model since about 1998 when teaching SANS courses… I am not pleased that this has now expanded to AI and programming. /cc @aristot73

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jul 06, 2025

My Unix Archive mirror was slaughtered by LLMs overnight, it is on a 10G link, they were taking over 1Gbps in requests to the same files over and over again.

I have Geo-blocked the whole of the US to stop them (with PF).

This is ridiculous.

0

cynicalsecurity

@cynicalsecurity@bsd.network · Apr 18, 2025

Replying to @marasawr@mastodon.social

@marasawr@mastodon.social also, avoid using the same throwaway email for all online purchases unless you are creating a specific fake profile, of course. I’d go as far as suggesting you minimise online purchases, where possible.

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Dec 27, 2024

Replying to @kevin@mastodon.km6g.us

@kevin@mastodon.km6g.us D - battery to be thrown at non-working DNS. /cc @jpmens@mastodon.social

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Oct 15, 2024

Replying to @fj@mastodon.social

@fj@mastodon.social @gbarbey@tooting.ch faudrait utiliser l’IA pour trouver ceux qui ne comprennent rien du sujet mais, malheureusement, faut entrainer l’IA et… oups la plus part des contenus du web sont écrits par ceux qui comprennent rien. Oh well.

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jul 29, 2024

Replying to @iro_miya@mk.absturztau.be

@iro_miya AC/DC have renamed themselves USB/PD.

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jul 19, 2024

Replying to @sophieschmieg@infosec.exchange

@sophieschmieg@infosec.exchange I have always performed interpretative dances while rolling out, on stage.

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · May 23, 2024

Replying to @ipg@wetdry.world

@ipg an interesting question becomes what happens when you emit a lethal fart while listening to Apple Music. Does that count as a potential chemical warfare agent?

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jan 09, 2018

Replying to @bhtooefr@mastodon.social

@bhtooefr@mastodon.social @phessler@bsd.network @aag@bsd.network I am thinking more of a processor with efficient x86 emulation… you could dedicate certain cores to emulating x86 in little-endian mode, certain cores to networking tasks (see it as a µkernel design where "networking" is a task) in big-endian mode and so on… there is a certain beauty to it.

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jan 09, 2018

Replying to @phessler@bsd.network

@phessler@bsd.network @aag@bsd.network oh, that is a lot less sexy then :( I thought it allowed you to mix endianness… but no, it is just boring power…

1

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jan 09, 2018

Replying to @phessler@bsd.network

@phessler@bsd.network @aag@bsd.network conceptually big.LITTLE is not a bad idea and I can see it being brilliant in servers where you offload network processing to the big-endian cores and run an x86 emulator in the little-endian cores… I have a plan™ ;)

0

14

0

cynicalsecurity

@cynicalsecurity@bsd.network · Jan 09, 2018

Replying to @aag@bsd.network

@aag@bsd.network @phessler@bsd.network that is an incredibly useful comment: I was recently digging into the ARM architecture and big.LITTLE sounded like something I really didn't need. Note that I have nothing against the Raspberry Pi 3, just that I'd like Gbit Ethernet since I am getting Gbit fibre...

0

17

1

0

cynicalsecurity

Posts

#openbsd - BSD Network

Remote instance

Media