Remote

David Leadbeater

@dgl@infosec.exchange

Monitoring 📊, SRE, Open Source, Security 🔐. Emoji fan 🦸‍♂️. Just your average cynical Brit 🇬🇧 in 🇦🇺. He/him.

341 Followers

312 Following

12 Posts

Joined October 31, 2022

🕸:

https://dgl.cx

🃏:

gopher://dgl.cx/1/~dgl

Posts

David Leadbeater @dgl@infosec.exchange · Jul 05, 2026

Replying to @dgl@infosec.exchange

@nikclayton@mastodon.social @mwichary@mastodon.online (also this definitely works in Apple iOS apps, other apps may or may not actually implement this…)

David Leadbeater @dgl@infosec.exchange · Jul 05, 2026

Replying to @nikclayton@mastodon.social

@nikclayton@mastodon.social @mwichary@mastodon.online you shake the phone to undo. Discovery varies depending on how you express frustration

David Leadbeater @dgl@infosec.exchange · May 04, 2026

Replying to @benjojo@benjojo.co.uk

@benjojo@benjojo.co.uk yes, you need the RFC 8195 mug

David Leadbeater @dgl@infosec.exchange · Apr 12, 2026

AI, by the way is free:

David Leadbeater @dgl@infosec.exchange · Apr 12, 2026

Was just looking at the possible specs of the Lenovo X1 Carbon Gen 14. Rather expensive option here! Also does anyone know what the $20 "Haptic Touchpad" means in terms of actual hardware?

David Leadbeater @dgl@infosec.exchange · Mar 20, 2026

Replying to @freddy@social.security.plumbing

@freddy @sash interesting… https://developer.mozilla.org/en-US/docs/Web/API/SVGElement/load_event claims it doesn’t work in Firefox and references a 15 year old bug… but yes, that would get a few more characters :)

David Leadbeater @dgl@infosec.exchange · Mar 20, 2026

Replying to @dgl@infosec.exchange

@sash this takes advantage of the fact (some?) browsers by default load a blank iframe, so it's fewer characters than . Works in Chrome at least.

David Leadbeater @dgl@infosec.exchange · Mar 20, 2026

Replying to @sash@hachyderm.io

@sash very cool find! I think it would be possible to fit it (just) in 32 characters with: (That url works; d.cx is serving a hello world alert payload at the moment, it works with e.g. https://d.cx/~dgl/l.html but I haven't tried actually doing it with OpenWRT.)

David Leadbeater @dgl@infosec.exchange · Feb 07, 2026

Replying to @opentechfan@exquisite.social

@opentechfan@exquisite.social @OpenBSDAms@mastodon.bsd.cafe @h3artbl33d@exquisite.social it’s often worth considering if you can turn the problem into a set of files, e.g. if the config file format supports includes or there’s a .d style config. That way you don’t need templating, or at least the templating is limited to a few files. Even with ansible that may result in easier to reason about deployments.

David Leadbeater @dgl@infosec.exchange · Dec 27, 2025

Interesting talk from 39c3: https://gpg.fail including my favourite classes of issues ANSI escape spoofing and abusing CR. A partial response from GnuPG is here https://www.gnupg.org/blog/20251226-cleartext-signatures.html — although there’s other issues that do seem more fixable. IMO better to use age if it makes sense and/or ssh signing (e.g. for git commits)

David Leadbeater @dgl@infosec.exchange · Sep 20, 2025

I probably should have polished my @ComfyConAU@infosec.exchange talk. Instead I got sidetracked into wondering just how much I could tunnel over DNS: https://dgl.cx/2025/09/images-over-dns

infosec.exchange

ComfyConAU (@ComfyConAU@infosec.exchange) - Infosec Exchange

David Leadbeater @dgl@infosec.exchange · Jul 17, 2025

Replying to @filippo@abyssdomain.expert

@filippo@abyssdomain.expert curl | cat -v please ;-)

Remote instance

infosec.exchange

Open on original server

David Leadbeater

Posts

ComfyConAU (@ComfyConAU@infosec.exchange) - Infosec Exchange

Remote instance

Media