@nothacking@infosec.exchange

nothacking @nothacking@infosec.exchange · Jul 31, 2026

The usual story about a lightbulb conspiracy isn't quite right: http://maurycyz.com/misc/tungsten/

maurycyz.com

You have been mislead about lightbulbs (Maurycy's blog)

70

7

60

1

nothacking @nothacking@infosec.exchange · Jul 30, 2026

LLMs: funny, but also kind of sad. Hover or focus to reveal Sensitive

So, I just got hatemail that appears to have been generated by an LLM. ... someone should go tell the orange site that they've lost their job to AI. Also, did anyone else on here get something from an proton.me email address that: [0] is clearly responding to a single published page, [1] echos fragments of the original page, [2] and has every point formatted as a question? If yes, I'd love to hear about it to get an idea of how common this is. (and to know if this is a one off or if someone built a fully automated hatemail bot)

0

2

0

nothacking @nothacking@infosec.exchange · Jul 29, 2026

Replying to @lcamtuf@infosec.exchange

@lcamtuf@infosec.exchange Yet another reason to: if ($http_user_agent ~* "Google") {return 418 "Shoo!";}

0

nothacking @nothacking@infosec.exchange · Jul 29, 2026

I know phone cameras take some liberties with image processing, but this is just ridiculous. I honestly don't even know what happened here: it's not just slopscalling because even large things like the SATA label are messed up. Almost looks like the output of stable diffusion "img2img"... perhaps someone told a chatbox to put the photo on a white background?

0

1

0

nothacking @nothacking@infosec.exchange · Jul 29, 2026

Replying to @foone@digipres.club

@foone@digipres.club Ask mastodon to write the HTML for me of course! Test text box:
Oooo, a button: , If it needs to be programmatic, I have written scripts for generating HTML before. It's not terribly difficult to roll your own.

0

nothacking @nothacking@infosec.exchange · Jul 27, 2026

AI slop (quoted to add CW) Hover or focus to reveal Sensitive

RE: https://oldbytes.space/@gloriouscow/116989115577194362

0

1

0

nothacking @nothacking@infosec.exchange · Jul 25, 2026

By the way, if you are behind cloudflare, this is what your website looks like to anyone who is [1.] using an slow computer [2.] is on a older mobile device [3.] using a slow internet connection [4.] have their browser set up for privacy or/and security. You don't see these users on your analytics, but they exist.

0

nothacking @nothacking@infosec.exchange · Jul 24, 2026

I think my IRC client is judging me for my sleep schedule:

0

nothacking @nothacking@infosec.exchange · Jul 23, 2026

The sun at ~21:00 UTC. Taken using a shitty solar "telescope" made by stacking non-overlapping filters until the light intensity was reasonable, and attaching that over a 150mm focal length camera lens.

0

nothacking @nothacking@infosec.exchange · Jul 23, 2026

Random bird:

0

nothacking @nothacking@infosec.exchange · Jul 23, 2026

Wildfire smoke + accidental sunspot: (Spur of the moment shot with cannon R100, a=23, fl=150, f/5.3)

0

nothacking @nothacking@infosec.exchange · Jul 20, 2026

Replying to @lcamtuf@infosec.exchange

@lcamtuf@infosec.exchange More book reviews soon? /s

0

1

0

nothacking @nothacking@infosec.exchange · Jul 18, 2026

Replying to @patcharcana@furry.engineer

@patcharcana@furry.engineer Perhaps you could try some non-js challenge, like setting a cookie and serving a From my tests, most of these bots are really dumb and it's possible to tell them apart without having to make legit users grind hashes.

0

nothacking @nothacking@infosec.exchange · Jul 18, 2026

Abusing progressive JPEG to make animations. (Got nerd snipped by https://infosec.exchange/@lcamtuf/116922305016859176)

0

1

nothacking @nothacking@infosec.exchange · Jul 17, 2026

Hmm...

0

1

0

nothacking @nothacking@infosec.exchange · Jul 17, 2026

NGC 7497 and IFN in pegasus. (25 minutes, 230 mm, fl=1500, f/6.3)

0

nothacking @nothacking@infosec.exchange · Jul 16, 2026

Replying to @karotte@chaos.social

@karotte@chaos.social I've spliced multiple progressive JPEGs together (except for start-of-frame, start-of-image and end-of-image markers). Since each scan includes it's lowest and highest DCT bin, the each image overwrites the last one (mostly).

1

0

nothacking @nothacking@infosec.exchange · Jul 16, 2026

Animated jpeg test: https://maurycyz.com/projects/bad_jpeg/msg.jpg

0

1

0

nothacking @nothacking@infosec.exchange · Jul 14, 2026

Replying to @vivianrose@mastodon.social

@vivianrose@mastodon.social Oh that's clever...

0

nothacking @nothacking@infosec.exchange · Jul 14, 2026

In light of recent events, I wrote a thing about making flexible "ice packs" that freeze at 18 °C. That's low enough to cool down, but high enough to be frozen in a basement (no electricity required!) The materials are cheap, non-toxic, non-corrosive, and store ~100 J/g (30% of ice, but can still provide an hour or so of cooling)

0

nothacking @nothacking@infosec.exchange · Jul 13, 2026

Replying to @lcamtuf@infosec.exchange

@lcamtuf@infosec.exchange Seems like a very uncomfortable lithium battery situation waiting to happen... I wonder how many people would know what part of the ring is safe to cut if anything goes wrong.

0

1

0

nothacking @nothacking@infosec.exchange · Jul 11, 2026

Replying to @catsalad@infosec.exchange

@catsalad@infosec.exchange FXAA

0

nothacking @nothacking@infosec.exchange · Jul 09, 2026

Replying to @lcamtuf@infosec.exchange

@lcamtuf@infosec.exchange I wonder if it counts people with Javascript disabled. All the off-the-shelf analytics tools (Google, Cloudflare, etc) depend on it...

0

nothacking @nothacking@infosec.exchange · Jul 09, 2026

Replying to @gloriouscow@oldbytes.space

@gloriouscow@oldbytes.space @tek@freeradical.zone I think the main problem is that it doesn't even show you a file tree. It's exceedingly easy to accidentally upload something you didn't want to (home dir, dot files, etc). Other than that, it's no different than any other free virtual web hosting or cloud storage provider (most allow publishing over HTTP)

0

nothacking @nothacking@infosec.exchange · Jul 09, 2026

Replying to @NanoRaptor@bitbang.social

@NanoRaptor@bitbang.social Good news is that a lot of soaps glow "biology goo green", so it's not all bad stuff...

0

nothacking @nothacking@infosec.exchange · Jun 30, 2026

Replying to @lichtfeind@chaos.social

re: Long, dumb computer things. Hover or focus to reveal Sensitive

@lichtfeind@chaos.social Yes. Generally the way that works is that the TPM verifies the password, so it's theoretically insecure against hardware attacks to the actual chip... but those are extremely rare and difficult. In real life situations, it's practically identical to password based encryption but less work. (Just make sure you hold on to that recovery key)

0

nothacking @nothacking@infosec.exchange · Jun 30, 2026

Long, dumb computer things. Hover or focus to reveal Sensitive

Regarding the recent windows affair, you should probobly not use TPM based disc encryption (like default bitlocker) Password based disc encryption works like this: the computer boots up, prompts you for a password, and uses that to decrypt your data. If someone steals the computer, it's mathematically impossible for them to see any of that data. However, if the computers breaks, you can plug the drive into another computer and decrypt it using your password. TPM based encryption uses a chip in your computer which watches the boot process. If it's satisfied that the OS is unmodified, it sends the key to the processor. This is bad for two reasons: First, it does not actually protect your data if the machine is stolen: since the attacker can full boot it up without a password, any vulnerability in the OS will let them steal the data. (this includes ones that haven't been found yet) Also, the chip can't detect hardware tampering: it's possible to use a logic analyzer to intercept it's communication and read out the key. (there are youtube vidoes showing how to do this) Second, it will cause dataloss if your computer or operating system breaks. Since the key is stored in hardware, the drive cannot be unlocked from another computer, even if you need to do so. A live USB environment won't work either because the TPM will see that the boot chain is different and refuse to provide the key. TLDR; This configuration provides minimum security while maximizing the risk of dataloss.

0

1

0

nothacking @nothacking@infosec.exchange · Jun 29, 2026

I dunno, but this seems very slightly excessive? (I guess I'll have to set up a block list on my email server)

0

1

0

nothacking @nothacking@infosec.exchange · May 16, 2026

Replying to @jwz@mastodon.social

@jwz@mastodon.social To be fair, the policy itself doesn't seem too bad:

we do not allow them to be used in ways that risk losing our shared social and technical understanding of the project

It's fine to use LLMs to answer questions, analyze, distill, refine, check, suggest, review. But not to create.

The following are allowed.

Any use of an LLM where you are the only one who sees the output. [...]

[...]

Using an LLM in the creation of experimental code changes that are not meant to be reviewed and will never be merged [...]

The following are banned.

Comments from a personal user account that are originally created by an LLM.

[...]

Documentation that is originally created by an LLM.

The following are decided on a case-by-case basis. ["for the purposes of experimentation to inform future revisions"]

[...]

"Trivial" code changes that do not meet the threshold of originality
Using an LLM to discover bugs, as long as you personally verify the bug, write it up yourself, and disclose that an LLM was used.

[...]

All of these must disclose that an LLM was used.

While it doesn't state it explicitly, it's heavy implied that any (non typo correction) code changes made by an LLM are banned.

Reads like a "we need to have a policy" policy. Allows things that the devs can't prevent, puts heavy limitations on slop coding where they can, and requires disclosure of any use.

6

0

nothacking @nothacking@infosec.exchange · May 01, 2026

Replying to @beyondmachines1@infosec.exchange

@beyondmachines1 Considering how popular built-in webcam covers are, it would be really nice to have a hardware microphone switch.

3

0

1

0

nothacking @nothacking@infosec.exchange · Apr 26, 2026

Replying to @stux@mstdn.social

@stux@mstdn.social https://en.wikipedia.org/wiki/W54 Not really intended for this, but you could throw one of these. (not particularity far tho)

1

0

nothacking @nothacking@infosec.exchange · Apr 26, 2026

Replying to @lcamtuf@infosec.exchange

@lcamtuf Just going to put this here. LD_PRELOAD=./remote_includes.so gcc https://maurycyz.com/hello.c && ./a.out (and yes, hello.c includes more remote files)

8

1

0

nothacking @nothacking@infosec.exchange · Apr 24, 2026

Replying to @ocean@raru.re

@ocean@raru.re As a general rule, registrars who's main businesses is domains are a bad choice, especially the ones that do promotions like ".com for 1$".

They are resellers, and must pay nearly the whole 10$/year to the registry (a different company), leading to very small margins. Any extra money to run ads or promotions must come from either:

charging you extra money
... or screwing customers.

If you see an ad for your registrar, find another one ASAP.

Even if you don't get screwed, it's just a bad deal: I pay $10.50 for a .com domain (just pennies over registry cost), but godaddy will happy charge you $23. The similarly shitty namecheap charges $15.

7

0

nothacking @nothacking@infosec.exchange · Apr 17, 2026

Replying to @thgie@post.lurk.org

@thgie@post.lurk.org How do they even come up with ideas like using inconsistant letter spacing for decoration? HereletmeremoveallthespacingfrommytextVeryeasytoreadright? It sucks no matter who's reading it. I don't mind decoratied text, but do it with fonts, colors and layout. Messing with spacing is like replacing all letters with "A"s in the name of reducing visual noise.

1

0

nothacking @nothacking@infosec.exchange · Apr 07, 2026

Replying to @vwbusguy@mastodon.online

@vwbusguy@mastodon.online

Last 90 days uptime

94 incidents in the last 90 days

89.43% uptime

90 days ago

wdm, it's totally five nines.

1

0

nothacking @nothacking@infosec.exchange · Apr 06, 2026

Replying to @david_chisnall@infosec.exchange

@david_chisnall @Natasha_Jay@tech.lgbt ... and LLMs are intentionally skewed to be "helpful" and not praise Hitler. It turns out the average internet comment is rather nasty and people don't want that. The average internet user is probobly quite a bit better, but LLMs are trained on text, not people.

0

nothacking @nothacking@infosec.exchange · Apr 01, 2026

https://lkml.org/lkml/2026/4/1/1284

2

0

7

0

nothacking @nothacking@infosec.exchange · Mar 22, 2026

Text drawing with my AVR video transmitter:

10

3

4

0

nothacking

Posts

You have been mislead about lightbulbs (Maurycy's blog)

Remote instance

Media