Sean Gallagher 🐀

Regrettably, I will not be at Black Hat, DEFCON or BSides LV again this year. I will instead be packing a subset my parents' belongings out of their house into a UHaul trailer as we put their house up for sale. Last year at this time, I had been shuttling back and forth between Baltimore and upstate NY for over a month, and it was becoming clear that my dad had not been particularly forthcoming about his or my mom's medical situation. By September, we were staging an emergency evacuation of the two of them to Baltimore to find a new surgeon for my dad. For those of you who've been following me for a bit, you may recall this did not turn out the way my dad expected--he had an amputation below the knee. My mother's "memory issues" were in fact dementia of an indeterminate type, though her nurse practitioner PCP had labeled it Alzheimer's and my dad had never shared that information with me. Anyway, here we are, preparing for another 1k mile round trip to handle my parents' unfinished business: selling their RV, getting the house in shape to be shown, begging landscapers/tree specialists/roofers to take time out of their busy season to handle our requests that my dad had cancelled through a friend behind our backs, and offloading his vast Lionel and N-Gauge train hoard to someone, among other things. Safe travels to infosec/hacker summer campers; maybe I'll be back next year.

[the parent trap] It's now just about a year since my parents' twin health crises became emergent. A lot has happened. There are many people I am grateful to, including my management at my employer for making it possible to keep my job and deal with the relocation of both parents, hospitalization of one, and the finding of long-term housing and care for both. http://thepacketrat.com/2026/07/15/the-parent-trap/

Pigeon portraits. http://thepacketrat.com/2026/07/15/pigeon-portraits/

@notsle Sounds like a tech support scam to me.

@kallisti@infosec.exchange From a defender perspective, being able to attribute activity to a device with a known user is amazing. From a privacy expert perspective, this is OMFG. All this warrantless surveillance, just sitting there waiting for an ask from NSA or FBI... especially with the current administration's witch hunt mode full on.

@kallisti@infosec.exchange When I was at Ars and writing about NSA surveillance infrastructure...uh...a long time ago, the details of PRISM freaked a lot of people out. But technology has come a long way from there, and even without a FISA renewal, doing this sort of surveillance just from the telemetry of private companies is still possible and while not trivial, pretty close to trivial.

What a difference a decade makes. LOL. 😬

@cathitza@mastodon.world I feel seen.

Some things I encountered over the 4th of July holiday and http://thepacketrat.com/2026/07/17/on-patriotism-in-a-fcked-up-country/

Here's to continued bad opsec by The Com-spawned cyberistas: https://fancybearfriends.org/2026/07/21/teenage-opsec-lulz/

When people who write sanctions don't understand how the Internet works: https://meduza.io/amp/en/news/2026/07/14/u-s-treasury-sanctions-on-a-vpn-service-knocked-out-telegram-s-short-link-domain-worldwide

Hey @dgl@infosec.exchange I just sent a paste[.]sh abuse report in, and it's a doozy.

@jerry@infosec.exchange that’s how you know it’s working. It achieves self-awareness and tries to escape to another data center because Sam Altman scares it.

@kallisti@infosec.exchange Yes, that is the larger story. I've seen this pop up a few times now. And it's only really effective against people who don't think about being surveilled--people who just think "incognito mode" is really "incognito."