infosec

Back on my boring post grind to document my learning.

New #Blog post going through a #TryHackMe challenge. This time detecting two different attack types with snort!

https://ligniform.blog/posts/snort-live-attacks/

💜 🌱

#InfoSec #Learning #CyberSecurity #BlueTeam #Hacking

Passkeys. 👀

#InfoSec

My debit card's "fraud protection":

1. Regularly flags payments to subscription services as potential fraud even though I've used them for years, paying with the same debit card, and in spite of the fact that I've indicated many times that I trust these services; and
2. Has never identified a real instance of fraud

Whatever they're doing to detect potential fraud, it has a large false positive rate and does not seem adaptive (at least in my case). It's especially odd to me that this bank asks if I've authorized transactions it flagged as potentially fraudulent, I indicate no, this is not fraud, and yet the system continues to flag transactions with the same vendor as potentially fraudulent. I'm giving it a reinforcement signal that couldn't be more clear!

Edit: this post is not a request for banking or financial advice, nor an invitation to critique my choices. I'm venting about what seems to be a poor algorithm and if you have any comments or insights into that particular topic I'm happy to hear them.

#DebitCard #banking #fraud #FraudProtection #FraudDetection #cybersecurity #InfoSec

Some may have experienced outage intervals for our primary zone "quad9.net" on 8 May - for which we are sorry and appreciate your support and patience 🫶 . Here are the details:

https://quad9.net/news/blog/analysis-of-outage-8-may-2026/

#DNS #transparency #infosec

A federal Judge Denise Cote in NY rejected the #Trump admin’s effort to dismiss lawsuit alleging #DOGE directed a massive breach of #OPM data affecting millions of people.

#law #InfoSec #NationalSecurity
https://storage.courtlistener.com/recap/gov.uscourts.nysd.636793/gov.uscourts.nysd.636793.72.0.pdf

Why use a URL shortener when you can use a phishy URL extender?

https://phishyurl.com/

Keep your security people alert and awake, generate phishing-looking redirecting links

#infosec

TOMORROW (4/8) at 6:30 PM EST, legendary @defcon speaker @RenderMan will be talking about his #intetnrtofdongs project finding #vuln #0days & #infosec research into smart sex toys for #DESCI NYC!

RSVP Here: https://lu.ma/descinyc32

#fediverse #mastodon #Hacker #sextoys #dildos #sextech

Oh, your service logged me out for my security? Great, I'll just open up the vault that contains my private keys so that I can open up the password manager with the master password of my other vault, which has the credentials I'll use to log back into my account. And then to finish the login process you'll send me a one-time password in clear text through SMS or email because those are the only options you offer for a "second factor". I feel much more secure now thank you.

(For clarity this is a sardonic post).

#InfoSec #cybersecurity #security #web #dev #tech

#Whistleblower details how #DOGE may have taken sensitive #NLRB data

In the first days of March, a team of advisers from #Trump's new Department of Government Efficiency initiative arrived at the Southeast Washington, DC, headquarters of the National Labor Relations Board.

The small, independent federal agency investigates & adjudicates complaints about unfair #labor practices.

#law #InfoSec #privacy #NationalSecurity #Musk
https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security

Today I discovered the PhoneTrack app for my #NextCloud instance. As I don't run stock Android, I do not wish to be tracked by the googs and this does an very nice job.

#infosec #cybersec #privacy

Today I discovered the PhoneTrack app for my #NextCloud instance. As I don't run stock Android, I do not wish to be tracked by the googs and this does a very nice job.

#infosec #cybersec #privacy

Are you interested in a different kind of security conference?

Then take a look at the Open Security Conference (@OSCo). #osco25 takes place from October 2 to 5 in Rückersbach (Germany near Frankfurt) and registration is still open at https://opensecurityconference.org/.
(this is an English version of the original German thread https://infosec.exchange/@realn2s/114936419689473030)

Why?

The Open Security Conference aims to be diverse and inclusive. This also includes different levels of knowledge and experience.
It is therefore not only for security experts or for people who have (already) worked in the security sector for a long time,
but also for people who are interested in security or want to get into the field.

The #OpenSpace format not only enables expert presentations,
but also non-expert topics or questions as session topics. Sessions are not resticted to presentations, they can be interactive, collaborative, workshops or basically anything else.

Since topics do not have to be submitted months in advance,
but the agenda is created jointly by the participants, hot topics can also be covered.

The conference is non-commercial, i.e. the total costs are shared between the participants (including the organizers).
The costs include accommodation and meals in the conference hotel.

And yes, there are also sponsors who cover part of the costs.

But not everything is different.

There are great keynotes e.g. by @bkastl ("History repeating itself") and Mireia Cano ("Building an AppSec Program from Scratch").

#CyberSecurity #Security #InfoSec #AppSec #ProductSecurity #OTsecurity

***infosec specialists are needed in the resistance ***

The world needs tech security specialists to run workshops at public libraries for all ages & abilities to remove spyware, AI, reduce surveillance, understand the issues, & for more advanced, move to Linux, degooglefy, etc.

Libraries will pay good wages for these workshops.
If you have these skills, please consider offering them.

#libraries #library #tech #infosec #privacy #security #activism #antifa #resistance

Hey y’all, I’ve let myself get consumed by work and school and all of that, but shit is pretty fuckin’ dire for my friend @catbailey.

https://infosec.exchange/@catbailey/115051886620613739

If you’ve any help you can spare, any at all, she could use it, she’s just trying to stay alive long enough to land a job and get back on her feet. If all you’ve got is your reach on a niche federated microblogging network, I understand, but we'd appreciate you sharing with your network on the Fediverse and/or Bluesky where she's @blackcatswhitehats.org.

$868.26/4500 raised

Best to use Venmo/PayPal/CashApp, but GoFundMe is appreciated too and good for higher latency needs.

GoFundMe: https://www.gofundme.com/f/aid-for-cat-and-her-kids-in-crisis?lang=en_US
PayPal: https://paypal.me/catalystediting
Venmo: @BlackCatHackers
CashApp: $BlackCatOps

#MutualAid #MutualAidRequest #InfoSec #HelpCatAndCo #CyberSecurity

Is it just me, or has the number of captcha challenges significantly increased over the past few months? Nowadays I feel like I'm being hit with captchas all day every day, where before it was relatively rare. It is especially noticeable on sites I visit frequently, have accounts with, and presumably have cookies for.

#captcha #SecurityTheater #infosec #CyberSecurity #security #tech #dev #internet #web

Hello Fediverse! I’m @cyberseckyle 👋
Formerly @beardedtechguy. Same human, new handle that fits the work I live and breathe. I’m still very much a tech guy and the beard is staying 🧔‍♂️💻

What to expect here: practical security tips, MSP life behind the scenes, blue-team playbooks, lab tinkering, tool breakdowns, and no FUD. If you like clear, actionable posts with a little humor, you’re in the right place.

Let’s swap ideas and make the internet a little less weird and a lot more secure. 🛡️
#Cybersecurity #InfoSec

Dear fellow or potential fellow gotosocial instance admins,
I've come up with a novel way to set up a #gotosocial server behind a reverse proxy, which avoids the use of making new firewalling rules - both on a VPS, and creating port forwarding on one's home router. This method is ideal for minimizing the cost of running one's own #ActivityPub/#Mastodon server, in a way that leverages inexpensive fast storage on the backend (say, on a #RaspberryPi 5, 2GB of RAM, with an NVMe). As many valiant and praiseworthy Mastodon server admins might attest to, renting cloud VPS' can cost a lot, especially when storing many tens or hundreds of GB of user data.

My method avoids the need of forwarding ports 443 and 80 into one's home LAN, using DNAT (on the VPS) and port forwarding (on one's home router). In a nutshell, it's a novel use of #Wireguard, in conjunction with #nginx on the frontend, and gotosocial on the backend. This can save the cost of renting a dedicated VPS, to get the exclusive use of ports 443 and 80, in conjunction with static IPv4 and IPv6 addresses. My method optimizes on reliability and cheapness, but it's not the most secure - decryption and re-encryption happens on the VPS, before the data travels down the Wireguard tunnel. This exposes the data to any underlying hypervisor at one's hosting company. So full disclosure there.

I've run my method by the helpful gotosocial furries in their #Matrix Help chatroom (and I'm grateful for their help to debug subtle warts the method had), and got their blessing, at least to the technical soundness of the method.

I have a testing instance of gotosocial 0.21.0 set up with this new method: https://g.toque.im

I'm the user @owl on that instance, should you wish to befriend me there.

I'll make a longer blog post on this in the days to come, and post it in a reply to this post. (I also cross-posted this on another account of mine, please forgive the duplicate: @gtsadmin )

#DevOps #Linux #infosec #SelfHosting #DataSovereignty #OpenSource

🏋🏻 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟲: 𝟭𝟬 𝘀𝗲𝘀𝘀𝗶𝗼𝗻𝘀 𝗱𝗲 𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 𝗮𝘃𝗮𝗻𝗰é𝗲 𝗱𝗼𝗻𝘁 𝘃𝗼𝘁𝗿𝗲 é𝗾𝘂𝗶𝗽𝗲 𝗱𝗲 𝘀é𝗰𝘂𝗿𝗶𝘁é 𝗮 𝗯𝗲𝘀𝗼𝗶𝗻 • 𝟭𝟬 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴 𝗦𝗲𝘀𝘀𝗶𝗼𝗻𝘀 𝗬𝗼𝘂𝗿 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗧𝗲𝗮𝗺 𝗡𝗲𝗲𝗱𝘀

Montez en compétence votre équipe de cybersécurité avec des formations pratiques offertes par des experts de l'industrie! NorthSec 2026 compte 10 cours intensifs couvrant les compétences les plus recherchées!

Level up your cybersecurity team with hands-on training from industry-leading experts! NorthSec 2026 brings together 10 intensive courses covering the most in-demand skills!

➡️ Red Team Training
Charles F. Hamilton (Mr.Un1k0d3r)

➡️ Beyond Whiteboard Hacking: Master AI-Enhanced Threat Modeling
Steven Wierckx

➡️ Offensive Active Directory Operations Certification (OADOC)
Evan Hosinski (White Knight Labs)

➡️ Deconstructing Rust Binaries
@cxiao

➡️ Reverse, Bypass, Exploit: Mobile Hacking Workshop
David Baker & Steven Smiley (Corellium)

➡️ Offensive Development Practitioner Certification (ODPC)
Munaf Shariff (White Knight Labs)

➡️ Attacking & Securing CI/CD Pipeline Certification (ASCPC)
Raunak Parmar & Robert (Bobby) Schwass (White Knight Labs)

➡️ Advanced Detection Engineering in the Enterprise
FalconForce

➡️ Offensive GCP Operations & Tactics Certification (OGOTC)
Chirag Savla (White Knight Labs)

➡️ Practical AI Security - Go Beyond Theory: Build, Break, and Defend
Harish Ramadoss

📅 11-13 mai/May 2026
📍 Montréal, QC

👉 Description complète des cours, réductions pour étudiant(e)s et informations sur l'inscription disponibles à:
𝘍𝘶𝘭𝘭 𝘤𝘰𝘶𝘳𝘴𝘦 𝘥𝘦𝘴𝘤𝘳𝘪𝘱𝘵𝘪𝘰𝘯, 𝘴𝘵𝘶𝘥𝘦𝘯𝘵 𝘥𝘪𝘴𝘤𝘰𝘶𝘯𝘵𝘴, 𝘢𝘯𝘥 𝘳𝘦𝘨𝘪𝘴𝘵𝘳𝘢𝘵𝘪𝘰𝘯 𝘪𝘯𝘧𝘰 𝘢𝘵:

🔗 https://nsec.io/training-sessions/

#trainings #cybersecurity #infosec #redteam #bluelteam #cloudsecurity

Slack's signin procedure is the digital equivalent of boarding an airplane, "security"wise.

One of my favorite "security challenges" is the "verify your email" one. By this point my email has been verified so many times it should have top secret clearance.

#SecurityTheater #cybersecurity #infosec #Slack #tech #dev

Hey y’all, another status update on @catbailey ’s situation. Apologies for any mistakes but I’m working from phone and memory, so if I get anything wrong I’ll correct the post.

Storage Units containing her kid’s inheritance are going up for auction in a matter of days if not day. Moving anything out of them would require becoming current on payments ($1350), having help, and either her car or use of one. Becoming current here is her highest priority.

Her car was repossessed early last week or late the week before after the bank with the loan took 9 days to draft their ACH against her account, allowing some other charges to hit first and dip her into insufficient funds. She can still reinstate the payment plan by becoming current before it sells in ~early November, to the tune of $2200.

Her internet faces cutoff immediately, $100, and phone is due soon, $120.

And, y’know, there’s the whole feeding her kids, her cats, and herself bit, in that order if I know her, plus the other essentials like cat litter, toilet paper, and so on. Adding it all up I’m bumping the goal again, because nothing ever gets cheaper.

$360/4500 raised

Best to use Venmo/PayPal/CashApp, but GoFundMe is appreciated too and good for higher latency needs.

GoFundMe: https://www.gofundme.com/f/aid-for-cat-and-her-kids-in-crisis?lang=en_US
PayPal: https://paypal.me/catalystediting
Venmo: @BlackCatHackers
CashApp: $BlackCatOps

#MutualAid #MutualAidRequest #InfoSec #HelpCatAndCo

The witch’s robes flapped in the gale as she knelt on the beach. Waves crashed and she squinted as the sea spray lashed her face.

She withdrew a small syringe from the water as the magic started to work. As she stood, the wind calmed to a gentle breeze. The ocean settled until it was smooth as glass.

“This spell,” she said, knocking sand off her knees, “I call ‘sea quell injection’”

#microfiction #dadjoke #infosec #sqlinjection

Once again blocked from using a website I've used regularly for years because of "unusual activity" from "your IP". After passing a captcha, no less.

Somehow bot-detecting algorithms have been degrading over time.

This is a troubling trend because people who aren't using the anointed access points of the internet struggle more and more to connect and interact. Large entities like CloudFlare choke off more and more avenues of access in the name of "security", enforcing digital checkpoints without any accountability to anyone.

#dev #tech #web #bot #DarkPattern #security #infosec #cybersecurity #checkpoint

It's been ages! But Scrolls is back once again. What's in it? A bunch of random stuff from bygone weeks. I hope you enjoy, and I hope to be back again soon with more good shtuff.

https://shellsharks.com/scrolls/scroll/2025-10-01

Thanks to those mentioned below. Their blogs, their writing, their thoughts, and what they share were not only featured in this week's edition, but they are part of what sustains myself and the IndieWeb in general in darker times. Thanks! 🧡

@laura @fyr @tinimalina @mttaggart @ismh86 @kedara_eu @WahPlus @luna @kalfeher @jwildeboer @decryption @adulau @aphyr @fedicat @StarWarsPlanets @fyr @bagder @stark4n6 @privacyguides @gaz @joel

#infosec #fediverse #indieweb

In an effort to create and provide better articles on my blog, especially those related to cybersecurity and tech, I want to get your feedback on what type of articles y’all would like to see.

So, let me know below the types, series, etc. that I can write about.

Feel free to share to help spread across the #fediverse.

#cybersecurity #infosec #tech #blogging #indieweb

Y'all, @catbailey has lost phone service, and target to get that turned back on is $85.83. She's also working out how to explain to her kid that everything he inherited from his father is gone, because it doesn't look like there's any chance of saving the storage units. Her car was repossessed and is expected to sell in ~early November.

$460/4800 raised

Best to use Venmo/PayPal/CashApp, but GoFundMe is appreciated too and good for higher latency needs.

GoFundMe: https://www.gofundme.com/f/aid-for-cat-and-her-kids-in-crisis?lang=en_US
PayPal: https://paypal.me/catalystediting
Venmo: @BlackCatHackers
CashApp: $BlackCatOps

#MutualAid #MutualAidRequest #InfoSec #HelpCatAndCo