Imperfect Confessional Lutheran. AntiCommunist. InfoSec incident responder. Former sysadmin. Frequent polemicist. Opinions my own. RT and like != endorsement.
Working too many incidents.
Joined August 2022
- Tweets26.7K
- Following3.3K
- Followers1.4K
- Likes5K
WellKnitTech retweeted
As of today, more Democrats have voted in Texas than Republicans.
Go vote today, and get a few patriotic friends to vote over the weekend.
Let’s turn this thing around.
WellKnitTech retweeted
There is nothing to worry about.
Nothing important is run on PHP or old software—except the water & electrical grid, a few government services like our missile defense systems and a handful of electrified fences at the zoo (for the lions, tigers and cobras).
Hey, @Support could you fix the Android app please? It keeps lagging and crashing.
WellKnitTech retweeted
NEW: The terrorist organization CAIR is backing dozens of Democrat candidates, including James Talarico, Gina Hinojosa, and Vikki Goodwin. texasscorecard.com/decisiont…
AI models can now read through open source code and flag serious vulnerabilities that used to sit there for years. Some people are treating this as a reason to stop shipping open source. That’s the wrong call.
@esrtweet's line still holds: given enough eyeballs, all bugs are shallow. We just augmented the eyeballs. Models don’t invent the bugs, rather they surface the ones that were already there and make them harder to ignore. The short-term pain is real. Maintainers in established projects are getting buried in reports, a lot of them noisy, and the gap between discovery and a deployed fix creates risk. Under-resourced projects will feel that the hardest.
The alternative is worse. Code that has to survive that level of automated review will, over time, end up with fewer of the stupid, expensive mistakes that have been burning organizations for decades. Closing the source doesn’t fix this. Almost every commercial product is still full of open source components, and models plus reverse engineering keep closing whatever gap remains. All you’ve done is make the same bugs harder for defenders to find and patch while attackers keep looking.
Open source at least spreads the cost of the review. The findings don’t stay trapped inside one vendor’s bug tracker. The practical move is to get better at prioritizing what actually matters and push maintainers toward fixes instead of just more tickets. Hiding the code was never a security strategy. It was just convenient. We have more eyes now, augmented with super-ultra laser vision. Use them.
WellKnitTech retweeted
Texas Comptroller @DonHuffines has issued a new executive order barring businesses that require COVID-19 vaccine passports from receiving contracts or grants from his office.
Businesses must certify compliance or face immediate termination.
WellKnitTech retweeted
‼️ Fortinet Urges Patching Critical Flaws Affecting FortiOS, FortiManager, & FortiAnalyzer
Details: cybersecuritynews.com/fortin…
Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated release addresses critical and high-severity vulnerabilities, including flaws found through AI-assisted security testing.
The company said customers should address internet-facing devices first. The update follows security releases for FortiMail and FortiAuthenticator, extending the patching effort across several key products.
Fortinet said its testing program uses advanced AI models to examine code paths, protocol handling, and configuration logic.
#cybersecuritynews
WellKnitTech retweeted
Major Houston-area public corruption indictments to be announced today at 1:30pm central. @USAO_SDTX + @FBIHouston + @TxDPS joint operation.
Press conference in our office. Media should contact us for details.
WellKnitTech retweeted
“Noncitizens don’t vote,” they said.
So how is it that 28% of noncitizens in California have voted?
These things can’t both be true.
EXTREMELY IMPORTANT 🚨 Federal Lawsuit against California shows that 28.8% of noncitizens in California HAVE A VOTING HISTORY
California elections are not legitimate, noncitizens are voting at an extremely large scale
- Los Angeles County elections officials took a sample batch of 200 ballots
- The 200 ballots were taken from a sample of 20,000 that the Trump Admin says are noncitizens
- Of the 200 ballots that were taken, 71.2% of the 200 have no voting history
This means 28.8% of the noncitizens ballots DID have a voting history
Nearly 30% of noncitizens are voting in California elections based on this sample. I’ll bet it’s much higher
WellKnitTech retweeted
Let’s not forget about this certificate clusterfuck while everyone is busy with the PHP RCE news.
Almost at the same time, another serious security incident became public.
Eight intermediate CA certificates from eMudhra were found to use ridiculously weak private keys. We’re talking about P-384 keys where one private key was literally the number 4. FOUR!
Six of these were TLS CAs, allowing anyone to recover their private keys and potentially issue trusted certificates for arbitrary domains.
Major browsers have already blocked the affected CAs. But what about API clients, backend services, embedded devices, containers, and systems with outdated trust stores?
Many don’t enforce Certificate Transparency or check revocation. Some could remain vulnerable for years.
These weak keys have existed since April 2025. No confirmed malicious exploitation so far, but the implications are serious.
Don’t overlook this one while focusing on PHP.
Technical details and test endpoints:
emudhra.we-have-a-problem.co…
Incompetence rigs elections.
📣TEXAS
"Voters also reported that measures were missing from some ballots, including measures in the Northside and East Central school districts. Carew said the issue was corrected within an hour after it was brought to the office’s attention. She said the ballot issue was not limited to school districts."
"Carew urged voters to review their ballots before submitting them and to tell an election judge immediately if a race or measure is missing."
“Once a ballot’s been cast, there’s not anything they can do,” Carew said."
#txlege
@TXsecofstate
How many thousands to millions of voters are missing races and measures?
Texas Election Code 122.001 a. 1-10 MAY NOT BE USED
This has been happening for years and you do nothing except protect ES&S, HART, and other for profit vendors products.
WellKnitTech retweeted
📣TEXAS
"Voters also reported that measures were missing from some ballots, including measures in the Northside and East Central school districts. Carew said the issue was corrected within an hour after it was brought to the office’s attention. She said the ballot issue was not limited to school districts."
"Carew urged voters to review their ballots before submitting them and to tell an election judge immediately if a race or measure is missing."
“Once a ballot’s been cast, there’s not anything they can do,” Carew said."
#txlege
@TXsecofstate
How many thousands to millions of voters are missing races and measures?
Texas Election Code 122.001 a. 1-10 MAY NOT BE USED
This has been happening for years and you do nothing except protect ES&S, HART, and other for profit vendors products. – at Leander, TX
WellKnitTech retweeted
😬
WellKnitTech retweeted
oh for fucks sake. as if the php issue isn't bad enough, eMudhra (An indian cert provider) had their private certs have like 8 bits of entropy.
Normally you want 384 or more. Their private key factors were literally 4, 56, 66, 115, 155, 156, 230, 237.
This is going to SUCK.
WellKnitTech retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
WellKnitTech retweeted
Gross incompetency from Indian certificate authority eMudhra.
You had one job: generate a 384 bit private keys and instead you used: 4, 56, 66, 115, 155, 156, 230, and 237.
This allows attackers to issue certificates for any websites.
Embarrassing that it’s a family business run by largely computer illiterate people. Only 1 of the 3 have a remotely computer-related background and even they never actually worked a technical job in their life. If you look at the LinkedIn, their tech team is young, from tier 3 education and paid sort of bottom barrel.
Imagine how many attacks you can design with AI given the existence of this genre of gross negligence.
WellKnitTech retweeted
In other non PHP related news, if you're somehow still a yahoo mail user, you have until 27th January 2027 to switch to a new provider, following which you can either pay £2.15 per month for your personal data to not be used to advertise to you, or content to personalised ads
WellKnitTech retweeted
I was leading Heinz Ketchup when Dip N Squeeze came out.
It was a massive upgrade from ketchup packets. Consumers LOVED it.
Problem was we couldn’t get any of the big fast-food players on board.
Dip N Squeeze was 3-5x (I forget the exact numbers) more expensive than packets, and they were free for customers.
The key question was “does having Dip N Squeeze drive more volume?”, thus justifying the incremental cost.
It was nearly impossible to prove. Every penny matters to these operators, so every sales meeting was the same. “We love it, but no.”
Chick Fil A was the only yes.
They didn’t need “proof”. They operated under the assumption simply giving their customers a better experience would pay off in the long run. Incremental cost be damned.
Their conviction was impressive.
They viewed every decision thru the lens of their customer. A much different approach from the other big players.
I assume they treated countless other decisions the same way.
This was ~15 years ago. CFA has been on quite the run since.
(separate but related, I believe being a private co is a massive competitive advantage for CFA)
Readers added context they thought people might want to know
Dan Reese claims he "was leading Heinz Ketchup when Dip N Squeeze came out" ~2011, but has described himself as an MBA intern at Heinz then. Reports show Chick-fil-A and Dairy Queen used the packets early on, with others testing.
x.com/DanReese21/sta…
cbsnews.com/news/reinvente…
linkedin.com/in/dan-reese-3…
codypeakadv.com/about-us/dan-r…