InfoSec. Dragons. Open Access. Occasionally Copyright. I'm also Jewish.
Joined March 2014
- Tweets18.5K
- Following3K
- Followers2.1K
- Likes105K
Pinned Tweet
I will never understand people who think the appropriate response to an insensitive comment is to wage a campaign of personal and professional ruination.
To borrow an old quip - it's akin to fighting dandruff with decapitation.
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
dragons/acc 🐉 retweeted
No fucking way
ITS 4 AGAIN
DIFFERENT BUG
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
dragons/acc 🐉 retweeted
This is why I went GrapheneOS when I did. Besides the targeted ads I would get through my Samsung phone I was seeing the trend of phone makers and governments pushing for clientside scanning into phones and increasing levels of telemetry.
The fact your phone can decide your now allowed to see your partner in an intimate manner cause its doing clientside scanning of your private conversations should concern EVERYONE.
This same tech system is used in China to surveill citizens to catch them discussing the government in negative manners, to catch them sharing or videoing protest symbols/images, etc.
These companies will claim its protect people but in reality is to surveillance, censor and eventually control them. 💀
dragons/acc 🐉 retweeted
Florida and Texas are both moving fast on digital ID and mass surveillance policies...all under the banner of “protecting kids.”
Age verification, parent-child linking, device-level tracking, and government-mandated data collection. Same playbook, different states.
This will be copied across the country in 2027.
#protectingkidsonline #digitalid #surveillance
dragons/acc 🐉 retweeted
One professor punished for speech? An anecdote. A hundred? Cherry-picked. A thousand? Selection bias. Surveys? Bad questions. Better surveys? Methodological concerns!
I've spent 25 years watching defenders of the higher ed status quo turn every new piece of evidence into yet another demand for proof, creating a never-ending cycle of increasingly impossible standards for demonstrating problems that were already obvious 50 years ago!
dragons/acc 🐉 retweeted
This is why people hate greedy, unethical @Microsoft. They’ve just installed an update on the computer of every user of Mac @Office 2021 that bricks Word, Excel, Powerpoint etc.
We all have perpetual licences for Office 2021 but apparently Microsoft decided it was time to try to make everyone pay them money, even though the licence was supposed to be a one-off purchase.
After some trial and error, this fix worked for me – posting here for anyone having the same problem:
1. Delete the Office apps (Word etc.) from the Applications folder
2. Download and run the Microsoft licence removal tool: go.microsoft.com/fwlink/?lin…
3. Download and install the version of Office for Mac from 6th October 2026: learn.microsoft.com/en-us/of…
4. Enter your original licence code for Office to activate it
5. In the Finder, go to Macintosh HD > Library > Application Support > Microsoft and delete the MAU2.0 folder
6. Open Word, then go to the Word menu, then About Microsoft Word and check that it shows your licence
7. Still in Word, go to the Help menu, and make sure that the Check for updates option isn’t there
8. Don’t update Office for Mac and it should keep working – you need to keep updates off or Microsoft will install an update that bricks Office all over again
What a waste of time.
dragons/acc 🐉 retweeted
"The idea that unwanted #fiction should be removed simply because somebody finds it objectionable is precisely the attitude that makes an #archive necessary in the first place." michigandaily.com/arts/digit…
dragons/acc 🐉 retweeted
Florida’s HB 3 bans kids under 14 from social media accounts even if parents explicitly approve.
🚫 No consent option. 🚫 No override. The state decides, not parents.
That’s not protecting parental rights. That’s government replacing them.
dragons/acc 🐉 retweeted
How. The. Fuck. Do they have this many employees?
BREAKING: DocuSign says it may lay off up to 162,000 employees.
Readers added context they thought people might want to know
As of Docusign's most recent 10-K filing, Docusign had 7,044 employees as of 1/31/2026, making it impossible to lay off 162,000 employees.
sec.gov/Archives/edgar…
dragons/acc 🐉 retweeted
How is the internet less private than in 2006, when the whole family shared one computer?
Back then, the internet was weird, personal, and all of ours.
So, we got your favorite meme legends back together to say it louder: What happened to the internet? 1/3
dragons/acc 🐉 retweeted
Every "child safety" law ends the same way: prove who you are to use the internet. Who gets to hold that list of everyone's faces and IDs?
dragons/acc 🐉 retweeted
Canada’s Bill C-22 would force telecoms and messaging apps to keep six months of metadata on every citizen, whether or not they’re suspected of anything.
Cabinet will decide who has to comply and how, with the first regulations due up to two years after it becomes law.
Companies can be fined $250,000 a day for not obeying secret ministerial orders.
The minister insists it isn’t about surveilling honest Canadians. Signal would rather leave the country than find out, and Windscribe is packing too.
The bill is now with a Senate committee, which is the last place anyone can change it.
dragons/acc 🐉 retweeted
This psychopath is back again and he's commissioning us to draw Sora from KH and Cloud from FF fighting Fatalis from Monster Hunter... Okay.
dragons/acc 🐉 retweeted
This ad is vile. One thing that's so despicable about far-left hatred of Israel is how quickly they just glide past the fact that Israel was subject to horrific terrorist violence. One does not have to agree with all Israeli policies (I certainly don't) to know that this is a grotesque caricature.
New low for normalized Jew-hate in the American Democratic Party. Very sad:
Painting your political opponents as puppets of Jews, as this El-Sayed ad does, and as crazed baby-killers and money-grubbing villains who are the root cause of every bad thing not just in the world, but in your life—from wars to the price of eggs to the reason you can’t have free healthcare—is not just low-grade Jew-hate. It’s pure Third Reich stuff, translated directly from the original German.
Do you remember when Jewish Democrats in Michigan explained that they would vote for El-Sayed despite his open disdain for Jews, since there are many other important issues they need him to fight for? That anything was worth it to “defeat MAGA”?
Well, here’s El-Sayed’s answer to them: Don’t worry, all those issues we agree on, like healthcare, inflation, and climate change, I’m going to make them about Jews too! I will tell the public that the Jews are the reason they can’t have those things.
dragons/acc 🐉 retweeted
Before online child safety laws, you could read, search, and speak online without showing ID.
After them, every click is tied to who you are.
Send this to the parent who still thinks this is about protecting kids.
Then ask them one question. Who gets to see the database?
dragons/acc 🐉 retweeted
The anti-open-weights panic looks VERY FUCKING CONVENIENT ahead of Anthropic’s IPO.
Anthropic is preparing to sell shares while pushing rules that would also cover its open-weight competitors. Big accounts are spreading fear about those models. Some have direct business ties to Anthropic.
October 15: reports put Anthropic’s public IPO filing on
October 26 and its roadshow on November 9. Billions depend on convincing investors this business can keep growing.
October 16: Anthropic’s own AI bill is circulating in Congress. Its frontier threshold is 10^25 FLOPs, low enough to include large open models.
October 21: PHP2Shell becomes public. Researchers found the vulnerabilities using CLOSED models, with disclosure and fixes coordinated through OpenAI’s Patch the Planet.
October 22: abliterated open models become a major target of the panic. Anthropic’s CISO posts "never let a crisis go to waste" urging security leaders to ask their boards for help with basic security. 4.3M views.
By October 25, Gates’s proposal is circulating too: powerful open models should run only on certified platforms that preserve safeguards.
I went through 400+ posts from October 16 to 26. This discussion includes Noahpinion, Suhail, yacine, beffjezos, Deedy, sporadica, AISafetyMemes, Matthew Green and Andrew Curran. Every account above 100K followers. Their positions differ, but the fear is reaching huge audiences.
And Deedy, who linked critical vulnerabilities to abliterated models, helped launch Menlo’s $100M fund WITH ANTHROPIC.
There is a business relationship here. There is an IPO coming. There is a company writing proposed rules for the market it competes in.
My conclusion: this wave serves the commercial interests of closed labs. Restrict the models people can run independently and you make those people more dependent on paid providers. Investors benefit from that dependence.
I run open models on my own 4x 3090. I will not quietly accept losing that freedom while people with money in the alternative explain how much safer I’ll be.
Fuck your valuation. Fuck your IPO.
dragons/acc 🐉 retweeted
The way frontier labs have restricted access to cyber capabilities makes no sense. If you're considered a "defender" you're not allowed access to the "offensive" versions of the models (the ones that can do development/validation of malware and exploits).
So for example, if you want to build some sample malware to test a detection system, nope.
Or if there's a major crisis due to a critical vulnerability in PHP and you need to rapidly triage fake exploits to see if there are any real ones floating around so you can warn people, nope.
Want to build a remote code exploit to make sure the detection rules you plan on proposing to the clients actually work? Hard nope.
You gotta call your red team friend and wait for them to do your job for you, because "defender" are only allowed to play in the sandbox with the children.
Not an expert, but I think that the ability to triage in-the-wild exploits during a major crisis affecting 40 million systems is possible maybe important.
And then they want to ban abliterated open weight models, which half of the people are only using because frontier labs will only give them access to lobotomized models.