Pinned toot
Pinned toot

Verifying myself: I am
@drwho in the
BEGIN KEYBASE SALTPACK SIGNED MESSAGE. kXR7VktZdyH7rvq v5weRa0zkFLUiWS VPZ3U48F7ZtSgPj wefiNd7VuwhcPTR twvzOMIJnFa45ac 9x1UEDMIjFcn3nq u7Rlldjihk74ohS IGKUECH96urnVF1 gn7wM6ahu9MJY9m yvwzo8IX6Lq6cpz z4ALlqryKh5mHwX cJPmbQ5dBsHgbq3 i6cEnn0SUl8P3Ka t0p8kNuM9eWM4P0 eg8WT2QiaRGsAbz 4itKIoK47onnbZg 1E2xCGNDevM3J9s SBF2Sd9grU14k. END KEYBASE SALTPACK SIGNED MESSAGE.

Pinned toot


Do what thou Wilt shall be the whole of the Law.

Infragard for laybeings:

Infragard is described as a public sector/private sector partnership (part of the FBI, though I don't know off the top of my head which one) where they share intel pertaining to information security with active security professionals. This means, you have to work for a company which is in a fairly important field, such as aerospace, a tier-1 or tier-2 ISP, finance, or software products. I worked at NASA at the time, and later went into fintech. Both times I had to join Infragard because I did information security as my job. When I worked as a pen tester for a consultancy, it was before Infragard existed, otherwise I'd have had to join.

Yes, I had to undergo a background check. They want to make sure that members work for established companies, actually do security work, and don't have any connections to criminal groups that would try to misuse the information (at the time it was Russian organized crime they were worried about).

Being a member of Infragard means you get access to bulletins a couple of weeks before the information goes public. Most of it is under Chatham House rules - you can use it, but you can't say "I got this from Infragard."

Unfortunately, most of this information is between three and six months out of date. If you do even a minimal amount of proactive intel gathering as a security practitioner (run honeypots, read your server logs manually once or twice a week), or have any kind of intelligence system in place () you'll scoop them easily.

Supposedly they have classified infosec intel that they disseminate, but I've never seen any of it. If I had, common sense says I'd stay the hell away from a site like and not say a damned thing about this tempest in a teapot.

Infragard has periodic members-only meetings where they talk about stuff going on. The group nomenclature /APT [0-9]*/ was first brought up during some of these seminars. Once in a great while a speaker will bring up something timely, but most of the time the meetings are pretty much a waste of time. Most of the ones I went to had to do with security policy compliance (meaning, "Did you follow all the steps in $handbook to lock your shit down?"), logging and analysis, that Windows XP wasn't going out of support just yet (at the time), and stuff like that. It's usually two or three speakers with an MC from Infragard while the rest of us sit in uncomfortable plastic chairs drinking crappy coffee and eating more-than-halfway-decent bagels and muffins for breakfast.

Yes, I had to wear a suit to attend. Highly uncomfortable in the DC metroplex in the summer, I can assure you.

No super-secret info, tips, or tricks were given out. I wish. It's all stuff that you'd know anyway if you'd ever been a system administrator. Hell, most of the people there weren't even techies, they were policy wonks. Quite a few times I was the only person there who actually worked /with/ and /on/ computers in any capacity. I was certainly the only person there with long hair.

For the record, if you want the High Gibson 0-day intel, crash a room party or two at Defcon or HOPE. That's where the good stuff is.

Infragard does not solicit, demand, or even request intel from its members. Everything was push (they tell us stuff), not pull (we tell them stuff). I doubt they'd even listen to us if we did tell them anything. A couple of times I spoke to presenters during breaks to correct them, because their knowledge of something was incorrect (see above remark about doing proactive infosec stuff) and either their eyes glazed over or they "Well, actually"'d me.

It's nothing really impressive if you have a technical background. Most of the time you'd be bored out of your mind, unless you were a checkbox-checker that did C&A (certification and accreditation) work (which is NOT actually testing security, it's asking questions on a checklist, only about 1/3 to 1/2 actually have anything to do about actual infosec; but that's a rant for another time).

Ostensibly I'm still an active member even though I haven't logged into the Infragard portal in about three years, though I still get the e-mails (I currently have over 200 in a folder, unopened, because most of the information is simply useless), and I can't be bothered to sit on the phone for three hours until I get through to a human who can unlock the account I never log into, anyway.

At no time, to the best of my knowledge, were any of us questioned about things we knew about or did. We were never even asked about stuff we saw going on in our own networks. I certainly wasn't, and I saw a lot of shit flying around on the Net at the time. Nobody ever told (or even gently suggested) to any us to keep an eye and ear open for anything interesting happening on Twitter, Facebook, or anything else. Hell, at the time Infragard didn't even seem to know anything about Lulzsec's shenanagains at the time, nor did any of the other members I talked to at seminars. I was the only person in the DC Infragard chapter who did, because I'd tasked part of me with monitoring the situation.

If the FBI /did/ want to monitor the Fediverse... well, pull up your profile and hit View Source. You'll see an RSS feed for everything you post. Here's mine:

tl;dr, they could surveil the Fediverse with a feed reader or even a shitty Perl script. No NSA magick required. Not even an account on that instance is required. So, there would be no point to standing up an instance for the purpose of surveillance.

Ask me anything I forgot about. I'll answer honestly and to the best of my ability. If I don't know, I'll say "I don't know."

Love is the Law, Love under Will.

Pinned toot

Do what thou Wilt shall be the whole of the Law.

A little bit of hacker history, for folks who didn't live through it:

Back in 1985, LEOs started setting up and running boards to sting hackers. They went to great lengths to make them look 'legit' insofar as the hacker community was concerned, even going so far as to use some of the phone phreaking tricks of the time to make the boards look more like the HPAC/V boards of the time.

The folks who ran those boards never, ever, ever mentioned they were cops, or indeed any kind of official. In point of fact, none of us knew until the raids were over and done with and the defendants went to trial.

That somebody - anybody - in the Fediverse would talk about their professional life and affiliations in any way flies in the face of how law enforcement agencies actually do stuff.

It also shows a profound lack of knowledge of what "information security professional" actually means. It's not code for "mercenary black hat h4x0r," it means that in our day jobs we do information security work. Sometimes it's red team, which many want to think it is. Usually it's blue team, which is not sexy, boring, or counterculture. But, we do it for a reason, which is we want to try to make life in the twenty-first century a little safer. Nobody ever counts the data breaches that don't happen, and that's because we work our asses off to keep them from happening. We read logs, run honeypots, complain on internal IRC servers, and yes, deal with professional organizations, the origins of some tend to make people act without thinking or even doing a Google search.

When you do incident response, you sometimes have to deal with law enforcement. There are times that, regardless of the severity the feds have to be called in, and you have to work with them. And sometimes, really bad things happen and the feds get called in because it's "holy fuck" bad. Like most of the botnets of the last five years.

Those of you who espouse organization and collective action are acting exactly the same way as groups that ostracize and accuse members who actually practice operational and information security, keep tabs on threats and collect intelligence of that which you are organizing against. And ignore their warnings.

Love is the Law, Love under Will.

Pinned toot

Do what thou Wilt shall be the whole of the Law.

Another bit of hacker history for you, if you didn't live through it:

Remember the Morris worm of 2 November 1988?

The one that helped inspire one of the movies hackers love to hate, _Hackers_?

The Morris worm used a couple of exploitation techniques that we consider largely obsolete these days, namely, buffer overflows and stack corruption for remote code execution. In 1988.

In 1988, hacking was pretty much "guess lots of passwords until you get lucky." That's it. That's what we had.

rtm (Robert Tappan Morris, Jr.) was writing RCE exploits in 1988. In comparison, _Smashing the Stack for Fun and Profit_ by Aleph1 ( was published in Phrack issue 49 (8 November 1996). Think about that for a moment. He was about seven years ahead of the state of the art for the hacker community.

RTM's father, Robert Morris senior worked for NSA between 1985 and 1994. He helped write some of the security standards that we take for granted these days, whether or not we realize that they were published in the Rainbow Books. He was also a Chief Scientist while at NSA.

There is an excellent chance (more likely a certainty) that most of the exploitation techniques that the hacker community takes for granted were discovered, perfected, and weaponized years before they were effectively rediscovered by the underground (or the professional infosec community). rtm certainly knew about some of those techniques, though exactly how remains a matter of speculation.

Are you okay with that state of affairs?

Love is the Law, Love under Will.

me: I think I'll go outside today and carve the holes into the new case I got for my blue box.

extension cord: <cut though by accident>

also me: Oh, well.

The Doctor boosted

Hey guys, it's totally possible to acknowledge that you don't understand or share someone's perspective or understanding of the world without alienating them.

I've told people that I don't think the world works the way they think it works and remained friends.

It's possible to disagree without being a dick.

Maybe now I can find a module that can dissect pcapng files. I'd rather not write a byte-level dissector if I don't have to.

alias pypisearch="$HOME/pypisearch/bin/python -m pypisearch"

The Doctor boosted

“With 'multimedia' the profound ethical and aesthetic challenge comes from the burden of responsibility that lies with the individual once the constraints on communications are so radically eased if not eliminated.”

- Kenneth Dyson

The Doctor boosted

i just realized that every coast of antarctica is its northern coast. lol

The Doctor boosted

A bit weird couple of questions for non-cis people. Boost if you like, please :boost_requested:

1. Do you have some sort of internal voice or monologue?

2. If you do, has this voice changed during your gender transition, gender-wise?

The Doctor boosted

Floating Point Numbers:
When a signed and an unsigned number fall in love, often they think they can do anything...

The Doctor boosted

It’s Saturday, so you know what that means!

I am once again asking that you start your own instance. Just do it. Control your own data, make your own rules, and choose what you see. It’s fun. And as the Fediverse scales horizontally, we will each individually hold a larger stake in the network.

Again, if you are having any trouble, please (!) feel free to reach out to me. I will be more than happy to help you out with whatever problems you have.

Set it up on a server that is yours or will be yours

Pay someone else to host it for you

The Doctor boosted

today is a hide-under-a-blanket kind of caturday, mew

*is a smol lump under a blanket*
*one paw pokes out*

Wow. Somebody's trying to phish my Dreamhost account?

Does anybody out there have a laser cutter that can handle MDF? @laurelindel needs some custom cutting done to make some drawer inserts.

Please boost.

The Doctor boosted

When building a vacuumeow tube amplifier, don't forgot to inspect the insulation of the power transformeow.

#electronics #mastocat #catstodon #cat #cats #caturday

The Doctor boosted

If you have to use #Cloudflare for some reason, you can still allow #Tor users to bypass the annoying challenge that usually comes up.

Check "Firewall" -> "Tools", and add an IP access rule for "Tor" with action "Allow".

The Doctor boosted

These are a few of my favourite things:

The Doctor boosted

“You don't have to constantly consume trauma in order to know injustice exists.”

Stolen from elsewhere. I think I’m gonna try to stay off the real-world medias for a while.

The Doctor boosted

That was indeed an easy print. 3 hours with rafts, and you have a field eye wash cup for any water bottle. Guide bar aids in sightless operation.

The Doctor boosted

Money request, dysphoria, tails :boost_requested: 

Hi everyone. my dysphoria is spiking and i need to ask for help again.
There aren't many... serious attempts at helping with transspecies dysphoria, if any whatsoever. That lack has led to no decent prosthetics, and no support in most medical communities (which is to say, any medical communities i have found).
A lack of tail has been a major dysphoria source. As such, i am attempting to obtain a tail from The Tail Company, plus a pair of positionable ears. All told, this is going to be around $300 what with shipping and stuff, last time i checked. While i am slowly saving towards that goal, any help getting there sooner (and hopefully relieving some of my dysphoria sooner) would be immensely appreciated.

Thank you, all. Please boost and donate as you can.

Cashapp: $LindsaySchm

Show more

A bunch of technomancers in the fediverse. Keep it fairly clean please. This arcology is for all who wash up upon it's digital shore.