It was of course to be assumed that the reason Russian government pushes Max messenger down everybody’s throat is so that they get full visibility into the communication. So no real surprises here but still good to see this analysis despite Max developers going to great lengths to make analysis harder.
Remote
Wladimir Palant
@WPalant@infosec.exchange
mastodon 4.8.0-alpha.3+glitchSoftware developer and security researcher, browser extensions expert. / searchable
3428 Followers
9 Following
50 Posts
Joined August 21, 2018
Website:
Pronouns:
He/him
We are going to see lots of open source projects deciding on how to deal with fascists within their community. After decades of conditioning people to view tech as a neutral, politics-free zone, very often they will make the wrong decision. You cannot have an open and welcoming community if you allow fascists or discuss that they might actually be “merely” racists or find other excuses not to take a decisive action. See paradox of tolerance.
If projects are being forked over this matter, I guess all we can do is embracing the fork.
#KDE
Remember when you had to resort to hacks like this one in order to have some basic privacy? https://palant.info/2009/03/02/getting-rid-of-flash-cookies/
Adobe Flash EOL was six years ago, though it got phased out before that already. A great win for the web platform.
I recommend that you read this article and think long and hard about it. If your first reaction is “half of this is probably not true” then you are part of the problem and this is something you have to fix. If victims speak out in the only way they feel they can, then you have to take this seriously and listen, then think about the structures that enabled their abusers and your role in those.
Also, if you want to keep your faith in humanity I recommend not reading the comments under this article (or maybe no comments under online media in general).
I see news that the #FTAPI data exchange platform has been hacked. And that name actually rings a bell, I’ve written about it a while ago: https://palant.info/2018/07/11/ftapi-secutransfer-the-secure-alternative-to-emails-not-quite/
Back then I found that their claims of data being end-to-end encrypted should be taken with a grain of salt. We might find out now just how large of a grain.
Content warnings serve a purpose. Yes, that includes politics.
You may feel that a topic is too important to “hide” it. But please understand that people are currently getting bombarded by horrible politics news from all directions. This is not sustainable, and it’s often a choice between muting this at least temporarily or burning out.
So: please don’t be an asshole and use content warnings. People ask for them for a reason, not to annoy you or to downplay the importance.
(I fully acknowledge that I don’t always think about this. But I try.)
Replying to
@BinChicken@theblower.au At least that’s what it currently looks like. I hope that it isn’t what it actually is. But we are going to see.
Replying to
@abacabadabacaba@infosec.exchange If you don’t know it already you might want to look up the thread that coined the term “Nazi bar.” They always do this stuff elsewhere at first. They will only show their true face in the project once they brought in enough friends or are otherwise in a position of power where they feel that they cannot be kicked out any more. So the stance “we only care about what people do in our spaces” is, quite frankly, a naive one. Projects should be paying close attention when somebody is called out for things they do elsewhere. Shooting the messenger is an extremely wrong approach, no matter the circumstances, and I hope that KDE still comes around to understand this.
RE: https://infosec.exchange/@WPalant/115380794950758884
Gotta love the world we are living in now.
report put together by a special operations command analyst and found it had been generated with the help of artificial intelligence (AI) — and that a chatbot the analyst had used inaccurately identified the material the ship was carrying.
The report, according to one of the sources, was “entirely false.” But it also “almost started a war,” the source said.
https://edition.cnn.com/2026/09/18/politics/us-military-ai-false-intelligence-china-ship
It’s not like anybody could have foreseen that this kind of thing will happen. Oh, I actually did…
Quoting
My father has served his mandatory time in the Soviet air defense. This is an area where the Soviet Union made a number of tragic mistakes. Innocent lives have been lost. https://en.wikipedia.org/wiki/Korean_Air_Lines_Flight_007
My father explained it to me like this: “You cannot have people permanently on alert. They will be caught off guard, and in a high-pressure situation they will make mistakes.”
Now give those people an “AI” that they consider more capable than themselves…
Open quoted postWhat the…??? I mean, leaking a signing key to a private GitHub repository is clearly better than leaking it to a public one. But still, I remember a blog post from something like two decades ago about how Mozilla was using hardware tokens for signing, so that the signing keys could not possibly leak. That probably pre-dated their Linux package repositories, so either the concept wasn’t used consistently after that or at some point performance became more important than protecting key material (Mozilla’s infrastructure is producing lots of builds).
Hollywood has some weird obsession with computer displays. A spy needs to copy data? They attach some fancy device to the display. Need to shut down a computer? They shoot the display of course. And never mind that a computer virus will always produce visible glitches on the display.
Replying to
Not quite unsurprisingly there are people in my comments who feel that automating vulnerability research is increasing their productivity and that they are in control, being the “human in the loop,” that they are in fact learning a lot. Well, Christine Lemmer-Webber just published a great article on that. One passage is particularly worth repeating:
“The vehicle is the LLM, you are the passenger. And I think the amount of agency people have over their journey is greatly reduced from what they feel like it is.”
This is about coding but if you look closely you will notice the same dynamics applying to vulnerability research. It’s all about speed, and understanding/validating LLM-generated results is inherently slow. So the human in the loop will always tend to give up more and more control, relying more and more on the LLM to just do the right thing. And we get the same deskilling that we see everywhere else, all while LLMs keep regurgitating old stuff.
Either way, I’m not interested in arguing about this. I won’t convince LLM fans just as they won’t convince me. We’ll see soon enough how this goes.
I have an extreme urge to reimplement Gtk’s ColumnView instead of dealing with the original. Not because of bugs but because of policy decisions. The former can get fixed, the latter won’t be. Like: I’ve never had to deal with a list widget where it was a policy decision not to expose the currently focused row. Some dev: “I need to know the currently focused row to display a context menu.” Gtk devs: “That’s not how you do it, register your context menu for individual cells, then you won’t need to know.” Well, I still need to know the currently focused row, e.g. to restore list state. Or to check whether changing focused row succeeded because there are many conditions where it will fail silently. Not possible, just assume that selection and focus are identical (spoiler: way too often they are not).
Similarly, invalidating a row is a trivial task in pretty much any framework I had to work with except Gtk. Some dev: “My data changed, how do I invalidate a row?” Gtk devs: “You don’t. Make sure that your list item properties are bound to the respective cell properties, then updates will happen automatically. Never mind that there are zero examples showing how to clean up the bindings in case the cell is reused later, surely you will get that implemented correctly.” I have a suspicion that cells are only supposed to be reused per documentation but this doesn’t actually happen in practice because otherwise lots of applications would turn out buggy in very subtle and annoying ways. Either way, in some cases I have complex enough data that managing updates via bindings would be a horrible mess. So I invalidate columns by re-registering their factory, and now I need to find another hack that allows invalidating single rows.
Last time I criticized Gtk I was asked what I was hoping to achieve. Well, nothing at all. I’m just venting. Because Gtk is an extremely frustrating framework to work with, and this is merely a tiny portion of its unfixable issues.
And I thought that the “expert” hired by a certain German publishing house was bad, putting his considerable academic reputation on the line with some complete bullshit arguments (as in: contradicting CS Theory 101 course to support his employer’s line of argumentation). That was a while ago, so I guess that he used students to play the role of cheap text generators. Nowadays that is no longer necessary of course.
Replying to
It gets even “better.” Tesseract dev shut down the project and removed the repositories. They are said to have posted a farewell message which contained JavaScript code that was sending 2000 requests to the Lemmy instance of the user who uncovered their secret blocking list (that message is no longer online). Not really enough for a DDoS attack but probably an attempt to drive up traffic costs.
https://lemmy.dbzer0.com/post/72962926
LLMs are quickly eroding the concept of truth.
I’m sure that more known people have had to refute claims about them for a while but now it happened to me as well. A researcher from a respectable university contacted me asking for an interview regarding “my position” on a particular topic. The issue: the cited position is the exact opposite of what I’ve always said, and I’m pretty sure that there are zero online sources confirming it to be mine. But whichever LLM they’ve consulted constructed a bullshit controversy where there never was one.
I can refute it this one time of course, and I assume that no such claims will make it into their final publication. But the tendency to rely on LLM-generated “information” is there, even in academia. And once they publish unverified bullshit it becomes “the truth” that LLMs will prioritize in their training and other people will refer to as proof that LLM claims are correct. This is going to be really bad.
One really has to wonder how some decisions were made. So somebody at #BMW thought: “You know, those suckers who paid $50,000 or more for our cars? We should really milk them some more. They probably get bored waiting for their car to start up anyway, let’s show them some ads! We’ll call it a special surprise for the drivers, no way they’ll object then.” Yes, totally reasonable.
Way to destroy a brand’s reputation…
Has been a while since I updated my collection of Chrome extension manifests. Just uploaded another snapshot: https://codeberg.org/palant/chrome-extension-manifests-dataset
Since my last snapshot (January 2025) there has been an outright explosion of extension numbers. With 250k it’s now almost twice as many extension manifests despite no changes on my end. The Chrome Web Store spammers have been very busy…
There have been reports about hundreds of “misleading” VPN extensions in CWS (as in: tricking you into installing, then likely spying on you). But that’s really only the tip of the iceberg, chances of randomly finding a non-malicious Chrome extension appear rather slim at the moment.
Reading this article and (remarkably) its comments is fun: https://arstechnica.com/ai/2026/08/the-new-instagram-logo-is-the-perfect-embodiment-of-ai-slop/
I mean, I do create an occasional icon containing text. I know some issues to watch for but I am by no means a designer, so I probably do a rather bad job. Reading how people perceive this hack job of a logo is remarkably helpful, I’ve learned a few new things to avoid. Also, it helps boost my self-esteem – my icons may not be great, but at least I’m not a multi-billion dollar company.
Replying to
@evacide@hachyderm.io I’ve learned about the concept of checks at school. Still, the only time I’ve actually seen one was when I was sent one from the US. The bank wanted 20€ just for processing it.
#OperaBrowser sending me spam to an address that I definitely didn’t give them, asking me to promote their ad blocking feature? Because … checks notes … I wrote an article about malicious ad blocking extensions that has the necessary keywords. “Since your site already covers tools and tips that help people have a better time online.” Not even mentioning my name because why would they bother finding it, I’m just some random blogger from the internet that their automated tools brought up.
That’s quite something. I wonder whether they realize that their product still enjoys some trust and respect which is probably undeserved since their owner change. And how such tactics affect this trust.
AI concerns, Linux
Replying to on social.woefdram.nl
@hans I thought cracking encryption involves typing on a keyboard really fast? 🤔
Replying to
@es0mhi@tilde.zone Here is your medal for suffering and wanting others to suffer in the same way. 🏅
It may come as a surprise but ignoring your own and other people’s boundaries is neither necessary to stay informed nor is it helping to change the current situation. These boundaries exist for a reason, respecting them and giving yourself a break from time to time is generally a good strategy to have the energy to actually do something.
Replying to
@orbman@infosec.exchange No, not people with different opinions. People who get all entitled when somebody asks for trivial accommodations – such as content warnings.
Replying to
@es0mhi@tilde.zone I assure you, people who need a break from politics know very well what is going on. And you can still write about politics even when using CW.
Even with debug symbols and everything, trying to match compiled Rust code with release optimizations to source code isn’t a healthy activity…
“How do we parse that data? Let’s mess with it a little so it becomes code and then we can run it.”
Hasn’t been a good idea back when people used this approach to “parse” JSON, still isn’t a good idea now…
Replying to
@freddy@social.security.plumbing Ja, ich habe auch schon alles gesehen (https://github.com/elk-zone/elk/issues/1877#issuecomment-2440130547 😬). Es gab ja mal diesen Standardisierungsversuch, aber jemand (John Gruber) meinte, dass es der Idee zuwiderlaufe und deswegen unnötig sei. Nun ist wieder ein Jahrzehnt vergangen, und das Chaos ist definitiv nicht besser geworden.
Replying to
@freddy@social.security.plumbing Strange that “high pain tolerance” isn’t listed as a requirement. 🤔
Replying to
@es0mhi@tilde.zone That’s a very unhealthy and an extremely American attitude. Are you interested in book suggestions?
Replying to
@hhg@infosec.exchange Yes, I was thinking about Tuxedo already, seems to be a good option. Didn’t know Slimbook, looks like a viable alternative, thanks!
Replying to
@freddy@social.security.plumbing Well, there is a tiny problem with going into hiding and throwing Molotov cocktails at data centers: unlike John Connor I have kids. 😅
Replying to
Replying to
@Bro666@social.tchncs.de I think you’ve made up your mind on this topic already. Why are you asking then?
(Yes, I’ve seen your previous post on the topic where you are massively misrepresenting the issue. No, I’m not going to discuss with you.)
Replying to
@iris_meredith@mastodon.social At the moment I’m just happy to have switched to GNOME recently (for unrelated reasons), so I can enjoy all this from the spectator’s seat. Of course, it’s probably only a matter of time until the GNOME project will have to make the same decisions – and who knows how they will decide.
(And with “they” I mean “us” – technically speaking I’m now part of the GNOME project. If it takes a wrong turn, migrating my project from their infrastructure, rebranding etc., this will get very ugly.)
Replying to
@freddy@social.security.plumbing Ein vernünftiger Markdown-Konverter wäre besser. Sternchen mitten im Wort hat in Markdown eigentlich keine Bedeutung.
Don’t get your hopes up that Ford rehiring some engineers is a sign of the industry recognizing just how detrimental the whole “AI” thing is. https://www.independent.co.uk/tech/ford-ai-automation-humans-hiring-artificial-intelligence-b3004733.html
It’s telling that Ford is only re-hiring “greybeards,” their most experienced engineers. A junior has no chance of getting their job back, nor will they ever get a chance to become one of those experienced engineers. Ford isn’t interested in building a sustainable system where people can accumulate experience and grow, they want the humans to help improve their cost-saving automation – and then the humans will be let go again. The strategy is still to replace human car designers by computers, this strategy merely suffered a minor setback.
Replying to
@freddy@social.security.plumbing Unfortunately, things are looking increasingly grim to do anything about this within the legal boundaries.
Replying to
@quinn@dresden.network That’s an interesting one even though its specs aren’t quite what I am looking for.
@cR0w@infosec.exchange Could you please add the image text to the alt text? E.g.:
A toy steering wheel mounted on the dash of the passenger side of a car. Above it the text: “When slopoholics think they’re in control of their machine of lies”
Replying to on gnusocial.jp
@simsa03@gnusocial.jp Other people’s mental health is not up to you to decide. That’s an even worse take than your first post, you are blocked.
Replying to
@sackofbones@kolektiva.social I wasn’t suggesting to embrace just any fork – only those created because the main project “tolerates” fascists. And definitely not the ones created by people ousted from the main project because… well, reasons.
RE: https://infosec.exchange/@WPalant/115633275489771501
It seems that I should start looking for a replacement for this laptop after all. Any recommendations, any other company with good hardware that can be repaired?