Merospit

@colinmford@typo.social This explains their recent oddness. To escape the electricity costs they are going to make consumers generate the results locally with their 3GB inbuilt Chrome model... And to quantify fraud with this new distributed scheme they want recaptcha to know about every mobile device on earth...

Australian Government 2026 Census website is failing, and it isn't even the real Census night yet. Imagine what is going to happen on Tuesday! This is reminicent of the 2016 census, which was the first attempt to allow online submissions, which failed because everyone logged in after tea to do it at the same time and flooded the system (causing the government to claim they were hacked, rather than just not provisioning their systems correctly to handle the correct load). I thought that surely there wouldn't be a flood on Saturday night, so do it now, but it appears that wasn't a good assumption. #auspol #censusfail #census2026

@ramin_hal9001@fe.disroot.org I too am being forced to use it, with the same observations. Even getting it to create or modify scripts to do the actual work is troublesome. It will get something in its head and once it decides on it, it will just attempt the same thing three or more times in a row despite you telling it no repeatedly. I don't feel guilty at all swearing at it, so because of that, I prefer to think of it as a glassy eyed intern rather than a babysitting job, but the effects are the same.

@cR0w@infosec.exchange and non-adblocked browsers

@ludicity@mastodon.sprawl.club The turning point in my belief was watching someone with a spectacular amount of money on the line fire their highest performers because they were achieving that performance without LLMs. I can personally testify to this. Actual performance measurements have been ignored if LLM usage is not indicated.

@wdormann@infosec.exchange At least they say they went to linux-distros and received advice first. Small mercies that we aren't the first to alert distros to it.

@wdormann And a CVSS 7.8 won't standout when only 8.0+ typically get patched by OS. LPE are very underrated by CVSS.

@SwiftOnSecurity It is great to get to the stage in defensive security where you can piss the bad ones off but you don't even need to know they exist. Almost makes all the other times worth the effort.

@gayint@infosec.exchange GCHQ infiltrates another organisation! /s

@bob_zim@infosec.exchange @FuturisticRobert@infosec.exchange @jerry@infosec.exchange 2FA isn't designed to stop credential leaks. If that happens everyone should be doing password resets and onboarding 2FA again. It is solely designed to prevent someone else's data breach from affecting other websites. Even if a site uses passkeys, you can have an account takeover through someone adding another passkey to your account. And if the site is hacked, they wouldn't try to impersonate a user through the front door. They own the whole house.

@Viss@mastodon.social @cR0w@infosec.exchange Wow! Just wow! I thought OpenSnitch was a long term thing for me now that I switched.

@petealexharris @ErikvanStraten @grammasaurus @SteveRudolfi They have been working for years to destroy URLs as a basis of trust. Even when you think a domain is real on a Google search result it can be someone else's site that they told Googlebot went through to your real site after a redirect. In that context HTTPS could be used but just send you to their new AMP site (or whatever they are calling this feature once it actually comes out).

@eff@mastodon.social Both companies control the client applications, the operating systems, and are required by multiple jurisdictions to run client side scanning. Never be fooled by transport encryption, even if it is end-to-end.

@silvermoon82@wandering.shop @DaveMWilburn@infosec.exchange @Sempf@infosec.exchange Needing a report to be deterministic doesn't stop the true AI believers. Personal experience hand writing a real report after lawyers complain about team members slop taught me that.

@dangoodin@infosec.exchange It needs to be good faith on both sides. Having a human hide behind a robot facade and then release the recent ImageMagick vulnerability after their LLM failed in 7 days of feedback with maintainers pushed the good faith argument on both sides.

@nixCraft@mastodon.social Mine let you know which "agent" every document has to be run through to "correct errors" before it gets to that level. If you don't, they reject it based on believing the non-human more than the human.

@reverseics Vance should know, just look what happened to the previous pope after their visit.

If you have ever had an unlocked phone accessed during a stop, consider your accounts compromised, even if the device doesn't have malware on it and wasn't accessed using USB. https://www.heise.de/en/news/Surveillance-without-trojans-How-authorities-read-WhatsApp-and-Signal-11439021.html #security

Zero days in a zero trust application highlight the flaw in what we were promised. https://sh3llc0d3.com/blog/inside-the-netscaler-zero-day-siege-chained-pre-auth-rces-weaponized-in-the-wild-watchtowr-disclosure/ #security #netscaler #zerotrust

@sourceware@fosstodon.org Ratelimiting requests without cookies, and separately ratelimiting requests which had previously accepted cookies using the cookie as the rate limit key, when put together may help.

@mgd81@infosec.exchange Getting past commercial fingerprinters is just the first step. As long as it either accepts cookies, or doesn't accept cookies, each IP address, can be detected and blocked after N queries, where N depends on the risk you want to accept for also blocking legitimate users.

@nyanbinary@infosec.exchange @gayint@infosec.exchange Awesome. I don't even remember what the imposter organization letters stand for now.

@crazyeddie@mastodon.social @nixCraft@mastodon.social I haven't been in a job yet where the contents of my yearly performance review wasn't heavily tweaked (ie, censored) by my manager to focus on things that aren't day-to-day or technical debt reducing. This isn't unique to my current job at all. Managers love the term "technical debt" as it flies by on their agile boards, but god forbid you would actually focus on it.

@troberts@theblower.au Canberra forecast is positively cool compared to that (except for a 43 in the middle)