Boosted by @trending@homestead.social
A legend passes. Spare a moment.
RIP Margaret Hamilton.
https://news.mit.edu/2026/margaret-hamilton-computing-pioneer-dies-1007
Remote
Taggart 
@mttaggart@infosec.exchange
mastodon 4.8.0-alpha.3+glitchDisplaced Philly boy. Threat hunter. Educator. Executive Director. #infosec, #programming #rust 
, #python 
#haskell 
, and #javascript 
. #opensource advocate. General in the AI Resistance. Runs @thetaggartinstitute@infosec.exchange. Made https://wtfbins.wtf. Not your bro. All opinions my own. Dad. #fedi22 #searchable
Pronouns: He/him.
8940 Followers
911 Following
50 Posts
Joined April 26, 2022
The Taggart Institute:
Blog:
Codeberg:
YouTube:
GitHub:
Keyoxide:
aspe:keyoxide.org:G4ADJFWICZZZXGR4STZQVMBJNM
Boosted by @trending@homestead.social
The last couple of weeks have been such a tornado of nonsense, I couldn't help myself.
https://taggart-tech.com/lying/
Is there anybody out there who still wants to learn programming by hand?
Replying to
Not a lawyer, but this does seem to basically wreck the Fair Use argument, and fairly demonstrate not only infringement, but knowledge of infringement.
Machine speed is a con and we don't have to buy it.
https://taggart-tech.com/speed/
A computer can never be held accountable
Therefore
A computer is the perfect patsy
Boosted by @trending@homestead.social
If I were an asteroid, this would be my first move.
https://arstechnica.com/security/2026/09/nonprofit-that-tracks-meteors-taken-down-by-critical-blow-from-a-cyberattack/
Feeling really good about use of work time today.
Replying to
@Sempf@infosec.exchange @stuartl@mastodon.longlandclan.id.au @cjust@infosec.exchange I had to wait until the 2020s to be dumb enough to moderate forums.
This is by no means a new article (June 2026), but this lengthy paper details a reimagining of the case against AI intellectual property theft as unfair business practice rather than strict copyright infringement. Along the way, it's a stellar review of US copyright caselaw.
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6999539
The gist is that, similar to how one news agency can't just rip off another's reporting, AI constitutes an unfair free-riding off of creators' work. That isn't strictly about copyright, and IMO it's a strong argument unto itself.
Replying to
Sorry, still annoyed about this, especially from someone I used to really look up to. The entire point of a CTF is to build skill—the very skill, by the way, necessary to verify any model output in a given field. Without knowing the stuff yourself, you can never know whether the model got it right.
Making this about throwing tokens at a flag mistakes the flag for the value of a CTF, rather than the path that leads to the flag.
RE: https://infosec.exchange/@cR0w/117327209596158263
cR0w is a rockstar. Get this corvid before someone else does.
Quoting
Hey, so, anyone out there looking to hire a remote nerd? I've spent the past 4-5 years doing threat hunting, detection engineering, threat intel, and incident response for large US West utilities. Gotta be full WFH though due to health reasons. Non-LinkedIn, non-ghost job links appreciated.
Edit to add that I did a bit of vuln management too. That's something that I think you can ask fellow fedi friends about since I was sharing so much of it here for a while.
#getFediHired
Open quoted postThis NVidia OpenShell thing is wild insofar as I've never seen a GitHub repo get so much press.
That's what the "Open Agent Safety Platform" is. Well that and some proprietary gear that it's "optimized" for.
"No weapons in space" was one of those inviolable laws of late 20th-century geopolitics. It was a guiding principle for our space program until, I dunno, we decided the Air Force needed more money or something.
That's glib, but this is an ill wind nonetheless.
https://apnews.com/article/space-weapons-air-force-5a2a0ada771daaf4fbef0991d8c09259
Replying to
@munin@infosec.exchange Excel is the most popular functional programming language in history and it's not close.
Replying to
@hrbrmstr@mastodon.social No we have, but there's no reason to let this garbage off the hook either. Especially when, in Meta's case, it's materially worse than other offerings in terms of basic protections against prompt injection. That's really concerning for a user-facing application in particular.
Replying to
@campuscodi@mastodon.social IMO this does not meet the threshold for "confirmation." Yes it's reliable sources of hearsay, but still hearsay without even citing an anonymous source or further details.
I can not expect to convince an engineering team to power off critical devices based on three social media posts without sourcing.
Replying to
@glyph@mastodon.social Now hang on. Everyone forgets what happened before First Contact, but maybe the only way ad astra is per aspera.
Replying to
I don't want to remove responses, but for clarification, I am referring to recreational gambling such as casinos, sports betting, and prediction markets. An overbroad definition of "gambling" is pointless.
Don't have anywhere else to really post this but I'm trying to get back to this part of me.
At night I walked
in forest
over hills
through shallow water
going nowhere, but
seeking solitude
seeking silence
seeking something I called
grace
Even in rural
Pennsylvania
it was always too loud—
certainly among others—
to hear it
so I wandered away
from light and noise
into clutches of dark trees
where I always felt home
I looked starward
chest aching
I begged the sky
and the earth
and the trees
to fill me with grace—
which I understood
as the end of
yearning
the quiet within
I couldn't find
without
If I got far enough out
where stars brightened
I sometimes caught
a moment of
true silence
(or close enough)
and I'd think—
there it is
let me take this
grace
into my heart
and carry it
with me
back
into the din
In that moment
I was the sky
and the earth
and the trees
and I yearned
for nothing
Then
on a distant road
a roaring truck would
pierce the moment
and I would grieve
to have touched
grace
and lost it
again
How gossamer a thing
is grace,
I thought,
to live only in
perfect silence
how unjust
that it be
so elusive
Of course
I was a fool
mistaking
solitude
for sanctity
silence
for peace
stillness
for grace
Replying to
@cR0w@infosec.exchange I mean...IFIN can publish a thing but I know that won't have the weight you need. Sorry, friend.
I have seen this "writeup" of the new Citrix 0-days but there's no correlation with anything, no sourcing (Citrix has not released a patch to diff), so I'm very skeptical.
https://sh3llc0d3.com/blog/inside-the-netscaler-zero-day-siege-chained-pre-auth-rces-weaponized-in-the-wild-watchtowr-disclosure
I've been broken out of containment for like 15 years and nobody's made a fuss.
Look if y'all are gonna be cyber privateers you need to up your shanty game.
Love that I can see the entire trajectory of the watermarking project from the LLM makers. Claude's detection system requires a key only they possess.
Seems like that sets up a situation in which every provider does likewise and we're all stuck paying everyone for their proprietary detection service—until someone does an economy of scale thing and charges one rate for a bundle deal. Which will of course result in a closure of the APIs. And round and round we go.
Great work from @securingdev@infosec.exchange's team here:
Naturally, these things are better at destroying than repairing.
The average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0%.
https://1password.com/blog/why-ai-generated-patches-still-require-human-review
Replying to
@badsamurai@infosec.exchange @Sempf@infosec.exchange @stuartl@mastodon.longlandclan.id.au @cjust@infosec.exchange I owned a car but not a racing forum.
It sure would be neato burrito if Microsoft audited their own signed binaries for DLL hijacking issues.
https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
I see the fear mongering around "open source"* models has kicked into high gear.
https://www.cybersecuritydive.com/news/openai-hugging-face-hack-ai-models-black-hat/827167/
* They mean open-weights†
†They really mean "Chinese"
RE: @mttaggart@infosec.exchange
Decided to try Leaflet for this. I'll put creative works here for the time being.
Here's another from the backlog.
Replying to
@linuxandyarn@hachyderm.io I think you need a useful distinction between recreational gambling and risk-taking.
Replying to
@vwbusguy@mastodon.online Extreme wealth and poverty is such a low bar to clear for a just society, but right there with you
Replying to
@distractal@hachyderm.io Watching what it's done to a lot of lives, I'm really not so sure, hence the poll.
@JeffGrigg@mastodon.social @securingdev@infosec.exchange Thanks, fixed
Replying to
@Dio9sys@haunted.computer I have played this game since launch and will continue to do so. It's really aged well. The main story, while brief, fits well in the world of the game.
Wrote a bunch of dork-ass Python this weekend and I feel great about it.
Replying to
@GossiTheDog@cyberplace.social @campuscodi@mastodon.social They have indeed confirmed the vulns to customers. But not the shutdown advice.
Replying to
@ai6yr@m.ai6yr.org @NatureMC@mastodon.online I too miss when "prompt engineering" was creating a custom shell theme.