SCADA, or as I like to call it, "involuntary retrocomputing"
Remote
Royce Williams
@tychotithonus@infosec.exchange
mastodon 4.8.0-alpha.3+glitchJust doing my undue diligence.
ISP vet (was AS7782, now AS8047), password cracker (Team Hashcat), security demi-boffin, YubiKey stan, public-interest technologist, AK license plate geek. Husband to a philosopher, father to a llama fanatic. Views his.
Day job: Enterprise Security Architect for an Alaskan ISP.
Obsessed with security keys:
techsolvency.com/mfa/security-keys
My 2017 #BSidesLV talk "Password Cracking 201: Beyond the Basics":
youtube.com/watch?v=-uiMQGICeQY&t=20260s
Followed = probably stole you from someone I respect.
Blocked inadvertently? Ask!
Am I following a dirtbag? Tell me!
Suggestions welcome!
Photo: White 50-ish man w/big forehead, short beard, & glasses, grinning by a display of Alaskan license plates.
Boosts not about security ... usually are.
Banner: 5 rows of security keys in a wall case.
#hashcat #Alaska #YubiKeys #LicensePlates
P.S. I hate advance-fee scammers w/heat of 400B suns
❤️:⚛👨👩👧🛡🙊🌻🗽💻✏🎥🍦🌶🍫!
3632 Followers
3891 Following
50 Posts
Joined April 26, 2022
Keybase:
GitHub:
Gravatar:
Boosted by @GroupNebula563@mastodon.social
Having this printed out on the wall behind where I normally join calls, and being able to point to it when its bingo square comes up in discussion, continues to pay dividends, @mcc@mastodon.social
Edit: original post (credit where due!):
https://mastodon.social/@mcc/115079977230405147
The "viral AI actress" is only "viral" because they paid someone to write a piece to call them "viral", and are manufacturing controversial features. It's still bullshit, just like the last time they tried to shop it. Don't give it oxygen.
The mocktail page of this menu is headed "Absence of Proof".
So the Transcend flash-IDE drives (to replace spinning rust in legacy computers) ... pretend they support SMART, but all the values are zero, so you can't tell actual power-on hours, etc.?
That's such a good deal I should probably just pick up all four.
Replying to
Also it's kinda wild that Shrubbery:
only provides an ftp:// URI to link to their downloadsdoesn't automate creating their SHA256doesn't provide links to download old versions of the software -- but here's a Wayback to .28:
https://web.archive.org/web/20250302064901/https://shrubbery.net/pub/tac_plus/tacacs-F4.0.4.28.tar.gz
RE: @yaelwrites@mastodon.social
New security goals unlocked. "So secure people think it's fake" 💡
RE: @campuscodi@mastodon.social
Ah, I get it now. They are doing the same thing to CISA that they did to 18F and login.gov - kill off perfectly functional (in fact, superior, non-partisan, cost-effective) public tech infrastructure so it can be privatized by attrition. The classic "starve it, then declare it ineffective" tactic. 😠
Replying to
Just imagine the cognitive dissonance and/or agony of the person who had to write this copy.
Replying to
@ryan@hates.company And the anticlimactic sequel "i know you're dead"
Replying to
@datum@zeroes.ca
I was literally in the process of attaching exactly that one! Excellent call, heh
@ZachWeinersmith@mastodon.social
Bring back the Password Village at DEF CON!
They help so many practitioners a year bootstrap from having zero cracking clue to actually getting it. That team works their butts off the whole con, often with minimal or zero external sponsorship, paying for a lot of stuff totally out of pocket, year after year, just to grow the practice and see the light bulb go off over somebody's head (when they realize that it's not just all about rainbow tables and how many GPUs you have).
And the effort they spend crafting the CMIYC cracking CTF ... It is difficult to explain to outsiders how deeply they understand their craft. It is a love letter to the breadth and depth of password cracking.
If there is any team that embodies what a practitioner's conference is supposed to be about, it is @CrackMeIfYouCan@infosec.exchange.
Bring back the Password Village!
Replying to
Posited corollary 2: Sinclair's "It is difficult to get a man to understand something when his salary depends on his not understanding it" ... is an existential security threat that will now more rapidly metastasize if left unchecked.
3/3
Replying to
Put another way:
Dan Geer's definition of security ("the absence of unmitigatable surprise") is facing a progression of machines that increasingly unearth all possible surprises. A threat ... and an opportunity.
Replying to
Posited corollary: @wendynather@infosec.exchange's "security poverty line" has always had a companion threshold: a "security realism poverty line", the divide between organizations that have the political will to mercilessly and constantly reduce the gap between what they think is true (or want to be true, or have budgeted to be true) and what is actually true ... and those that don't, whether due to budget or competence or competing incentives.
And the AI-accelerated death of security through all-cause obscurity (described above) is magnifying the gap on either side of that line.
Sinclair's "It is difficult to get a man to understand something when his salary depends on his not understanding it" ... is an existential security threat that will now more rapidly metastasize if left unchecked.
Replying to
"It wasn't on purpose, that was my lead generation platform."
"Feel free to convey to your food chain that that's what lost you the sale."
No shade or anything, but I do not understand the urge to wear an Emirates shirt. It just looks like you like an airline.
That's a new one. (Voicemail transcription)
Replying to
I first read this book 20 years ago, and that story still literally chokes me up a little. It's what gets me up in the morning.
Replying to
@danluu@mastodon.social Fascinating! Have you seen the work that Jordan Hubbard (FreeBSD / Apple / NVIDIA) is doing on nanolang, to tackle efficient token use in a programming language?
https://github.com/jordanhubbard/nanolang
Replying to
@bapt@mastodon.social @trashheap@tech.lgbt
Really appreciate the effort, it's clear the teams put a lot of thought into it.
Replying to
@vermaden@mastodon.bsd.cafe So many of these details appear to be requiring people to construct them for themselves, which is not the standard I have come to expect from the project, so I'm not sure what has changed.
All part of this Turing-complete breakfast!
Hey, cracking folk ... did you know that Hashtopolis 1.0.0 was just released?
https://github.com/hashtopolis/server/releases/tag/v1.0.0
Total redesign, SPA based on TailwindCSS, Postgres support, Docker driven, full REST API, OAUTH2, improved supertasks, full UTF-8 support.
Did a fresh install, working great so far!
Thanks to @s3inlc@infosec.exchange and team!
Replying to
@ANC_Historian@alaskan.social (And that year in the description jibes with the plate, that's a 1962 plate with 1964 sticker (yellow, bottom left) and 1963 tab (blue, bottom right)
Replying to
@catc0n@infosec.exchange Oooh, fair point - would be good to see the lifecycle / dwell axis alongside the data over time. Hmm!
Replying to
@wdormann@infosec.exchange I mean, naively, could these just be the ones that were shared somewhere else, like on Reddit or on forums or something?
Replying to
@corq@infosec.exchange If I recall correctly, he played this when he was a guest star on WKRP!
Replying to
@buherator@infosec.place Wow that's really thorough, this will be useful! Though I was expecting there to be some for operating systems as well, though that seems like a different kind of problem in some ways.
The purpose of Stauer, Danbury Mint, Bradford Exchange, Lillian Vernon, the various "coin exchanges" / "mints", etc is to extract 90% markup from people who can't shop in person anymore and/or have no sense of actual market value.
And newspapers, magazines, and TV stations that run their ads are complicit in the victimization of a vulnerable population.
Replying to
@krypt3ia@infosec.exchange 🍞 🍚 🔫 🧻
Replying to
@ANC_Historian@alaskan.social Anything that looks potentially unusual is absolutely in scope, this is a fantastic find!
Replying to
@dpp@mastodon.social I see what you did there
It's gonna be ... hard to get one of this year's DEF CON badges for the security-key collection.
Replying to
@sarahjamielewis@mastodon.social
Hey, cool! Note that we couldn't reverse anything here - had to use classic cracking, trying lots of host/domain combos until we got exact hits. Kudos to @s3inlc@infosec.exchange for getting some really hard ones at the end!
All of the major third parties you rely on ... are constantly trying to reduce their dependency on third parties.
Some dependencies are inevitable. Which of your third parties can prove they are actively reducing entire classes of the risk they expose you to?
Between Hoyt Axton's "Della and the Dealer" and Conway Twitty's "Saturday Night Special", I seem to have an affinity for stories where good folk have to get tough with the bad folk in defense of a cutie ... and then high-tail it for the hinterlands with said cutie.
Replying to
@gnomon@mastodon.social No lies detected!
Replying to
@fugueish@wandering.shop I had seen people linking to it but didn't know what it was a review of. I literally just got home from seeing it, and ... she's not wrong. Hm.
Replying to
@neurovagrant@masto.deoan.org Huh. Naively, feels like a proactive legal play, like it makes certain kinds of charges or lawsuits possible later?
Replying to
@ANC_Historian@alaskan.social Actually if it was 1965, their sticker is expired. 😉 Or else it's really 1964 ...
Replying to on mastodon.social
@lzg@mastodon.social
/me nods in Alaskan
Replying to
@tithonium@clacks.link But hey, it's directly supported by NetBSD!
Just got my first "YouTube detected this screenshot" Android notification. 😱