Reversing (malware and otherwise); appsec and websec; embedded security; exploit dev; knows how not to use cryptography.
Currently finding bugs in Windows bootloaders.
You may also know me from capcom.sys.
| github | https://github.com/Wack0 |

Reversing (malware and otherwise); appsec and websec; embedded security; exploit dev; knows how not to use cryptography.
Currently finding bugs in Windows bootloaders.
You may also know me from capcom.sys.
| github | https://github.com/Wack0 |
Can't believe this news escaped me...
Google has an "official" account on the Fediverse.
I say "official" because there's no green check.
Their last update was two days ago.
FYI, I've seen a few Google engineers on the Fediverse. I even got into a disagreement with one Google engineer about self-hosting -- he didn't like it one bit! https://9to5google.com/2022/11/21/google-social-account-mastodon/
so back in the day, we cursed a guy's desk at twitter. the dude was braying, incorrect, and shittily condescending about it.
he ended up emailing the whole company with a shitty, braying, incorrect and condescending screed, expecting his privilege to buffer him, didn't take any of the polite outs people were offering, doubled down, and got publicly humiliated by being fired and walked out of the building by HR
and we just look at what's happening with Elon and realize: "Fuck. we forgot an ending condition on that curse."
we're at another point in the history of the fediverse where things are hard and complicated. the explosive growth that's resulted from the upheaval at twitter has brought new issues to the forefront while we're still trying to come to terms with the old, unresolved issues.
I'm talking with the "we" word again, and that's going to make writing this harder this time, rather than easier.
for a long while, some folk have spoken about the "fediverse community" or the "fediverse culture" and while it glossed over some of the finer points it was a useful framing for discussing issues that cut across the concerns of individual people in the fediverse or individual instances in the fediverse.
but we (see? hard) have known that we were intentionally limiting the scope of that conversation in order to not have to call out every exception, complication, and contradiction involved in what we were trying to say.
it got us here.
but now, as the population of this former void grows to millions of people instead of thousands, I'm pretty sure the concept of a singular "fediverse" is no longer helpful to the conversations that need to be had.
it was never truly a single fediverse. it's always been a messy venn diagram of fediverses.
the fact is that this virtual space is occupied by innumerable individual people who self-connect as part of one or more of the innumerable individual communities that make this exist.
uncomfortably, the needs and wants of these people and communities are often in opposition.
people who have the need to feel safe and protected by agents of oppressive governmental and/or institutional organizations are not going to be placated by statements about those orgs' representatives being "some of the good ones". that does nothing to address a history of violent confrontation and criminalization of those people's very existence.
there's not middle ground to be had there, folks - you cannot compromise away an existential threat, even if you think that threat is being blown out of proportion.
choices will need to be made. sometimes uncomfortable choices. and sometimes the choices one person or community group makes will seem extreme, an outsized reaction to the input provided. those same choices will be seen by some others as a strong and clear message about what is or is not acceptable to that person/community.
and ultimately it's all about trust. trust that one will be safe.
please listen to people when they have concerns about being able to trust. rarely is trust removed without there being a long history of events that eroded or destroyed the trust that may have previously held sway. it's almost impossible to rebuild trust in meaningful ways across large numbers of people once it has been violated, and the more violent the violation the less likely it is that the trust can be repaired.
at the same time, I would ask that each of us take the time to remember that communities are made up of individual whole people, each of whom brings their very own complexities to any situation. we are all at different places in our lives. some people have not learned the lessons you may have. some people have learned entirely different lessons that seem contradictory to your learnings.
we're complicated.
take the actions you need to take to keep you and your communities safe and well. maybe also consider that communities who make choices other than yours are doing likewise and have different needs in terms of safety. the human condition is a spectrum of spectrums and it defies easy reduction into simpler terms.
maybe we all need to get more comfortable with being uncomfortable sometimes.
I don't have a lot else to say on the topic du jour. my personal feelings about the issue and any action I feel I need to take is my responsibility. I hope each of you and your communities find a stance that you feel good about in relation to your needs.
@da_667 it's a kind of weird both worlds situation.
And like, there are -very- valid reasons for folks to not want direct interaction with fed type folks; those interactions are -not safe- for them. So if there's going to be a demi-official presence in a given instance, yeah, it makes sense for those individuals to address their need for safety.
And the threat level here vs. twitter[prior management] is very different - trivially, it's far easier for the feds to co-opt any given masto instance owner than it was for them to co-opt and gain specific special access in the old place. That should be a fairly obvious and non-controversial part of most people's threat model - at which point "how does the possibility of federal co-option of an instance affect my personal model" becomes the next question.
If you're cishetnormative, white, and reasonably connected, then ofc there won't be much of a difference for you.
If you're -not that- then the threat environment changes significantly - even drastically.
And like, I used to work in fedland too - that's never been a secret. But since then I've learned that a lot of folks have -vastly- different threat models than I do, and my own has ...changed significantly.
I have to maintain a presence here because -this is where infosec is-, so it's kind of mandatory for me. But I personally would feel much more at ease if there weren't -direct- cooperation between fed agencies and the server here.
I do realize that - especially given how this chaos is shaking out right around the holidays when getting anything done in fedland is "lolnope" - there's a need for that agency to have these communications and they do not have the immediate authorization nor resources to stand up their own instance right away.
I'd -like- some assurance that this is a temporary situation and that we're not going to have to have their immediate presence permanently.
But I've also taken the time to diversify my presence in this proto so that those who -aren't- comfortable talking on a fed-aligned instance can still talk to me. It is extra work, yes. But there's a lot of folks who I talk to for whom federal interaction is counterindicated, if not explicitly dangerous.
This shit's hard! but we knew that when we signed up.
ugh, Official USA Gov't Accounts? on this mastodon server? it appears more likely than you'd think
and the trouble is, not sure if i can even move, most of infosec people are here and a lot of them probably won't be moving...
i guess I could make an alt but.. ugh.
I think I'll wait it out for a while and see what happens. If people start moving elsewhere due to blocks I'll definitely think about it. I adore weird fedi and don't really want to be cut off from them.
tbf I've been thinking of moving ever since I realised that this server was the largest glitchsoc server...
...I really don't know what to do.