Binary Large Octopus

64 Followers
136 Following
155 Posts
#infosec professional with academic #network and #security background.
General interest in #science topics. #opensource enthusiast,
#gentoo and #voidlinux. Enjoys #whisky and strange #movies.
Admirer of #octopuses and #bees.

RE: https://infosec.exchange/@mttaggart/116235185090539701

This is what everyone should read before considering to follow AI suggestions for any critical task.

I just happened to witness some alleged experts ripping a virtualization cluster apart by piping half-understood commands from ChatGPT directly to the CLI. That was some horrible experience.

IRCv3 is shaping to be amazingly good!

here's the things it offers, today, right now, on a chat server we just set up in one evening:

  • you don't need a bouncer (friggin finally)
  • there are moblie clients that work well
  • you can see backlog when joining a channel
  • you can browse chat history
  • you can connect from multiple devices with one account and nickname
  • if you disconnect, your nickname is still present in a channel you joined, marked as away
  • you can highlight or DM people who are away and they'll see your message when they join (without crutches like MemoServ)
  • there is a "last read message" marker and it is synchronized between multiple connections
  • messages have identifiers (and server timestamps) and replies can be tagged with the message you're replying to
  • messages can be redacted (for moderation)
  • you don't need to deal with fussy nonsense like NickServ authorization, ghosting, or such; connect with your username and password and that's it
  • there are typing notifiers, if you want them
  • there are message reactions, if you want them

here's the things it does not offer:

caveat: since IRCv3 is a true extension of IRCv2, the features listed above work if they're supported by both the server and the client. in my onboarding experience so far, people do not find it difficult to find a suitable client, but your mileage may vary. on the flipside, legacy clients will work just fine.

unexpectly, i realized that IRCv3 can completely replace Matrix rooms for my own group chat purposes, and i'm probably not going to set up any Matrix homeservers again; it's just not worth it and frankly I should instead put that effort into coming up with a file upload IRCv3 extension or something

Add filehost by emersion · Pull Request #562 · ircv3/ircv3-specifications

This is shipped by soju + gamja + goguma + senpai as a vendored spec, and is based on an earlier draft by @progval.

GitHub

The war waged by the tech authoritarian oligarchy against the media has reached a new level:

#Palantir is suing us. Us, the Republik Magazin.

A small Swiss media company, funded by readers, founded in 2018 and free of advertising. I am not aware of any other media company globally that Palantir is currently targeting so aggressively.

What is this about? Together with my wonderful colleagues at the WAV research collective Jenny Steiner, Lorenz Naegeli, Marguerite Meyer, and Balz Oertli, we published a two-part series on Palantir's activities in Switzerland on December 8 and 9.

Using an extensive corpus of documents – which we obtained thanks to the Freedom of Information Act – we were able to trace a sales campaign over a period of seven years. Palantir tried to get in with many federal authorities – and was rejected everywhere.

And we also found out that the Swiss Army Staff evaluated the products and came to the conclusion that the army should refrain from using Palantir products.

Among other risks, they feared that data would be passed on to the US authorities.

Palantir is not just any company. ICE uses its products to hunt down migrants in the US. The Israeli army IDF uses the software in its Gaza offensive. The British health authority NHS has made itself dependent on the products for data analysis during the pandemic. And CEO #AlexKarp displays inhuman and aggressive rhetoric towards Europe, while the company itself advertises the “optimization of the kill chain.”

These are all facts, repeatedly verified and published by renowned media outlets. Our research relating to Switzerland and Zurich is based on this.

In addition to analyzing documents, we also spoke to various sources – including Palantir executives here in Zurich. The quotes used were presented to them and approved. Of course, we always adhered to the high standards of journalistic work. We conducted a thorough fact check before publication.

But the company doesn't want us to write the truth.

After the US company owned by right-wing tech billionaire #PeterThiel dedicated an absurd blog post to us, claiming some misinformation (such as that they had not participated in official tenders with the federal administration, a point we never claimed. On the contrary: we spoke from the outset of attempts to establish contact, sales talks, informal meetings, business as usual), after the Global Director of Privacy & Civil Liberties (PCL) Engineering and contact person for Swiss media Courtney Bowman launched personal attacks against us in LinkedIn comments between Christmas and New Year (“partisan fear-mongering”), Palantir's Swiss lawyers demanded a counterstatement on December 29.

We rejected this demand in its entirety.

In January, they demanded the same thing again. We rejected it again.

And now we see each other in court.

But why all this?

Our research on the Swiss army report caused a huge international media response. The Guardian and the Austrian newspaper Der Standard reported on the Swiss army's rejection. Numerous financial portals and stock market magazines picked up our news (which could have consequences for the overvalued stock market company Palantir).

And Chaos Computer Club spokesperson Constanze Kurz presented our research to a huge audience at the renowned IT conference Chaos Communication Congress in Hamburg at the end of December.

All of this is making Palantir nervous.

We have now submitted a comprehensive defense brief. We can substantiate all of our findings with several documents and publicly available media reports.

We trust in the rule of law and freedom of the press in this country.

In keeping with yesterday's event “Zurich, little Big Tech City” at the Gessneralle, where we first announced this news exclusively to the audience on site:

World politics will soon be negotiated in Zurich: freedom of the press, the facts about ICE, Trump, Israel, Karp, tech authoritarianism.

The truth.

All this at the Zurich Commercial Court.

We will not be intimidated. And we will keep you informed.

@soatok

I have an even simpler reason for why E2EE should simply be mandatory table stakes:

Security is habits. If you consistently do things securely - you don't need to worry as much about mistakes causing an issue.

I've historically done audit work in AWS. When someone says "do we encrypt EBS?" - the answer is yes. Always. "But what if we don't need it?" - irrelevant. If you always encrypt, it turns a week of audit questions about why you didn't encrypt into "yes it's all encrypted".

If you use secure communications mechanisms with audited implementations and full end-to-end encryption - certain failure modes are greatly reduced or disappear entirely. Certain questions never need to be answered again. The impact of human mistakes on the part of the user are significantly reduced.

If doing the right thing is a habit, it makes it harder to do the wrong one.

I can't drive without a seatbelt. Feels weird. So "I forgot to put my seatbelt on" isn't a failure mode I need to think about. Habits. It's good to feel weird when you do the wrong thing.

@watchTowr Ivanti keeping its top spot, for now...

We observed a 65% drop in global telnet traffic in a single hour on Jan 14, settling into a sustained 59% reduction. 18 ASNs went silent, 5 countries disappeared, but cloud providers were unaffected.

Our analysis of 51.2M sessions points to backbone-level port 23 filtering by a North American Tier 1 transit provider.

🔗 https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/

#GreyNoise #ThreatIntel #CyberSecurity #InfoSec

2026-01-14: The Day the telnet Died – GreyNoise Labs

On January 14, 2026, global telnet traffic observed by GreyNoise sensors fell off a cliff. A 59% sustained reduction, eighteen ASNs going completely silent, five countries vanishing from our data entirely. Six days later, CVE-2026-24061 dropped. Coincidence is one explanation.

GreyNoise Labs

Earlier this week, the fourth most downloaded app in Denmark was "UdenUSA" (Danish for "Without USA") — an app for scanning your groceries to make sure they are from the US.

Is that what Trump means when he calls the US "the hottest country"? And was this what Tim Cook was hoping for when he began supporting The Mad King?

The app is currently ranked number 16 in the Utilities category.

Der fossile Lobbyist Trump lügt den Leuten vor, China würde selbst keine Windkraft nutzen sondern sie nur an dumme Europäer verkaufen.
Das fossile Propagandamedium Nius lobt die Lügen.
Viel mehr muss man über Nius nicht wissen, außer vielleicht wer das finanziert.

RE: https://mstdn.social/@jmason_links/115926895528138976

This leads to the proprietaryzation of email. I urge everyone to never use this API for the benefit of the open internet. Remember XMPP and google talk….