#Deepfakes are everywhere, but #DigitalForensics investigators are fighting back:

🌍 https://scim.ag/42dMPBg

Have you seen this news?

#Mastodon just got funding to add end to end encryption into their software.

So, some time next year, you’ll be able to send truly private messages to the vast majority of the #Fediverse

Im so excited about this.

Because it’s an open spec, this opens the doors for every Fediverse app to join the party.

Yesterday, this project was a proof of concept. Today, Mastodon has turned it into a stampede.

#E2EE

https://blog.joinmastodon.org/2026/04/sovereign-tech-agency-funding/

IT'S HAPPENING.

#BSidesLjubljana 0x7EA is LIVE.

Ljubljana, let's go. 🔥

#BSidesLjubljana #InfoSec #Cybersecurity

did you know that SSH has a little-known secret menu?

i wrote a post about this on cohost a while back, but since that site shut down i'm posting it here too

Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access.

https://securinglaravel.com/security-tip-your-jwt-might-be-a-forever-key/ #Laravel

Cybersecurity blog posts, writeups, papers, and tools

https://github.com/0xor0ne/awesome-list

#infosec

Today's sysadmin discovery:

So, for all that I like Debian, one big sticking point I've had with it is that when you install a package which contains a system service, even if it was pulled in as a dependency of something else, that service gets auto-enabled, with a default configuration.

That has always felt like bad security practice to me, as it means any update can suddenly expose new services to the outside world without warning. It's also subtly broken my setup on at least two different occasions.

Fortunately, there is a way to change the default policy, so that new services only get enabled when you tell them to be:

https://manpages.debian.org/trixie/systemd/systemd.preset.5.en.html (example 1)

Definitely going to put that in my ansible configs!