Jason Stangroome

170 Followers
391 Following
1.4K Posts

He/him. Principal Infrastructure Engineer. CISSP. Futurama and Factorio enthusiast. Privacy advocate.

Australia.

#infosec #cybersecurity

githubhttps://jstangroome.github.io/jstangroome/
justmytootshttps://justmytoots.com/@jstangroome@infosec.exchange
Joining the LackRack club.

Made my first attempt to convert a simple Golang CLI tool to a TUI tool today. Charm Bubble Tea seemed like the most appropriate TUI framework to use.

Quickly discovered I was going to need to explicitly manage a lot more of the UI state (e.g. which view is active, which control has focus) than I expected.

Working with web UIs (even framework-less) and WinForms (many, many years ago) has apparently spoiled me.

Bubbles components, Huh forms, and Lipgloss composition may reduce some of the explicit state management, but it's a non-trivial learning curve, exacerbated by my need to understand not just the "how" but which approach is most idiomatic.

Web application security has DVWA and WebGoat. VoIP and WebRTC security hasn't had anything like it ... until now.

We built DVRTC (Damn Vulnerable Real-Time Communications): a hands-on lab for learning VoIP/WebRTC attack techniques. Full dockerized stack with Kamailio, Asterisk, rtpengine, and coturn — each configured to exhibit specific vulnerable behaviors.

7 exercises covering SIP extension enumeration, RTP bleed, SIP digest leaks, credential cracking (online and offline), TURN relay abuse, and traffic analysis. There's a live instance at pbx1.dvrtc.net you can test against right now.

https://www.enablesecurity.com/blog/introducing-dvrtc-damn-vulnerable-real-time-communications/

GitHub: https://github.com/EnableSecurity/DVRTC/

#infosec #webrtc #voipsecurity #sipsecurity #penetrationtesting #training #TURN

Introducing DVRTC: a vulnerable lab for RTC security

DVRTC is a vulnerable VoIP and WebRTC lab for hands-on security training, with exercises covering SIP enumeration, RTP attacks, TURN abuse, and more.

Enable Security

Codeberg is different.

Codeberg is a non-profit.

Moreover, it is a *democratic* non-profit. You can (and, if you actively use Codeberg, should) become a member and you will have an equal vote and a fair say in the running of the association, and in any decisions we make about what to offer and what not to offer.

This democratic right is guaranteed to you not only by our constitution, but by German law, which guarantees that the membership as a whole has the ultimate decision-making power.

RE: https://mastodon.social/@bagder/116294927524710539

A rare and underappreciated approach to better software security:

"our commitment to never breaking ABI or API allows all users to easily upgrade to new releases. This enables users to run recent security-fixed versions instead of legacy insecure versions."

I suspect the ecosystem would be improved greatly by this behaviour alone if it was more common.

I know it's not that simple. Maintaining years of backwards compatibility can significantly increase surface area and complexity and become its own source of vulnerabilities.

Maybe a pattern I've seen in Terraform is the middle-ground: whenever breaking changes need to happen, include a tool to automatically migrate existing dependant code to use the new API.

We are now officially using @forgejo! The Fedora Forge is ready for contributors to start migrating to. Cutoff for switching from Pagure is by Flock to Fedora 2026.

New chapter :)

➡️ https://communityblog.fedoraproject.org/the-forge-is-our-new-home/

#Forgejo #Fedora #OpenSource #Linux

The forge is our new home. – Fedora Community Blog

While Pagure.io has been a vital part of our community for many years, the time has come to retire our homegrown forge and transition to this powerful new tool.

Fedora Community Blog

this sort of unhinged fuckery is what i live for

bring on the crazy

https://astrid.tech/2026/03/24/0/curl-to-dev-sda/

curl > /dev/sda

How I made a Linux distro that runs `wget | dd`

astrid dot tech
Delve - Fake Compliance as a Service - Part I

How Delve managed to falsely convince hundreds of customers they were compliant and then lied about it when exposed and called out

DeepDelver
For nearly 30 years, journalists have relied on the Internet Archive to see how stories were originally published, before edits, removals, or changes. We need to safeguard that. https://www.eff.org/deeplinks/2026/03/blocking-internet-archive-wont-stop-ai-it-will-erase-webs-historical-record
Blocking the Internet Archive Won’t Stop AI, But It Will Erase the Web’s Historical Record

Imagine a newspaper publisher announcing it will no longer allow libraries to keep copies of its paper. That’s effectively what’s begun happening online in the last few months. The Internet Archive—the world’s largest digital library—has preserved newspapers since it went online in the mid-1990s....

Electronic Frontier Foundation
Making an account on something today when I came across a novel to me password restriction