Paul Hoffman

@paulehoffman@infosec.exchange
289 Followers
190 Following
838 Posts
Old Skool Internet geek, particularly DNS. Pronouns: us/y’all.

Aight y’all, so I think some folks have me sideways here —

“There was a legitimate target next to it” is NEVER and excuse for blowing up a hospital, school, or other sensitive civilian target. It happens all the time, and it is always wrong.

Also, I don’t trust Iran worth a fuck. I just also don’t trust Israel or the current US government. Everyone is lying. What I know is hospitals in Gaza, Israel, Iran, Sudan, and Ukraine keep getting blown up, and that is wrong.

Google is what happens when a system forgets why it was built but remembers how.
wondering whether post-quantum will also have the bullshit popups all over the show

I've been sitting on this for a while, and it's not much, but in light of Wellnhofer's contribution I'd like to propose:

"Maintenance Terms", as distinct from licensing terms:

https://github.com/mhoye/maintenance-terms

Access to code is no promise of access to people.

GitHub - mhoye/maintenance-terms: Project Maintenance Terms

Project Maintenance Terms. Contribute to mhoye/maintenance-terms development by creating an account on GitHub.

GitHub

Something that’s been bothering me for years in the security world: why do researchers demand bug bounties for vulnerabilities in open source projects, when the very contributors maintaining and fixing those issues get nothing, just goodwill?

It feels deeply unfair. The burden falls on unpaid maintainers, yet bounty hunters get rewarded. If you want a paid bounty, maybe help fund the people who actually fix the mess too.

#opensource #security #bugbounty

No more embargoed security issues for libxml2: https://gitlab.gnome.org/GNOME/libxml2/-/issues/913
Triaging security issues reported by third parties (#913) · Issues · GNOME / libxml2 · GitLab

I have to spend several hours each week dealing with security issues reported by third parties. Most of these issues aren't critical but it's still a lot of...

GitLab

Luigi is charged as a terrorist for tagging a CEO, but a man who targeted 3 individuals, including 2 senators, is not charged as a terrorist.

Do you guys see it now? Yet?

Heather exposes that calling MCP an "open standard" is incorrect.

It's so incorrect it could be called a lie, similar to the other lies coming from the AI world. It is not "open": it is controlled by one company with no obvious way to contribute to it. It is not a "standard": if you read https://modelcontextprotocol.io/introduction, you'll see that it is described by "here, trust our code" not "here is how you can write your own code".

This could have been easily fixed if they actually wanted an open standard. Setting up a quickie focused SDO with mailing lists and so on takes a few days at most. (Please don't reply that it is not possible to do it that quickly or easily: I've done it.) They didn't bother, even after announcing MCP, so it's clear they don't want an open standard.

I'm glad MCP seems to work for a few use cases. #MCP folks: please stop lying about it an open standard or, better yet, please do the work to make it an open standard.
https://mas.to/@sphcow/114697886847062461

Introduction - Model Context Protocol

Get started with the Model Context Protocol (MCP)

Model Context Protocol

Before I take seriously any dreams you may have about terraforming Mars, buy a few acres of the worst farmland in your area, and build a no input farm on it that feeds your family year-round.

If you can't even do that, no mention of living on Mars please.

I don't recall seeing much measurement research on mobile carrier identification from client traffic. Didn't find much in a cursory search.

Does this exist? Is it feasible, particularly with branded devices like this?

Can classification be done by address pools unique, IDs, MACs, user agent strings, default start-up apps, default DNS queries/settings, etc.?

Clue, ideas, and pointers wanted.
https://journa.host/@w7voa/114693187624704978

Steve Herman (@w7voa@journa.host)

Attached: 1 image CNBC - A company owned by President Trump announces it own branded Trump Mobile cell phone service and will sell a "T1" smartphone, featuring gold-colored metal case etched with an American flag. https://www.cnbc.com/2025/06/16/trump-mobile-phone-plan.html

Journa.host