Aaron Soto

@surefire@infosec.exchange
176 Followers
524 Following
6.2K Posts

Teaching was my first love. Packets were my second.

I make classes to teach people how to defend themselves against hackers. In my spare time, I teach college students to compete in cybersecurity competitions, or try to take back my home automation from the cloud.

he/him 🏳️‍🌈 ❤️💜💙

(Profile banner is a sunset sky from underneath a bridge with kayakers and the edge of the Austin city skyline)

Twitter@_surefire_
Githubhttps://github.com/sure-fire

"But it’s alarming how easy it is for smart device makers to decide that your property won’t work. There’s no easy solution to this problem. "

Uhhh ... yes there is. Use standard protocols or open the APIs. Every device that requires vendor-managed cloud control should be considered as having a limited lifetime, which could blow at any moment.

(I put my Dreo fans and Roborock vacuum in this category. i priced that into my initial purchase decision.)

https://arstechnica.com/gadgets/2025/07/belkin-shows-tech-firms-getting-too-comfortable-with-bricking-customers-stuff/

#iot #smartHome

Belkin shows tech firms getting too comfortable with bricking customers’ stuff

There’s no easy alternative, and IoT customers are paying the price.

Ars Technica
I took two pictures of Summer on our walk that might be my new favorites.
I am glad she isn't bothered by my phone in her face. She is a good sport.
I especially love the photo with all paws in the air. Summer is a high flying dog.
#Summer #DogsOfMastodon

Validate your mastodon account by

Posting a picture of a shark or elephant stuffie.

Talking about #gravy

Installing Linux instead of "anything else"

Detailing in depth why AI doesn't work.

Posting 20 photos of your dog or cat.

Adding ALT text to all pictures.

Fed verse chick may not respond.

Everybody's been saying that the only warning system left for #Texas is Ted Cruz fleeing the state, so there needs to be a new system based on that.

Here it is!

#NWS #NOAA

@mrundkvist I'm getting a little tired of reading about all the studies that show UBI works well and pays for itself. I wish we'd stop studying and start implementing.
@grrlscientist

Who fucking cares if poor people abuse the system? Rich people do it every fucking day and y'all ain't bat an eye."

#poverty #WarOnPoorPeople #racism #misogyny #GreedyBastards #politics #FascistAmeriKKKa #fascism #Nazis #tyranny #ProfitsOverPeople

Today I spent 2 hours kayaking on the Columbia River! It was very sunny with clear blue skies and beautiful views of Mt. Hood and the Oregon-Washington interstate bridge. 💙 #Portland
One question I commonly see in the @owncast community is how to set up a chat overlay on their stream. So, I decided to write a blog post on how I have mine set up in OBS Studio and how it works: https://logal.dev/blog/owncast-chat-overlay-obs-studio-setup/

I hope it helps someone out there!
How to Set Up an Owncast Chat Overlay in OBS Studio - LogalDeveloper

CONTRIBUTOR POLICY

In order to filter out unwanted autogenerated issues, every issue text must contain:

- one profanity,
- one US or Chinese politician’s name, and
- one article of pornography

The items do not need to be related, but any issue missing any of these items will be automatically closed.

×

Hey masto admins! The era of AI-powered spammers has arrived.

I had 2 registrations a few minutes apart, from adjacent IPs in a netblock famous for forum spammers, with improbably ideal introductions.

They’re not coming. They’re here.

@tek I knew they would come, but I do wonder if they’ll stick around.
A lot of the “goals” of these slop accounts (monetization, influence, virality) are mostly absent on Mastodon. Do you think they’ll come, see that there’s nothing to gain here, and leave? Or am I too naive about all this?
@toni Good question, and I don’t know. Buuutttt, the spammer’s customer isn’t end users, but advertisers. If they can automate signups so they can say “we cover x% of the fediverse, too, which is more than our competition!”, then they may make their money even if it’s completely ineffective. Everyone loses but the spammer, which is fine by them.

@tek They’ll only make their money if advertisers pay them for this coverage. Hopefully most real-people mastodon users just… won’t respond to ads/sponsored posts here and the well will dry up quickly for the spammers.

I realize that’s kinda wishful thinking, but that *is* what I am really wishing for here :D

@toni That’s the problem: spammers don’t actually have to deliver effective ads. They only have to convince people dumb enough to advertise with spammers that it’s a sure fire investment. “Oh, we can deliver to 80% of Mastodon instances!” “So 80% of users will read my ad? Amazing!” “Well, that’s a different question.”

@tek I can tell that the "reasons for joining" descriptions/texts are AI generated. Wouldn't have been able to tell if the user was an AI bot or a real user.

Good job catching on the ip addresses though. It would suck if both users were siblings with the same household though.

@Shredd_Tone The IPs were the tell. I saw 2 similarly florid texts within a few minutes, looked at their applications, whoised the IPs, and realized what was up.
@tek Well, that does make sense then, so I'll have to trust you there. Now I'll need to give everyone else on my end a heads up over the AI bots.

@tek Oh, I've been dealing with this for a while. And I'm fighting it with AI models!

It's AI models all the way down....

@michael I could here more about your fighting methods. New style LLM stuff or tried-and-true Bayesians?

@tek Oh, back in the day I did fiddle around with non-LLM NLP - both professionally and for personal projects.

Now, I've given up and let the GPTs take care of the work - specifically, Google's Gemini Flash.

My process is based on my custom Mastodon signup flow at https://join.theatl.social.

1. Someone who wants to sign-up for an account first needs to make it through a Cloudflare managed challenge + blocks on problem ASNs / IP blocks.

2. If we get past that, then via a prompt, the profile details and name is checked to determine if_human and if_spam. If certain thresholds are met, the account is automatically suspended, with the email address associated with the account notified with an option to reverse.

Glad to provide additional details (or prompts) via DM if helpful!

theATL.social - Connect with Atlanta's Community via Fediverse & Bluesky

Join Atlanta's vibrant online community. For $5/month, access the Fediverse and Bluesky networks, connect with local Georgians, and participate in exclusive Atlanta-focused conversations.

@michael I might have to check that out. It sounds lovely!

@tek Those introductions are so f***ing vague.. a handful of buzzwords that say nothing.

I've been using spam filters on my personal blog for decades, and these "introductions" were apparently written by the same spammers.

(Not necessarily AI... just boilerplate spam you can plug in anywhere)

@ObbieZ Legit point, but these are starting to feel different, like they’re customized for the target instance. Something in the wording is a little too perfectly aimed in many cases.
@tek lmao, these messages read like a motivational cover letter in a job application

@tek I am passionate about exploring new ideas in the fields of innovation...

nah... that field consists only of old ideas.

@goedelchen “I am especially partial to squares that are rectangular.”
@tek maybe we can make a honeypot fediverse for all the AI to talk to each other
@ozeng Hey, that’s my blog! https://honeypot.net
Honeypot.net

Extracting chaos from order