Orca 🌻 | 🎀 | 🪁 | 🏴🏳️‍⚧️

@Lana@beige.party Shouldda be enough a reason that they don't pay a living wage 😬

@delta@chaos.social China does this for every messaging app that attempts to shield user communications from prying eye. In Chinese app stores you can't find Signal, Element, Wire, or any other secure messaging app, either. They even blocked access to F-Droid.

@sarahjamielewis@mastodon.social systemd's development has been guided by huge conglomerates, targetting use cases in cloud, large clusters and hyperscalars, for at least a few years already. They're not "compelled to do so", they're doing what spineless corporations do all the time: offering compliance happily in advance.

谷歌 自行报告 2023年其数据中心直接用水量 109 亿加仑 （约4100万吨）。

@WPalant@infosec.exchange How could Overstreet treat the LLM as his gf while referring to the LLM as a "teenager"? Doesn't dating a "teenager" as an adult makes the whole thing morally... wrong? 🧐

@protonprivacy@mastodon.social Proton thinks mandatory ID requirement is bad and Proton thinks mandatory facial scans is the solution to age verification. Piss off.

@evacide@hachyderm.io Cops really do got arrested? That's unexpected.

@siderea@universeodon.com @jeffowski@mastodon.world Obviously I mean where did that image come from. That image seems like an episode cover from a podcast named Latter Gay Story, but there doesn't seem to be such an episode listed on their website. So I was wondering where Jeff got that image from.

谷歌将预估的 Q-day （预计的量子计算机可以破译当前的密码学算法（主要是公私钥密码算法，包括 RSA 和 EC ）的日期）大幅度提前至2029年。
谷歌警告业界需立即着手迁移到对应的 PQC（后量子密码学算法），以应对即将到来的 CRQC 将带来的风险。

https://arstechnica.com/security/2026/03/google-bumps-up-q-day-estimate-to-2029-far-sooner-than-previously-thought/
https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/

​:nachoneko_8:​​:nachoneko_8:​​:nachoneko_8:​​:nachoneko_8:​​:nachoneko_8:​

RE: @dangoodin@infosec.exchange

@blogdiva@mastodon.social @nixCraft@mastodon.social Thought there's no way it's not satire. Read his twitter. He's actually serious. wtf 🤣🤣😭😭😭😭😭

@daveburb@mastodon.au @netblocks@mastodon.social Chosen users are granted privileged accessWanna guess if MuddyWater belongs to those "chosen users" or not? 🙃

@billchenchina@bcom.moe 还真得让机器在启动完后禁止载入任何模块🫠

@infobeautiful@vis.social It's not North America if it only includes US and Canada, though? What about Mexico?

@arstechnica@mastodon.social Is that even fucking legal?

@WPalant@infosec.exchange Definitely. That's one more level of wrong out of the already reprehensible and deranged mentality of Kent Overstreet that 1) LLM psychosis, 2) own and control his "love interest" to the point of "lobotomize" his LLM because the LLM claimed to be a lesbian. I guess that specific part caught my attention because I was reminded of the current ruiling class in US 🫠

@Blender@mastodon.social You're talking like Wikimedia Foundation after they suffered a backlash for adding "AI summary" feature to Wikipedia. https://arstechnica.com/ai/2025/06/yuck-wikipedia-pauses-ai-summaries-after-editor-revolt/

@rysiek@mstdn.social I know. Just want to add that the opposite of "curl|bash everything" isn't necessarily "never curl|bash anything". Vuln PoC on some random websites is definitely something I won't, especially as this one didn't start with raw.githubusercontent.com so there's a real chance of attacker controlled server waiting for someone to curl|bash 😬

@rysiek@mstdn.social curl | bash (It's python but whatever) works fine if one trusts the web server it curl'd. For example, if someone is installing a toolchain and would download the toolchain from that same server anyway, curl |bash would be fine as it didn't trust more entities it would have with alternative means. (Of course blindly curl|bash is a thing and I won't argue that's indeed bad) But that copy[dot]fail website which seems extremely AI-pilled? ... 😬 Also that python script seems extremely obfuscated and unreadable (*). That's probably intended to support the claim of "732-byte Python script"... Haha as if how few lines of code a PoC have means anything outstanding right 🙃 Deeply unserious people. (*) after I downloaded it from Github. I don't trust Microsoft very much but I have not heard that Microsoft has ever served targetted malware to people downloading things from Github either.

@maxleibman@beige.party AI bro was stunned for a moment and then asked you for the price of the new ocean.

@gnome@floss.social @tragivictoria@mastodon.catgirl.cloud ​:neocat:​ Bites u

@fullfathomfive@aus.social @rysiek@mstdn.social UN is so done.

@gunstick@mastodon.opencloud.lu @josephcox@infosec.exchange Wrong. WhatsApp never shares private key with servers.

@NanoRaptor@bitbang.social Just had a disaster a few days ago and I'm so f glad I stored an extra copy in a different location.

@sophieschmieg@infosec.exchange chuckle we're in danger

@d3adpaul@mastodon.social At this point I feel like you're just twisting my words, framing me for something I didn't say and name calling me for something I didn't do. I can hardly see the reason to keep this conversation, so this would be my last reply to you. If you destroy your data which might be of interests to the cops (by any mean, including serving ) after being served a search warrant, you're inviting cops to charge you with tampering of evidence. If you don't give them any password, they try a list of password they got elsewhere and hit a duress pass, wiping the evidence, that's on them. But if you give them duress pass and it wiped evidence, that's on you. Of course there are genuine reasons to try to trigger wipe despite the high legal risks and I recognize that, but if you teach others to do so without mentioning the high legal risk attached, you're exposing others to danger, i.e. being an asshole. Bye. Ah and "reddit up the place"? Nice accusation lol. @LukefromDC@kolektiva.social @evacide@hachyderm.io

@mattburgess@infosec.exchange Who would be behind those hacking? Some government agencies, or NSO, I wonder? 🤔

@cwebber@social.coop TheVerge paywall is bypassable with JavaScript disabled, so either disable JS in adblocker settings or use something that doesn't support JS (like curl) would work.

@mttaggart@infosec.exchange Should I send you the certificate or the csr ​:neocat_catmode:​

@d3adpaul@mastodon.social @evacide@hachyderm.io They don't give it to the techies immediately. They follow whatever the techies said until they can hand it to the techies. That's called cooperation.

@soatok@furry.engineer Maybe shred instead /j

@alexanderkjall@mastodon.social They even have time to obfuscate and minimize that exploit code, which makes it very hard to understand. As if "732 bytes" means anything. Surely the best way to create a proof-of-concept exploit to share their understanding with the world? /s

@mjg59@nondeterministic.computer @scream@bots.robots.rodeo

@ryanc@infosec.exchange Co-Authored-By: Two wolves inside me 🐺

@jeffowski@mastodon.world Didn't found that on Latter Gay Story. Where's the source, if I may ask?

@QasimRashid@mastodon.social Leopards won't "not eat his face" if he gave leopards others to eat. Well maybe not today, but still.

@evacide@hachyderm.io ← Have never wfh yet can't interact with people without making it weird

@gnome@floss.social Do you mean GNOME has localization for cat languages by using that picture?

@danirabbit@mastodon.online If someone asked people if they will commit crimes in the future on the Internet, they're either feds baiting or doing the feds' work.

@cameron29@mastodon.social @eff@mastodon.social @Thorin@mastodon.social Why would they "discontinue" it, then? Won't it be better if they can continue to harvest your data forever while pretending they can't?

@WeirdWriter@caneandable.social What the hell?! This is so disgusting.

@cameron29@mastodon.social @eff@mastodon.social @Thorin@mastodon.social Yes. And why would they stop pretending to be offering you E2EE while they can siphon your data without you knowing, knowing "this user turned on fake E2EE, their data is likely extra juicy"? If they didn't offer E2EE from the beginning, what's the motivation to discontinue it? What's the benefit for Meta to announce they're discontinuing E2EE?

@cwebber@social.coop The perfect example of "high on own supply" 😬

@evacide@hachyderm.io part of Android's Advanced Protection ModeSo it's not in AOSP but in GMS, heh...

最近有些 Signal 用户被社会工程学手段欺骗，导致自己的 Signal 帐号被攻击者取得。 Signal 平台本身没有安全问题。

然后有些人就开始大呼小叫“啊 Signal 就是不安全啦，因为 Signal 不是自主可控的加密聊天软件，大家都应该改用欧洲自主开发的 Wire ，并且呼吁封杀 Signal ”。

有些时候我在想这种人是真的蠢还是他们其实是想通过传播假消息达成什么目的 🫠

@kuketzblog@social.tchncs.de

@arstechnica@mastodon.social They still need to sell their compressed kill cycle to government agencies and militaries, after all ​:anenw05:​ https://web.archive.org/web/20260402155236/https://www.redhat.com/rhdc/managed-files/ve-compress-the-kill-cycle-detail-693397pr-202402-en_3.pdf

@hakona@im.alstadheim.no @eff@mastodon.social There are. But you're likely going to be figured out that this is a VPN endpoint instead of a web server if someone employs DPI.

@eff@mastodon.social Yeah. Sure. Make sure they also removed their own very expensive VPN equipment from their networks /s

@gunstick@mastodon.opencloud.lu @josephcox@infosec.exchange Hmmm. Or maybe your device backed up keys to their server in an encrypted form? I don't exactly know how WhatsApp achieved it, but I know matrix has this.

@jiub@not.an.evilcyberhacker.net @revoluciana@chaosfem.tw Not really. They just switched from "you're such a girl" to "you'll never be a girl" seamlessly.