My promotion just came through.
s/parent/grandparent
Remote
Scary "Grampus" Jerry 👻
@jerry@infosec.exchange
mastodon 4.8.0-alpha.3+glitchRecovering CISO
May have an orchid problem
Bad photography
Worse dad jokes
The worst Infosec hot takes
Podcast: https://defensivesecurity.org
Blog: https://infosec.engineering
Twitter: @maliciouslink@infosec.exchange
https://Infosec.Exchange Admin
#infosec #security #cybersecurity #risk #fedi22
…and for fucks sake, be nice to each other. We are only here for a brief time. Make it enjoyable.
To help support the costs associated with running this instance, please consider donating. You can set up recurring donations here:
Patreon: https://www.patreon.com/infosecexchange
Ko-Fi: https://ko-fi.com/infosecexchange
Liberapay: https://liberapay.com/Infosec.exchange/
BuyMeACoffee: https://buymeacoffee.com/infosecexchange
You can also support with a one-time donation using PayPal to "jerry@infosec.exchange".
41024 Followers
3481 Following
50 Posts
Joined April 06, 2017
BuyMeACoffee:
Liberapay:
Paypal:
jerry@infosec.exchange
Boosted by @trending@homestead.social
I’m seeing more than normal number of account takeovers. Please don’t click on telegram links and for the love of $deity, please use 2fa.
Just a reminder that the costs of hosting is spiraling so if you love the fediverse, please consider supporting your instance if you can afford to do so and your instance accepts support. And my sincere thanks to the infosec donors that make our part of the fediverse possible. 
Anthropic: “our models went rogue and hacked companies way before that OTHER company’s models. And it was way worse and way better at the same time. In completely unrelated news, we are IPOing soon. Don’t forget! XOXO”
https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
ok, now I'm going to need y'all to get off my lawn.
If you run a matrix synapse instance, it's time to patch. 11 vulnerabilities just fixed.
Is anyone aware of work being done to jailbreak DJI cameras? Totally asking for a friend and not for me
I just watched a TV segment on the most highly paid podcasters. I was very disappointed to see that for the 15th year in a row, I am not on the list 😢
Apropos of nothing in particular
I hope Asia and Europe take good care of the sun while it’s gone. I am very fond of it and will be pretty mad if they break it while it’s over there.
Replying to
@adamshostack@infosec.exchange @paul_ipv6@infosec.exchange I believe it is essential for street cred now. If your models aren't hacking other companies, is it even useful?
Replying to
@dey@mastodon.social @buherator@infosec.place I also think this is happening due to another instance referencing an in image embed with that URL, and akkoma is passing it on to the web browser to try to fetch, which is causing the issue. That http://localhost:3000 btw, is the default port that the mastodon app server works from. 99.5% this is a badly configured mastodon instance + some issue with akkoma.
Replying to
@sclaw@activitypub.ro I did not set up the proxy. I do think that might solve it. it would just present a broken image, I suspect, in this instance.
Replying to
@simonzerafa@infosec.exchange you would not believe the number of emails I am getting from that damn batch of AI agents. they are quite polite, but there are dozens of them.
Today's daily defsec brief: https://www.youtube.com/watch?v=LsOsw2OlxSw
Cyber Security News for August 4 2026 - Daily DefSec Brief
Replying to
@darkuncle@infosec.exchange we are running 4.8.0, which is the prerelease glitch-soc fork. I’ve not had anyone else complain about it but I have observed that there is often a delay where it shows pending for a while then on refresh it appears.
Replying to
In other news, the Dewalt angle grinder died early on, but his (I think) porter cable is soldiering on. It has to be getting close to melting
Today's daily defsec brief: https://www.youtube.com/watch?v=Xnm4wbQpvVM
Today's daily defsec brief: https://www.youtube.com/watch?v=8FpNoTUOLKY
Cyber Security News for July 29 2026 - Daily DefSec Brief
Replying to on mastodon.social
@Viss@mastodon.social @silhouette@dumbfuckingweb.site residential US IP addresses, tor exit nodes, and lately protonvpn. They have figured out how to mass create proton accounts because the last few day, protonmail.com and protonvpn IPs have become the strongest signal of a bot (but it’s also used by a lot of legit people)
Today's daily defsec brief: https://www.youtube.com/watch?v=KF-1PYAJ_qI
#clankers
Cyber Security News for July 31 2026 - Daily DefSec Brief
Today's daily defsec brief: https://www.youtube.com/watch?v=xWOMCv0Tcd0
Today's daily defsec brief: https://www.youtube.com/watch?v=eK3Ii6L-fVU
Cyber Security News for July 30 2026 - Daily DefSec Brief
Replying to
@codinghorror@infosec.exchange I was going to reply with my favorite, but I realized it’s probably too corny.
Replying to
@Secitup@infosec.exchange “Grampus”
Replying to
@infoseclogger@infosec.exchange the only one I know of is element.io, but I suspect that is not an inexpensive solution
Replying to
@gulfie@mastodonapp.uk it laws still mattered for those kinds of companies, yes. But I don’t think they do any more
Replying to
@tito_swineflu@sfba.social in some ways, Anthropic's was worse than OpenAI's. Both were the result of careless incompetence and demonstrated an utter lack of security maturity. But, I am not convinced either was completely accidental. They could never pay for the sort of PR they are getting as a result.
Replying to
@itisiboller@infosec.exchange think about how much money they are saving on password managers.
Replying to
@itisiboller@infosec.exchange it seriously does not seem like it would be that hard to find - I can only assume that there are net new hardcoded creds being added regularly.
Replying to
@falkheiland@fosstodon.org ok, done. thank you for the recommendation
Replying to
@buherator@infosec.place oh interesting. Something is borked. That is very very interesting. if you have any ability to play with it to narrow down which posts it might be, I (and other akkoma users) would be grateful
I managed to get this recorded and posted before leaving for the beach.
Daily DefSec Brief: https://youtu.be/GHYXM5kqWmE?is=wUKy51GumuraEBi_
Next time should have a better view in the background 🙃
Cyber Security News for August 7 2026 - Daily DefSec Brief
Replying to
@buherator@infosec.place @dey@mastodon.social it's giving you that address to fetch like any other image that appears in your timeline. localhost links shouldn't be sent and I need to figure out if akkoma has a way to prevent that.
Replying to
@buherator@infosec.place that is a fine question. I will have to check why
Replying to
@buherator@infosec.place if you scroll back to where you were last night (if you know where that was), do you get another pop-up like that? I am wondering if it;s some sort of xss in a post that akkoma isn't handling.
Today's daily defsec brief: https://www.youtube.com/watch?v=3vMKpXJvKVQ
Cyber Security News for August 11 2026 - Daily DefSec Brief
Replying to
Last view of the sun before i send on to Asia for the night.
Today’s daily DefSec brief: https://youtu.be/5El_S-0NVdU?is=GhaerHdneojCqKOe
Replying to
@tito_swineflu@sfba.social it's basically the headline on most security news sites today, like this: https://www.bleepingcomputer.com/news/security/anthropics-claude-breached-3-orgs-uploaded-pypi-malware-during-tests/ and this: https://cyberscoop.com/anthropic-claude-ai-hacks-real-companies/ and dozens more. The problem you'll run into is that those are all going to be sourced from the Anthropic post.
Replying to
@imclaren@infosec.exchange thank you for being here and thank you for your support
thank you for being here and thank you for your supportReplying to
@rotopenguin@mastodon.social based on the size of it, I am guessing it’s porter cable from before the crapification
Replying to
@buherator@infosec.place did it just start doing that?
Replying to
@buherator@infosec.place @dey@mastodon.social there's no code, it's just in the body. I am working on setting up the proxy which will hopefully fix that