@realn2s@infosec.exchange cover
@realn2s@infosec.exchange avatar

realn2s

@realn2s@infosec.exchange

SW craftsperson & technology enthusiast, emphasis on security #SpielerischeSicherheit.

Private here. Working in the intersection of #informationSecurity, #ITSecurity, #OTSecurity, #SecureDevelopment, #ProductSecurity with a dose of #CriticalInfrastructure mixed in.

(working for @SMAsolar)
#BLM #nonazis #NoAfD #IamAntifa

This profile is from a federated server and may be incomplete. View on remote instance

SallyStrange , to bookstodon group
@SallyStrange@eldritch.cafe avatar

10 authors, of whose books I've read at least five:

Ursula Le Guin
Kim Stanley Robinson
Octavia Butler
N. K. Jemisin
Becky Chambers
Iain M. Banks
Martha Wells
M. R. Carey
Lois McMaster Bujold
Vonda McIntyre


@bookstodon

realn2s ,
@realn2s@infosec.exchange avatar

@SteveClough @n0madz @SallyStrange @bookstodon
What five books did you read of JRR Tolkien? 4 is probably easy 😉 but i totally failed reading the Silmarillion 😬

Or does the Christopher do the trick 😉?

realn2s , to Cybersecurity
@realn2s@infosec.exchange avatar

I haven't seen a lot of posts regarding the newly "discovered" Russian backdoor from any of the usual suspects. Only articles in general newspapers.

I this just hyped by a security firm?

realn2s OP ,
@realn2s@infosec.exchange avatar

@jerry
I'm looking forward to reading assessments here 🙂

briankrebs , to Random stuff
@briankrebs@infosec.exchange avatar

Some thoughts about attribution in the XZ backdoor, having just wasted so many hours digging into the details.

The email addresses used for a couple of years at least by the parties involved have absolutely zero trace in any kind data breach or database beyond Github/Gitlab, and maybe Tukaani and Debian and a few mailing lists.

Normally when I see this, the assumption is that we're dealing with a single-use or single-purpose email address that was created either for fraud or b/c someone is super paranoid about privacy.

The people in the latter camp who do this tend to have other tells that give them away, or at least some trace or home base in the online world. Especially if we're talking on the order of years using that address.

Either way, very few people do opsec well, and for every year you're operating under the same name, nick, number, email, etc you dramatically increase the risk of screwing up that opsec. And almost everyone does, eventually.

To see this complete lack of presence in breached databases once or twice in the course of an investigation is rare, but to find it multiple times suggests we're dealing with an operation that was set up carefully from the beginning. And that almost certainly means a group project (state-sponsored).

realn2s ,
@realn2s@infosec.exchange avatar

@briankrebs
For the lazy ones like me the direkt link 😉
(sorry I didn't manage to shorten it 😬)

https://www.linkedin.com/feed/update/urn:li:activity:7180632334503677953?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7180632334503677953%2C7180636464802607104%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287180636464802607104%2Curn%3Ali%3Aactivity%3A7180632334503677953%29

hazelweakly , to Random stuff
@hazelweakly@hachyderm.io avatar

I love explaining complicated subjects in a quippy way that isn't necessarily wrong. For example:

Kubernetes is 20 while-true loops in a trench coat pretending to be a container orchestration platform.

What are your favorite quippy ways to explain a complicated topic? It could be anything! I'm just curious what y'all have :)

realn2s ,
@realn2s@infosec.exchange avatar

@daedalus @hazelweakly
I laughed out loud at

Powerpoint is the hammer that lots of people use to paint their house.

Reminds me of
The three rules of engineering.

  1. Always use the right tool for the job
  2. A hammer is always the right tool
  3. Any tool can used as a hammer
realn2s , to Random stuff
@realn2s@infosec.exchange avatar

One thing (at least die Android) lacks is the ability to share files with other applications.
E.g. i put mp3 in my ProtonDrive they are available offline on Android. But my music player doesn't see them.

And yes i understand that this would mean they can't be stored encrypted (i would still call it E2E with the device being the end)

Maybe i just haven't figured it out yet.

Cc @protonmail

Chrishallbeck , to Random stuff
@Chrishallbeck@mastodon.social avatar

Target.

[A frog is shown wearing a shirt and tie.] Business Frog: Okay steady... Aim and... Go! [The frog shoots its tongue out of their mouth. They are then frozen, as if stunned as we see they are sitting in front of a laptop computer and their tongue has hit the screen.] Coworker: I told you this is an old computer. There's no touchscreen. Business Frog: Ugh. I gotta use the track pad?
ALT
  • Reply
  • Expand (5)
  • Collapse (5)
    • realn2s ,
    @realn2s@infosec.exchange avatar

    @Chrishallbeck
    I'm sorry but this reminds me of this classic
    https://youtu.be/sfSJP8avHWI

    eliyahhavemann , to Random stuff
    @eliyahhavemann@det.social avatar

    IDF erklärt: etwa 9.000 Hamas-Kämpfer wurden ausgeschaltet.
    Hamas erklärt: 23.000 Tote in Gaza

    Angenommen, die Zahlen stimmen, ergibt das eine Todesrate von 1,6:1. In Wahrheit liegt sie wohl noch darunter.

    Laut UN ist die durchschnittliche Todesrate in einem „Urban Conflict“ 9:1, also 9 tote Zivilisten pro getötetem Kämpfer.

    Genozid sieht anders aus, liebe Freunde der Wahrheit. Es ist sogar so, dass die IDF mehr in den Schutz der Zivilbevölkerung investiert, als jede andere Armee der Welt.

    realn2s ,
    @realn2s@infosec.exchange avatar

    @eliyahhavemann

    😱​ Ich muss sage ich finden diese Take krass.

    Wenn es kein Genozid ist, dann ist es OK das

    • 10600 Kinder,
    • 7200 Frauen,
    • und 1049 alte Menschen
      insgesamt 24285 Menschen in Gaza getötet wurden?

    Wenn der Faktor 1.6 ist da zeigt sich die "Vorsicht" der IDF???

    Und das bei den obigen Todeszahlen dann nur 5436 Tote "übrig" bleiben, die IDF laut ihrer Angabe aber 9000 Kämpfer getötet hat. Heißt wohl viele der Frauen und Kinder ware auch Kämpfer???

    Oder könnte es sein, das wie in jeden Konflikt der Neuzeit jeder Tote erst mal ein generischer Kämpfer ist (Vietnam lässt Grüßen)

    Ich stimme die absolut zu, das jedes verlorenen Menschenleben eins zu viel ist.

    Der Terroranschlag der Hamas mit 1200 Toten ist durch nicht zu rechtfertigen und verachtenswert. Er ist ein Kriegsverbrechen und Verbrechen gegen die Menschlichkeit

    Aber ein Gräuel rechtfertigt keine Folgegräuel.

    Dein Schönrechnen und die Reduktion von Menschenleben auf Zahlen, deine Nutzung von "ausgeschaltet" statt getötet, ... wirkt auf mich wie Rechtfertigungsversuch, damit alles OK ist. Und das ist es nicht!

    realn2s ,
    @realn2s@infosec.exchange avatar

    @eliyahhavemann

    Sorry, nein es ist keine zwangsläufige "Konsequenz", es ist eine Reaktion. Aber Reaktionen müssen angemessen sein. Und ein Großteil der Bevölkerung des Gaza Streifen ist gleichermaßen eine Geisel der Hamas.

    Man muss jeder Nation die in einer kriegerischen Handlung gegen eine andere Nation oder Anteile der Bevölkerung, vornimmt Genozid vorwerfen können! Wenn der bloße Vorwurf dann ohne weitere Argumente als Antisemitismus bezeichnet wird, ist das im besten Fall sehr Fragwürdig.
    Zumal israelische Regierungspolitiker offen über eine Umsiedlung der palästinensischen Bevölkerung sprechen (Wannseekonferenz lässt Grüßen) und andere Stimmen eine komplette Vernichtung der Palästinenser fordern.
    Und es ja nicht nur die Türkei ist, die diese Vorwürfe vorbringt.

    Ich will in keinster weise die Existenz und auch den erschreckenden Wachstum von Antisemitismus abstreiten.
    Aber die Vorwürfe müssen untersucht und beurteilt werden.
    Dazu ist eine ungehinderte Berichterstattung nötig und sollte im Interesse des beschuldigten Landes liegen. Wenn Kommunikationsinfrastruktur zerstört wird, wenn Pressevertreter in besonderem Masse getötet werden, andere verhaftet werden, ist das alles andere als Vertrauenerweckend

    Noch was, wenn wir bei Zahlen bleiben.
    Bei den Kämpfen sind seit dem 8 Oktober 200 israelische Soldat*innen getötet worden. Das erhöht die die Zahl der israelische Todesopfer um mehr als 15%. Macht es wirklich Sinn wenn, als "Konsequenz" schließlich ähnlich viel oder vielleicht sogar mehr israelische Tote zu beklagen sind? Zum Erinnerung die Militäraktionen die auf 9/11 (3,000 Tote) folgten, haben 7000 US Soldaten (und noch mal 8000 US Contractors) das Leben gekostet (und 900000 anderen Menschen).

    nixCraft , to Random stuff
    @nixCraft@mastodon.social avatar

    "In C++ it's harder to shoot yourself in the foot, but when you do, you blow off your whole leg. " -- Bjarne Stroustrup, C++'s creator.

    realn2s ,
    @realn2s@infosec.exchange avatar

    @nixCraft
    Very reassuring 😅

    timrichards , to bookstodon group
    @timrichards@aus.social avatar

    When I was in a book club, I wouldn't show up if I hadn't read that month's book. I eventually left when almost no one each month read the book. The socialising was nice but, c'mon, read the book.

    Why we keep showing up to book clubs — even when we haven't read the book https://www.abc.net.au/news/2024-01-18/book-clubs-still-popular-bringing-readers-together/103326462

    @bookstodon

    realn2s ,
    @realn2s@infosec.exchange avatar

    @Arlenecw @siftinsand @feather1952 @bookstodon @timrichards
    💜 I love the idea

    altlife , to Random stuff
    @altlife@me.dm avatar


    Hello world!

    My name is Priyanka Singh. Born in New Delhi, India, I've been traveling since past few years to continue my learnings about life. Academically I did my postgraduation in literature and worked for a decade in publishing. I also worked in a non profit for a few years and this year I intend to start a free progress school in my parent's village in Pithoragarh, Uttarakhand. I'm looking to connect with people ideating innovation in education. Thank you for reading. 🪷

    realn2s ,
    @realn2s@infosec.exchange avatar

    @altlife @appassionato @bookstodon
    There ist also "Augehöhe macht Schule"
    (Rough translation "on equal footing in school)
    https://augenhoehe-film.de/augenhoehemachtschule-2018/

    Sadly the material is all in German

    crowgirl , to Random stuff
    @crowgirl@hachyderm.io avatar

    I have received hundreds of birthday wishes online so far. And I just turned 40 less than an hour ago.

    Thank you everyone! I'm seriously crying happy tears.

    ❤🎉🎂

    realn2s ,
    @realn2s@infosec.exchange avatar

    @crowgirl
    Here one more 😀
    Happy birthday 🥳

    realn2s , to Random stuff
    @realn2s@infosec.exchange avatar

    need please

    I'm looking for a copy of the article by Daniel Bobrow: "A Turing Test Passed" ACM SIGART Newsletter, December 1968, pp. 14–15;

    I can't find a digital version 😞

    The article describes an conversation of Daniels boss with (one of the first chatbots) which went something like this

    VP: Do you think that I can use the computer this morning?
    ELIZA: Why do you ask?
    VP: I might be able to make some additional telcomp sales.
    ELIZA: Why aren't you sure?
    VP: My prospective customers have never seen a demonstration of the system.
    ELIZA: Does this mean very much to you?
    VP: Of course it does.
    ELIZA: You seem very positive of that.
    VP: This is ridiculous.
    ELIZA: What do you mean this is ridiculous?
    VP: Is there any reason why I can't use the computer now?
    ELIZA: Tell me more about your prospective customers.
    VP: Call me

    Note that after that remark the VP left out the period. Therefore, of course, the computer didn't answer him. This so infuriated the VP, who thought I was playing games with him, that he called me up, woke me from a deep sleep, and said:

    Why are you being so snotty with me?

    What do you mean why am I being snotty to you?

    The VP angrily read the dialog that 'we' had been having, and couldn't get any
    response but laughter from me. It took me a while to convince him it really was the
    computer.

    realn2s OP ,
    @realn2s@infosec.exchange avatar

    @dentangle
    I'm writing a book recommendations on the non-technical aspects of

    At the moment about the books

    • Weapons of Math Destruction
    • Atlas of AI
    • The Media Equation

    Regarding the last one i thought of bringing the example of the ELIZA dialog. For this i thought to check the original source

    lunalein , to bookstodon group
    @lunalein@federatedfandom.net avatar

    @bookstodon should i start reviewing/rating books

    realn2s ,
    @realn2s@infosec.exchange avatar

    @lunalein @bookstodon
    What about ?
    @bookwyrm

    ChrisMayLA6 , to bookstodon group
    @ChrisMayLA6@zirk.us avatar

    For this of us accused of buying too many - Umberto Eco was on our side:

    'It is foolish to think that you have to read all the books you buy, as it is foolish to criticize those who buy more books than they will ever be able to read. It would be like saying that you should use all the cutlery or glasses or screwdrivers or drill bits you bought before buying new ones'

    h/t Subir Dey (LinkedIn)

    @bookstodon

    realn2s ,
    @realn2s@infosec.exchange avatar

    @ChrisMayLA6 @bookstodon
    And you can use Umberto Eco again if they criticise you for not having read them all

    Unread Books Are More Valuable to Our Lives than Read Ones as they contain the knowledge we don't have yet

    😀
    https://www.themarginalian.org/2015/03/24/umberto-eco-antilibrary/

    arstechnica , to Random stuff
    @arstechnica@mastodon.social avatar

    How to avoid the cognitive hooks and habits that make us vulnerable to cons

    Psychologists behind "invisible gorilla" study are back with a new book: Nobody's Fool .

    https://arstechnica.com/science/2024/01/how-to-avoid-the-cognitive-hooks-and-habits-that-make-us-vulnerable-to-cons/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

    realn2s ,
    @realn2s@infosec.exchange avatar

    @arstechnica
    Very interesting read 🙏🏻

    jerry , to Random stuff
    @jerry@infosec.exchange avatar

    The Y2K denial threads are amazing. Must be what people who work at NASA in the 60’s and 70’s feel about moon landing hoaxers

    realn2s ,
    @realn2s@infosec.exchange avatar

    @MisuseCase @jerry
    This reminds me of this 😬
    https://youtu.be/-_kXIGvB1uU

    GossiTheDog , to Random stuff
    @GossiTheDog@cyberplace.social avatar

    [Thread, post or comment was deleted by the author]

    •
    realn2s ,
    @realn2s@infosec.exchange avatar

    @GossiTheDog
    Not sure

    realn2s ,
    @realn2s@infosec.exchange avatar

    @GossiTheDog
    🙏🏻
    I agree that it makes the study less "independent" and therefore the results should be taken with a (larger) grain of salt.
    As studies are often financed even some (or all) none Microsoft name list wouldn't make me on ease.

    georgetakei , to Random stuff
    @georgetakei@universeodon.com avatar

    99 years and our media hasn’t learned enough of the lessons it needs to.

    realn2s ,
    @realn2s@infosec.exchange avatar

    @karlauerbach @georgetakei
    It wasn't even really a prison

    In the month he was there he had over 300 visitors, could converse freely, didn't have to work, and used the time to write "Mein Kampf"

    German article https://fragdenstaat.de/blog/2023/10/28/gefangenpersonalakt-adolf-hitler/

    realn2s ,
    @realn2s@infosec.exchange avatar

    @Architeuthis
    😮

    i0null , to Random stuff
    @i0null@infosec.exchange avatar

    An IBM slide from 1979

    realn2s ,
    @realn2s@infosec.exchange avatar

    @i0null
    Do you have a source for this?
    I tried tracking it down but couldn't find a plausible source for this slide

    18+ SocraticEthics , to Media Industry Discussions
    @SocraticEthics@mastodon.online avatar

    ⛔️🇨🇭Please note: according to The Telegraph News Source, Russians have hacked Swiss ‘Protonmail.com’. If your email is secured by Protonmail.com, the system was compromised by the FSB. Careful when relying on the systems security henceforth | source - Ukraine: The Latest Podcast (In timeline Below)

    realn2s ,
    @realn2s@infosec.exchange avatar

    @DominickGalang @SocraticEthics
    Some more background would be great.
    Not that it is impossible, but it is unclear for me why the FSB should do this?
    I don't think @protonmail is an easy target and if they don't host the emails of many interesting targets it's probably much easier to individually compromise accounts than to infiltrate the system.

    Something similar was spread in 2018
    https://www.bleepingcomputer.com/news/security/hacker-say-they-compromised-protonmail-protonmail-says-its-bs/

    realn2s ,
    @realn2s@infosec.exchange avatar

    @protonmail @DominickGalang @SocraticEthics
    🙏🏻​

    realn2s ,
    @realn2s@infosec.exchange avatar

    @protonmail @DominickGalang @SocraticEthics

    Still one question.
    As far as I see even with zero-access encryption an attacker could get access to the data by deploying modified code to the clients, extracting the encryption keys. IF they have full access to the infrastructure.

    Or how can this be prevented?

    ewolff , to Random stuff German
    @ewolff@mastodon.social avatar

    Mitarbeiter-Bewertungssystem bei SAP führt zu Unmut
    https://t3n.de/news/sap-bewertungssystem-mitarbeiter-ranking-1595392/

    realn2s ,
    @realn2s@infosec.exchange avatar

    @ewolff
    Das erinnert mich irgendwie stark an die McKinsey Artikel wie man Software Entwickler Produktivität messen kann und den was @tastapod dazu geschrieben hat

    "If the mindset is “weeding out poor performers” then this suggests an abdication of responsibility; the idea that the flower is at fault for failing to grow rather than the soil or climate. In this context it does not really matter what tool we use to “assess” people, because we are clearly solving the wrong problem."

    https://dannorth.net/mckinsey-review/

    realn2s ,
    @realn2s@infosec.exchange avatar

    @ewolff @tastapod
    I understood the problem not to be a junior senior distinction but to try to assess "performance" on an individual level and additionally to attribute it to the individual and neglect the system

    ewolff , to Random stuff
    @ewolff@mastodon.social avatar

    Die Süddeutsche kann Visionäre nicht von ganz gewöhnlichen Betrügern unterscheiden. 🤮https://www.sueddeutsche.de/projekte/artikel/wirtschaft/psychologie-charisma-erfolg-open-ai-sam-altman-e511539/

    realn2s ,
    @realn2s@infosec.exchange avatar

    @ewolff @javahippie
    Hmm, ich bin mir da nicht so sicher.
    Einerseits war die Innovationskraft vom AI betrifft und andererseits wegen des Personenkult.
    Wenn eine Innovation nicht weitergehen kann, will eine Person das Unternehmen verlassen muss, ist das für mich ein Warenzeichen

    Die wirklichen Kosten der, zugegebenermaßen beeindruckenden Textgenerierung sind auch noch total verschleiert.

    realn2s ,
    @realn2s@infosec.exchange avatar

    @ewolff @javahippie
    Das "funktionieren" gilt nur in einem eingeschränkten (und vor allem unbekannten) Rahmen

    Beispiel
    https://infosec.exchange/@realn2s/111336046539384508

    Ähnliche Ergebnisse hatte ich mir Dall-E, sobald ich nicht "Standard" Bilder angefragt habe

    Dall-E Ergebnisse für die Anfrage drawing representing organized cybercrime Mehrere farbige "Organigramme" mit Zufallstext

    realn2s ,
    @realn2s@infosec.exchange avatar

    @ewolff @javahippie
    Ja, ChatGPT kann einen Business Plan schreiben (Zahlen waren zwar falsch, ließen sich aber einfach verifizieren und korrigieren) und liefert auch eine gute Grundlage für ein Bewerbungsanschreiben.

    Beides Aufgaben bei denen unangenehme Tätigkeiten abgenommen wurden und die leicht zu validieren waren.
    Bin einer KI erwarte ich aber auch, dass sie die Feiertage-Aufgabe lösen kann

    realn2s , to Random stuff
    @realn2s@infosec.exchange avatar

    Damit, I missed my first anniversary 😅
    https://infosec.exchange/@realn2s/109378313934512511

    Thanks to @jerry die providing this space

    protonmail , to Android
    @protonmail@mastodon.social avatar

    Today, we’re happy to announce we’re launching the Proton Drive app for Mac! 🎉

    We’re hitting this significant milestone, thanks to our community members who gave us feedback for the Mac OS beta.

    is now available on , , , the web, and now .

    Download it here: https://proton.me/drive/download

    realn2s ,
    @realn2s@infosec.exchange avatar

    @protonmail
    Is there a Linux version in planning?
    That would be great and i could instantly drop Dropbox 😋

    Ok, question was asked and answered.
    Yes 😀

    https://infosec.exchange/@occirol/111459378852740421

    realn2s , to Cybersecurity
    @realn2s@infosec.exchange avatar

    TL;DR;: Help!. Do you have tips writen policies or examples of good policies you could share?

    Please for reach.

    Long:
    A

    I really struggle with writing

    I feel caught between writing them for (easy evidence that it is followed), prescriptiveness (telling "everyone" what they need to do), usability (adapted to real life usage and followable), risk appetite (which is so different depending who you ask and depending on the context) and "security" (related to risk appetite, what is it anyway 🤪​).

    And, to make matters worse I'm not an expert on all topics I'm asked to write policies for.
    AND they shouldn't require frequent change 😠

    From what I see (there are so many bad policies around) I don't seem to be the only one 😕

    Help, stories, example, ... to help me (or others) writing better policies greatly appreciated.

    realn2s , to Random stuff
    @realn2s@infosec.exchange avatar

    Community question

    Does anyone know about a application for ? It seems that once there was but I can't find any instance.

    Probably would work as well.

    Please boost for reach

    realn2s , to Random stuff
    @realn2s@infosec.exchange avatar

    I'm looking for ,

    One of my reoccurring unsolved problems is, finding stuff i know exists but I only remember fragments about.

    E.g. I know I follow a person but can't recall their handle. Search is useless as i can't restrict it to "following". Handle auto-completion only works if i know enough of the beginning of the handle.
    Essentially I have to scroll through my followings, bookmarks, favourites or wherever I think I find them easiest

    Is this a client problem?
    Are there client which offers a "following" search?

    cc @feditips

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • Mordhau
  • WatchParties
  • Rutgers
  • Teensy
  • Lexington
  • cragsand
  • mead
  • RetroGamingNetwork
  • mauerstrassenwetten
  • WarhammerFantasy
  • xyz
  • PowerRangers
  • AnarchoCapitalism
  • kamenrider
  • khanate
  • neondivide
  • itdept
  • AgeRegression
  • steinbach
  • electropalaeography
  • MidnightClan
  • learnviet
  • bjj
  • loren
  • space_engine
  • supersentai
  • jeremy
  • fandic
  • All magazines
    •