We know that bulk surveillance + automation means bulk yet tailored psychological manipulation at scale. But it never occured to me until this morning that adding LLMs could enable bulk tailored _blackmail_.

Good morning to everyone except the authors of the Gmail Android app, who for some reason have made it so that you cannot search the locally cached emails without an Internet connection.

Finally, Citizens United comes to its logical conclusion. A judge in Delaware, where many big U.S. companies are incorporated, ruled ‌on Tuesday that a small town that allows corporations to vote in municipal elections was not violating the state's constitution […]

RE: https://mastodon.social/@campuscodi/116641209849845349 Oh no. Who could have predicted this.

Do you skip the `1` part of the 3-2-1 backup rule because you don't like the concept of a recurring bill that repeats until you are dead? Do you have a friend that has internet at their home? Congratulations! You may be able achieve a proper 3-2-1 backup routine. I've written up a guide for […]

The iMessage "can't look at the contents of a deleted message without restoring it" thing sucks.

@tragiccommons Obligatory graybeard story. Before the web, when we shared files across the internet via anonymous ftp, the research.att.com server would happily let you fetch the ostensible /etc/passwd file, which had a short list of uses with encrypted passwords that, when cracked, spelled out […]

Signal beta on Android is now notifying "You may have new messages" ... when there aren't.

Spent the whole flight checking my baggage status just to make sure it was still aboard

It's so cute that they thought that five CVE digits per year would be plenty, and went to all that trouble to add just one digit.

I mean, the "KE" in KEV stands for "_known_ exploited". How where organizations reporting _before_ to CISA that they were being exploited? I'm not seeing how making it easier to tell CISA that you were exploited is a bad thing?

Are you a FreeBSD person, jealous of all the Windows and Linux LPEs we've got these days? Don't worry. FatGid has got your back. It was fixed last year and assigned CVE-2026-45250 today Current FreeBSD versions are unaffected I'm not sure why the official […] [Original post on infosec.exchange]

Microsoft ... got rid of ... customizing columns in Outlook? So I can't ... sort by ... size? [...] Y H _G_ T B _F K M_ (Yes, I know about the search option)

The best time to prune your dependency trees was 3 years ago, second best time is right now.

The @thunderbird team has just announced that starting in a couple of months, extensions that use "Experiment" APIs (which implement required functionality not provided by standard APIs) will no longer run on Thunderbird's monthly release channel. The top nine most popular Thunderbird extensions […]

If your post title begins with "Patch Now:" but it's for something that 99% _of the tech world_ doesn't use and hasn't heard of, I'm judging you. (Looking at you, Dark Reading)

You say that like it's a bad thing, Google. YubiKeys as _second_ factor 4 lyfe!

When Egghead went under, Newegg -- appearing shortly thereafter -- swore their name was unrelated, but I was not fooled.

Spicy auto complete except it's that thing where you are falling asleep during a casual conversation and you respond out loud to what you half-dreamed you heard but you think they really said it

RE: https://tldr.nettime.org/@tante/116603384370030013 This of course makes Google's browser monopoly even worse. Repeating my call to the EU to just buy out Mozilla, fire the AI folks, rebuild the policy arm and run it as a public service.

New: The U.S. telecom industry has launched a second ISAC to facilitate private discussions among companies about sensitive cybersecurity issues. I talked to the new ISAC's executive director and T-Mobile's CSO about why the industry felt it needed this. www.cybersecuritydive.com/news/telecom...

RIP Peter H. Salus, UNIX historian. His book is an amazing tour of the history. Source: https://www.tuhs.org/pipermail/tuhs/2026-May/033750.html

When @lweiss.bsky.social and I were planning our recent trip to southern Spain, I had one top priority for our time in Seville, and now I can reveal that we accomplished it.

Yahoo still has someone with the official title of 'Postmaster' and they are actually doing what a Postmaster is supposed to do and I could not be more delighted.

The ACM obituary for PGN, by @spaf and Simson Garfinkel, is wonderful: https://cacm.acm.org/news/in-memoriam-peter-g-neumann-1932-2026/

Good morning to everyone except the UX cabal rhat decided that showing battery percentage simply by waking up the device needed to be gated behind frictions like authentication.

inb4 all of the fun vulnerability brand names are used up and researchers start randomizing phoneme groups, like those Amazon "brands".

> In December 2024, Dr. Neumann made an anonymous $4 million donation to the San Francisco Symphony to save its chorus, his daughter, Helen, said. Sure hope he left instructions to disclose this upon his death.

The misleading hubris of NYT rendering DARPA "Darpa" and CHERI "Cheri."

Peter Neumann was a funny, kind, brilliant, generous person. A long and rich life filled with computing, music, friends, and humor. My life is very much richer for having known Peter. I will miss him. https://www.ieee-security.org/TC/SP2010/photos/med-0079_IMG.jpg […]

NYT Obituary for Peter Neumann had many facts I didn't know […]

Good afternoon to everyone except Thunderbird, which obscures in the Account Setup wizard the 50 reasons why an account setup might be failing.

Any sufficiently advanced long-term strategy to minimize how many people can run local models is indistinguishable from a general hardware shortage.

brb asking the people running the garage sale what the Wi-Fi password is

Our custom RV is for sale in Minnesota if you happen to be in the market for such a thing. 165K miles, two year warranty, lift bed, swivel bench seating. albatross.org/forsale/transit350.php #forsale #minnesota #RV

Then make it easier to sort and filter on message size, GMail. (Yes, I'm aware of the `size:` operator)

Say Anything (1989) is about committing to love _before_ life complicates it. Grosse Pointe Blank (1997) is about reclaiming love _after_ life has complicated it. And in my own headcanon, it's the same universe, but alternate timelines (Diane / Debi), "Sliding Doors" style. I will not be […]

Are you sick of Linux vulnerabilities lately? Good. Here's ssh-keysign-pwn You can read any root-owned files from an unprivileged account. CVE unknown. Was patched in the Linux kernel 11 hours ago

Glacially building and rebuilding a mental high-level logical diagram, one email or meeting at a time, gets more tempting as the percentage of remote participants grows. Virtual whiteboard that thing! Make the org identify who owns turning it into an artifact -- and keeping it current […]

ME: There's a 30% chance that this will be realized within 3 years, and will only take an hour of operational time to address. We've spent more time debating it than it would take to mitigate. Our risk calculation / future-modeling fu is weak SMDH ALSO ME: [Eats something I know I'm allergic to […]

Offline backups aren't.

Every org that has been relying on obscurity hiding _their_ backdoor.

Now the work begins to steer orgs towards the "eliminate entire classes of attack" mitigations we've been asking for for years, instead of just chasing patches. Being able to do this or not -- technically and politically -- may be an existential differentiator.

RE: https://cyberplace.social/@GossiTheDog/116565662607962457 I know people who have been sitting on encrypted drives for years. They're popping them like cans of soda. Setting a pre-boot BitLocker pin does appear to mitigate this (reported by others, I haven't checked it myself).

I put some words all in one place about Copy Fail CVE-2026-31431, Dirty Frag CVE-2026-43284 and CVE-2026-43500, and friends: https://tharros.com/copy-fail-dirty-frag-and-friends-linux-kernel-vulnerability-coordination-in-the-modern-world/

I have an "about to go unsupported" Kindle Paperwhite 1st gen (serial starting with B01B), and some of the online howtos suggest Winterbreak2 ... but it involves going to an HTTPS website (winterbreak2.now.sh, which redirects to winterbreak2.vercel.app) ... and the fetch fails because this […]

Pwn2Own Berlin 2026 is rejecting working RCEs because organizers ran out of contest slots. Visit a website in Firefox and get code execution? Rejected. Strange days indeed.

ME: Hey, I totally forgot my 1994 undergrad CS "solve the Eight Queens Problem with backtracking" exercise in Pascal I did in Pascal! I really got into it, did way more than the assigment required, taught it to log its work, ran it on the Sears salesfloor computers (Pentium II just came out!) a […]

Maybe curl has been scrutinized so heavily and maintained so thoroughly that the kind of stuff Mythos (or other models) can find isn't there.