If you’re involved in any form of protest organization or center/left leaning politics, go enable Lockdown Mode NOW. ssd.eff.org/module/how-t...

What do I win?

“We should have banned government use of face recognition when we had the chance because it is dangerous, invasive, and an inherent threat to civil liberties,” EFF’s @MGuariglia.bsky.social told @404Media.co. www.404media.co/ice-and-cbp...

As new projects, blog posts, and other efforts around TCG show up, I'm listing them here: tradecraftgarden.org/references.h... I've put together a Friends of the Tradecraft Garden list on BlueSky too: bsky.app/profile/did:... Thank you for building, exploring, & teaching w/ this young project 🪴

I fixed the MCP server from the Kali repo so it's no longer openly hosting an authentication-free instance of Kali for everyone on your network to freely enjoy like your favorite PornHub category github.com/johnnyxmas/M...

LibCPLTest: A shared library for Crystal Palace that allows you to unit test your PICOs. It's nothing too fancy, just a few helper functions and a macro, but it's helped me to create a consistent framework for testing my PIC capabilities. github.com/ofasgard/Lib...

Donate. Please, please support the @EFF! Our collective privacy has never been more important or more at risk.

HEY EVERY VENDOR. Remember all those times I was a HUGE PITA because you wanted a non-redacted copy of my ID? Yeah, this is why.

This, your company shouldn’t store this in email, ticketing, or ANYWHERE for any amount of time, ever.

Catching @mr-minion.bsky.social’s talk at GrrCon this morning!

A little OpenGraph POC for mapping PE header imports of all .dll and .exe files in a fresh Windows install. These are all the binaries that have some kind of import chain leading to kernel32.dll

Nobody asked for it. We did it anyway. If you ever used Winamp during the later years, it had an awesome, awesome visualizer called Milkdrop. The Webamp people implemented a workalike called Butterchurn. Internet Archive now supports Webamp and Butterchurn. Just click on the llama!

Teaching the wife Diffie-Hellman exchange tonight.

ALPRs can still be abused given the sheer volume of data collected and the lack of transparency in who can request it. “What we actually need, if we want these laws to mean something, are robust oversight measures,” EFF’s @maassive.bsky.social told Spectrum News 1. spectrumnews1.com/ca/southern...

RunDll Exporters www.hexacorn.com/blog/2025/09...

I put together a script to verify that your linux/mac install didn't get a compromised npm package. This, unlike some other checks out there, looks through your prior installed packages to make sure an update didn't obscure the compromise. gist.github.com/TechByTom/5f...

Some say write-ups are too OP. I dressage. We love seeing the work.

Way to go!

I'm one of the 37 targeted below by DNI Tulsi Gabbard. I haven't had a clearance nor worked in government since 2013. This is political theater & a dangerous example of government abusing its powers to punish private citizens for openly exercising their 1st Amendment rights. My full statement:

This is both funny and horrifying. Horrifying because people are using and trusting this tool to be reliable and wrecking careers when it's wrong.

/me cries in HIPPA

PHENOMENAL work by @censys.bsky.social w/special shout out to one of the best cyber researchers out there (Himaja, who is smartly not on social media). They discovered sophisticated proxy infra designed for long-term espionage operations, & most victims probably have no idea they're compromised.

Last thought: while I'm on a tradecraft+capability separation kick, I intend Crystal Palace as an open-ended object/PIC stitching sandbox. Keep playing with it. Try different ideas. It's really cool. This is what organic cross-inspiration and conversation looks like. I pivot when inspired too.

Oh hey, the first video is now available! Check out Steve Shelton’s keynote for #BSides312, the abstract for which had me sobbing.

Astronomers may have just discovered the third interstellar object passing through the Solar System! ESA’s Planetary Defenders are observing the object, provisionally known as #A11pl3Z, right now using telescopes around the world.

This is 100% going into my private C2 www.procustodibus.com/blog/2024/04...

Do not sleep on my blue team 💪🏻

A lot about what I’m going to say, comes back to what role you view the red team fulfilling inside of your organization. Let’s talk about assumed compromise.

Over 300 in attendance today, and more than 100GB of Internets slurped. @bsides312.org was a huge success. Lots of growth from last year. I can’t wait to see everyone again next year!

@lintile.lol TIL “hodling” is actually 4 letters?

Wedding planning and sharing the palate in hex, like any self respecting hacker would.

Good morning, @thotcon

I’m super excited to be part of a team that just earned the BHIS Honey Badger award!

🤨

I wonder what this would mean for investigation tools looking at phishing and payload delivery sites.

A rare personal post from me - my engagement photos just came in, and I’ve got a new wallpaper.

@j0hnnyxm4s.johnnyxmas.net ahem

During pentest postmortem, one of the most important things to identify what your defenders knew, and when they knew it. This should be one of the primary objectives of collecting and comparing timelines. It can help you identify opportunities to improve the effectiveness of your incident response.

Another great #BSides312 talk comin’ atcha!

Imagine how much data you can lose on this bad boy [slaps hood]

I think one of the things that is the most challenging for organizations understanding is the context of how important it is to implement particular remediation mechanism. For example, do we care more about eliminating all local admins, or blocking executable file types?

I always used this as a metaphor for orgs using Red Teams to “teach them a lesson” (whoever/whatever that person/group is). Also, I don’t endorse using a red team as a way to prove your point. Unless, that is, if your goal is to bankrupt your security team’s political capital.

Hardwire your home security cameras.

@subtee.bsky.social there IS an excel world championships. fmworldcup.com/product/mewc...

Zhuowei Zhang released POC code for CVE-2024-53104, a zero-day used by Cellebrite to unlock Android devices -patched in February -used by Serbian law enforcement to unlock the phones of anti-government protesters and journalists github.com/zhuowei/face...

What an awesome project. Debug 64bit windows binaries in your browser. github.com/momo5502/sogen

Not just driverless. Lots of modern vehicles (especially EVs) such as Tesla have always-on cameras in an almost 360 degree radius. That's a lot of data that manufacturers could decide to give away / sell to third parties.

My record length cracked password was ntlm (md4) hashed, and 47 characters long. Lyrics are a bad idea.

The border is a bit of a 4th amendment loophole on search and seizure. Especially concerning with our phones and laptops. Inspired by WIRED recently updating their guidance and put together some with some of EFFs info. www.youtube.com/watch?v=AuEi...

The case of the $20 C2 framework, and how I learned I was “vibe coding“