Behold, the greatest thinkpad propaganda you will ever see

Testing out live terminal session replays on my blog. Same "easy viewing" of a proof of concept as a gif/video except: 1. Super easy to record `asciinema rec file.cast` 2. Super easy to host on my site 3. The best part.... you can copy/paste the text from the terminal replay 🤯

I'm always a little happy when I have to build something from source and see it's written in rust. Cargo is so nice :)

Yeah im just gonna go to bed after that one

lofi hip hop devices to relax/study to

No skips

She keeps the creepers away

I understand now

Cat not enjoying the new record player

They're on to us

TIL: there doesn't seem to be a way to read a raw file from a remote repository using pure git commands without first cloning the repo 🤨 ("Well acktchually 😐☝️" comments welcome)

When looking for obscure issues I always end up with tons files like: poc_final_final2.sh I don't always have time to organize things without the potential of losing my train of thought so I've been trying to find an easy solution. This is my most recent attempt:

Look how beautiful this code-block is on this person's blog ertt.ca/nix/shell-sc...

don't be like me and try listening to the nix evangelists

Anyone successfully using both markdown and silverbullet? Interested in hearing about your workflows for either but specially interested in silverbullet

Happy Monday, all! ICYMI, there's a new version of my comprehensive guide to DevOps-based homelabbing available!

hi, to anyone impacted at Crowdstrike. please feel free to reach out if I can help you land a role at Google or any other shop. happy to do resume reviews, coaching, or referrals. we're always looking for skilled dfir, CTI, SecOps, and many other disciplines! happy to help if I can.

POV: You're a Linux admin working at TikTok

Kubernoodles

POV: Me (allegedly) gaining write access to the internal container registry and setting all container images to mine crypto

I learned so much writing Gubble. Can't wait to release it this week! Any ideas what it could be?

Pass is a really cool CLI and GPG based password manager that follows the Unix Philosophy. Do one thing and do it well. Project: passwordstore.org Setup Guide: ryan.himmelwright.net/post/setting...

As a zoomer, this is what my filesystem looks like

Every week I post a summary of what security ideas I've been thinking about. This week it's mostly ideas from myself discussing the threats and opportunities of AI as well as why I think we're seeing a shift away from the cloud. loworbitsecurity.com/radar/radar7/

All this time put into learning cyber security and I can't stop my girlfriend from downloading a sketchy rewrite of moshi monsters off github

Some invaluable Linux tools I've used this week and some of my personal notes on how to use them in the future:

"Although Cleo published an update and advisory for CVE-2024-50623—which allows unauthenticated remote code execution—Huntress security researchers have recreated the proof of concept and learned the patch does not mitigate the software flaw." www.huntress.com/blog/threat-...

I'm releasing this a day earlier than normal because I'm quite proud of this: This week's topics include: Downstream Impacts of the Telco Breaches, 2024 Insider Threat Report with A Stern Talking To About Branding, and Chasing The Ghost In The Wire loworbitsecurity.com/radar/radar6/

NPM and PyPi "firewall" for preventing the installation of known malicious packages. A very cool idea. github.com/DataDog/supp...

I'm taking netwars for my masters which came with an OVA file. I was messing around with Incus recently so I took some quick notes on using Incus to run a .OVA File grahamhelton.com/blog/incusova/

Some small businesses I enjoy: @ugmonk.bsky.social: High quality items, I own and love most of the desk organizational pieces from the Gather collection. ugmonk.com/collections/...

NO CYBER ATTACKS THIS WEEK PLEASE

In case you missed it, here are my thoughts on some news that hit my radar recently. In this week's post I go over 2024 CISO Salary Data, The Nearest Neighbor Attack, Federated Security Training, and more. Enjoy! loworbitsecurity.com/radar/radar5/

Cyber security related black Friday deals: github.com/0x90n/InfoSe...

Hello my #infosec friends. I have come aboard BlueSky. Would love some follows! :).

Morning! Here are some of my thoughts on recent security trends. This week's topics: Python Digital Attestations, The Fate of CISA, and more. I post these every Monday to help inspire informed discussions of the events I find useful, check it out! loworbitsecurity.com/radar/radar4/

Just unboxed a stat trak factor new fade toothbrush. Willing to trade for a karambit. No lowball offers, I know what I've got.

Anecdotally, Ubuntu 24.04 has had major performance issues on desktop for me. I suspect it has something to do with app armor.

Thinking of checking out brighter shores, has anyone spent time checking it out? Worth it?

I typically don't send these out until Monday, but if you're interested in my thoughts on security news, here is tomorrow's post. loworbitsecurity.com/radar/radar3/

The more I talk to other security consultants, the more I realize that the industry deserves a shake-up. FTE seems more and more like an inevitable path to burnout every day.

You should follow Ricky, he's an incredible security professional and an ever more wonderful human.

The adoption of LLMs that can be used to pump out platitudes that lack any actual security analysis makes it increasingly difficult to have productive security discussions about news and trends. I couldn't find many sources I trusted so I'm starting my own: loworbitsecurity.com/radar/radar1/

This is a really interesting move from Apple. Challenging researchers via a $1,000,000 bug bounty for their new Private Cloud Compute technology, releasing source code, architecture docs, and tooling means apple is VERY confident in this tech. 1/? security.apple.com/blog/pcc-sec...

Passkeys remain mysterious and confusing to me, a cryptographer. I want to use them but every time I interface with them they do something weird.

never attribute to malice what can be attributed to CYBERATTACKS

I do wonder if this report suffers from some level of survivorship bias. The data from the report is collected from companies that can afford Datadog. It's hard to collect data from companies that do not have the expensive security services, potentially skewing the data.

If your company gives you a training budget but no business hours to do the training, they don't actually care about professional development.

Just read the phenomenal "2024 State Of Cloud Security" report from DataDog www.datadoghq.com/state-of-clo... Biggest takeaway is secure by default settings makes a massive impact and violations of the principles of least privilege are really hard problems to solve. Here are my thoughts:

Datadog’s new State of Cloud security report is out. Lots of interesting insights from some of my colleagues! www.datadoghq.com/state-of-clo...