RE: https://mefi.social/@aneel/117498357032132827

This is the most perfect example of the Dadaist Hell that is the current infosec datascape that I can imagine. Genius. Chef's kiss. No notes.

yeah, the next round of roll my own (I'm parked at a host atm, since it becomes their problem, just turn the site off at rate limit, I don't care.) I'm loading in fail2ban. I had a honeypot running for a while, just to test intrusion events, but jeezy creezy, having one of the oldest sites on the internet means you're on a lot of lists I guess.

So, I’ve mentioned before that I have a site I’ve had since 1995 that I had to strip down to a single page because a Chinese company started using my name, but seems to have no interest in buying the domain.

I tell you that story only to tell you this one, I’ve been hit over 50,000 times with ai bots in the last 12 hours. They’re doing lateral path searches, like /etc/passwd and /etc/shadow, and just pounding SSH. (HP1 has been slurped, confirmed.)

Anyway, if your #server has #bandwidth limits, now is a good time to check on those.

#infosec #sysop #StupidestTimelineEver

People have said to me, they've said, "MissConstrue, you claim to be an evil supergenius, and yet you seem suspiciously good. When, precisely, have you ever committed evil?"

And I say unto them: Witness my acts, you doubting dolts! For I have sent out, unaccompanied, with NO supervision, a Senior engineer...to buy a suitable outfit for a fancy dinner.

And I did this to a man I *love*! And you doubt my capacity for evil. Simpletons!

Rats have more empathy than MAGA Republicans.

This slipped past my radar when it happened, but this ruling is a significant sea change in #copyright vs #LLMs training theft.

The U.S. Court of Appeals for the Third Circuit ruled on September 29, 2026, in Thomson #Reuters v. ROSS Intelligence, that using copyrighted text to train an #AI model does not constitute fair use when the AI product directly competes with the original work. 

For authors and artists who have seen prompts like “in the style of Terry Pratchett, or in the style of David Hockney”, this is an important ruling. All bets are off when it comes to the Supremes though. I guess we need to find out how much Reuters has preemptively paid #GOP whisperers to know if things will go their way. https://www.courthousenews.com/ai-training-of-copyrighted-material-not-fair-use-third-circuit

SAFE FROM WEALTH

Everyone, I have a suggestion: New Skill November.

#NewSkillNovember

RE: https://dobbs.town/@cosmictrigger/117490576139563736

It’s rare that I would suggest a step as drastic as removing our national drinking song and replacing it with a more time appropriate ditty…and yet, It’s Time For Guillotines.

https://www.youtube.com/watch?v=TMHCw3RqulY

I would like to say, that if I am found murdered with no apparent method of death, it was the cats.

I had the studio open to the catio. What I had not realized is that the honeysuckle had grown through the exterior door, cracking it open enough for a mouse to get in.

Athena and Purrsephone had it cornered, I put on my welding gloves, and tossed the wee mousie back outside and closed the catio.

They are not pleased. They demand that I open not only the catio, but the door to the outside, where many more furry toys await. My refusal is being treated an offense to all things cat.

#catsofmastodon

RE: https://discuss.systems/@ricci/117483934159219855

This is an astonishing thread. I was posting about disasters as they were revealed, but Rob was mitigating in real time.

If you are still trying to figure out what happened, why, and how it isn't really over..this is a really good explanation from the sysop perspective.

My debut novel, AETHER AND EGO, is featured on Mary Robinette Kowal's blog today!

https://maryrobinettekowal.com/journal/my-favorite-bit/my-favorite-bit-joanne-merriam-talks-about-aether-and-ego/

#bookstodon #booksta #bookstagram

Hey, self-hosting people, need your help!

Could you recommend static site generators suitable for non-technical people? i.e. Ones that work without needing any command lines, that work entirely graphically.

(There's an odd paradox that static sites are technically much simpler but their editors are often harder to use.)

#StaticSite #StaticSiteGenerators #AskFedi

You know, sometimes you see a thing on line and you think, there is no way that exists, it must be ai, but what if, though…
May I introduce you to Alfred. He is real. His little claws move, his tail moves, he’s actually leather, he has wee legs and feelers! Y’all… I have a crawdad bag. This pleases me to no end.

A billionaire #EpsteinClass member has spent hundreds of millions of dollars in Washington to make sure little girls have to have their vulvas examined if they want to play sports. It is not now, nor has it ever been, about protecting women.

#transrightsarehumanrights

Apologies for edit; switching link from proprietary enclave to publisher:
https://www.theguardian.com/us-news/2026/oct/21/washington-anti-trans-sports-genital-exams

#WomensRights #NoMandatoryCSA #KeepGOPOutOfChildrensPanties

@MissConstrue and now, Node.js! https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Wanna take your mind off the sobbing infosec people in your life? Keep eyes on #Israel. I mean, it won’t make you feel better, but this way you can layer your anxieties, and thus keep panic at bay.

I may not understand how to keep panic at bay.
https://www.npr.org/2026/10/21/nx-s1-6010460/brad-lander-detained-west-bank-israel-palestinians

Oh. My. Bob. It is a hella day to be in #infosec, I tell you what.

#Gitlab has a CVSS 10! and released critical patch updates on October 21, 2026, addressing multiple severe vulnerabilities including an unauthenticated Remote Code Execution (#RCE) flaw.

The patches cover GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

The update fixes CVE-2026-110264, a CVSS 10.0 integer overflow in the regular expression compiler that allows unauthenticated code execution across all self-managed versions dating back to 7.0 (2014).

The release also remediated 10 additional security issues, including cache poisoning in OAuth/OIDC endpoints (told you it was problematic).

Administrators of self-managed GitLab instances are strongly advised to upgrade immediately, as GitLab.com and GitLab Dedicated tenants already have the fixes applied.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

RE: https://infosec.exchange/@briankrebs/117467920904451947

Ya know how most vpns are owned by data brokers? Who could have predicted that ransom negotiators (which is apparently a real job in this bobforsaken timeline), would collude with the extortionists when the vig for millions of dollars is on the line.

Brian, once again bringing receipts.

#ShinyHunters #ransomware #krebs

Oh hey, while we're on the topic of the datascape being a nightmare under attack by clankers;

The private keys of eight #eMudhra intermediate certificate authority (CA) certificates are compromised, #Mozilla and Google's #ChromeRoot Program confirms on October 20.

An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept.

Scott #Helme, (@ScottHelme) a security researcher, recovered all eight private keys from the public certificates on his laptop in under a second, one of them is the number 4 and the rest are also whole numbers below 256, and he said that an AI agent did the same from a single prompt.

https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

#infosec #truststore #CertificateAuthority