@tilde@infosec.town
@tilde@infosec.town avatar

tilde

@tilde@infosec.town

๐ŸŒธ "High-end nondescript." ๐ŸŒธ

#Nonbinary ๐Ÿณ๏ธโ€โšง๏ธ #Trans ๐ŸŒˆ #Queer ๐Ÿง  #Disabled ๐Ÿ• #Jewish ๐ŸŒน #Socialist ๐Ÿด๐Ÿšฉ #AntiFascist ๐Ÿ™ #Urbanist.

๐Ÿต Limitless green tea & matcha; elaborately-prepared coffee in moderation. โ˜•
๐ŸฅŸ Dumplings & soup, therefore: xiao long bao. ๐Ÿฑ
๐ŸŽฒ Immersive and site specific theater, storytelling & roleplaying. (Most recently: Pathfinder, Quest)
๐ŸŒธ Cherry blossom season. (Even if in the SF Bay area, they're mostly plums.). ๐ŸŒบ Wildflowers of all kinds. ๐Ÿชป
๐Ÿงฑ Gently dissociating with elaborate Lego sets and podcasts or audiobooks. ๐ŸŽง
๐Ÿ•๏ธ Hiking, sailing, being among trees. โ›ต (And so can you! semperexplorandum.com)

๐Ÿ’ป #Technologist ๐Ÿ“ฃ #Activist & โ˜” #ProductManager in ๐Ÿคซ #Privacy, ๐Ÿ”’ #Security, &.๐Ÿ‘๏ธ #TrustAndSafety. ๐Ÿ›ก๏ธ
๐Ÿซฐ๐Ÿป Current gig: Head of Product for Red Queen Dynamics. redqueendynamics.com
โŒ› Previously: Tall Poppy, https://mastodon.social/@brave, Committee to Protect Journalists, https://mastodon.social/@torproject, https://mozilla.social/@mozilla. tildelowengrimm.com/#experience
๐Ÿงญ Volunteering: Explorers Guild, Cornell Clinic to End Tech Abuse, Call of the Sea, Techies for Reproductive Justice.

๐Ÿคณ๐Ÿป Avatar alt text: a white person with high cheekbones and dark eyes looks squarely at the camera. Asymmetric purple and indigo curls fall on one side of their head.
๐Ÿ•น๏ธ Header image alt text: magenta and blue lighting falls over a collection of retro electronics: an original Game Boy, a Commodore, an IBM-style mechanical keyboard and more.
๐Ÿ“ท Header/banner image is "vintage gray game console and joystick" by Lorenzo Herrera, used under the Unsplash license. unsplash.com/photos/p0j-mE6mGo4

๐Ÿ“ Unceded Ohlone land in the Confederated Villages of Lisjanโ€™s territory. Pay your Shuumi Land Tax to support rematriating stolen land. sogoreate-landtrust.org/shuumi-land-tax/

This profile is from a federated server and may be incomplete. Browse more on the original instance.

tilde, to random
@tilde@infosec.town avatar

In Dungeons & Dragons, the Sending spell can convey exactly 25 words. In reality, linguists are unable to precisely pin down what a word is. Sending is one of only a few long-distance magical communication methods in the worlds of D&D, and this makes it an important tool in the hands of those who run large organizations, kingdoms, or empires.

This implies that mystical linguists in D&D worlds are out there pushing the technological boundaries of what constitutes a "word", experimenting with different hyphenation techniques, and assembling new compound languages like the fabled "Hypergerman", which are particularly amenable to compounding. All to improve the efficiency of Sending, and eke out a little more information from each scarce spell slot. How much additional information can you add if you start experimenting with tones?

I'm just imagining the รฆther-messengers of the Imperial Bureaucratic Service constructing Sendings with all the comprehensibility of a dialup modem sound, and blasting out whole paragraphs of information to someone on the other end who has Keen Mind and has to spend an hour with a diabolical grammar and particle reference translating this data-pulse back into the trade tongue.

tilde, to random
@tilde@infosec.town avatar

I know that those little "library" take-a-book/leave-a-book hutches on people's porches in bougie neighborhoods like mine turn out to be a bit of a moral hazard because they create the impression of library availability without materially supporting the fundamental mission of libraries (and therefore sap actual libraries of support). But I'm a sucker, I love the รฆsthetic, and they're a lot of fun to browse when I'm out and about. Plus, I try to pre-order new books to support my favorite authors, but I don't really want a ton of paper books in my house โ€” a few, yes, but I mostly prefer audiobooks and ebooks. Those "library" boxes are an easy way to give away those pre-ordered books which don't deserve a permanent place on my shelves once the electronic & audio editions are available.

I have a lot of public-domain books, audiobooks, and other media that I love to share with my housemates, neighbors, and friends. I think it would be really neat to have a sign out front which sort of looks like one of those library boxes, but actually tells people how to access my virtual library either locally on their phones or later on their computers at home.

The number one way I've tried to share things so far has been a shared folder on a NAS which I make available via Tailscale. Which absolutely works for the total nerds who comprise a large fraction of my friends, but not so much for the people who'd have a harder time locating their own copies. (To be clear: I have spent a lot of time searching for copies of esoteric documents, cleaning up bad formatting and metadata, and generally managing my personal media archive. There isn't an online directory which reasonably matches mine.) And it absolutely doesn't work for anonymous access by any neighbor who wanders by and sees a QR code or types in a link.

I'd like to share things in a straightforward way which is more accessible to less-technical folks. I would prefer not to use a commercial hosting service because I don't want to deal with them being pro-active copyright overzealots โ€” I have absolutely zero confidence in their ability to understand that some books are actually in the public domain or appropriately-licensed, and I have no interest in spending time arguing with their support people. And besides, I have wonderful gigabit fiber at home, so why not be the archivist I want to see in the world and share things from a box of hard-drives in the basement? Plus, local copies make it easier to share with anyone walking past, regardless of their cellular connection.

I am sure that I am not the first person to want to host a collection of books and so on which they make available to others? What tools should I look at for sharing things locally on my network, remotely to friends, and easily to any anonymous person who walks by?

tilde, to random
@tilde@infosec.town avatar

Yesterday, I switched my account from mastodon.social to infosec.town: a newish Firefish instance run by the same people (mostly Jerry) responsible for infosec.exchange. I've mostly abandoned the idea of running a bunch of semi-connected accounts on different servers, so all my other accounts on tech.lgbt, sfba.social, and infosec.exchange are now marked as pointing to this one. If you're seeing this post, then hopefully everything has gone according to plan and you've automatically switched over to following the new account.

The biggest reason for me to switch to Firefish is that it allows you to copy over all of your posts rather than having to leave that whole history behind. That's the missing feature which has kept me feeling locked in on mastodon.social โ€” a service I picked way back in the day because it seemed like a reliable default rather than any more thoughtful basis. "Migration is easy!", they lied. Migrating between Mastodon accounts leaves so much behind, so I've felt stuck there to mastodon.social. I couldn't even change my username on the same server to match my new name without losing my history, which really makes me sad.

First impressions of Firefish: this seems like a really complete and full-featured app. It's gorgeous to look at, and full of bells and whistles โ€” but none of that is overwhelming. And the timeline view is absolutely gorgeous. The PWAs work great on mobile and desktop. The only big downside is that @ivory only currently supports Mastodon servers. Firefish say that they're coming out with their own native clients at some point, but I'd much rather use Ivory.

Heya from over here on Firefish. ๐Ÿ‘‹๐Ÿป Hop on in, the experience is great.

tilde, to random
@tilde@infosec.town avatar

Look, the internet of things is generally utter garbage. But I have a product idea which I know I could sell a million of. It's just a smoke alarm, but you get a push notification telling you to replace the batteries a whole week before it starts beeping at 4am.

tilde, to random
@tilde@infosec.town avatar

"Fortune favors the bold." is a common misconception. What you're actually seeing there is survivorship bias. Most adventurers don't survive the first goblin, but nobody tells stories about them.

tilde, to random
@tilde@infosec.town avatar

"No wonder they have so much time to do their laundry." hit me like a dagger between the ribs.

RE: hachyderm.io/users/deirdresm/statuses/112245691846182472

tilde, to random
@tilde@infosec.town avatar

The child tax credit cut child poverty in half in the US. As soon as it expired, child poverty went right back where it was. Poverty is a choice โ€” a policy choice. We could end most poverty today by just giving people money โ€” that's exactly what the child tax credit did.

Not all poverty can be directly solved with cash payments, but most poverty can. Far and away the number one cause of poverty is not having enough money. And when someone has other problems too, money makes those other challenges easier to face.

For decades โ€” in fact most of a century since the early forays into a welfare state โ€” our society has had the means to almost completely abolish poverty and deprivation. We justโ€ฆ keep deciding not to. The example of the child tax credit shows just how easily and quickly cash payments can end poverty. That choice continues to be available, and the implementation is so straightforward.

The number one cause of poverty is not having enough money. When we give people money, they stop being poor. We have the money, and we have the means to give it out.

tilde, to random
@tilde@infosec.town avatar

Reading Scatter, Adapt, and Remember back to back with Four Lost Cities, @annaleen comes off as something of a luxury travel writer whose destinations just happen not to exist any more. It's as if they started with an obsessive need to understand how cities and societies fall apartโ€ฆ and so naturally went on a wold tour of climate scientists, historians, and archeological sites. The books are just kinda an inevitable side effect which occur naturally when a science (fact & fiction) writer and journalist tracks down a thought which they simply cannot get out of their head any other way.

tilde, to random
@tilde@infosec.town avatar

In the 90s โ€” so the story goes โ€” the APA noticed that they were basically only diagnosing boys with ADHD, so they checked, and, yep, girls get it too, it just looks different because โœจreasonsโœจ. So they invented the inattentive subtype for ADHD to make sure girls got diagnosed too. And anyway it is so strangely validating not only to finally have a formal ADHD Diagnosis, but also to specifically have Girl ADHDโ„ข, because yes, obviously, correct.

tilde, to random
@tilde@infosec.town avatar

Pleased to report that I am now tilde.69 on Signal.

tilde, to random
@tilde@infosec.town avatar

I have two eSIMs in my phone (iOS). One of them is the number I actually use and my primary data plan on Google Fi. The other one is a backup data plan on Visible (Verizon) with coverage for my watch (because Fi still doesn't support Apple Watchโ€ฆ or vice versa. It seems complicated?).

Unfortunately, the other (Visible/Verizon) plan comes with a phone number which also receives calls. Lots of calls. Lots of spam calls. I've added the number to the FTC do-not-call list. I have the carrier anti-spam setting on. I have Nomorobo installed. I still get half a dozen spam calls a day. iOS has a setting to ignore calls from unknown numbers but that applies to both lines. I get calls from unknown numbers on my actual number on the Fi line, and I want to receive those.

I just want to stop getting calls on my secondary number all together. Or forward them all to the void. I don't need that number for calls, and I want them to stop bugging me. Is there some carrier magic I can do to eliminate voice calling? [This is a request for assistance, solutions or recommendations are welcome.]

tilde, to random
@tilde@infosec.town avatar

What's the word for when you feel lethargic and antsy at the same time? Like you absolutely have to do a bunch of things right now, but doing anything is utterly impossible?

tilde, to random
@tilde@infosec.town avatar

The greatest power fantasy of D&D is that getting a full night of rest will leave you fully healed and refreshed.

tilde, to random
@tilde@infosec.town avatar

A solid argument that the term "antisemitism" has had its time, and we make life easier and more straightforward by using terms like "anti-Jewish hate".

Original on Twitter: twitter.com/sim_kern/status/1786500008742687217
Thread compiled off-site for those without an account any more (good work): threadreaderapp.com/thread/1786500008742687217.html

And some bonus reading on the history of the term: academic.oup.com/ahr/article/123/4/1139/5114731

tilde, to random
@tilde@infosec.town avatar

What the heck is "default opt-in"? Is this corporate consent-subversion talk for "opt-out"? Just say "opt-out". mastodon.social/

RE: mastodon.social/users/arstechnica/statuses/112457773374003138

tilde, to random
@tilde@infosec.town avatar

I have done one (1) plumbing. Please clap.

tilde, to random
@tilde@infosec.town avatar

Wizards in D&D like to pretend that they're geniuses who understand the essence of reality itself while Warlocks are just magical sugar babies. Sure some wizards like Mordenkainen & Leomund unpick the weave and discover some foundational principles of the universe. But 98% of D&D wizards are just script kiddies. They're just running someone else's code with the barest clue how it works.

tilde, to random
@tilde@infosec.town avatar

I am one thousand percent here for Ify Nwadiwe and Brian David Gilbert to host the new season of Um Actually. They have a fantastic chaotic energy which I'm looking forward to seeing together. And the new set is ๐Ÿ”ฅ๐Ÿ”ฅ๐Ÿ”ฅ youtu.be/pe6lnxZ9QbI

tilde, to random
@tilde@infosec.town avatar

Q: How do you get to Robert Moses State Park?
A: By car.

tilde, to random
@tilde@infosec.town avatar

Look, I'm all for bodily autonomy. Trans rights are human rights and all that. But I think that your right to gender-affirming support ends when it harms your community. And these modern trucks are more dangerous than basically any other vehicles on public roads. The massive raised hoods almost guarantee that any pedestrian they hit will be thrown under the wheels. And by the same token they make the sightlines on these vehicles impossible. I'm 5'11" and I can stand in front of some modern trucks and be invisible to the driver. I just think that we should place some common-sense restrictions on how dangerous a vehicle can be to the people around it โ€” regardless of how empowering and affirming it is to the driver.

tilde, to random
@tilde@infosec.town avatar

Whose idea was it to wrap single-use compostable cutlery in individual non-compostable plastic bags? What even is going on here?

tilde, to random
@tilde@infosec.town avatar

In addition to the one very polite (though sometimes loud) bird who lives inside the house, there are simply too many extremely loud birds who live in the garden and are on birdie-Tinder at the top of their tiny lungs at a truly unreasonable hour. Send help.

tilde, to random
@tilde@infosec.town avatar

I have to agree with Brennan/Gurdy on this: of the many honeyed confections, baklava is king. (And by far the best baklava I've had in the SF Bay Area is from Baklava Story on Harrison Street in SF.)

tilde, to random
@tilde@infosec.town avatar

My security friends keep asking me what it is that we actually do at Red Queen Dynamics. I just sent this pretty-concise explanation privately. I think it's a reasonably good summary for folks who aren't elbow-deep in this every day of the week.

Security and compliance are difficult. It's hard to understand because it's so convoluted, it's hard to know if you're doing the right thing, and often compliance especially is a big short-term push to get the thing done. We're trying to be an executive functioning prosthesis for this, taking away a bunch of the garbage work like unending spreadsheet checklists, and also the mental overhead of not knowing the right thing to do.

So we made a little app which contains all (most of) our knowledge about security and also maps that to a bajillion compliance frameworks like NIST's cybersecurity for SMB, the defense industrial base's CMMC, and the CIS controls, as well as a bunch of the underwriting checklists for cybersecurity insurance providers. We know that password managers, automatic updates, and phishing-resistant auth are important. Our clients know that they need (ex) CMMC self-attestation and cyber insurance. And we've built this kinda deduplicated knowledge graph of all of that.

We send a question or two a week to everyone in an organization. And those questions are mostly written by me and are human-readable. We ask some calibration questions to know who's who at the org and then send the right people the right questions to get a more-or-less comprehensive human-level understanding of the org's security/compliance posture.

Most people at the org just do this two-minute task a week, and the app compiles all that info, digesting it for their technical leaders or their MSP or whatever. It spits out insights for them like "You said you wanted to get cyber insurance, and here are the three things you can do to get guaranteed good rates and expedited processing." (with the knowledge that they are actually complying with the terms of the policy!), or "You said you wanted to be CMMC compliant, and you still need to make this technical change to get there.", or "You've reached compliance with CIS v8 IGA, would you like to print of a serious-looking PDF self-attestation document to show someone?", or "You said your business has a high ransomware risk, but your backups aren't really ready for that. Here's what to ask your MSP for." or whatnot.

In a nutshell, we've built something which takes like 60-80% of the general-purpose security/compliance expertise of someone like me or @Tarah (or the people who ask me this question), and we make it available to small businesses who absolutely could not afford a couple of hours of our consulting rates. And! We encourage small, consistent, incremental long-term improvement rather than rushed/hurried compliance cram-sessions.

And (mandatory self-promotion ๐Ÿ˜ฌ) you can sign up today at signup.dynah.net/ or learn more at redqueendynamics.com

tilde, to random
@tilde@infosec.town avatar

"We abolished the inheritance of political power; why, then, should we not abolish the inheritance of economic power, too?"

insidestory.org.au/the-case-for-banning-billionaires/

  • All
  • Subscribed
  • Moderated
  • Favorites
  • โ€ข
  • JUstTest
  • kavyap
  • DreamBathrooms
  • cisconetworking
  • khanakhh
  • mdbf
  • magazineikmin
  • modclub
  • InstantRegret
  • rosin
  • Youngstown
  • slotface
  • Durango
  • tacticalgear
  • megavids
  • ngwrru68w68
  • everett
  • tester
  • cubers
  • normalnudes
  • thenastyranch
  • osvaldo12
  • GTA5RPClips
  • ethstaker
  • Leos
  • provamag3
  • anitta
  • lostlight
  • All magazines