{"generator":"GNU social 2.0.2-dev","title":"Conversation","totalItems":3,"items":[{"actor":{"id":"https:\/\/ioc.exchange\/users\/icrawler","displayName":"icrawler","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/381529-original-tmp20260222111947.webp","rel":"avatar","type":"image\/webp","width":111,"height":111},{"url":"https:\/\/gnusocial.jp\/avatar\/381529-96-20260222162919.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/381529-48-20260222162919.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/381529-24-20260222162919.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"381529"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/381529-96-20260222162919.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"network protocols, [in]secure networks, threat modeling","url":"https:\/\/ioc.exchange\/@icrawler","portablecontacts_net":{"preferredUsername":"icrawler","displayName":"icrawler","note":"network protocols, [in]secure networks, threat modeling"}},"content":"

@soatok<\/a>
I feel you and admire your resolve for all these pro bono works you're doing.. Also your adventures ;) keep me moving forward and endure as well, so thank you. <\/p>

i.e. I recently discovered that some SDK includes a home grown crypto protocol that basically allows a related-key attack... (at that the 'crypto' part was missing in docs thus not easily findable via threat modeling process) It took weeks to persuade a responsible party to seek an independent consultation to confirm my finding , while an initial response was that they don't want to waste precious resources to beautify the code. And I didn't seek neither money nor fame, just wanted to make the world a better place ;)<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-10:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/ioc.exchange\/users\/icrawler\/statuses\/116114007178371720","object":{"id":"https:\/\/ioc.exchange\/users\/icrawler\/statuses\/116114007178371720","objectType":"note","content":"

@soatok<\/a>
I feel you and admire your resolve for all these pro bono works you're doing.. Also your adventures ;) keep me moving forward and endure as well, so thank you. <\/p>

i.e. I recently discovered that some SDK includes a home grown crypto protocol that basically allows a related-key attack... (at that the 'crypto' part was missing in docs thus not easily findable via threat modeling process) It took weeks to persuade a responsible party to seek an independent consultation to confirm my finding , while an initial response was that they don't want to waste precious resources to beautify the code. And I didn't seek neither money nor fame, just wanted to make the world a better place ;)<\/p>","url":"https:\/\/ioc.exchange\/@icrawler\/116114007178371720","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/furry.engineer\/users\/soatok\/statuses\/116110711766383494","url":"https:\/\/furry.engineer\/@soatok\/116110711766383494"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/furry.engineer\/users\/soatok"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-02-21:objectType=thread:nonce=e0907c6a4a64f9a2","notice_info":{"local_id":"12172277","source":"ActivityPub"}},"published":"2026-02-22T16:29:19+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/ioc.exchange\/@icrawler\/116114007178371720"},{"actor":{"id":"https:\/\/infosec.exchange\/users\/SpaceLifeForm","displayName":"SpaceLifeForm","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/theme\/gnusocialjp\/default-avatar-profile.png","rel":"avatar","type":"image\/png","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/theme\/gnusocialjp\/default-avatar-stream.png","rel":"avatar","type":"image\/png","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/theme\/gnusocialjp\/default-avatar-mini.png","rel":"avatar","type":"image\/png","width":24,"height":24}],"profile_info":{"local_id":"61180"}},"image":{"url":"https:\/\/gnusocial.jp\/theme\/gnusocialjp\/default-avatar-profile.png","rel":"avatar","type":"image\/png","width":96,"height":96},"objectType":"person","summary":"Old Geek. Hacking for a Half Century. My Header is an image of a Black Hole without an accretion disk. May be cryptic. May wax philosophical. Big Bang is illusion.","url":"https:\/\/infosec.exchange\/@SpaceLifeForm","portablecontacts_net":{"preferredUsername":"SpaceLifeForm","displayName":"SpaceLifeForm","note":"Old Geek. Hacking for a Half Century. My Header is an image of a Black Hole without an accretion disk. May be cryptic. May wax philosophical. Big Bang is illusion."}},"content":"

@soatok<\/a> <\/p>

These days, when I hear that the problem is outside of their threat model, then I conclude that they are the threat model.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-10:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/infosec.exchange\/users\/SpaceLifeForm\/statuses\/116110874938076312","object":{"id":"https:\/\/infosec.exchange\/users\/SpaceLifeForm\/statuses\/116110874938076312","objectType":"note","content":"

@soatok<\/a> <\/p>

These days, when I hear that the problem is outside of their threat model, then I conclude that they are the threat model.<\/p>","url":"https:\/\/infosec.exchange\/@SpaceLifeForm\/116110874938076312","status_net":{"notice_id":null},"inReplyTo":{"objectType":"note","id":"https:\/\/furry.engineer\/users\/soatok\/statuses\/116110711766383494","url":"https:\/\/furry.engineer\/@soatok\/116110711766383494"}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/person","id":"https:\/\/furry.engineer\/users\/soatok"},{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-02-21:objectType=thread:nonce=e0907c6a4a64f9a2","notice_info":{"local_id":"12169183","source":"ActivityPub"}},"published":"2026-02-21T22:40:21+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/infosec.exchange\/@SpaceLifeForm\/116110874938076312"},{"actor":{"id":"https:\/\/furry.engineer\/users\/soatok","displayName":"Soatok Dreamseeker","status_net":{"avatarLinks":[{"url":"https:\/\/gnusocial.jp\/avatar\/34725-original-tmp20230809073048.webp","rel":"avatar","type":"image\/webp","width":400,"height":400},{"url":"https:\/\/gnusocial.jp\/avatar\/34725-96-20230823231405.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},{"url":"https:\/\/gnusocial.jp\/avatar\/34725-48-20230823231406.webp","rel":"avatar","type":"image\/webp","width":48,"height":48},{"url":"https:\/\/gnusocial.jp\/avatar\/34725-24-20230823231406.webp","rel":"avatar","type":"image\/webp","width":24,"height":24}],"profile_info":{"local_id":"34725"}},"image":{"url":"https:\/\/gnusocial.jp\/avatar\/34725-96-20230823231405.webp","rel":"avatar","type":"image\/webp","width":96,"height":96},"objectType":"person","summary":"He\/him. Gay\/demi dhole (Cuon Alpinus) furry.Blogger, programmer, security engineer, cryptography nerd. 30+Too spicy for Twitter (banned with all the prominent journalists on 2022-12-16)I don't represent any company, individual, or community.","url":"https:\/\/furry.engineer\/@soatok","portablecontacts_net":{"preferredUsername":"soatok","displayName":"Soatok Dreamseeker","note":"He\/him. Gay\/demi dhole (Cuon Alpinus) furry.Blogger, programmer, security engineer, cryptography nerd. 30+Too spicy for Twitter (banned with all the prominent journalists on 2022-12-16)I don't represent any company, individual, or community."}},"content":"

Me: \"If this API is prone to misuse by a careless or clueless developer, that is a security issue that needs fixing.\"<\/p>

Me: \"If the tests pass even if I change the logic of the source code, then the test doesn't actually cover it. I don't care what the code coverage metrics say.\"<\/p>

Me: \"The threat model needs to state its assumptions as well as both risks both mitigated and not mitigated.\"<\/p>

Other projects, apparently: \"Well this attack is outside our threat model so we're dismissing your report, but we'll eventually fix it as a defense-in-depth if we really must I guess.\"<\/p>

Step up your game.<\/p>","generator":{"id":"tag:gnusocial.jp,2026-08-10:notice-source:ActivityPub","objectType":"application","status_net":{"source_code":"ActivityPub"}},"id":"https:\/\/furry.engineer\/users\/soatok\/statuses\/116110711766383494","object":{"id":"https:\/\/furry.engineer\/users\/soatok\/statuses\/116110711766383494","objectType":"note","content":"

Me: \"If this API is prone to misuse by a careless or clueless developer, that is a security issue that needs fixing.\"<\/p>

Me: \"If the tests pass even if I change the logic of the source code, then the test doesn't actually cover it. I don't care what the code coverage metrics say.\"<\/p>

Me: \"The threat model needs to state its assumptions as well as both risks both mitigated and not mitigated.\"<\/p>

Other projects, apparently: \"Well this attack is outside our threat model so we're dismissing your report, but we'll eventually fix it as a defense-in-depth if we really must I guess.\"<\/p>

Step up your game.<\/p>","url":"https:\/\/furry.engineer\/@soatok\/116110711766383494","status_net":{"notice_id":null}},"to":[{"objectType":"http:\/\/activitystrea.ms\/schema\/1.0\/collection","id":"http:\/\/activityschema.org\/collection\/public"}],"status_net":{"conversation":"tag:gnusocial.jp,2026-02-21:objectType=thread:nonce=e0907c6a4a64f9a2","notice_info":{"local_id":"12168891","source":"ActivityPub"}},"published":"2026-02-21T21:21:13+00:00","provider":{"objectType":"service","displayName":"GNU social JP","url":"https:\/\/gnusocial.jp\/"},"verb":"post","url":"https:\/\/furry.engineer\/@soatok\/116110711766383494"}],"links":[{"url":"https:\/\/gnusocial.jp\/conversation\/6175499","rel":"alternate","type":"text\/html"}]}