Notices by Viss (viss@mastodon.social)

happy friday, internet

https://m.slashdot.org/story/456046

looks like claude has been your insider threat for a while now

neat!
#homeassistant

i should make a home assistant wet bulb graph

update: it just tickled the red all day then fell off.
totally fine if youre a weirdo hermit like me and dont go outside. less good if you do strenuous stuff outside.

Here's the howto if you wanna do it

https://gist.github.com/Viss/04646803ae950a0b0f1300ef5df99733

#homeassistant

https://www.theguardian.com/us-news/2026/jul/01/empire-state-building-banner-proposal

ill take this over a gender reveal wildfire every day

@pluralistic holy shit! congrats man!

i made this gif in 2016.
ten years ago
its from one of simone giertz' videos from before she got famous.

seems super relevant today.

woo! orbital bugfixes in!

i have in fact, pushed to prod past 4pm on a friday :D

@quinn i miss the days when shit like national burrito day was 'the news'

fucking spectacaular

https://www.theregister.com/personal-tech/2026/06/22/microsoft-accidentally-kills-epic-outlook-email-threads/5259388

microsoft broke replying to email in outlook

my entire angle here was simply:

"if we're not phshing people with what they NORMALLY get hit by, we're doing them a disservice and training them to freak out on false positives, or whatever bogus nonsense got dreamed up by someone who doesnt actually deal with phishing IR all day. we need to be as close to real attackers as possible"

my job was to bring all the redteam creativity i'd been fostering before taking the job into reorganizing the internal twitter security aparatus. One thing of concern at the time (because this was the hot thing in 2011) was internal phishing training.

meaning: running soft, but live-fire phishing campaigns against the staff to measure how they did. *MY* intention was to improve things, but "the market" later ended up just calling this an insurance/compliance checkbox

my program was different

https://www.theregister.com/security/2026/06/22/canadian-health-board-sorry-after-tasteless-phishing-test/5259320

let me tell you a story about the very first time i did an in-house phishing campaign for twitter, after they hired me in 2011

"well, my work gave it to me. i just got hired at twitter and this was one of their onboarding perks"

so what happened next is super super fucking american. super WEALTHY american, specifically.

there was no discussion, there was no phonecall, there was no, like, line of questioning

the steakhouse straight up called their legal team, and had their legal team get in touch with twitters general council

fuckin nope.

one person didnt take the time to click at all, bypassing the entire phishing campaign, they printed out the ticket and walked it to the steakhouse. they presented the qr code to the greeter at the front desk, who went 'uhhh... this isnt real. our gift cards are ... not that.'

this guy insisted. he pushed. so the front desk person went to talk to the manager. the manager ... was not happy.

"where did you get this? why do you think its real?"

so i looked around town for a nice restaurant that had a good selection of stuff, and was on the low end of the 'pricey' side of things, and dreamed up a phishing lure:

a QR code for a 20% off coupon at a nice steakhouse in sf that was popular at the time. the place didnt actually use QR codes as their gift cards. they were super fancy, magstripe cards handed out in little envelopes so guests could feel special. I figured a jpeg of a qr code emailed to people would be a dead giveaway

and twitter at the time was squirting money all over the place. staff got all sorts of perks.

so i figured - hey, all these 20somethings fresh out of college are going back home after work and gushing to their friends about how much cool shit they just got from their cool new job - thats 100% a vector, i should take advantage of that.

so i spent a couple weeks noodling on it. That time was my onboarding.

see, at the time, twitter would fly noobs up to the office in sf for 2 weeks of onsite trainng. part of that, amusingly, was me doing a presentation to the noobs about "welcome to twitter, you now have a target painted on your back, people will try and phish you to either get shells or to get access or to get intel etc. you have to be careful now. just by working here, your risk goes up"