Notices by Royce Williams (tychotithonus@infosec.exchange)

It's okay to peel that protective film off of the screen of that thing you bought. You have my permission.

@ryanc @m8urnett I'll ask them if they want to donate it to mine 😁

@inthehands Ha! Reminds me of the (less sophisticated):

There once was a man from Peru
whose limericks stopped at line two.

Just going to leave this here for future use. And present use. And past use.

https://www.angryflower.com/functi.html

@dalias So ... are you saying only encrypted backups are backups? 😉

@dalias Very fair! (though there are also security properties for not being able to read a backup, that's kinda a different animal.) Though I'd also argue that there's a fuzzy demarc of immutability for which "disconnected and in a drawer" buys additional insurance. YTMMV as always!

Non-offline backups aren't.

Every org that has been relying on obscurity hiding their backdoor.

(Unfortunately, so is everyone else.)

@dalias generally true, except as written it may silently fail:

https://infosec.exchange/@tychotithonus/116490466168316767

The CopyFail folks shouldn't have routed stderr to /dev/null in their workaround guidance. For some platforms, where it's not a module ... that mitigation is a no-op:

So if there's no kernel patch available yet, you can't use that workaround. Instead, use AppArmor / seccomp / SELinux to block unprivileged AF_ALG socket creation if you can (but don't just turn these hardening layers up if they''re not already in place - they can be tricky)

#CopyFail #CVE_2026_31431

AMAZON: Hey, this thing you bought late last November has a safety recall

ME: Uh, thanks, but ... I bought that for someone's wishlist. Do you know who?

AMAZON: Yes! But I'm not gonna tell you

Not all unexpected additional project work is "scope creep". Sometimes it's"we now better understand how we have to meet original scope, and it's gonna take more effort".

Today's silly actual suggested filename for download of financial statement:

"ten99PDF.pdf"

@roytam1 @nina_kali_nina @mirabilos I wonder if MyDefrag / JkDefrag would also work! Dramatically more features than the stock defrag, but is just a wrapper and uses stamdard system calls for the defragmentation of each file. Not affiliated, just a long-time favorite. (And I wonder whatever happened to its author, Jeroen Kessels?)

RE: https://infosec.exchange/@zak/115793005915790340

This is a metaphor about cybersecurity products.

So if you initiate the phone-to-phone Signal account transfer process, and it almost completes, such that the account is transferred, but the data isn't, and then errors out ... and if you didn't have backups enabled ... then your entire chat history just vanishes into thin air with zero recourse. In other words, Signal nukes your history from orbit on the old phone before validating that it actually successfully transferred to the new phone.

I am indescribably angry right now.

(The extra insurance you need, that I didn't have, was to enable general backups on the old phone first, and make sure that a backup completes on the old phone before initiating the transfer.)

#Signal

"Let us be the repository of your passkeys" and "We may terminate your account at any time and permanently refuse to communicate with you" ... seems like a bad combination?

@patrickcmiller More specops spam

@ryanc Make uptime in scope.

@ryanc Now you just need a poll with three options. 😉