mkultra tournament edition

so if I jump in it'll just kick me out the other side? neat.

> ... a cinematic search for an elusive group - CLODO - that bombed computer companies in 1980s Toulouse, France. Journeying through the cybernetic nodes of military, industrial, and socialist development, the film exposes how recording devices fail to collect the ashes of history.

Cool thrift store find today. I know it's Nortel, but I heard it so much f'ing with them locally bitd that "Meridian Mail. Mailbox?" is permanently etched in my brain. I also want to build an Ithaca version of Telehamster (telehamster.net) but am also scared of picking up phones.

Apparently my 2009 app store 99c goldrush slop app got linked in Wired back in the day. If I remember correctly I didn't renew my dev license and it got delisted a few months later. Still, time to add "featured in wired" to my CV.

Not going to DC this year (boo.) but I wanna flog the cool badge co-worker bud is bringing to @defcon.bsky.social this year for badgelife peeps to get sweaty over. www.instagram.com/reels/DZVt7t...

Reached out to (politely) ask a vibe-coded app to stop scraping my data; too aggressive, no caching, repeated expensive queries. Got back a very apologetic email that was an LLM'ed "you're absolutely right" response. I mean, I'm glad they knocked it off but an all-bot interaction is just a bummer.

correction, also the parade. gotta carrot this year too.

"My Dinner With Andre" (coworker pointed out my shirt situation halfway into the day)

the book sale is Ithaca's only recognized civic holiday

A critical security issue I've been trying to report to SpankMatch/SpankChain since Dec 2023 has finally been addressed. This post details that, plus the shitshow the waning days of GCR were. Quote GCP: "The product team has currently not expressed interest in proactively reaching out to users."

Firebase should require a written aptitude test at this point, jesus.

#DITC

"Because everyone else lowered the bar, we decided to join them" is so on-brand...

I've still not heard back from anyone. It's is an issue that's survived the shutdown of SpankMatch and I've sent emails about since _Dec 2023_. Root cause is in the email & I'd be happy to answer any Qs. I'd normally do this over email but bsky is the only response I've had. @spankchain.bsky.social

Missed this when it came out, good shit. At this point I don't think it's controversial that Firebase should be "considered dangerous" in the slop era (and in the past) but it's just going to get worse and have a super long tail. I'd complain about Goog's response, but meh, Always Has Been.

hooray for mail day

Pre-order arrived, finally got a chance to listen. Holy hell.

I WARNED YOU ABOUT [GitHub PATs (classic)] BRO !!!! I TOLD YOU DOG! [2025-12-17] amenbreakpoint - Reported information disclosure in a GOV.UK service [2025-12-10] amenbreakpoint - Reported information disclosure in a GOV.UK service

Smells like GCP's "allAuthenticatedUsers" principal footgun...

At this point I believe I've received a copyright claim from every member of KISS except Peter Criss. Working on it.

We stand with our colleagues and fellow members in full solidarity - this unfair and illegal arrest is an affront to a free press. ✊💔

Make sure to do the good shit on Signal, not here.

had a nyquil dream that was just my brain trying to workshop bootleg shirt mashups of ikiru and akira. all bart ska-mpson level disasters.

"Yesterday’s flexibility has become today’s insurmountable technical debt." Put it on my tombstone.

I've seen a TON of ways to fuck up Docker/OCI image builds and leak build context, secrets, etc. but I just reported one to a vendor that I've never seen before: they leaked a GitHub PAT through the build _provenance attestation_ and they'd been leaking multiple tokens for a few years (!). Wild.

Aaaaand Firebase claims another one. The misconfig rate for Firebase/appspot buckets and Firestore DBs has gotta be one the worst for a "turnkey" system.

Today I'm publishing my writeup about a number of security issues I reported last September to Zigazoo, the self-described "World's Largest Social Network for Kids!". Impact included access to all user records, uploaded media (inc deleted items), account escalation, and user impersonation.

jazz is the brown notes you _don't_ play