Justin M

Justin M

@justinm.one

Working on security in tech. Opinions are my own :) If you have a large audience, please do not RT me

934 followers611 following1.1K posts

Justin M reposted

Kevin Jones
@vcsjones.dev

My kid’s puzzle board leaked the EC private key for the emsign intermediates month ago.

Justin M reposted

Revolving Door Project
@revolvingdoordc.bsky.social

A major Silicon Valley venture capital firm has hired former Obama press secretary Jay Carney — just as Democrats are poised to retake Congress and hold Big Tech accountable.

therevolvingdoorproject.orgDemocrats Shouldn’t Let Jay Carney Bring Back The Obama-Era Tech Friendship | Revolving Door ProjectObama administration alum Jay Carney is tapped to mend Silicon Valley’s relationship with Team Blue as Dems seem poised to win big in the midterms, and possibly start to hold Big Tech accountable…

Justin M reposted

Benn Jordan
@bennjordan.bsky.social

It should be illegal for campaign funds or PACs to buy ads, send unsolicited messages, or send mailers about anything other than the candidate and policies they're backing. What's even wilder is when these candidates won't even show up to debate the person they're smearing!

Justin M reposted

Jason Koebler
@jasonkoebler.bsky.social

Replying to @jasonkoebler.bsky.social

Security through obscurity is a terrible principle but in practice a lot of things didn't get hacked bc people ignored them, or didn't know they existed, or just generally got missed. AI makes it easy to probe all of these things at scale + makes it easier to find/develop exploits

Justin M
@justinm.one

Just another Tuesday

nightshade →home, for now@nightshade.technology

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

Justin M reposted

Tangled
@tangled.org

Next year, we will assign one issue to every kid in America. This will be the first of many.

Justin M
@justinm.one

If this was promoted by Meta's algorithms, then amplifying this was Meta's first-party speech.

Ryan Mac 🙃@rmac.bsky.social

On X, users have circulated nonconsenual AI videos created by Grok of a woman they think is Jane Doe. They continue to spread her name. People have praised X for staying relevant for AI and tech conversation. But it also is the main vector for a doxing. That is X. www.nytimes.com/2026/10/16/n...

nytimes.comWhen a Social Media Mob Came for Cornell’s Jane DoeAfter a former student named seven men in a lawsuit saying they had sexually assaulted her, a movement gained steam online to reveal her identity.
Justin M
@justinm.one

Why don't they just train people how to use RSS? Or provide training on how to use an independent PDS on Bluesky (immune to censorship)? Just move people away from Instagram and TikTok to take their power away... it isn't hard.

Josh Sternberg@joshsternberg.com

Meta took down the No Kings instagram; TikTok banned the Musk documentary account for supposedly violating its political posting policies. A reminder that platforms are owned by the wealthiest of people, control the means of media distribution, & put their thumbs on the democracy scale as they wish

Justin M reposted

Bluesky
@bsky.app

no kings includes billionaires who think they’re kings

Josh Sternberg@joshsternberg.com

Meta took down the No Kings instagram; TikTok banned the Musk documentary account for supposedly violating its political posting policies. A reminder that platforms are owned by the wealthiest of people, control the means of media distribution, & put their thumbs on the democracy scale as they wish

Justin M reposted

Micah
@rincewind.run

it turns out that “optimize for engagement” and “optimize for societal best outcomes” are opposing goals and if you look at the entire history of the tech industry you can see which of those two wins out

Denny Carter@dennycarter.bsky.social

Facebook back in 2021 temporarily turned off the “drive people insane” setting and it completely changed what people were seeing. They turned it back on when engagement dipped by like 1 percent.

Justin M
@justinm.one

Currently reading a codebase and seeing how sloppy it is (and has been before the advent of AI), and now I understand why the team behind it loves AI...

Justin M
@justinm.one

At random, checked an old list I had of suspected bot accounts. It's quite surprising to see one particular account has not only not been banned, but has grown in followers (and a handful of accounts I respect are following it). Checked on it, and it is still posting disinfo. Ban the follow button.

View full thread
Justin M
@justinm.one

Humans never evolved like this. We lived in tribes and villages where thieves and liars would be imprisoned or chased out. And this removes them from the social hierarchy even for those who have not heard all of the details about said crimes. The follow button completely neutralizes this.

Justin M
@justinm.one

Great solution for the problem. Communities oriented around ideas are much more normal in terms of human interaction. E.g. You go to Church, or a movie, or etc. and interact with other people who are there for the same reason as you. This is the virtual implementation of the same dynamic.

alex benzer@alexbenzer.com

we have an idea for communities in the app that we're calling "spaces" — places where people can gather around shared interests or social groups. here's a peek at some early prototypes. these are explorations, not polished or final. looking for feedback, esp from community builders 👀

Justin M
@justinm.one

At random, checked an old list I had of suspected bot accounts. It's quite surprising to see one particular account has not only not been banned, but has grown in followers (and a handful of accounts I respect are following it). Checked on it, and it is still posting disinfo. Ban the follow button.

Justin M
@justinm.one

Really - that conclusion might seem unexpected, but it is the follow button that enables this sort of dysfunction. It completely distorts normal social hierarchy and forces every single individual follower to do their own vetting on an account. And tough luck if your mutuals screw up their vetting.

Justin M
@justinm.one

Now this is how to steal an election

NPR@npr.org

Voters are already voting in the midterms. This year, some voters are trying something new to get ready for the election: asking AI to help research their ballot and even decide who to vote for. n.pr/3U2U8uW

n.prVoters are increasingly using AI chatbots to fact-check and compare candidatesVoters are already voting in the midterms. This year, some voters are trying something new to get ready for the election: asking AI to help research their ballot and even decide who to vote for.
Justin M
@justinm.one

Now this is how to steal an election

Thomas Germain@thomasgermain.bsky.social

I just did the dumbest thing of my entire career to prove a much more serious point. I tricked ChatGPT and Google, and made them tell other users I’m a competitive hot-dog-eating world champion People are using this trick on a massive scale to make AI tell you lies. I’ll explain how I did it

Justin M
@justinm.one

Artifactory privilege escalation - I'm _fairly_ certain a basic static analysis tool could've caught this. This is also a systemic weakness in JSON web tokens; most libraries let you get at the payload without validating the signature.

Justin M reposted

Andy Craig
@andycraig.bsky.social

The Constitution allows it. South Korea has proven it works. If you want to make impeachment viable—and so much else is pointless if you don't—then it can be done by a simple majority adopting a simple rules change: vote on the verdict by secret ballot.

theunpopulist.netA Democratic Senate Should Adopt Secret Impeachment Ballots on a Priority BasisSuch a change, requiring no constitutional amendment, would free senators to vote their judgment instead of their fears

Justin M reposted

Justin M
@justinm.one
404media.coCandy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your LocationA hack of location data company Gravy Analytics has revealed which apps are—knowingly or not—being used to collect your information behind the scenes.
Baptiste Robert@fs0c131y.com

🛰️ The Gravy Analytics breach exposes how easily citizens can be tracked: - Seen at Space Launch Complex 36 - Work commute mapped - Stops at Home Depot & family visits near Kansas City logged 🔒 A stark reminder of the privacy risks in location data collection.

Justin M
@justinm.one
404media.coCandy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your LocationA hack of location data company Gravy Analytics has revealed which apps are—knowingly or not—being used to collect your information behind the scenes.
Baptiste Robert@fs0c131y.com

🛰️ The Gravy Analytics breach exposes how easily citizens can be tracked: - Seen at Space Launch Complex 36 - Work commute mapped - Stops at Home Depot & family visits near Kansas City logged 🔒 A stark reminder of the privacy risks in location data collection.

Justin M
@justinm.one

Honestly seems like literally the only use case of this is for committing fraud

Sung Kim@sungkim.bsky.social

Maybe I can AI clone myself and let them remote work for companies??? Tavus' Griffin, the first(?) model to pass video Turing test. 48% of people who talked to it live thought it was a real human. Previous systems have had a pass rate <3%. It is #1 on NVIDIA's benchmark for full-duplex AI video.

Justin M reposted

Timnit Gebru
@timnitgebru.blacksky.app

I'm not sure if y'all saw a CNN report on how the US had almost started WW3 with China based on fabricated information generated by a chatbot, claiming that a Chinese vessel was carrying components of nuclear weapons. That was an "existential threat" to humanity www.theguardian.com/commentisfre...

theguardian.comForget ‘superintelligence’: error-prone AI nearly sparked world war three this month | Timnit Gebru and Emily M BenderThe risks of AI aren’t what we think they are, as a recent security incident between China and the United States reveals
Justin M
@justinm.one

"They couldn't crack newsrooms" Yep. Social media recommendation engines ("the algorithm") basically just gave our enemy a very powerful tool to use against us. Facebook should've been banned after Myanmar IMO

Will Stancil@whstancil.bsky.social

A great illustration of the way social media has essentially shredded society’s informational immune system: The USSR spent a fortune trying to spread conspiracy theories, without success because they couldn’t crack newsrooms. Today, you can reach the globe with a post that costs $20 to make.

Justin M
@justinm.one

The CEO of Nvidia doesn't even know where he lives or what his own phone number is?

Matt Ford@mford.bsky.social

Ezra Klein asked Nvidia CEO Jensen Huang about AI making kids worse at math and reading. Huang’s reply: “Does it matter?” Then he said he doesn’t know his own address or phone number. “We’re going to lose some fine intellectual dexterity.” www.nytimes.com/2026/09/23/o...