syn

syn

@syn.horse

big #queer #infra overlord. #nonbinary. #ME and #MS. #devops, #infosec, #politics, #shitposts. collaboration not competition. may contain #gender. hashtags make you cool. https://keyoxide.org/8EA4E68124FEA8B559F482A2943E9700DECFC535

552 followers810 following2.8K posts

Found out about Honeygain the other day (you run a residential proxy on your phone, they pay you a pittance for bandwidth). Have already found a vulnerability letting anyone control any Honeygain instance they can redirect DNS for. This surprises nobody.

(to be clear this vuln doesn't really put users at risk. DNS redirection on a home network is kind of hard and Honeygain is a shitty target. what it does allow, pending analysis of the wire proto, is for someone to create fake traffic they'll be paid for.)

Not sure exactly when I became an authority on prompt injection and residential proxies but I'll take it?

Today's idea for evil: an incremental game which you can get a head start on by leaving open overnight. But in the background, it operates as a residential proxy. Sidesteps the issue of iOS apps only being active in the foreground by encouraging you to foreground it overnight. (Don't do this)

The unpopularity of the Tau pretty much tells you everything you need to know about most - most, not all - 40K fans. Honest to God I think they think the Imperium are the goodies.

All I'm saying is - Facebook is a PHP shop, and it's tough to know you've patched everything in an estate that big.

This is the KURU TOGA DIVE. I imported it from Japan for more money than I care to admit to. It is the ultimate nerd's pencil. It rotates the lead to keep a sharp point. It even extrudes the lead while writing. It is unnecesssary and over-engineered and as such I felt a powerful kinship with it.

welp. it took me less than half an hour to go from "receive shiny new FM-1" to "brick FM-1 and have to crack out the Raspberry Pi to restore it to life". Standard. The firmware scene for it is stunning though. So cheap! And it's so WEENY! Wonder if it'll fit in my Volca rack.

People are sellling ESP32-based devices as "solo miners" claiming they're a "crypto lottery". I mean. Yeah? It's true that you have a chance of hitting a block on one? But the hashrate is so comically low compared to any real miners that your chances are infinitesimal.

I haven't run the numbers but I'd expect the actual lottery to have chances orders of magnitude higher.

If the trend of mispronouncing a single word in your video in order to generate engagement could end like, immediately, that would be super. it's transparent and we fucking see you. stop it.

We all know about plus addressing, yeah? If you have a Gmail inbox, be it normal Gmail or Google Workspace, say your mailbox is you@gmail.com or you@domain.tld . You can also receive mail at you+anything@gmail.com (or you+anything@domain.tld) and even filter on the plus-addressed email address.

Fun fact: over on GitLab, I managed to yoink the username `dave`. It comes with being tagged into all manner of repos and conversations. Including internal GitLab ones.

Just to be clear, this does not happen a small number of times. I do not use Gitlab. None of these projects are mine, nor do they involve me at all.

I'm really interested in the way models are going, looking at more than chat as the interface. The decision models we're seeing with Jev and Laya.

View full thread

I would love to see AI spread into more structured data. Asking a question in the form of structured data and getting an answer in the form of structured data.

If we do that, we haven't got to worry about prompt injection, and we can use these more rigid models to guide LLMs with their far greater general-purpose capability.

I'm really interested in the way models are going, looking at more than chat as the interface. The decision models we're seeing with Jev and Laya.

One of the major problems I see with AI is that we are fixated on chat as the interface, and that comes with a variety of problems, not least ChatGPT psychosis, but also it's impossible to solve prompt injection when free text is the interface.

I am so happy with my GTD system. Linear to ticket everything, not just tech work. Then Sunsama. Sunsama provides a place for tasks to come from Linear, GitHub tickets, my calendar, and most importantly, my email inbox. Linear is a superb ticketing system. Sunsama brings it all together.

ghidra won't compile unless you use the Oracle JDK 25. bad NSA. no cookie. for fuck's sake.

If you use AI screeners for your position, you should know three things about me. 🧵 1/4

View full thread

Three, I work in DevOps. A ton of my work is figuring out how diverse systems interact with each other. I am more than ready to apply those skills to wasting as much of your time as I can. 🧵 4/4

Valuing of time is bidirectional. I expect you to want me to value yours. I'm quite willing to. I'm willing to do that by default. But if you do something to challenge that default, don't be surprised when my value for your time in turn goes down the toilet.

If you use AI screeners for your position, you should know three things about me. 🧵 1/4

One, I now do not want your position. You've said all I need to hear about how much you value my time. 🧵 2/4

Two, I am however 100% petty enough to become Your Problem, and I will fuck with the AI 'recruiter' as much as possible. 🧵 3/4

Does anyone else have this when grocery shopping? An inability to buy ONE of anything? It always feels more comfortable to buy two, and it feels actively worrisome - for some reason - to buy one. Brains, man. Wonk.

Today in things I was wrong about & you should understand: AI does use water in a wasteful way. What should happen: closed loop cooling. Take water, run it through heat exchangers, evaporate it, condense it, return it to the pool, run it through heat exchangers, evaporate it, repeat forever. 🧵 1/2

There will be losses, but not the majority. What actually happens: no condensation step. Water comes in and is evaporated to the atmosphere. That's it. There are better options. We're not using them. 🧵 2/2

PROTIP: if you have a lot of small files you want to put in cloud storage on a Mac, use iCloud. It handles it like a champ. What I WANT to use is Dropbox, so it's not tied to an ecosystem, but Dropbox absolutely chokes with lots of small files. Really badly. Which is why I'm having an rclone party.

it is a constant source of pleasure to know that across the internet, admittedly not very often, gen alphas are discovering jerkcity for the first time. behold. a gift from my era of the internet. also dicksucking huuahlugahghhgh

Playing VOYAGER: ACROSS THE UNKNOWN. sort of good? I think? not totally convinced it could work without the trek licence. anyway, to my absolute surprise, it surfaced an episode of VOYAGER which I've not seen! ("Rise")

Made an autonomous agent harness? Cool cool. No, I understand, that's everyone's dream right now. You rock on. I won't be fucking touching it until we solve prompt injection. 🧵 1/3

Think about the problem, at its root, being that we interact with agents through chat. Wouldn't it be safer if we could find a way to structure that data, more so than just passing a structured object in chat? 🧵 2/3

I don't have the skills for this. Too Deep AI. But it's where you could make a HUGE impact. 🧵 3/3

syn reposted

‘The Matrix’ creator Lilly Wachowski on J.K. Rowling and the new ‘Harry Potter’ series: “She is funding trans genocide. J.K. Rowling funds trans genocide, full stop. So, if you support ‘Harry Potter,’ you’re supporting trans genocide.” variety.com/2026/tv/feat...

variety.comLilly Wachowski on Her New Studio Anarchists United, the Black Power Origins of ‘The Matrix’ and How ‘Harry Potter’ Fans Are ‘Supporting Trans Genocide’‘The Matrix’ filmmaker Lilly Wachowski opens up about her new studio for marginalized voices Anarchists United, J.K. Rowling and Elon Musk.

Holy shit. The KARR and SWDS "security" units - designed to help you prevent car theft, are vulnerable for absolute clowntown reasons. - They bridge BLE to CAN. - They protect that BLE interface with a key... - ...which is stored in plaintext in the mobile app.

Turns out that no matter how defensively you program, your code doesn't get executed if it doesn't get imported. Anyway, that was the last three hours of my life.