iiinova — where your digital self keeps evolving

mkultra tournament edition @amenbreakpoint.com · 30/07/2026

Lookin at an (old?) unsecured bucket for a "NSFW AI Character" chat app and this shit is GROSS. Generated characters from real people, way too much stable diffusion Emma Watson, etc. And why the fuck are dudes sending dick pics to a chatbot? Thousands of weird dude dicks wtf.

210

mkultra tournament edition @amenbreakpoint.com · 22/06/2026

so if I jump in it'll just kick me out the other side? neat.

000

mkultra tournament edition @amenbreakpoint.com · 20/06/2026

> ... a cinematic search for an elusive group - CLODO - that bombed computer companies in 1980s Toulouse, France. Journeying through the cybernetic nodes of military, industrial, and socialist development, the film exposes how recording devices fail to collect the ashes of history.

vimeo.com

Machines in Flames [Full Documentary]

Machines in Flames (2022, 50min) finds a secret history of self-destruction by following the footsteps of a clandestine group of French computer workers from the 1980s. Machines in Flames presents a ...

000

mkultra tournament edition @amenbreakpoint.com · 20/06/2026

Cool thrift store find today. I know it's Nortel, but I heard it so much f'ing with them locally bitd that "Meridian Mail. Mailbox?" is permanently etched in my brain. I also want to build an Ithaca version of Telehamster (telehamster.net) but am also scared of picking up phones.

220

mkultra tournament edition @amenbreakpoint.com · 18/06/2026

Apparently my 2009 app store 99c goldrush slop app got linked in Wired back in the day. If I remember correctly I didn't renew my dev license and it got delisted a few months later. Still, time to add "featured in wired" to my CV.

web.archive.org

iPhone App Turns Your Smile Upside Down

If you�re a staunch pessimist like me, people who seem to always be walking on sunshine weird you out. Fortunately, a new iPhone application called Daily Downer should drag those bright-eyed Pollyanna...

000

mkultra tournament edition @amenbreakpoint.com · 31/05/2026

Reached out to (politely) ask a vibe-coded app to stop scraping my data; too aggressive, no caching, repeated expensive queries. Got back a very apologetic email that was an LLM'ed "you're absolutely right" response. I mean, I'm glad they knocked it off but an all-bot interaction is just a bummer.

020

mkultra tournament edition @amenbreakpoint.com · 28/05/2026

correction, also the parade. gotta carrot this year too.

030

mkultra tournament edition @amenbreakpoint.com · 22/05/2026

"My Dinner With Andre" (coworker pointed out my shirt situation halfway into the day)

A "Janus Films" shirt being worn under a flannel, which cuts of the leading "J", leaving the text ANUS FILMS. The wearer had many face to face meetings that day.

010

mkultra tournament edition @amenbreakpoint.com · 11/05/2026

the book sale is Ithaca's only recognized civic holiday

010

mkultra tournament edition @amenbreakpoint.com · 14/04/2026

A critical security issue I've been trying to report to SpankMatch/SpankChain since Dec 2023 has finally been addressed. This post details that, plus the shitshow the waning days of GCR were. Quote GCP: "The product team has currently not expressed interest in proactively reaching out to users."

amenbreakpoint.com

SpankMatch, Secrets, and (Everyone's!) Orphaned Google Container Registry Layers

In which Google moves the headstones and leaves the bodies.

122

mkultra tournament edition @amenbreakpoint.com · 07/04/2026

Firebase should require a written aptitude test at this point, jesus.

010

Reposted by mkultra tournament edition

Nathan McNulty @nathanmcnulty.com · 25/03/2026

"Because everyone else lowered the bar, we decided to join them" is so on-brand...

0145

mkultra tournament edition @amenbreakpoint.com · 23/03/2026

I've still not heard back from anyone. It's is an issue that's survived the shutdown of SpankMatch and I've sent emails about since _Dec 2023_. Root cause is in the email & I'd be happy to answer any Qs. I'd normally do this over email but bsky is the only response I've had. @spankchain.bsky.social

000

mkultra tournament edition @amenbreakpoint.com · 19/03/2026

Missed this when it came out, good shit. At this point I don't think it's controversial that Firebase should be "considered dangerous" in the slop era (and in the past) but it's just going to get worse and have a super long tail. I'd complain about Goog's response, but meh, Always Has Been.

mrbruh.com

Firewreck 2.0

Out of the top 1.5 Million Android apps on the Play Store, 11,126 were insecure and exposed users' PII. In total these 11 thousand apps exposed 1.43 Billion user records.

000

mkultra tournament edition @amenbreakpoint.com · 12/02/2026

I WARNED YOU ABOUT [GitHub PATs (classic)] BRO !!!! I TOLD YOU DOG! [2025-12-17] amenbreakpoint - Reported information disclosure in a GOV.UK service [2025-12-10] amenbreakpoint - Reported information disclosure in a GOV.UK service

vdp.cabinetoffice.gov.uk

010

mkultra tournament edition @amenbreakpoint.com · 29/01/2026

Smells like GCP's "allAuthenticatedUsers" principal footgun...

000

mkultra tournament edition @amenbreakpoint.com · 22/01/2026

At this point I believe I've received a copyright claim from every member of KISS except Peter Criss. Working on it.

Screenshot of a copyright claim email from Ace Frehley.

000

Reposted by mkultra tournament edition

NYT Tech Guild @nytguildtech.bsky.social · 16/01/2026

We stand with our colleagues and fellow members in full solidarity - this unfair and illegal arrest is an affront to a free press. ✊💔

0206

mkultra tournament edition @amenbreakpoint.com · 11/12/2025

Gonna flog this dead horse since this mirrors my experience with GCR and other registries: BUILD CONTEXT LEAKS ARE EVERYWHERE (and OCI images are the absolute worst offenders). You're probably doing it _right now_.

184

mkultra tournament edition @amenbreakpoint.com · 02/12/2025

had a nyquil dream that was just my brain trying to workshop bootleg shirt mashups of ikiru and akira. all bart ska-mpson level disasters.

000

mkultra tournament edition @amenbreakpoint.com · 22/11/2025

I've reported like 10 leaked PATs from packages to their owners in the last couple of weeks and it's kinda bs this issue (from 2022!) is open has been added & removed from the GitHub Public Roadmap 3 times. imo any PAT's a disaster waiting to happen, call that shit "Chekhov's Token (classic)".

github.com

Packages support for fine-grained PATs · Issue #558 · github/roadmap

Summary Personal Access Tokens, or PATs, provide users a quick way to create tokens they can use to make API calls. The tokens allow users to specify scopes to determine what the token can access. ...

100

mkultra tournament edition @amenbreakpoint.com · 13/11/2025

"Yesterday’s flexibility has become today’s insurmountable technical debt." Put it on my tombstone.

020

mkultra tournament edition @amenbreakpoint.com · 06/09/2025

I've seen a TON of ways to fuck up Docker/OCI image builds and leak build context, secrets, etc. but I just reported one to a vendor that I've never seen before: they leaked a GitHub PAT through the build _provenance attestation_ and they'd been leaking multiple tokens for a few years (!). Wild.

000

mkultra tournament edition @amenbreakpoint.com · 25/07/2025

Aaaaand Firebase claims another one. The misconfig rate for Firebase/appspot buckets and Firestore DBs has gotta be one the worst for a "turnkey" system.

020

mkultra tournament edition @amenbreakpoint.com · 21/07/2025

Today I'm publishing my writeup about a number of security issues I reported last September to Zigazoo, the self-described "World's Largest Social Network for Kids!". Impact included access to all user records, uploaded media (inc deleted items), account escalation, and user impersonation.

amenbreakpoint.com

Zigazoo too, Another Firebase Boogaloo

GCP security at "The World's Largest Social Network for Kids!"

1289

mkultra tournament edition @amenbreakpoint.com · 30/05/2024

jazz is the brown notes you _don't_ play

030