iiinova — where your digital self keeps evolving

Tentei interagir e só recebi mais hostilidade e desinformação. Quer saber? Passar bem.

Tem que fazer voto de pobreza e ai de você se conseguir algum destaque pela competência. Será infinitamente ridicularizado.

yaso @yaso.is · 28/07/2026

Reposted by Diego F. Aranha

Não sei como o governo consegue ter a cara de pau de discutir soberania e AI com esses valores desse jeito. Mals ae pelo fogo amigo

183

E alegar que precisamos "desmontar urna" para montar qualquer ataque explorando vulnerabilidades no *software* é desinformacão pura de quem nunca leu um relatório ou artigo científico a respeito, nível cloroquina.

000

Acho curiosa a idéia de ser injusto receber destaque por fazer um trabalho bem feito e de interesse público. Se o pesquisador vive na torre de marfim, é criticado; se aprimora sistemas de interesse social, é criticado. Concluo que você é tão anti-ciência e anti-cientista quanto aqueles que critica.

100

Se você parar para pensar com o cérebro ao invés do fígado, era meu *dever* como funcionário público dar o diagnóstico exato da qualidade do sistema, dada a oportunidade. Nosso trabalho comecou anos antes do Bozo ser eleito, e da pauta ser capturada por politicagem.

100

Collendo louros de clickbait como, comédia? O trabalho técnico foi feito com excelência, publicado em eventos científicos de qualidade e premiado. O impacto é claro e eventualmente melhorou o sistema. O que eu deveria fazer a respeito? Morrer em silêncio? Fingir que nada aconteceu?

100

* Dependia tanto disso que deixei o Brasil há 8 anos, para nunca mais olhar para trás. Um dos motivos foi exatamente essa hostilidade gratuita com pesquisadores. * Nosso trabalho acadêmico foi conduzido nos moldes permitidos pelo TSE, com resultados publicados e premiados. Onde está a cloroquina?

131

Respondendo ao @rofnight.bsky.social por aqui, já que o post original não admite respostas: * Nunca "fiz carreira" com urna eletrônica, muito pelo contrário. Gastei muito tempo e o sistema melhorou por causa disso. * Nunca foi nem meu tema principal de pesquisa, basta olhar artigos publicados.

Dare Obasanjo @carnage4life.bsky.social · 28/06/2026

Vamos chegando perto do período eleitoral...

160

Reposted by Diego F. Aranha

Ford has rehired hundreds of senior engineers after replacing them with AI backfired and has cost the company billions of dollars. AI adoption is blamed for Ford being the most recalled automaker in the U.S. with 51 recalls covering over 11 million vehicles in the first half of 2026 alone.

340105163960

Reposted by Diego F. Aranha

Guillaume Hiet @guillaumehiet.bsky.social · 23/06/2026

ISC 2026 submission deadline extended to July 2! Keynotes by Shweta Shinde and Diego Aranha. Submit your latest work in cybersecurity: isc2026.github.io 🇫🇷 Join us in Rennes this October — including a social event at Mont-Saint-Michel!

isc2026.github.io

ISC 2026: Information Security Conference

021

Reposted by Diego F. Aranha

Nadim Kobeissi @nadim.computer · 17/06/2026

Today I learned that a *third* former student got accepted into a top grad program abroad as a direct consequence of my applied cryptography mentorship in Lebanon last year. Walking in Paris with my chest so puffed from pride that it’s pushing cars out of the way and denting buildings

0171

Reposted by Diego F. Aranha

🦇🎃💀 Riana-mator 💀🎃🦇 @riana.bsky.social · 20/05/2026

Reminder that I maintain a periodically-updated reading list of papers at the intersection of E2EE and Trust & Safety; suggestions welcome: docs.google.com/spreadsheets...

docs.google.com

Encryption + Trust & Safety reading list (updated 2026-05-20)

28322

Reposted by Diego F. Aranha

Nadim Kobeissi @nadim.computer · 09/06/2026

Today is both: - First day of the summer semester of my applied cryptography course! WE'RE BACK BABY - Deltarune Chapter 5 is likely to be announced (during today's Nintendo Direct) TODAY IS A GOOD DAY

081

Diego F. Aranha @dfaranha.bsky.social · 09/06/2026

And we just arrived to the final day! * How (anonymous) credential apps are not really anonymous, as in not providing any basic form of unlinkability * Loyalty point multiplication miracles * More DevMode shenanigans * Free groceries for all \o/

100

Diego F. Aranha @dfaranha.bsky.social · 08/06/2026

Day 5 had some great highlights too: * How to get free laundry across machines in the AU campus * A self-sovereign digital identity wallet that was not... very sovereign * How to play GeoGuessr with Chinese IP cameras!

Diego F. Aranha @dfaranha.bsky.social · 04/06/2026

Day 4 has started! Craziest "DevMenu" of the day is hidden functionality that pops up after you click the app logo for a total of 7 times. Students found it with LLMs because code was too obfuscated to be readable by humans. We live in strange times indeed!

130

Users choose a 4-digit PIN code during school years when they are still kids, so one can just use library authentication as an SSN oracle. Fix the PIN, iterate the SSN until one gets a matching pair. There are enough library apps to distribute the load and avoid rate-limiting countermeasures.

110

TIL that the best way to farm social security numbers in Denmark is by exploiting the university library system. The Danish SSN is a concatenation between a birth date and 4 additional digits, some of which form a checksum. Before 2007, there were about 270 valid SSNs per date.

Clément Canonne @ccanonne.github.io · 02/06/2026

Reposted by Diego F. Aranha

A list of principles put forth by mathematicians, for mathematicians and other researchers, regarding the use of AI in research. "Number #9 will surprise you!" leidendeclaration.ai

leidendeclaration.ai

Leiden Declaration on Artificial Intelligence and Mathematics

This declaration calls for action to address the challenges posed by the use of artificial intelligence within mathematics research.

02711

Day 3 has just started and it's by far the craziest, with one priv escalation. I can't help but think that these apps are only surviving out there because Denmark is a rule-based high-trust society. The tech is embarrassingly bad and wouldn't resist a week in the adversarial environment back home.

140

The highlights in Day 1 were vulnerabilities enabling fare evasion in Danish public transport, and manipulation of payment transactions in multiple shopping apps. Day 2 was less eventful, and focused on transport apps that were much harder to break in comparison.

131

This year's recurrent theme has been "DevMode", where students find hidden functionality in mobile apps that unlock admin functionality. Why would one ship to the app store a mobile app with builtin DevMode that allows the user to bypass security controls?