Sign in

iiinova is part of the Atmosphere — an open, public network where you own your identity.

Royce Williams

@tychotithonus.infosec.exchange.ap.brid.gy
133 followers 13 following 1.6K posts

Just doing my undue diligence. ISP vet (was AS7782, now AS8047), password cracker (Team Hashcat), security demi-boffin, YubiKey stan, public-interest […] 🌉 bridged from ⁂ infosec.exchange/@tychotithonus, follow @ap.brid.gy to interact

PostsRepliesMedia
Reposted by Royce Williams
Scary "Grampus" Jerry 👻 @jerry.infosec.exchange.ap.brid.gy · 10h
There are major account take-over problems happening right now on mastodon instances - all appearances are that the actor is using stolen passwords, probably from malware running on desktops. I've suspended hundreds of compromised accounts over the past 48 hours, but only two on mine. If you […]
infosec.exchange
Original post on infosec.exchange
132 3
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 12h
I believe the developers mean well, but they added the HIBP dip because it's cool, not because they did any actual threat modeling (otherwise, these other fundamentals would have been urgently fixed first)
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 12h
Home Assistant: [leads marketing copy with "privacy first" language] Also Home Assistant: By default, we're going to silently and involuntarily test your Supervisor password against HIBP once an hour. Because security! Also Home Assistant: [no throttle in the web interface on how often a user […]
infosec.exchange
Original post on infosec.exchange
100 1
Reposted by Royce Williams
Jernej Simončič � @jernej--s.infosec.exchange.ap.brid.gy · 14h
@prism The really awful thing here is that unless you have prior knowledge of OneDrive doing this, even having local backups of your whole computer won't help you, as the files aren't there for backup to back up (and if you use eg. BackBlaze, which operates on file level, they intentionally […]
infosec.exchange
Original post on infosec.exchange
012 2
Reposted by Royce Williams
Drew Mochak @prism.infosec.exchange.ap.brid.gy · 21h
I'm more upset than I've been in a while. Windows 11 sets the default documents folder to onedrive\documents. Anything that gets saved there gets backed up to one drive. This includes various save games, all my Reaper stuff, and various other odds and ends that I like to, you know, save. To […]
infosec.exchange
Original post on infosec.exchange
7978 78
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 15/10/2026
I think leap seconds were fine, actually
000 0
Reposted by Royce Williams
René Mayrhofer :verified: 🇺🇦 🇵🇸 @rene-mobile.infosec.exchange.ap.brid.gy · 15/10/2026
www.theguardian.com/technology/2026… - ad-blockers are now clearly required as a security measure in all contexts. We have long suspected this, but now we have documented proof that online ads are […]
infosec.exchange
Original post on infosec.exchange
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 15/10/2026
@sojucifer And we have rmondello@hachyderm.io to thank for that! 🤩 (handle neutralized to prevent mention, but they are a great follow!)
100 1
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 15/10/2026
Just so everyone knows, I am now a member of the prestigious Landry's Select Club. 😎 🏆👑 Being in Alaska, there is exactly one applicable establishment within 3,000 miles, which I frequent about twice a year. Press release and press conference coming soon
010 1
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 15/10/2026
Today's terrifying / spooky micro-fiction: Poettering vibe-coding
000 0
Reposted by Royce Williams
ploum @ploum.mamot.fr.ap.brid.gy · 14/10/2026
People who find LLMs useful when "used correctly" don’t understand that they manage to use them correctly because they spent 20 years of there life learning their craft without LLMs. LLMs is the only tool where the less you use it, the better you become at using it.
015 5
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 15/10/2026
@north And in my defense ... I was 25. My forebrain had not finished developing.
000 0
Reposted by Royce Williams
Jess👾 @jesstheunstill.infosec.exchange.ap.brid.gy · 14/10/2026
Spicy take: I kinda agree that pull requests to major mission critical open source projects like the Linux kernel should be limited to people who are signing up for developing on it like hundreds of hours a year. It can't be on the maintainers to manage endless drive by pull requests - […]
infosec.exchange
Original post on infosec.exchange
001 1
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 14/10/2026
@north The legend is still told to this day
100 1
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 14/10/2026
@north Almost got fired for talking to a reporter about playing hooky from work to go see the new Star Wars movie. Carrying a briefcase in junior high Wearing tennis shoes with my tux at the high school prom prep rally Finding niche taxonomy hobbies and driving too deep on them ("oh yeah […]
infosec.exchange
Original post on infosec.exchange
000 0
Reposted by Royce Williams
Don Marti @dmarti.federate.social.ap.brid.gy · 14/10/2026
This is only part of the character.ai story. Originally it was a project at Google—but from the outside, it looks like it was rejected as too risky to launch under the Google name. So they turned it into a separate legal entity that "pays Google for cloud services" (and even got outside […]
federate.social
Original post on federate.social
002 2
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 14/10/2026
@north does infamy count?
100 1
Reposted by Royce Williams
Scott Francis @darkuncle.infosec.exchange.ap.brid.gy · 13/10/2026
Complexity is the single biggest cost in most enterprises: it's difficult to quantify, never on the balance sheet, and rarely urgent enough to rise to the top of the priority list. But it will cost more in time and opportunity and operational overhead than any other single factor. #ops #architecture
116 6
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 12/10/2026
@masnick.com And tree law is famously not to be fscked with. This lesson may be ... expensive.
170 7
Reposted by Royce Williams
Mike Olson @mikeolson.mastodon.social.ap.brid.gy · 10/10/2026
I do not design spacecraft, but a number of these apply more broadly. spacecraft.ssl.umd.edu/akins_laws.h…
spacecraft.ssl.umd.edu
Akin's Laws of Spacecraft Design
009 9
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 10/10/2026
Due to a confluence of events, I have a small credit in an article in the Yale Journal of Law and Technology, Symposium 28 (Spring 2026?). The article is about how claims that simple hashes "anonymize" identifiers like email addresses can be easily disproven, using traditional (but focused) […]
infosec.exchange
Original post on infosec.exchange
001 1
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 09/10/2026
@rene_mobile Interesting! Do you run more than one Pi-hole? Not sure how my firewall (pfSense) would handle that yet (hopefully at least round-robin)
000 0
Reposted by Royce Williams
Eric Geller @ericjgeller.com · 09/10/2026
Rogue AI hacks are generating a lot of interest in AI security careers, and colleges are trying to meet the demand. My new story looks at the schools preparing students to secure our autonomous future, including what lessons they're trying to prioritize. www.cybersecuritydive.com/news/ai-cybe...
1254 25
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 09/10/2026
It's me, I'm someone. You goobers.
Six Facebook login-related system messages, three of which are "Someone tried to log in, but we stopped them."
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 08/10/2026
@wdormann Spinellis thinks so: www.spinellis.gr/blog/20261008/inde…
spinellis.gr
blog dds: 2026-10-08 — Thinking will become a hobby
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 08/10/2026
Also I have one unit that doesn't post (due to something extremely stupid I did, pulled a card out while it was powered up, they run silent since the power supply is external and I had replaced the HDD with flash, and I I was behind it and didn't realize it was still on!). I'm not a circuitry […]
infosec.exchange
Original post on infosec.exchange
003 3
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 08/10/2026
Highly motivated to seek folks with Whistle InterJets -- late-90s 486 SOHO Internet appliance on FreeBSD 2.2.x, resold by ISPs in the US, Europe, and Asia (IBM bought and sunsetted it, and sold off the whistle.com domain). People with long ISP memories may […] [Original post on infosec.exchange]
A live Whistle InterJet, next to a Whistle-branded coffee cup. About the size of a large toaster, it features a green LCD screen and a blue rubbery keypad. The LED in the upper left is orange because the unit is running on its own internal UPS battery.The case of a unit is open, showing a vertical mainboard with two 32 MB SIMMs, a 486 covered by a heat sink, and a transcend 8 GB IDE flash. The main board is plugged into a horizontal backplane on the bottom.
1015 15
Reposted by Royce Williams
Jeff Moss @thedarktangent.defcon.social.ap.brid.gy · 08/10/2026
With all the new G's (New GTLDs that ICANN has approved) coming up like .pdf now is a great time to disable search from your browser bar so you don't accidentally end up at a malicious site. For FireFox or Tor Browser do: - about:config - set browser.fixup.alternate.enabled false - set keyword […]
defcon.social
Original post on defcon.social
1016 16
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 07/10/2026
Societally, it's like a combination of boiling the frog, plus the boa-constrictor technique (where as you struggle, it finds whatever new area to tighten further).
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 07/10/2026
My favorite explanation for the bizarrely variable intelligibility of 2600 Magazine is that it's the equivalent of a numbers station.
000 0
Reposted by Royce Williams
David Roberts @volts.wtf · 05/10/2026
Holy shit.
709263068673 26.3K
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 06/10/2026
Ah, so the purpose of the Googlebook is to kill off the affordable Chromebook category?
001 1
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 06/10/2026
0 as I pull away from the electronics recycling center after having ogled some fascinating pea hardware in one of the bins, I suspect that if I got a job there, it would kind of like the cat hoarding lady getting a job at the animal shelter.
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 05/10/2026
This used to be my homepage, decades ago. www.alaska.net/~royce/pub/roycelink…
Screenshot of a 3x5 HTML table with a variety of topic areas, most of which are from the late 90s or early 2000s: Connectivity, Spam, Software, News and Search, SA [Sysadmin] References, General Reference, Coworkers, ACS ISPs, Other ISPs, Mailing Lists, OSes, BSDs, Emulators, Programming, Sun and Solaris, FreeBSD, UNIX Software, MS and Win32 software, i386 hardware, Software Collections, Certification, Security, Security Software, Firewalls, Security Reference, Food and Health, Humor, Controversial / Dark Humor, Moveis and Theatre, Shopping, Music, Org and Tips, Banking and Finance, Environment, Health, Travel and Maps, Mobile, Web-based Email, Social Networks.
020 2
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 05/10/2026
It's like a dog with a cropped tail wagging a little stub, except it's the rear wiper on people's cars that have broken off but the wiper is on but they have no visual feedback to see that it's on, so it just stays on indefinitely, wagging a little stub as they drive through town.
010 1
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 05/10/2026
I, for one, do _not_ welcome our new Russian plague overlords.
000 0
Reposted by Royce Williams
Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 05/10/2026
I only just recently realized that my cheapo (at the time) N95 CPU in my DVR can do hardware video encoding, which was completely unutilized until now. So of course I nerd-sniped myself into writing a script that uses Intel QSV for automatically transcoding my MPEG2 recordings into H.264. 😂
010 1
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 04/10/2026
One of the best uses of an old phone is as a _local_ scratch device, for activity that tends to burn through battery. This: * reduces wear on the battery of your daily driver (likely your highest-value device, that you're probably trying to stretch its lifetime in these times, and * […]
infosec.exchange
Original post on infosec.exchange
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 04/10/2026
Today I learned that Habermas would have been a great hacker. > Their core insight: _most of what we call “normal” was designed by someone, for a reason, and that reason might not be your reason._
c.im
000 0
Reposted by Royce Williams
Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 04/10/2026
Threat-Actor explorer v1.1.0 released with many improvements and upgrade to the latest Pivotick library Latest A standalone, browser-only HTML/JavaScript application for exploring the MISP threat-actor galaxy, UUID-based relationships across every cluster […] [Original post on infosec.exchange]
Overview of the Threat-Actor explorer.
066 6
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 04/10/2026
Every few years, I randomly remember that Binaca was a thing.
An ad for Binaca, a pocket-sized portable breath spray. Ad copy says "press the button and freshen breath instantly"
010 1
Reposted by Royce Williams
Eric Geller @ericjgeller.com · 29/09/2026
GAO has a new report about how agencies gave DOGE staffers vast access to sensitive data and largely refused to verify to GAO that proper security controls were in place. The most remarkable part is the agencies' displays of pique & rancor toward GAO for asking questions. www.gao.gov/assets/gao-2...
18039 80
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 29/09/2026
SCADA, or as I like to call it, "involuntary retrocomputing"
227 7
Reposted by Royce Williams
David Choffnes @proffnes.discuss.systems.ap.brid.gy · 29/09/2026
www.theverge.com/transportation/100… Amazing work by Sarah, Nicole, and the rest of the team! And many thanks to Consumer Reports for saying “yes” when I posed the somewhat ridiculous idea of letting a bunch of researchers test over […]
discuss.systems
Original post on discuss.systems
015 5
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 27/09/2026
Good think I'd already decided to migrate away from 1Password, because now that it has a passkey for a site, it wants to be the sole mediator of _all_ auth to that site, and I can't just say "no I want to use my security key instead"
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 26/09/2026
The mixed emotions of being at a talk and asking a dumb question and getting a really good, informative, insightful answer.
200 2
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 26/09/2026
@Edent Thought-provoking! Acknowledging attempting to achieve valid HTML is _not_ sufficient ... I _do_ find it necessary for catching a certain class of bugs: _validation errors I did not intend_. It doesn't prevent me from using valid HTML that produces outcomes I don't want, but it does […]
infosec.exchange
Original post on infosec.exchange
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 25/09/2026
Compiling FreeBSD 2.2.6 ... as one does. #PlansWithinPlans
000 0
Royce Williams @tychotithonus.infosec.exchange.ap.brid.gy · 24/09/2026
It's 2026 and Bank of America still only lets you use a max of two security keys.
100 1
Reposted by Royce Williams
Liam Proven @lproven.social.vivaldi.net.ap.brid.gy · 24/09/2026
Pick is a living fossil of computer history <- an interesting, if very unaffectionate, 3-part look at the original database OS P1: csixty4.medium.com/pick-is-a-living… P2 […]
social.vivaldi.net
Original post on social.vivaldi.net
201 2