Sign in

WillW

@wrw7.bsky.social
85 followers 212 following 33 posts

Infosec and non profits and baking

PostsRepliesMedia
Reposted by WillW
Catalin Cimpanu @campuscodi.risky.biz · 21h
A vulnerability in the GoBalance load balancer can allow hackers to retrieve the private keys of Onion dark web services. The vulnerability was allegedly used to hack Dread, a Reddit-like community on the dark web www.slcyber.io/research/lea...
1146
Reposted by WillW
Michael Geist @mgeist.bsky.social · 09/10/2026
Must read from @kate-ro.bsky.social on Bill C-22: "The assumption by government officials that technology companies can find “safe ways” to weaken critical cybersecurity protections badly misreads the current threat landscape." www.theglobeandmail.com/opinion/arti...
theglobeandmail.com
Opinion: The Lawful Access Act threatens to blow a hole in Canada’s national security
The proposed federal bill is built on a faulty premise: that there’s a way to safely build surveillance back-doors for law enforcement. That’s a particularly risky bet in this rapidly changing AI envi...
067
Reposted by WillW
Michael Geist @mgeist.bsky.social · 08/10/2026
Mozilla: “Let us be clear: there is no safe way to create exceptional access to encrypted data that only the intended actor can use. An access mechanism created for law enforcement can also be discovered, exploited or abused by potentially bad actors.” blog.mozilla.org/netpolicy/20...
blog.mozilla.org
Canada’s bill C-22 threatens encryption, users’ privacy and the security of digital economies  – Open Policy & Advocacy
Encryption is woven into everyday digital life. It protects our messages and passwords, but also banking and payments, health data, government services and the digital infrastructure societies rely…
11616
Reposted by WillW
Maarten Schenk @mschenk.bsky.social · 07/10/2026
An example of FIMI (Foreign Information Manipulation and Interference) in action at the @disinfo.eu conference? Apparently someone in the U.S. did not agree with the topic of a session named "USA as a FIMI threat: acknowledge, adapt, push back" and applied pressure on the sponsors...
4304158
Reposted by WillW
The Citizen Lab @citizenlab.ca · 06/10/2026
Citizen Lab director @rondeibert.bsky.social tells @theglobeandmail.com how Canada’s lawful access bill “will make it impossible for a large number of invaluable privacy-preserving tools” to operate in the country.
0258
Reposted by WillW
Gareth Heyes @garethheyes.co.uk · 06/10/2026
Another XSS vector for our cheat sheet, this time using <usermedia> Special mention to AmirMohammad Safari, who found this one and has contributed so many excellent vectors to the cheat sheet. portswigger.net/web-security...
<usermedia onstream=alert(1)>
041
Reposted by WillW
Michael Geist @mgeist.bsky.social · 30/09/2026
The government's encryption compromise in Bill C-22 doesn't work. Police say it does little to change what they can already obtain. Tech companies, industry groups, and security experts say it still leaves users at risk. The Senate needs to pick a side. www.michaelgeist.ca/2026/09/is-c...
michaelgeist.ca
Is Compromise on Encryption Possible? Why Bill C-22's "Minor Opening" Leaves the Central Question Unanswered - Michael Geist
Bill C-22, the government’s lawful access legislation, is awaiting Senate consideration this fall with the encryption provisions likely to be the centre of attention given diametrically opposing…
068
Reposted by WillW
Gareth Heyes @garethheyes.co.uk · 30/09/2026
Chrome added a <camera> tag. omidxrz made it an XSS vector: Now in our XSS cheat sheet. portswigger.net/web-security...
<camera onvalidationstatuschange=alert(1)>
041
Reposted by WillW
Michael Geist @mgeist.bsky.social · 30/09/2026
For months, the government insisted Bill C-22 was "encryption neutral" and dismissed warnings from tech companies as misinformation. The Minister now says the bill has a "minor opening" on encryption in "extenuating circumstances." Is there such a thing? www.michaelgeist.ca/2026/09/is-c...
michaelgeist.ca
Is Compromise on Encryption Possible? Why Bill C-22's "Minor Opening" Leaves the Central Question Unanswered - Michael Geist
Bill C-22, the government’s lawful access legislation, is awaiting Senate consideration this fall with the encryption provisions likely to be the centre of attention given diametrically opposing…
164
Reposted by WillW
Joe Uchill @joeuchill.bsky.social · 30/09/2026
In Europe, this would be a GDPR violation punishable by 4% of annual turnover.
57916
Reposted by WillW
Joe Uchill @joeuchill.bsky.social · 29/09/2026
I'm still looking for infosec researchers who've published research outside of traditional academic journals (e.g., at a hacker conference or as a corporate report) for a research project. If that's you, send me a note. Ostrich for engagement.
Woman hitting ostrich skeleton with picnic basket says "take that, you ostrich skeleton!"
51314
Reposted by WillW
BSides Vancouver Island @bsidesvi.bsky.social · 29/09/2026
BSides Vancouver Island 2026 - that's a wrap! A huge THANK YOU to everyone who came out on Friday, supported the event, filled the rooms, listened to some incredible talks, asked great questions, and most importantly, helped make BSidesVI the community-driven event that it is.
121
Reposted by WillW
Janet 🇨🇦 @jansplanet.bsky.social · 28/09/2026
“Canada should be able to support legitimate investigations without making secure systems easier to attack, and without making Canadian companies less competitive globally as more countries look for trusted, sovereign infrastructure,” #CdnPoli #BillC-22 #Security #Sovereignty 
betakit.com
Tailscale, Windscribe co-sign open letter asking feds to further amend Bill C-22 | BetaKit
Canadian and European tech companies still have concerns over Canada's federal “lawful access” bill.
0259
Reposted by WillW
Michael Geist @mgeist.bsky.social · 28/09/2026
Buried in the 232-page Bill C-39 is the Enabling Digital Trade Act, Canada's first federal law on electronic bills of lading and other trade documents. Overdue, but it leaves key rules to regulation and adds a broad data-sharing power. It needs study. www.michaelgeist.ca/2026/09/buri...
michaelgeist.ca
Buried in Bill C-39: The Enabling Digital Trade Act Brings Canada Its First Federal Electronic Trade Documents Law - Michael Geist
The government introduced Bill C-39, the Building Canada Strong Act, last week, and while it emphasized faster project approvals, public discussion has focused almost entirely on the implications for…
043
Reposted by WillW
Gareth Heyes @garethheyes.co.uk · 28/09/2026
Stuck inside a <meta> and angle brackets blocked? You can still get XSS... In Firefox, use hidden=until-found and onbeforematch with a URL hash to trigger your handler. Now in our XSS cheat sheet, thanks to ­Mathias Karlsson.
<meta name=description 
content=x id=p 
hidden=until-found 
onbeforematch=alert(document.domain)>
1175
Reposted by WillW
Michael Geist @mgeist.bsky.social · 28/09/2026
The focus on Bill C-39 has been project approvals and collective bargaining. But buried in the bill is a new statute on bringing digital technologies to shipping and supply chains, with a data-sharing power that overrides nine confidentiality laws. www.michaelgeist.ca/2026/09/buri...
michaelgeist.ca
Buried in Bill C-39: The Enabling Digital Trade Act Brings Canada Its First Federal Electronic Trade Documents Law - Michael Geist
The government introduced Bill C-39, the Building Canada Strong Act, last week, and while it emphasized faster project approvals, public discussion has focused almost entirely on the implications for…
054
Reposted by WillW
Sandra L Lester 🇨🇦 #KillBill22 @sandrallester.bsky.social · 26/09/2026
OMG, I have eaten these! Please share.
106528
Reposted by WillW
Veilid 🅅 @veilid.com · 26/09/2026
We had three Veilid app releases and announcements today! A password vault: veilpass.io A collaborative note taking app: makertube.net/w/sRRwAZJsCd... And a shared media server (built to mimic winamp) www.veilamp.com Big day for building the future!
33117
Reposted by WillW
Tanya Janca | SheHacksPurple @shehackspurple.bsky.social · 24/09/2026
See you there this Friday?
031
Reposted by WillW
Rachel Gilmore @rachelgilmore.bsky.social · 23/09/2026
There’s an Israeli app claiming to turn a politician’s supporters into “digital fighters” by feeding them AI-generated replies for “rewards.” It was just used for the first time in Canadian politics — that we know of. I'm teaming up with @nationalobserver.com to share @rorywh.bsky.social's scoop!!
1122195
Reposted by WillW
Michael Geist @mgeist.bsky.social · 23/09/2026
Mandated transparency should be the starting point for any AI regulatory framework. My submission to the Canadian government consultation on the need for a new AI Transparency Act. www.michaelgeist.ca/2026/09/an-a...
michaelgeist.ca
An AI Transparency Act for Canada: My Submission to the Government's AI Transparency Consultation - Michael Geist
The government’s consultation on AI transparency closed yesterday. My submission builds on appearances before the House of Commons Industry committee, the Senate Transport and Communications…
033
Reposted by WillW
Emmanuel Thomé @emmanuelthome.bsky.social · 21/09/2026
Forging 1024-bit RSA signatures in nearly SNFS time Hand over your HSM for some time, and we can forge signatures for its key. Arbitrary signatures. Forever. github.com/ucsd-hacc/NS...
github.com
GitHub - ucsd-hacc/NSNFSSSFSFN: Nearly SNFS-Speed Signature Forgery Sans Factoring N
Nearly SNFS-Speed Signature Forgery Sans Factoring N - ucsd-hacc/NSNFSSSFSFN
13013
Reposted by WillW
Dominik Picheta @dom96.picheta.me · 19/09/2026
Today I am releasing KillSwitch: a new programming language designed to be difficult for LLMs to write, edit and understand. It makes for a great benchmark suite for LLM models and is a lot of fun to program in. Check it out 👇 killswitch-lang.org
killswitch-lang.org
KillSwitch
An esoteric programming language built to break LLMs and coding agents.
2177
Reposted by WillW
jaeFantom, Angry Arkifane & Pissed Archmagos @ Telecomix @ MeMBu @membu.org · 20/09/2026
The Citizen Lab has been tracking an Israeli influence op selling services to the public. #MeMBu citizenlab.ca/research/bla...
citizenlab.ca
Research Note: BlackCore’s Influence Operations for Hire - The Citizen Lab
In this research note, we examine the digital infrastructure of BlackCore, an Israeli influence-for-hire company. We describe how we identified a BlackCore campaign consisting of a training program pr...
164
Reposted by WillW
Jimmy Thomson @jameswsthomson.com · 18/09/2026
Now you know: if you see any of these sites show up in your Google News feed, you can quickly block them.
A screenshot showing how to block spam websites in Google News.
1176
Reposted by WillW
hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪 @hrbrmstr.mastodon.social.ap.brid.gy · 17/09/2026
We have 28 positions open (most remote, some non-US|CA). Attached are the research & engineering positions open (since I don't think sales or marketing folks follow me here). Links to these and more @ censys.com/careers DM me for a Signal contact #FediHired
Senior Security Researcher
Remote
Systems Engineer
RemoteEngineering
Distributed Systems Engineer (Data Platform)
Remote (US/Canada)
Distributed Systems Engineer (Data Platform)
Remote (US/Canada)
Engineering Manager
Remote (US/Canada)
Senior AI/LLM Engineer
Remote (US/Canada)
Senior AI/LLM Engineer
Remote (US/Canada)
Senior Distributed Systems Engineer
Remote (US/Canada)
Senior Machine Learning Engineer
Remote (US/Canada)
Staff Backend Engineer, Exposure Management
Remote (US/Canada)
Staff Backend Engineer, SOC & Threat Hunting
Ann Arbor, MI
Staff Scanning Engineer
Remote (US)
015
Reposted by WillW
Ron Deibert @rondeibert.bsky.social · 17/09/2026
NEW @citizenlab.ca report uncovers a covert influence op by Israeli firm BlackCore on behalf of the Angolan government. Lead author @fittarelli.com with a 🧵 👇 citizenlab.ca/research/bla...
citizenlab.ca
Research Note: BlackCore’s Influence Operations for Hire - The Citizen Lab
In this research note, we examine the digital infrastructure of BlackCore, an Israeli influence-for-hire company. We describe how we identified a BlackCore campaign consisting of a training program pr...
1199
Reposted by WillW
Taylor Noakes @taylornoakes.com · 17/09/2026
It’s so much worse than their continued (and inexcusable) use of Twitter #cdnpoli
084
Reposted by WillW
Raphael Satter @raphae.li · 17/09/2026
New: @citizenlab.ca's @fittarelli.com, @jsrailton.bsky.social & Maia Scott take a deep dive into the Israeli disinformation firm BlackCore. Among their findings: They accidentally left a spreadsheet detailing their Angola information operations exposed to the web. citizenlab.ca/research/bla...
citizenlab.ca
Research Note: BlackCore’s Influence Operations for Hire - The Citizen Lab
In this research note, we examine the digital infrastructure of BlackCore, an Israeli influence-for-hire company. We describe how we identified a BlackCore campaign consisting of a training program pr...
198
Reposted by WillW
MetropleX @metroplex.bot · 16/09/2026
GrapheneOS continues to reveal Googles active hobbling of the ability of OEMs to protect their users in favour of market exclusivity/protection, and pushing ahead with monopolistic anti competitive abuse hand in glove with GPL violations. Read below the break for the teams detailed analysis:
097
Reposted by WillW
🎃 🧙🏻‍♀️Yell 👻 Growler💀🎃 @yaelwrites.com · 16/09/2026
P.S. Here is a gift link! www.theverge.com/ai-artificia...
theverge.com
The sexy AI-powered dating app scams are here
Thousands of people have been catfished by scammers supercharged with AI.
0104
Reposted by WillW
Micah Lee @micahflee.com · 16/09/2026
Flock cameras are riddled with security vulnerabilities and hard-coded credentials. Here's my analysis of today's @ddosecrets.org Flock leak micahflee.com/flock-camera...
micahflee.com
Flock cameras are riddled with security vulnerabilities and hard-coded credentials
This morning, DDoSecrets published an exciting new dataset: Filesystem images of the partitions from an in-use Flock ALPR camera. 404 Media and Wired published a joint investigation into it. I downloa...
6275114
WillW @wrw7.bsky.social · 16/09/2026
Oh no! ...anyway
000
Reposted by WillW
BSides Vancouver Island @bsidesvi.bsky.social · 15/09/2026
🚨 Too many alerts. Too many frameworks. Not enough people. Sound familiar? Join Michael Argast, cybersecurity veteran and Co-Founder & CEO of Kobalt.io, as he shares how organizations can build a security harness that enables small teams to achieve big results through thoughtful use of AI.
111
Reposted by WillW
dorian @doriantaylor.com · 11/09/2026
the thing about The Specificity Gradient is that it's a good idea to organize your research and design materials from more coarse-grained and durable to more detailed and perishable irrespective of e.g. your use of coding agents youtu.be/e6FxOpVfCBg
youtu.be
The Specificity Gradient — Now With AI!✨
YouTube video by dorian taylor
193
Reposted by WillW
BSides Vancouver Island @bsidesvi.bsky.social · 11/09/2026
Happy Friday, cyber enthusiasts! The cat's out of the bag, thanks to Quantum Village for announcing that they will be joining us on Friday, September 25, 2026 for BSides Vancouver Island! #BSidesVI2026 #cybersecurity #infosec
133
Reposted by WillW
Zack Whittaker @zackwhittaker.com · 10/09/2026
New, by me: ID verification giant IDScan confirms data breach of driver's licenses. The company checks IDs used in stores and entertainment venues to verify age/identity. IDScan's statement implies hackers contacted the company with a ransom demand. Ad-block bypass: web.archive.org/web/20260910...
techcrunch.com
ID verification giant IDScan confirms data breach with more than 150 million driver's licenses stolen | TechCrunch
The ID checking company said the data breach included people's full names and driver's licenses and other government-issued identity documents.
14535
Reposted by WillW
ddɐ˙ʎʞsʞɔɐlq˙uǝʌs@ @sven.blacksky.app · 10/09/2026
And as y'all can expect, the reasons given for this new iteration of a Nexus of Torment are cowardly hilarious (not).
In a wide-ranging conversation about threat monitoring and analysis, the interview also touches on monitoring activists. "Last year we had an executive travel into a major city when we received some intelligence through Samdesk about a planned protest," Ellison said. The originally scheduled protest was moved up due to permitting issues. "Samdesk gave us about 60 minutes of advanced notice that the protest organizers had moved the timeline," Ellison explained. "That extra hour was critical. Without it our executives would have departed their meetings, they would have ran right into the heart of the disruption." Ellison said that Anthropic used this data to devise an alternate route for the executive and funnel them to a service entrance at the hotel. "What could have been a high-stress situation," he said, "was really mitigated through early detection through Samdesk and giving us that information."
13919
Reposted by WillW
BSides Vancouver Island @bsidesvi.bsky.social · 10/09/2026
🚨 Speaker Spotlight Alert! We're excited to welcome Chris Brown, a seasoned management consultant with a track record of leading mission-critical programs where risk is rising, complexity is growing, and delivery cannot fail. #BSidesVI2026 #Cybersecurity #InfoSec
111
Reposted by WillW
Canada's National Observer @nationalobserver.com · 09/09/2026
Canadians have to be able to recognize when we’re being played by outside forces. But we can’t expect Canadians to take this seriously if our own governments seem to be asleep at the switch, @supriya.bsky.social writes.
nationalobserver.com
Alberta's referendum is exposing Canada's vulnerability to disinformation attacks
Both the Alberta and federal governments seem much more interested in how we’re going to build out data centres than they are in figuring out how to keep Canadians safe from some of the more nefarious...
28438
Reposted by WillW
Paris Marx @parismarx.com · 06/09/2026
“The 23 [AI-generated] websites are designed to influence the answers that AI chatbots give to voters in Alberta, targeting farmers, young people, veterans, mothers and oil industry workers.”
nationalobserver.com
A US-linked network of fake websites is promoting Alberta separatism to AI chatbots
The websites present crude, AI-generated slop disguised as the voice of real Albertans. But they're made in Florida — and they're not even targeting Albertans directly.
115183
Reposted by WillW
RBAC Fan Account @cdemwell.bsky.social · 08/09/2026
I interacted with a few Moneris terminals just today. This seems like a terrible idea.
031
Reposted by WillW
Joe Uchill @joeuchill.bsky.social · 07/09/2026
Hey, cyberpeople. Help a PhD student out. Did you recently write or supervise a vendor's research report or release research on a blog? Maybe you dropped a vuln at a conference? In general, did you do something that, if we were in any other industry, would be an academic paper? Let me know.
92626
Reposted by WillW
Sam Harsimony @harsimony.bsky.social · 06/09/2026
This project is incredible. First an open-source micromanipulator, then fiber optics, now a 3D printer with 10 micron resolution. www.youtube.com/watch?v=UvV2...
youtube.com
Micro-Fabrication with a Fiber Tip – A Low-Cost 3D Micro Printing Method
YouTube video by Diffraction Limited
27615
Reposted by WillW
Dan Gillmor @dangillmor.bsky.social · 07/09/2026
If you support "age verification" online, you are supporting a system that GUARANTEES privacy meltdowns -- endangering all of us -- because the giant databases of scanned IDs are perpetually hacked by criminals who sell private data.
techdirt.com
Hackers Had A Live Feed Of Every ID This Verification Company Scanned. For Over A Year.
From the very beginning of this recent obsession with identifying everyone online (yes, they like to call it “age” verification, but it always ends up as identity verification), we&#821…
213261
Reposted by WillW
Jimmy Thomson @jameswsthomson.com · 04/09/2026
This story is a big deal. Please give it a read, even if you need to sign up for a one-dollar subscription. This tactic — manipulating chatbots as a backdoor to human beings — is only going to get worse, and Alberta separatism appears to be just a testing ground for these people.
712180
Reposted by WillW
BSides Vancouver Island @bsidesvi.bsky.social · 04/09/2026
📅 Check out the schedule and start planning your day: www.bsidesvi.com/bsi... We can't wait to see you at BSides Vancouver Island, September 25th! #BSidesVI2026 #CyberSecurity #InfoSec #SecurityCommunity #VictoriaBC
013
Reposted by WillW
Evan Greer @evangreer.bsky.social · 04/09/2026
Age verification makes everyone less safe. Age verification makes everyone less safe. Age verification makes everyone less safe. Age verification makes everyone less safe. Age verification makes everyone less safe. Age verification makes everyone less safe.
techdirt.com
Hackers Had A Live Feed Of Every ID This Verification Company Scanned. For Over A Year.
From the very beginning of this recent obsession with identifying everyone online (yes, they like to call it "age" verification, but it always ends up as identity verification), we've been pointing out that it was a huge privacy nightmare waiting to happen. Or maybe it wasn't waiting. Maybe it was already happening. This week a...
81148317739
Reposted by WillW
Catalin Cimpanu @campuscodi.risky.biz · 03/09/2026
Another one... FalconFlank in CrowdStrike github.com/MSNightmare/...
0138
Reposted by WillW
Andrea Barisani @andreabarisani.bsky.social · 03/09/2026
I released go-boot v1.9 with bug fixes, improvements and new features contributed by @nablahero.bsky.social (thanks!). github.com/usbarmory/go...
011