Reader

Um tutorial sobre o recurso de criar listas no Mastodon.

O Mastodon oferece um importante recurso de organização dos perfis que você segue, permitindo que você crie listas, que funcionarão como um recorte da sua timeline principal.

Como a plataforma não possui timelines com algoritmos que detectam os seus interesses, e os posts na plataforma obedecem uma ordem estritamente cronológica, o recurso de criação de listas se mostra muito interessante para você não perder os posts de determinado assunto ou de determinados perfis de seu interesse, possibilitando que você navegue pelas notícias ou temas em que você está interessado naquele momento específico.

Com a versão 4.2 do Mastodon, você pode ocultar de sua timeline inicial os perfis que estão em uma lista que você criou, tornando-a menos poluída e lhe propiciando uma melhor experiência, pois você pode seguir centenas de perfis, sem ter a preocupação de ter uma página inicial caótica, em que posts interessantes são perdidos pelo caminho.

Para criar uma lista é muito simples. Vamos usar como exemplo a criação de uma lista cujo tema é “notícias científicas” e vamos ocultar essa lista da linha inicial, supondo que às vezes você só quer entrar e ler as notícias mais recentes do meio científico sem ter que ficar as procurando em meio aos posts dos seus amigos.

Você irá clicar na opção Listas no menu da plataforma, o que te levará para a aba de listas, onde são apresentadas todas as listas que você criou. Na parte de cima, você pode escrever o nome de uma nova lista que deseje criar (neste exemplo vamos criar a lista cujo nome é “Ciência”) e após clicar no botão de +, circulado na imagem, você a terá criado.

Uma vez criada a nova lista Ciência você clicará nela para a editar:

Clique no menu de Mostrar Configurações circulado em verde na imagem abaixo, para exibir as opões de edição, e então clique em Ocultar estes posts da página inicial, caso deseje que os perfis que irá adicionar a essa lista não sejam exibidos em sua timeline inicial.

Finalmente, você precisa seguir os perfis que pretende adicionar à sua lista. Você pode os incluir na lista de duas maneiras: na primeira forma, dentro do menu de opções da lista, conforme a imagem abaixo, você clica em Editar lista, o que abrirá a aba mostrada abaixo, onde você digita o nome do perfil e aperta enter para o localizar, clicando depois no sinal de + para adicionar o perfil à sua lista:

Na segunda forma, você entra diretamente na página do perfil que pretende incluir na lista, clica no ícone de três pontinhos, circulado na imagem abaixo, o que abrirá uma aba de opções, dentre as quais Adicionar ou remover de listas, em que você irá clicar para escolher em que lista deseja incluir o perfil selecionado, clicando em +, conforme está circulado na segunda imagem abaixo.

Pronto, você terá incluído o perfil à lista criada. Você pode adicionar vários perfis temáticos relacionados em uma mesma lista.

Como deve ter notado pelas imagens, é um recurso que utilizo bastante e possuo atualmente oito listas temáticas, nem todas ocultadas da minha linha inicial, visto que algumas uso apenas para focar em posts de determinados perfis que não me incomodarão se forem visualizados também na página inicial.

Espero que sua experiência no Mastodon seja cada vez mais divertida!

#Tutorial #MastoDicas

I spent last week at Headquarters which is always great to talk directly with many security colleagues in a short amount of time – and not just in the office, but also dinner and drinks. That always allows for conversations that can go deeper and more passionate – and sometimes more honest – than you get in the day time, let alone when meeting virtually. Especially when you've known each other for years.

Thursday was the local Cybersecurity Awareness Month event, and I was invited for an Executive Q&A on our security strategy and direction. To continue the conversation, I invited those interested to dinner after to close out my week before flying back home. This is how I found myself opposite my oldest friend in the security organization, deeply engaged on one of his favorite topics: open source security.

“But That Stuff is Boring!”

He wanted to talk about protecting against zero days in the most common open source components used in our solutions. Admirable, but aside from the greater risks from known vulnerabilities, how would you do that? Not knowing they exist, such zero days by definition would have slipped through our SAST and DAST scanning. So, are you proposing we run continuous fuzzing tests against such components and dependent libraries, in addition?

We can engage the internal security community (another one of his favorite topics), he replied. They can submit vulnerabilities and pull requests to the maintainers. And we could patch our landscape even before the vulnerability is disclosed.

Wait, you're suggesting we fork the library and deploy a patch, rather than wait for the fix to be released by the maintainers? And then how do we get back on the official version? Do we force all the developer teams to patch twice for a zero day nobody knows about and we have no evidence is exploited in the wild? Why wouldn't we just manage it through the existing known vulnerability management processes with established SLAs, and if necessary deploy a temporary detection or mitigation?

Oh, but that stuff is boring...

Ignoring the Boring Makes Us Vulnerable

We have such a habit in infosec to chase after the esoteric and interesting. It is encouraged through conferences and social media fame. The cybersecurity industry adds to it, whether for marketing reasons or added features without guidance or consideration how to operationalize them but demo well. We like intellectually interesting problems we can solve on our own. But then we shouldn't be surprised when the basics aren't taken care of, and developer teams consider us burdensome and adding irrelevant toil.

I get that it may not be as much fun to chase after teams with reports on alerts or missing evidence for compliance controls, help teams to manage a never ending stream of newly reported vulnerabilities against SLAs, or to improve asset discovery and metadata management, rather than chase after zero days. But the boring basics are what truly reduces the attack surface. Ignoring the boring is what continues to make us vulnerable.

Finding Excitement in the Boring

To solve the big problems in security, we must find excitement in the boring. Let's focus our minds on how we implement and operationalize least-privilege IAM and secrets, how we can make CI/CD pipelines both more secure and efficient for developer teams to allow for greater code quality and higher velocity, and provide secure-by-default infrastructure, platforms and services that enable teams to be more productive without getting in their way. Find the intellectual challenge in security engineering and operations. We must work on the risks we face, not the threats we like.

Security is a tough discipline. To do it well requires focus, so we don't spin our wheels, spend effort and budget, or get distracted by the latest hype. It is unfortunate, therefore, that we often get caught in dogmas we tell ourselves, but we don't examine whether they are correct or even useful. Here are three such dogmas that are just plain wrong.

1. Defenders Have to be Right All the Time, Attackers Only Once

If this was ever true, it certainly isn't today. A quick look at the MITRE ATT&CK framework makes it very clear that there are many stages in attacks, from reconnaissance to initial access to execution and persistence, just to gain a first foothold in a defender's landscape. Before a threat actor gets to actual data collection and exfiltration, or a ransomware attack, he or she needs to get a lot of things right – all of which could potentially be detected.

A layered defense that presents multiple obstacles also means that the defender may not get it right all the time – a vulnerability in a container, a misconfiguration in the network architecture, an open RDP port – but should still have multiple opportunities to detect malicious activity before the attacker is at your crown jewels. Lateral movement, privilege escalation, creation of rogue resources or user accounts all give opportunities to detect an attack in progress, and as long as an attacker has no access to a KMS may never get to encrypted data or into databases.

The dogma doesn't recognize the advantages of defenders and ignores the obstacles attackers must overcome. Attackers need to be right all the time. Defenders have multiple opportunities to stop them.

2. No Security Through Obscurity

This is often repeated, but as a result prevents us from taking the benefits of obscurity as part of a layered defense. Run an SSH open to the public internet on port 22 and it will be hammered constantly by automated scripts. Run it on a high random port and it will see virtually no traffic. Only very persistent threat actors focused on a particular target victim will scan for all open ports.

And if defenders were diligent enough to run SSH on a high randomly chosen port, logs showing failed logins will present a far more valuable and reliable alert than the noise that comes with SSH on port 22.

3. Zero Trust Network Architecture

This is possibly the most controversial dogma at all, as it seems the entire industry has lost their mind over this. NIST SP 800-207, the relevant Zero Trust standard says:

Zero trust focuses on protecting resources (assets, services, workflows, network accounts, etc.), not network segments, as the network location is no longer seen as the prime component to the security posture of the resource

So, it correctly starts with the premise that the network cannot be trusted... and yet spends most of the document discussion network controls, trying to re-establish trust in the network.

Trying to fix IAM, application context, and network security all at the same time, by adding a new policy control overlay in the network to implement the user access controls we should already have on application level. But why? Didn't we just declare the network no longer trusted? Especially in a cloud landscape, you may even end up creating network connections that don't need to exist. Why prevent a user access to a resource by network they already don't have access to on application level? The problem is IAM and that is hard enough. We can manage IAM and application context with Workload Identities for service accounts. Why complicate it further by adding the network back in?

Organizations struggle already with the basics. Why set them up for failure with a massive ZTNA implementation? IAM is boring and network security companies have products to sell?

Abandon the Idea that it's Not Good Enough Unless it's Perfect

There is this joke that goes that the only secure computer is one that is locked away in a separate room, does not have mouse, keyboard or screen, has no network connection, and is powered off. This is supposed to be instructive to get the balance of confidentiality and integrity right in relation to availability. It's intended to show that perfect security is not possible. It is not to be taken seriously as reasonable security guidance.

We supposedly moved at least a decade ago to a risk-based approach. However it seems a good portion of our industry continues to look for the perfect, and anything less is not good enough. Is it any surprise that there is such a gulf between security consultants, advisors and policy writers on the one hand and practitioners on the other? Let's abandon our perfect dogmas so we can focus on the actually important security operational problems.

In the wake of his purchase, far-right billionaire Elon Musk has made many awful changes at Twitter. Kneecapping capabilities for viewing, researching, and archiving materials posted on the forum is certainly less immediately harmful than, say, stochastic terrorism against schools & childrens' hospitals, but it's still no good, and requires some stopgaps.

Twitter frequently now seems to block archive.org altogether; and even when it is possible to archive a tweet by other means, it is generally only viewable as a single post, devoid of any surrounding context in the form of threads or replies.

One intermittent way to currently get around this limitation is to use the open-source, alternative Twitter front-end “Nitter”, and specifically Chris McCormick's redirect proxy Twiiit.

The steps I've found useful are as follow:

• For example, let's say I need to preserve this post along with some of its immediate context: https://twitter.com/dril/status/1707911269033148925
• I replace the url's “twitter” domain with “twiiit” – e.g. https://twiiit.com/dril/status/1707911269033148925
• Before I hit “enter”, I COPY that modified URL. This is because Nitter instances themselves are regularly being blocked by Twitter, or are otherwise unable to dredge up a copy of the post. The “twiiit” re-direct will try various Nitter instances, though; so if the first couple don't function, I simply paste the URL and try again. It only saves a couple of seconds, but they can add up.
• I find myself redirected to a functional Nitter front-end of the tweet, which includes replies and context, in this case it's this one: https://nitter.nohost.network/dril/status/1707911269033148925
• I create an archive of that Nitter front-end by using archive.org and/or archive.today.

If I'm trying to preserve a longer thread, I will sometimes archive every fourth or fifth post to ensure that the data is complete via overlapping captures.

As Musk continues to use his fortune in an apparent quest to singlehandedly reinvigorate the embers of the alt-right, it'll remain important to be able to document & preserve some of what is posted on his platform — this will likely require a continual stream of kludgy workarounds by diligent researchers who are much more clever than I am. So, thanks in advance.

---

P.S. – Nitter instances render timestamps as UTC, which is generally more reliable than the local timestamp which appears when I view the original tweet from the US West coast.

Today.

(Updated:2023-09-26)

This list only contains accounts for security bsides, events, and conferences found in the fediverse / Mastodon with some post history. I will regular update this post as more events migrate here. For hacker meet-ups and local DEFCON / 2600 groups, please refer to the link below.

📌⁠InfoSec Events by Region (ᵃˡˢᵒ🦣ⷨ) 📌⁠Hacker Meet-ups by Region (ᵃˡˢᵒ🦣ⷨ) 📌⁠Hackerspaces by Region (ᵃˡˢᵒ🦣ⷨ)

🐈🥗

⸻ Event Info

@cfp_time@infosec.exchange – Call for Papers (#CFP) @InfoCon@defcon.social – #InfoCon @InfoconDB@infosec.exchange – #InfoconDB archive @SecurityBSidesGlobal@infosec.exchange – Security BSides Global

⸻ Online 🌐

@ComfyConAU@infosec.exchange – #ComfyCon @Digit4lOverdose@infosec.exchange – D.O. Conference @pancakescon@infosec.exchange – #PancakesCon

⸻ Canada 🇨🇦

@BSidesCalgary – #BSidesCalgary, AB @BSidesEdmonton – #BSidesEdmonton, AB @BSidesFredericton – BSidesFredericton, NB @BSidesMTL – #BSidesMTL Montreal, QC @BSidesOttawa – #BSidesOttawa, ON @BSidesRegina – #BSidesRegina, SK @BSidesStJohns– #BSidesStJohns, NL @BSidesTO – #BSidesTO Toronto, ON @BSidesVancouver – #BSidesVancouver, BC @BSidesVI@infosec.exchange – #BSidesVI Vancouver Island, BC @hackfest@infosec.exchange – #Hackfest Québec City, QC @halifaxbsides@infosec.exchange – #BSidesHalifax, NS @NorthSec@infosec.exchange – #NorthSec Montréal, QC @polar@infosec.exchange – #PolQc POLAR Conf, QC @seqcure@infosec.exchange – #SeQCure Québec, QC @thelongcon@infosec.exchange – #TheLongCon Winnipeg, MB

⸻ US – Northeast

@bsidesboston@infosec.exchange – #BSidesBoston, MA @BSidesBuffalo@infosec.exchange – #BSidesBuffalo, NY @BSidesCambridgeMA@infosec.exchange – #BSidesCambridge, MA @BSidesCharm@infosec.exchange – #BSidesCharm Towson, MD @BSidesCT – #BSidesCT Hamden, CT @BSidesFloodCity – #BSidesFloodCity Johnstown, PA @BSidesHBG – #BSidesHBG Harrisburg, PA @BSidesNJ@infosec.exchange – #BSidesNJ ? NJ @BSidesNYC@infosec.exchange – #BSidesNYC New York City, NY @bsidesphilly@infosec.exchange – #BSidesPhilly Philadelphia, PA @bsidespgh@infosec.exchange – #BSidesPGH Pittsburgh, PA @bsidesroc@infosec.exchange – #BSidesROC Rochester, NY @hushcon@infosec.exchange – #HushCon New York City, NY @jawncon@infosec.exchange – #JawnCon Philadelphia, PA @pumpcon@infosec.exchange – #PumpCon Philadelphia, PA @ShmooCon@infosec.exchange – #ShmooCon Washington, DC @SummerC0n@infosec.exchange – #SummerCon Brooklyn, NY

⸻ US – Midwest

@BlueTeamCon@infosec.exchange – #BlueTeamCon Chicago, IL @bsides312@infosec.exchange – #BSides312 Chicago, IL @BSidesBloomington – #BSidesBloomington, IN @BSides_BTown@infosec.exchange – #BSides_BTown Bloomington, IN @bsidesboulder@infosec.exchange – #BSidesBoulder, CO @bsideschicago@infosec.exchange – #BSidesChicago, IL @BSidesColoradoSprings – #BSidesColoradoSprings, CO @BSidesColumbus – #BSidesColumbus, OH @bsidesdayton@infosec.exchange – #BSidesDayton, OH @bsidesdenver@infosec.exchange – #BSidesDenver, CO @BSidesFtWayne – #BSidesFtWayne, IN @bsideskc@infosec.exchange – #BSidesKC Kansas City, MO @BSidesMilwaukee – #BSidesMilwaukee, WI @BSidesPeoria – #BSidesPeoria, IL @bsidesspfd@infosec.exchange – #BSidesSpfd Springfield, MO @CircleCityCon@infosec.exchange – #CircleCityCon Indianapolis, IN @CypherCon@infosec.exchange – #CypherCon Milwaukee, WI @thotcon@infosec.exchange – #THOTCON Chicago, IL @WWHackinFest@infosec.exchange – #WWHackinFest Deadwood, SD

⸻ US – West

@bsidescv@infosec.exchange – #BSidesCV Central Valley, CA @BSidesHawaii – #BSidesHawaii Honolulu, HI @bsidesla@infosec.exchange – #BSidesLA Los Angeles, CA @BSidesPDX@pdx.social – #BSidesPDX Portland, OR @BsidesSD@infosec.exchange – #BSidesSD San Diego, CA @bsidesseattle@infosec.exchange – #BSidesSeattle, WA @bsidessf@infosec.exchange – #BSidesSF San Francisco, CA @soups@hci.social – #SOUPS Symposium on Usable Privacy and Security, Anaheim, CA

⸻ US – Southwest

@BSidesAlbuquerque – #BSidesAlbuquerque, NM @bsidesaustin@infosec.exchange – #BSidesAustin, TX @BSidesDFW@infosec.exchange – #BSidesDFW Dallas-Fort Worth, TX @BSidesLV@infosec.exchange – #BSidesLV Las Vegas, NV @BSidesRGV@infosec.exchange – #BSidesRGV Rio Grande Valley, McAllen, TX @BSidesSATX@infosec.exchange – #BSidesSATX San Antonio, TX @BSidesSantaFe – #BSidesSantaFe, NM @BSidesTucson – #BSidesTucson, AZ @cactuscon@infosec.exchange – #CactusCon Mesa, AZ @defcon@defcon.social – #DEFCON Las Vegas, NV @DianaInitiative@defcon.social – #DianaInitiative Las Vegas, NV

⸻ US – Southeast

@bsidesatl@infosec.exchange – #BSidesATL Atlanta, GA @BSidesAugusta@infosec.exchange – #BSidesAugusta, GA @BSidesBirmingham – #BSidesBirmingham, AL @BSidesCharleston@infosec.exchange – #BSidesCharleston, SC @BSidesCLT@infosec.exchange – #BSidesCLT Charlotte, NC @BSidesCHS – #BSidesCHS Charleston, SC @BSidesCharlotte@infosec.exchange – #BSidesCharlotte, NC @BSidesGVL – #BSidesGVL Greenville, SC @BSidesHSV – #BSidesHSV Hunstville, AL @BSidesJAX – #BSidesJAX, Jacksonville, FL @BSidesKC – #BSidesKC Kansas City, MO @bsidesknoxville@infosec.exchange – #BSidesKnoxville, TN @BSidesNOLA – BSidesNOLA New Orleans, LA @BSidesNoVA – #BSidesNoVA Arlington, VA @bsidesorlando@infosec.exchange – #BSidesOrlando, FL @BSidesRoanoke – #BSidesRoanoke, VA @BSidesRDU@infosec.exchange – #BSidesRDU Raleigh/Durham, NC @BSidesSPFD@infosec.exchange – #BSidesSPFD Springfield, MO @bsidesSTL@infosec.exchange – #BSidesSTL St. Louis, MO @BSidesStPete – #BSidesStPete St. Petersburg, FL @BSidesTampa – #BSidesTampa, FL @CackalackyCon@infosec.exchange – #Cackalacky Con, Raleigh, NC @CYBERWARCON@infosec.exchange – #CyberwarCon Arlington, VA @securityonion@infosec.exchange – #SecurityOnion Con, Augusta, GA

⸻ US – Territories

@BSidesPR – #BSidesPR San Juan, PR 🇵🇷

⸻ Caribbean

@BSidesCaymanIslands – #BSidesCaymanIslands, KY 🇰🇾

⸻ Latin America

@BSidesArgentina – #BSidesArgentina Jujuy, Argentina 🇦🇷 @bsidescdmx@infosec.exchange – #BSidesCDMX Mexico City, Mexico 🇲🇽 @BSidesCO – #BSidesCO Bogotá, Colombia 🇨🇴 @bsidesjp@infosec.exchange – #BSidesJoãoPessoa, Brazil 🇧🇷 @BSidesPeru – #BSidesPeru Lima, Peru 🇵🇪 @BSidesPanama – #BSidesPanama Panama City, Panama 🇵🇦 @BSidesSP@infosec.exchange – #BSidesSP Sao Paulo, Brazil 🇧🇷 @BSidesVitória – #BSidesVitória, Brazil 🇧🇷

⸻ Europe 🇪🇺

@botconf@infosec.exchange – #Botconf Nice, FR 🇫🇷 @brucon@infosec.exchange – #BruCON Mechelen, BE 🇧🇪 @BSidesAthens – #BSidesAthens, GR 🇬🇷 @BSidesBUD – #BSidesBUD Budapest, HU 🇭🇺 @BSidesCyprus – #BSidesCyprus Limassol, CY 🇨🇾 @BSidesDublin – #BSidesDublin, IE 🇮🇪 @BSidesKraków~~ – #BSidesKraków, PL 🇵🇱 @bsideskbh@infosec.exchange – #BSidesKbh København, DK 🇩🇰 @bsideslisbon@infosec.exchange – #BSidesLisbon, PT 🇵🇹 @bsidesljubljana@infosec.exchange – #BSidesLjubljana, SI 🇸🇮 @BSidesMilano – #BSidesMilano, IT 🇮🇹 @BSidesOsijek – #BSidesOsijek, HR 🇭🇷 @bsidesoslo@infosec.exchange – #BSidesOslo, NO 🇳🇴 @BSidesPrishtina – #BSidesPrishtina, XK 🇽🇰 @BSidesRoma – #BSidesRoma, IT 🇮🇹 @bsidesrvk@infosec.exchange – #BSidesReykjavik, IS 🇮🇸 @BSidesSOF@infosec.exchange – #BSidesSOF Sofia, BG 🇧🇬 @BSidesTallinn – #BSidesTallinn, EE 🇪🇪 @BSidesTirana – #BSidesTirana, AL 🇦🇱 @BSidesTransylvania – #BSidesTransylvania Cluj-Napoca, RO 🇷🇴 @BSidesUmeå – #BSidesUmeå, SE 🇸🇪 @bsidesvienna@infosec.exchange – #BSidesVienna, AT 🇦🇹 @BSidesZurich@infosec.exchange – #BSidesZurich, CH 🇨🇭 @deepsec@social.tchncs.de – #DeepSec Con, Vienna, AT 🇦🇹 @hack_lu@infosec.exchange – #HackLu, LU 🇱🇺 @passthesaltcon@infosec.exchange – Pass the SALT Con, Lille, FR 🇫🇷 @securitybsidesitalia@infosec.exchange – #BSidesItalia IT 🇮🇹 @TumpiConIT@infosec.exchange – #TumpiCon Turin area, IT 🇮🇹

⸻ Germany 🇩🇪

@BSidesBerlin – #BSidesBerlin @BSidesFrankfurt – #BSidesFrankfurt am Main @BSidesMunich@infosec.exchange – #BSidesMunich @BSidesStuttgart – #BSidesStuttgart @elbsides@infosec.exchange – #Elbsides BSides Hamburg @WEareTROOPERS@infosec.exchange – TROOPERS Conference, Heidelberg

⸻ United Kingdom 🇬🇧

@44CON@infosec.exchange – #44CON London 🏴󠁧󠁢󠁥󠁮󠁧󠁿 @AbertayHackers@infosec.exchange – #SecuriTay Abertay, Dundee, 🏴󠁧󠁢󠁳󠁣󠁴󠁿 @BSidesBasingstoke – #BSidesBasingstoke @BSidesBelfast – #BSidesBelfast @BSidesBHAM@infosec.exchange – #BSidesBham Birmingham 🏴󠁧󠁢󠁥󠁮󠁧󠁿 @BSidesBristol – #BSidesBristol @BSidesCambridge – #BSidesCambridge @BSidesCheltenham@infosec.exchange – #BSidesCheltenham 🏴󠁧󠁢󠁥󠁮󠁧󠁿 @BSidesDundee – #BSidesDundee 🏴󠁧󠁢󠁳󠁣󠁴󠁿 @BSidesExeter – #BSidesExeter @BSidesLancashire – #BSidesLancashire @bsidesleeds@infosec.exchange – #BSidesLeeds 🏴󠁧󠁢󠁥󠁮󠁧󠁿 @BSidesNewcastle – #BSidesNewcastle @VirusBulletin@infosec.exchange – #VB2024 VirusBulletin, London 🏴󠁧󠁢󠁥󠁮󠁧󠁿

⸻ Africa

@BSidesCapeTown – #BSidesCapeTown, South Africa 🇿🇦 @BSidesNairobi – #BSidesNairobi, Kenya 🇰🇪

⸻ India 🇮🇳

@BSidesAhmedabad – #BSidesAhmedabad @BSidesBangalore@infosec.exchange – #BSidesBangalore @BSidesChennai – #BSidesChennai @BSidesIndore – #BSidesIndore @BSidesJaipur – #BSidesJaipur @BSidesOdisha@infosec.exchange – #BSidesOdisha

⸻ Asia

@BSidesMyanmar – #BSidesMyanmar, Myanmar 🇲🇲 @BSidesSG – #BSidesSG Singapore, China 🇨🇳 @BSidesTokyo – #BSidesTokyo, Japan 🇯🇵 @BSidesYerevan – #BSidesYerevan, Armenia 🇦🇲

⸻ Australasia

@bsides_bne@infosec.exchange – #BSides_Bne Brisbane, AU 🇦🇺 @bsidescbr@infosec.exchange – #BSidesCanberra, AU 🇦🇺 @bsidesmelbourne@infosec.exchange – #BSidesMelbourne, AU 🇦🇺 @bsidesperth@infosec.exchange – #BSidesPerth, AU 🇦🇺 @bsidessydney@infosec.exchange – #BSidesSydney, AU 🇦🇺 @crikeycon@infosec.exchange – #CrikeyConAU Brisbane, AU 🇦🇺

⸻ For other events not in the fediverse try: ➡️⁠https://securitybsides.com ➡️⁠https://github.com/xsa/infosec-events by Xavier Santolaria @0x58@infosec.exchange

Feel free use, copy, modify, steal, boost, encrypt, or plagiarize this information anyway you want. :cc_cc:​𝟶 “No Rights Reserved”

⸻ #InfoSec #CyberSecurity #BSides #CatSalad #cc0

(Updated:2023-09-26)

This list only contains local 2600, DEFCON, CCC, OWASP, LUG, and InfoSec groups with active fediverse / Mastodon accounts, including languages other than English. As more are created or discovered, I will update this message. For hackerspaces, see the link below.

📌⁠InfoSec Events by Region (ᵃˡˢᵒ🦣ⷨ) 📌⁠Hacker Meet-ups by Region (ᵃˡˢᵒ🦣ⷨ) 📌⁠Hackerspaces by Region (ᵃˡˢᵒ🦣ⷨ)

🐈🥗

⸻ InfoSec Groups

@2600@lemmy.world – 2600 Community (Lemmy) @blackhoodie@infosec.exchange – #BHRE (women only) @CCC@social.bau-ha.us – Chaos Computer Club @ccc@anonsys.net – #CCC (friendica) @guide@chaos.social – CCC events #cccRegio @womenincybersecurity@mastodon.social – Women In Cybersecurity (#WiCyS)

⸻ Canada 🇨🇦

@dc902@defcon.social – #DC902 Halifax, NS @OWASP_Ottawa@infosec.exchange – OWASP Ottawa

⸻ US – Northeast

@2600_new_hampshire@eventos.hispagatos.org – 2600, NH @blacksincyber@defcon.social – Blacks In Cybersecurity™ (BIC), Washington, DC @blacksincyber@infosec.exchange – #BIC DMV Metro Area, DC @dc215@defcon.social – #DC215, Philadelphia, PA @defcon201@diode.zone – #DC201 North New Jersey @dc201@diode.zone – DC201 North NJ @defcon201@hostux.social – DC201 North NJ @defcon610@defcon.social – #DC610 Easton, PA @hacdc@fosstodon.org – #HackDC Washington, DC @NYC2600@infosec.exchange – #NYC2600 NY @NYC2600@mastodon.social – NYC 2600, NY @owaspboston@infosec.exchange – OWASP Boston, MA @philly2600@jawns.club – #Philly2600 Philadelphia, PA @Phillysec@infosec.exchange – #Phillysec Philadelphia, PA

⸻ US – Midwest

@defcon402@infosec.exchange – #DC402 Nebraska @DC608Madison@defcon.social – #DC608 Madison, WI @DC608Madison@infosec.exchange – DC608 Madison, WI @defcon937@infosec.exchange – #DC937 Dayton, OH @DenverSec@infosec.exchange – #DenverSec Denver, CO @lansing2600@mastodon.praxis.red – #Lansing2600 Lansing, MI @RockyMtnLUG@fosstodon.org – Rocky Mountain LUG, CO

⸻ US – West

@dc503@defcon.social – #DC503 Portland, OR @dc510@defcon.social – #DC510 Oakland, CA @DCG858@defcon.social – #DC858 / #DC619 San Diego, CA @pdx2600@mastodon.online – #PDX2600 Portland, OR @rainsec@infosec.exchange – #RainSec PDX, Portland, OR

⸻ US – Southwest

@ASULUG@fosstodon.org – #ASULUG ASU, AZ @dallas_hackers@infosec.exchange – Dallas Hackers Dallas, TX @DC512@defcon.social – #DC512, Austin, TX @PLUG@fosstodon.org – #PLUG, Phoenix, AZ

⸻ US – Southeast

@dc404@defcon.social – #DC404 Atlanta, GA @DC443@defcon.social – #DC443 Baltimore, MD @dc540@defcon.social – #DC540 Nova regional, VA @dc540@infosec.exchange – DC540 Nova regional, VA @RTP2600@kolektiva.social – #RTP2600 Raleigh, NC

⸻ Europe 🇪🇺

@2600Malmo@mastodon.online – #2600Malmo 2600 Malmö, SE 🇸🇪 @2600stockholm@mastodon.social – #2600stockholm Stockholm, SE 🇸🇪 @2600_madrid@eventos.hispagatos.org – 2600 Madrid, ES 🇪🇸 @amsterdam@chaos.social – Chaos Amsterdam, NL 🇳🇱 @c3wien@chaos.social – CCC Wien, Vienna, AT 🇦🇹 @CCCBasel@chaos.social – CCC Basel, Muttenz, CH 🇨🇭 @dc4822@infosec.exchange – #DC4822 Warsaw, PL 🇵🇱 @dc9723@defcon.social – #DC9723, Tel-Aviv, IL 🇮🇱 @lugos@floss.social – #LUGOS SI 🇸🇮 @lugv@troet.cafe – #LUGV Vorarlberg, AT 🇦🇹 @ulug@social.linux.pizza – #ULUG Uppsala, SE 🇸🇪

⸻ Germany 🇩🇪

@amborg_sulzbyte@chaos.social – Chaostreff Amberg Sulzbach @c3d2@c3d2.social – CCC Dresden @cccac@chaos.social – CCC Aachen @cccda@chaos.social – CCC Darmstadt @cccffm@chaos.social – CCC Frankfurt @cccfr@chaos.social – CCC Freiburg @ccchh@chaos.social – CCC Hamburg @cccp@chaos.social – CCC Potsdam @cccs@chaos.social – CCC Stuttgart @cccwi@cccwi.social – CCC Wiesbaden @cciz@chaos.social – Computer Club Itzehoe @chaospott@chaos.social – CCC Essen @clubdiscordia@chaos.social – CCC Berlin @ctaz@rheinhessen.social – Chaostreff Alzey @ctbk@chaos.social – Chaostreff Backnang @erlug@social.anoxinon.de – #ErLUG Erlangen @flipdot@social.flipdot.org – #Flipdot CCC Erfa-Kreis, Kassel @haecksen@chaos.social – #Haecksen (Stuttgart, Hamburg, Hannover, Karlsruhe, Leibzig, Göttingen and Berlin) @geekfem@chaos.social – #Geekfem Hamburg @KiLUG@mastodon.social – #KiLUG Haslach im Kinzigtal @LUG_MYK@chaos.social – LUG Mayen-Koblenz @lug_nuernberg@mastodon.online – LUG Nürnberg @lughannover@norden.social – LUG Hannover @lugor@dynlinux.io – #LUGOR Oberhausen Rheinland @muccc@chaos.social – CCC Munich @owasp_de@infosec.exchange – OWASP DE @owasp_ka@chaos.social – OWASP Karlsruhe

⸻ India 🇮🇳

@dc_9111@ioc.exchange – #DC9111, Delhi

⸻ United Kingdom 🇬🇧

@2600@glasgow.social – 2600 Glasgow 🏴󠁧󠁢󠁳󠁣󠁴󠁿 @AbertayHackers@infosec.exchange – Abertay Hackers, Dundee 🏴󠁧󠁢󠁳󠁣󠁴󠁿 @DC44131@infosec.exchange – #DC44131 Edinburgh 🏴󠁧󠁢󠁳󠁣󠁴󠁿 @OWASPLondon@infosec.exchange – OWASP London 🏴󠁧󠁢󠁥󠁮󠁧󠁿

⸻ Australasia

@flinderscybersoc@infosec.exchange – Flinders Cybersecurity Society, Adelaide, AU 🇦🇺 @linuxaustralia@fosstodon.org – Linux Australia 🇦🇺 @owaspmelb@infosec.exchange – OWASP Melbourne, AU 🇦🇺 @PalmyLUG@mastodon.nzoss.nz – #PalmyLUG Palmerston North, NZ 🇳🇿

⸻

For other groups & meetups not in the fediverse: ➡️⁠https://forum.defcon.org/social-groups ➡️⁠https://events.ccc.de/ ➡️⁠https://owasp.org/www-community/meetings/ ➡️⁠https://www.2600.com/meetings

Feel free use, copy, modify, steal, boost, encrypt, or plagiarize this information anyway you want. cc​𝟶 “No Rights Reserved”

⸻

#InfoSec #CyberSecurity #DEFCON #2600 #CCC #OWASP #WomenInCybersecurity #LUG #LinuxUserGroup #CatSalad #cc0

(Updated:2023-09-26)

This list contains hackspaces and hacklabs with active fediverse / Mastodon accounts. For monthly group meets, see the post link below. This list will be update as more workshops in the fediverse are discovered.

📌⁠InfoSec Events by Region (ᵃˡˢᵒ🦣ⷨ) 📌⁠Hacker Meet-ups by Region (ᵃˡˢᵒ🦣ⷨ) 📌⁠Hackerspaces by Region (ᵃˡˢᵒ🦣ⷨ)

🐈🥗

⸻ United States 🇺🇸

@hacdc@fosstodon.org – #HackDC Washington, DC @iffybooks@post.lurk.org – Iffy Books – Philadelphia, PA @Noisebridge@sfba.social – #Noisebridge Hackerspace – San Francisco, CA

⸻ Latin America

@lhc@mastodon.com.br – Laboratório Hacker de Campinas, Brazil 🇧🇷

⸻ Europe 🇪🇺

@coredump@chaos.social – #Coredump Hack- & Makerspace, Rapperswil-Jona, CH 🇨🇭 @fhl@mastodon.cisti.org – F-HackLab, Rome, IT 🇮🇹 @hackeriet@chaos.social – #Hackeriet Oslo, NO 🇳🇴 @hackstub@kolektiva.social – #Hackstub Strasbourg, FR 🇫🇷 @hspsh@0x3c.pl – #HsPsh Hackerspace Pomorze, PL 🇵🇱 @hswaw@hackerspace.pl – #HsWaw Warsaw, PL 🇵🇱 @KaouennNoz@diaspodon.fr – #KaouennNoz Rennes, FR 🇫🇷 @lebib@social.bim.land – #LeBIB Montpellier, FR 🇫🇷 @hslodz@mas.to – #HSLodz Hakierspejs Łódź, PL 🇵🇱 @tamperehacklab@qoto.org – #TampereHacklab FI 🇫🇮

⸻ Austria 🇦🇹

@devlol@chaos.social – #DevLol Linz @itsyndikat@chaos.social – #Itsyndikat Innsbrucks @metalab@chaos.social – #Metalab Vienna @realraum@chaos.social – #Realraum Graz @usrspace@chaos.social – /usr/space, Leobersdorf

⸻ Germany 🇩🇪

@acmelabs@chaos.social – #ACMELabs Bielefeld @backspace@chaos.social – #Backspace CCC-Erfa, Bamberg @binhacken@chaos.social – #BinHacken Hacker- & Makerspace, Bingen @bytespeicher@social.bau-ha.us – #Bytespeicher Erfurt @bytewerk@chaos.social – #bytewerk Ingolstadt @c4@chaos.social – CCC Cologne @cbase@chaos.social – c-base, Berlin @cccac@chaos.social – CCC Aachen @cccda@chaos.social – CCC Darmstadt @cccffm@chaos.social – CCC Frankfurt @cccfr@chaos.social – CCC Freiburg @ccchh@chaos.social – CCC Hamburg @cccwi@cccwi.social – CCC Wiesbaden @chaos_fl@chaos.social – Chaostreff Flensburg @chaosdorf@chaos.social – #Chaosdorf Hackspace & CCC Erfa, Düsseldorf @chaostreff_osnabrueck@chaos.social – Chaostreff Osnabrück @chaotikumev@social.chaotikum.org – #Chaotikum Lübeck @chch@chaos.social – Chaostreff Chemnitz @clubdiscordia@chaos.social – #ClubDiscordia CCC Berlin @daslabor@chaos.social – #DasLabor Bochum @datenburg@bonn.social – #Datenburg Bonner @dezentrale@chaos.social – Dezentrale Leipzig @eigenbaukombinat@chaos.social – #Eigenbaukombinat Halle, Saale @entropia@chaos.social – #Entropia Karlsruhe @flipdot@social.flipdot.org – #Flipdot Kassel @hacklabor@chaos.social – #Hacklabor Schwerin @hackershell@social.anoxinon.de – #Hackershell 🌐 @hacksaar@social.saarland #Hacksaar Saarbrücken @Hackzogtum@chaos.social – #Hackzo Coburg @Hasi@chaos.social – Hackspace Siegen @haxko@chaos.social – #Haxko Mayen-Koblenz @HSB@chaos.social – Hackerspace Bielefeld @k4cg@chaos.social – K4 Computergruppe, Nuremberg @krautspace@chaos.social – #Krautspace Jena @leinelab@chaos.social – #LeineLab Hannover @maglab@chaos.social – #MagLab Magrathea Laboratories, Fulda @maschinenraum@social.bau-ha.us – #Maschinenraum m18, Weimar @muccc@chaos.social – CCC Munich @neanderfunk@nrw.social – Freifunk Neanderland, Wülfrath @neotopia@chaos.social – #Neotopia Göttingen @Nerdberg@chaos.social – #Nerdberg Nuernberg @netz39@machteburch.social – #Netz39 Magdeburg @OpenLabAugsburg@chaos.social – OpenLab, Augsburg @OWN@chaos.social – Offene Werkstatt Norderstedt @Port39@chaos.social – #Port39 Stralsund @raumfahrtagentur@chaos.social – Raumfahrt, Berlin @schaffenburg@social.schaffenburg.org – #Schaffenburg @space47@ruhr.social – #Space47 Duisburg @spline@chaos.social – #Spline Berlin @stratum0@chaos.social – #Stratum0 Braunschweig @RaumZeitLabor@chaos.social – #RaumZeitLabor Mannheim @temporaerhaus@chaos.social – Temporärhaus, Ulm @toppoint@chaos.social – Toppoint Hackspace, Kiel @Turmlabor@chaos.social – nachtsnochlicht@Turmlabor, Dresden @UN_Hack_Bar@chaos.social – UN-Hack-Bar, Unna @warpzone@social.bau-ha.us – warpzone, Münster @welcomewerkstatt@norden.social – #WelcomeWerkstatt Hamburg @werkraum@chaos.social – #Werkraum Zittau @westwoodlabs@chaos.social – #Westwoodlabs Westerwald @xHain_hackspace@chaos.social – xHain Hack- Makerspace, Berlin @zLabor@chaos.social – #zLabor Zwickau @ztl@rheinneckar.social – Zentrum für Technikkultur Landau

⸻ Netherlands 🇳🇱

@amsterdam@chaos.social – Chaos Amsterdam @bitlair@hsnl.social – #Bitlair Amersfoort @hack42@chaos.social – #Hack42 Arnhem @hackalot@hsnl.social – #Hackalot Eindhoven @pixelbar@hsnl.social – #Pixelbar Rotterdam @revspace@hsnl.social – #RevSpace Hague @TDvenlo@hsnl.social – #TDvenlo Venlo @TechInc@mastodon.social – Technologia Incognita, Amsterdam @tkkrlab@hsnl.social – #TrrkLab Enschede

⸻ United Kingdom 🇬🇧

@57n@abdn.social – #57n Hacklab, Aberdeen 🏴󠁧󠁢󠁳󠁣󠁴󠁿 @57n@hostux.social – #57North Hacklab, Aberdeen 🏴󠁧󠁢󠁳󠁣󠁴󠁿 @cheltenham_hackspace@mastodonapp.uk – Cheltenham Hackspace 🏴󠁧󠁢󠁥󠁮󠁧󠁿 @EEHackSpace@mstdn.social – #EEHackSpace East Essex 🏴󠁧󠁢󠁥󠁮󠁧󠁿 @hackhitchin@techhub.social – #HackHitchin Hitchin 🏴󠁧󠁢󠁥󠁮󠁧󠁿 @leigh_hackspace@mastodon.social – Leigh Hackspace, Manchester 🏴󠁧󠁢󠁥󠁮󠁧󠁿 @nottinghack@hachyderm.io – #NottingHack Nottingham 🏴󠁧󠁢󠁥󠁮󠁧󠁿

⸻ Australasia

@ballarat@hackerspace.au – Ballarat Hackerspace, AU 🇦🇺

⸻

For other hackerspaces not in the fediverse try: ➡️⁠https://wiki.hackerspaces.org/List_of_Hacker_Spaces

Feel free use, copy, modify, steal, boost, encrypt, or plagiarize this information anyway you want. :cc_cc:​𝟶 “No Rights Reserved”

⸻

#CCC #ChaosComputerClub #Hacker #Hackspace #Hackerspace #CatSalad #cc0

List of some useful links, news sites, and open web search engines that also provide .Onion service access through Tor :tor:. Each searx site varies on their up time, so it pays to visit the 🗂️⁠SearXNG Index to find alternatives.

📌⁠List of torified fedi instances (ᵃˡˢᵒ🦣ⷨ) 📌⁠List of useful torified sites (ᵃˡˢᵒ🦣ⷨ)

⸻Links🔖⁠⸻

🗃️⁠Archive.Today⁠〰️→🧅⁠archivei… 💻⁠DEFCON Forums⁠→🧅⁠ezdhgsy… 💻⁠DEFCON Home⁠〰️→🧅⁠g7ejphhu… 💻⁠DEFCON Media⁠〰️→🧅⁠m6rqq6k… 🔐⁠Key.OpenPGP.org⁠→🧅⁠zkaan2x… 🔖⁠Reddit.com⁠〰️〰️→🧅⁠redditorj…★ 📚⁠zLibrary Articles⁠→🧅⁠articles2… 📚⁠zLibrary Books⁠→🧅⁠bookszlib…

⸻News🗞️⁠⸻

🗞️⁠BBC News⁠〰️〰️→🧅⁠bbcnewsd…★ 🗞️⁠DeutscheWelle⁠→🧅⁠dwnewsg…★ 🗞️⁠ProPublica⁠〰️〰️→🧅⁠p53lf57… 🗞️⁠The Guardian⁠〰️→🧅⁠guardian2…★

⸻Search🔍⸻

🗂️⁠SearXNG Index⁠→🧅⁠searxspb… 🔍⁠divided-by-zero⁠→🧅⁠f4qfqajs… 🔍⁠nicfab.eu⁠〰️〰️→🧅⁠lgmekfn…★ 🔍⁠northboot.xyz⁠→🧅⁠4n53nafyi… 🔍⁠ononoki.org⁠〰️→🧅⁠searchvrz… 🔍⁠priv.au⁠〰️〰️〰️→🧅⁠privateoz… 🔍⁠prvcy.eu⁠〰️〰️→🧅⁠rq2w52k… 🔍⁠sapti.me⁠〰️〰️→🧅⁠gbat2pb… 🔍⁠stinpriza.org⁠→🧅⁠z5vawdo… 🔍⁠thefloatinglab⁠→🧅⁠iziatwmt… 🔍⁠tiekoetter⁠〰️〰️→🧅⁠searx3ao…

⸻ (★ = Supports HTTPS-over-Onion) 🐈🥗

#TorProject #OnionService #OnionServices #Tor #Onion #Privacy #CatSalad

(Updated:2023-09-26)

List of fediverse instances that also provide access through .Onion servers using Tor Hidden Services. I will add more as I find them... Well, most of them anyway.

📌⁠List of torified fedi instances (ᵃˡˢᵒ🦣ⷨ) 📌⁠List of useful torified sites (ᵃˡˢᵒ🦣ⷨ)

⸻FediTor🔖⁠⸻

⁠⛔⁠Alive.bar⁠〰️〰️〰️→🧅⁠alivebrntm… 💻⁠Defcon.social〰️→🧅⁠zpj4sjt4a…★ 💻⁠Ieji.de⁠〰️〰️〰️〰️→🧅⁠iejideks5z…★ 💻⁠Infosec.exchange⁠→🧅⁠7jaxqg6… ⛔⁠⁠Kolektiva.social⁠〰️→🧅⁠klktvbm… ⛔⁠⁠Masto.ai⁠〰️〰️〰️→🧅⁠yiynyc2ly…★ 💻⁠Mstdn.social⁠〰️→🧅⁠c6usaa6… 💻⁠Octodon.social⁠→🧅⁠octodonic… ⛔⁠⁠Partyon.xyz⁠〰️→🧅⁠partyonl2… ⛔⁠⁠Qdon.space⁠〰️→🧅⁠nqt42rzz5… 💻⁠Slippy.xyz〰️〰️→🧅⁠irvqsc5bb… 💻⁠Vern.cc⁠〰️〰️〰️→🧅⁠ak.vernccv… 💻⁠Wetdry.world⁠〰️→🧅⁠qm7a3tu…

⸻ (★ = Supports HTTPS-over-Onion) (⛔⁠ = Cloudflared)

🐈🥗

#FediTor #TorProject #OnionService #OnionServices #Fedi #Tor #Onion #Privacy #CatSalad

start by drawing a n by n grid of points

  ╭─────── n ───────╮
╭ o  o  o  o  o  o  o
│ o  o  o  o  o  o  o
│ o  o  o  o  o  o  o
n o  o  o  o  o  o  o
│ o  o  o  o  o  o  o
│ o  o  o  o  o  o  o
╰ o  o  o  o  o  o  o

take the dots on the main diagonal and move them over to the side

  ╭─────── n ───────╮             1
╭    o  o  o  o  o  o             • ╮
│ o     o  o  o  o  o             • │
│ o  o     o  o  o  o             • │
n o  o  o     o  o  o     ==>     • n
│ o  o  o  o     o  o             • │
│ o  o  o  o  o     o             • │
╰ o  o  o  o  o  o                • ╯ 

we can see the points in the diagonal can be arranged into a line of 1 by n points, thus the main square without the diagonal is n²-n

we can also see that the remaining dots are divided up into two mirror images of each other, mirrored along the main diagonal. Since it can be evenly divided into two, it the remainder must be even

  ╭─────── n ───────╮
╭    •  •  •  •  •  •
│ o     •  •  •  •  •
│ o  o     •  •  •  •
n o  o  o     •  •  •
│ o  o  o  o     •  •
│ o  o  o  o  o     •
╰ o  o  o  o  o  o   

We can also slide all the point of one halve towards the other, creating a rectangle

  ╭───── n-1 ────╮
╭ •  •  •  •  •  •
│ o  •  •  •  •  •
│ o  o  •  •  •  •
n o  o  o  •  •  •
│ o  o  o  o  •  •
│ o  o  o  o  o  •
╰ o  o  o  o  o  o

This gives us the factored form of the expression n (n-1)
From this expression we can see that it must always produce an even result as it takes the product of two consecutive numbers, one of them must be even, and the product of two numbers is even if either number is even

#math

I recently came across Veilid, a new network focused on secure communication, similar to TOR, but mixed in with distributed storage and a promise of true decentralization without any blockchains or coins.

Both the website and DefCon talk are a bit lacking in explanation at this moment, with a promise of more documentation coming soon. Looking at the repository however gives slightly more insights.

This guide seems to be the most complete introduction at this point.

Also looking through the slides might also give some more crumbs of detail.

TL:DR; Distributed storage

The network provides two kinds of storage:

Block storage allows to store medium sized chunks of data (up to 1MB) onto the network. These are accessed by their hash and are immutable. Nodes can choose to actively become a provider of a block, and nodes will cash retrieved blocks based on demand
(Note: at this point the block store is not implemented yet but is firmly on the roadmap)

Distributed hash table (Key/Value store) is for smaller chunks of (mostly text) data that can be modified by it's owner. These, as the name implies, are accessed via a key. Nodes can register to be informed of changes.

TL:DR; Networking

Everyone participating in the Network is a node, and all nodes are treated equally. Nodes can choose how much or little traffic they are willing to relay, and how much data to store.

At the start a node reaches out to a bootstrap server with a known address, which tells the nodes what other nodes in the network it can contact. From there the new node asks them for information on more peer in the network. This bootstrap server will usually be the main veilid bootstrap server, but can be your own, especially if you want to create a smaller, isolated network for some reason.
Once the node has info on it's peers it will not need to bootstrap again, unless all known peers stop existing the next time it attempts to join.

Since nodes can change, user identity is given by a public/private keypair which identifies a user and allows them to modify their data.

Routing your traffic by relaying it through other nodes is optional. Every user has a list of routes they can be reached by, which change frequently. These routes can just be the user's node itself it they don't want to receive traffic anonymously or a chain of nodes that lead to the user's node. The same thing applies to sending data. You can either send your data though a route of relays of your choosing to hide where it is coming from, or just send your traffic to the receivers route directly.

Up next: Setting up a node and playing with it

#veilid

Nuclei is a tool that allows you to scan web targets for various vulnerabilities and misconfigurations using predefined templates¹. Here are 10 powerful one-liners that you can use with Nuclei to find interesting and potentially exploitable issues:

• Scan for all CVEs in a target list: cat targets.txt | nuclei -t cves/ -o results.txt

• Scan for all exposed panels in a target list: cat targets.txt | nuclei -t exposed-panels/ -o results.txt

• Scan for all subdomain takeovers in a target list: cat targets.txt | nuclei -t subdomain-takeover/ -o results.txt

• Scan for all XSS vulnerabilities in a target list: cat targets.txt | nuclei -t xss/ -o results.txt

• Scan for all SSRF vulnerabilities in a target list: cat targets.txt | nuclei -t ssrf/ -o results.txt

• Scan for all SQL injection vulnerabilities in a target list: cat targets.txt | nuclei -t sqli/ -o results.txt

• Scan for all open redirects in a target list: cat targets.txt | nuclei -t redirects/ -o results.txt

• Scan for all misconfigured CORS policies in a target list: cat targets.txt | nuclei -t cors/ -o results.txt

• Scan for all prototype pollution vulnerabilities in a target list: cat targets.txt | nuclei -t prototype-pollution/ -o results.txt

• Scan for all RCE vulnerabilities in a target list: cat targets.txt | nuclei -t rce/ -o results.txt

Top 5 Tools for CTFs

Capture the Flag (CTF) competitions are a great way to test and improve your cybersecurity skills. They involve solving a variety of challenges, such as hacking into websites, cracking passwords, and reverse engineering malware.

To be successful in CTFs, it's important to have a good understanding of a variety of cybersecurity topics, as well as the right tools. Here are our top 5 picks for the best CTF tools:

1. Burp Suite

Burp Suite is a powerful web application security testing tool. It can be used to perform a variety of tasks, including intercepting and modifying HTTP requests and responses, scanning for vulnerabilities, and fuzzing.

1. Ghidra

Ghidra is a free and open-source reverse engineering tool developed by the National Security Agency (NSA). It can be used to disassemble and analyze machine code, as well as to debug and create software exploits.

1. Nmap

Nmap is a network mapping and security scanning tool. It can be used to identify all of the devices on a network, as well as the services they are running and the ports they are open on.

1. SQLMap

SQLMap is an automated SQL injection and database takeover tool. It can be used to exploit SQL injection vulnerabilities in web applications and gain access to underlying databases.

1. Python

Python is a general-purpose programming language that is widely used in the cybersecurity community. It is a good language for learning and scripting, and it can be used to solve a variety of CTF challenges.

In addition to these tools, it is also important to have a good understanding of the Linux command line and basic networking concepts.

Here are some additional tips for success in CTFs:

Practice regularly. The more CTF challenges you solve, the better you will become at it. Work with a team. CTFs are often more fun and successful when you work with others. Don't be afraid to ask for help. There are many people who are willing to help beginners learn about CTFs and cybersecurity. With the right tools and skills, you can be successful in your next CTF competition!

My eyes are open. My eyes are open so I must be awake. What is that sound? What is that clicking sound? A black stick is falling toward my eyes. I see it. But I'm not blinking. My eyes aren't closing. My eyes can't close. The stick moves past. It's alive. Without moving my head. I can't move my head. I see my wife beside me in bed. Reading. “Please help me,” I say. She ignores me. I see the black sticks again. Legs. They are legs. Weaving. Spider legs. I lift my hand to brush them away. My hand doesn't lift. My arm doesn't move. My arms are made of stone, concrete. They will not move. I feel something on my sternum. Heavy. Round. Like a living bowling ball. Directing the spiders on my face. I can hear them. I know their language. But they are whispering. I ask them, “Why are you doing this?” “What are you doing?” The spider on my sternum shifts. The spiders on my face say “Hush.” Spiders don’t have the concept of a “tone of voice”. But. These two spiders spinning the web to cocoon my head. They seem very patronizing. I haven't earned the right to know what they are doing. My eyes close. I am lost in time. It's almost silly when I find out. The spiders are aware of the popularity of Spider-Man. They think that sounds like a good idea. A spider-human hybrid would be wonders for their reputation. I was chosen as one of the test beds for the brightest spider minds. I would not be their final achievement. No. But I would be experimented on. Techniques would be perfected. I was adrift in time. My eyes open and I am free. I stand and see a well-lit living room. I see an indoor swimming pool, in ground. Not large, but exceptionally clean and inviting. I walk forward and feel my body. The limbs are lanky. Extra tissue has been removed or replaced. My skin seems paper thin on my hands. I step into the water of the pool. It's warm. I expected it to be cool, but it's warm. I lower my head into the water and breathe. I can breathe underwater. I feel the water on my head. My hair is short. I see my golden silk house clothes billow in the water. I exit the pool on the other side, using the concrete steps. A little girl, perhaps 10 years old runs up and smiles at me. “I hate it when you go in the water,” she says. “Sometimes you stay down there for 15 minutes!” She's so young that 15 minutes must seem like eternity. “You'll understand when you're older,” I say. I don’t recognize my own voice. I half-remember a lifetime of experience. Decades. It's breakfast time. One of my daughters is cooking breakfast. I can smell the sizzling meat. I feel a warm surge down my legs. I look down and see hundreds of small brown and gray spiders spread out from my pants. I can hear them. Each of them. I know them. Every one of them. Not by name. They don't have names. But we are connected. They know me and I know them. I know what they know and see what they see. But I don’t see it. I just know it. They are going on patrol. They will keep out the vermin. They will be the barrier at the edge of our domain. They will die to protect us. My body sways and my legs carry me to the table. There are other family members already sitting, all female. Women and girls. I am a grandmother, perhaps a great-grandmother. In this house, I am the Mother of All Spiders. I remember for the spiders. They have short lives. To them my mind is vast. My lifespan nigh immortality. I am their computer. I am their incubator. !!!!!!!!!!!!!!!!! The children! My face turns toward the front room. Before I can form a coherent thought. My hands reach down in front of me and grip the floor. My legs bend and crack. My legs reach up behind me and grab the ceiling. My arms bend and crack . My arms reach up above me and grab the ceiling. My throat aches. My mouth opens wide. I rush along the ceiling. Faster than I imagined possible. I burst through the doorway. I see a man. I know him. He has his hand inside his jacket. He's reaching for something. I snarl and a glob of webbing is projected out of my throat at high velocity. It hits the man in the chest. He's knocked backwards and onto the floor. “No need for that,” he says. He pulls out an envelope. He waves it in the air. My legs reach down to the floor. My legs crack and bend. My arms let go of the ceiling. My arms crack and bend. The spinnerets in my throat retract. The two halves of my jaw reconnect themselves. “You didn't knock,” I say. He stands up. He shakes his head. “When the day comes, you will never see me coming.” He hates us. We know. He knows we know. He doesn't care. He waggles the envelope. “Just take it.” I take the envelope. It is addressed to our family. “Mayor thought it'd be funny to have me deliver your invitation.” I open the envelope and start reading. My spiders will keep their eyes on our guest. And my mind is connected to their minds. My mind is connected to their eyes. I read the invitation: cordially invited… demonstration of advances in science and medicine… honored guests… I remember now. We, the spiders and I, decided to collaborate with other scientists. The best spider minds are very young and naïve compared to the best human minds. It made sense. “I hear they're planning to show off something with centipedes,” he says. My children shift uneasily. The man straightens his jacket and makes a sinister finger gun gesture. “Be seeing you,” he says, before leaving of his own accord.

---

#WhenIDream #Dreams #Dreaming #Dreamlands #Writer #Writing #Writers #WritingCommunity #ShortFiction #Fiction #Paranormal #Spiders #NightTerrors #SleepParaylsis

---

CC BY-NC-SA 4.0 This work is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License