Dmitry Dain

CTO @VirgilSecurity CoFounder Rant Gaming Studio

[Leman Walters @LemanWalters]

What a superb ad, wow

[Mike Beckham @mikebeckhamsm]

This is a leading indicator of where the economy is headed.

Very soon more money will be spent on new construction for digital workers (data centers) than human workers (general office space)

[GrapheneOS @GrapheneOS]

@eculoos X banned non-GMS (Google Mobile Services) operating systems for their app. There's no legitimate reason for them to ban GrapheneOS. If they insist on verifying the device they could still support GrapheneOS via https://t.co/94bjK4cnRl. People who work there need to get it fixed.

[JB Benjamin @jbwb2020]

Proud to be a Judge on ICP World Hackathon!

[David Wong @cryptodavidw]

Before regulating AI, Europe should fix the cookie popup mess

[Casey Handmer @CJHandmer]

It's wild to me that Tesla has been publicly doing this for ten years and almost no one has realized that independently controlled behind the meter batteries will do to peaking thermal plants what Uber did to taxis.

Every day I'm still hearing that more solar and wind will require more grid build out, that the Spanish grid collapsed because of too much solar, that we have to build more gas assets.

I am literally begging you to pick up a pencil and do a page of math.

Every $ spent on spinning generation, thermal generation, and grid is a $ wasted. It won't come back. No one will write you a trillion dollar check to bail you out in a few years.

Electricity market control is no longer even in the hands of the grid operator. They're caught in the tractor beam of solar + batteries. The outcome is not in doubt.

[Madhavan (Maddy) @madhavanmalolan]

Please check out @kkutsenok & @NoiseSocket's blogpost on the details

https://t.co/EpLcPfXxp4

[vx-underground @vxunderground]

Rant / opinion

DdoS attacks can be difficult to attribute especially if it's DdoS-as-a-Service. Additionally, accurate attribution of any offensive cyber operation in mere hours in low.

The likelihood of a state sponsored group performing a DdoS attack on an American social media platform is also extremely low. A DdoS attack wouldn't serve any military objective (or an intelligent one rather).

The broad sweeping statement the DdoS attack came from Ukraine (or the Ukraine area(?), at a moment where many Americans are divided on the Ukraine-Russian conflict, is inflammatory at best, is propaganda at worst. Generally speaking, DFIR needs to performed, external organizations will need to be consulted, you cannot (or rather should not) make a statement regarding the situation at hand while having little to no conclusive evidence for accurate attribution. In other words, an organization typically would not make a statement regarding the origins of an offensive cyber operation without concrete evidence.

tldr sigh, non computer nerds will eat up this crap and spread conspiracy theories and misinformation.

[Ligero Inc. @ligero_inc]

Zero-Knowledge (ZK) proving, redefined.
With Ligero ZK Development Platform, you don’t need to rely on external prover networks—generate proofs locally on your own device (mobile, laptop, or server). No trade-offs in speed or privacy. **Self-sovereign proving**🔥 #ZK #Web3 #Selfsovereignproving

[Arnold Schwarzenegger @Schwarzenegger]

I don’t really do endorsements. I’m not shy about sharing my views, but I hate politics and don’t trust most politicians.

I also understand that people want to hear from me because I am not just a celebrity, I am a former Republican Governor.

My time as Governor taught me to love policy and ignore politics. I’m proud of the work I did to help clean up our air, create jobs, balance the budget, make the biggest infrastructure investment in state history, and take power from the politicians and give it back to the people when it comes to our redistricting process and our primaries in California.

That’s policy. It requires working with the other side, not insulting them to win your next election, and I know it isn’t sexy to most people, but I love it when I can help make people’s lives better with policies, like I still do through my institute at USC, where we fight for clean air and stripping the power from the politicians who rig the system against the people.

Let me be honest with you: I don’t like either party right now. My Republicans have forgotten the beauty of the free market, driven up deficits, and rejected election results. Democrats aren’t any better at dealing with deficits, and I worry about their local policies hurting our cities with increased crime.

It is probably not a surprise that I hate politics more than ever, which, if you are a normal person who isn’t addicted to this crap, you probably understand.

I want to tune out.

But I can’t. Because rejecting the results of an election is as un-American as it gets. To someone like me who talks to people all over the world and still knows America is the shining city on a hill, calling America is a trash can for the world is so unpatriotic, it makes me furious.

And I will always be an American before I am a Republican.

That’s why, this week, I am voting for Kamala Harris and Tim Walz.

I’m sharing it with all of you because I think there are a lot of you who feel like I do. You don’t recognize our country. And you are right to be furious.

For decades, we’ve talked about the national debt. For decades, we’ve talked about comprehensive immigration reform that secures the border while fixing our broken immigration system. And Washington does nothing.

The problems just keep rolling, and we all keep getting angrier, because the only people that benefit from problems aren’t you, the people. The only people that benefit from this crap are the politicians who prefer having talking points to win elections to the public service that will make Americans’ lives better.

It is a just game to them. But it is life for my fellow Americans. We should be pissed!

But a candidate who won’t respect your vote unless it is for him, a candidate who will send his followers to storm the Capitol while he watches with a Diet Coke, a candidate who has shown no ability to work to pass any policy besides a tax cut that helped his donors and other rich people like me but helped no one else else, a candidate who thinks Americans who disagree with him are the bigger enemies than China, Russia, or North Korea - that won’t solve our problems.

It will just be four more years of bullshit with no results that makes us angrier and angrier, more divided, and more hateful.

We need to close the door on this chapter of American history, and I know that former President Trump won’t do that. He will divide, he will insult, he will find new ways to be more un-American than he already has been, and we, the people, will get nothing but more anger.

That’s enough reason for me to share my vote with all of you. I want to move forward as a country, and even though I have plenty of disagreements with their platform, I think the only way to do that is with Harris and Walz.

Vote this week. Turn the page and put this junk behind us.

And even if you disagree with me, vote, because that’s what we do as Americans. https://t.co/eHFZ723I4H

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Matthew Green @matthew_d_green]

Telegram may start “moderating private chats.” This seems like a decision that would only be possible in a non-E2E messenger. https://t.co/UGNBIIxpmz

[Matthew Green @matthew_d_green]

So by all means be angry that France is using weird legal powers to arrest Durov. It feels legitimately bad. But don’t lionize these people. They knew exactly what the stakes were and they could have done real things to protect their vulnerable users. They just didn’t.

[Matthew Green @matthew_d_green]

You can believe that Telegram was malicious in doing this. You can assume they were just negligent. I don’t care: the outcomes are all really, really bad.

[Matthew Green @matthew_d_green]

I hope that the arrest of Pavel Durov does not lead to him or Telegram being held up as some hero of privacy. Telegram has consistently acted to collect huge amounts of unnecessary private data on their servers, and their only measure to protect it was “trust us.”

[GrapheneOS @GrapheneOS]

Telegram has full access to all of the content of group chats and regular one-to-one chats due to lack of end-to-end encryption. Their opt-in secret chats use homegrown end-to-end encryption with weaknesses. Deleting the content from the app likely won't remove all copies of it.

[Anti-Cheat Police Department 🕵️ @AntiCheatPD]

VAN: RESTRICTION HVCI
Vanguard added a new restriction. Players now may need to enable HVCI to be allowed to launch VALORANT. Enabling HVCI (Hypervisor-Protected Code Integrity) ensures system integrity by disallowing unsigned code to be executed in the kernel.
This prevents most type of internal and external cheats as they are unable to load custom code in the kernel for their cheat to work, some DMA cheats are also affected.
Cheaters now slowly notice their cheats are unable to work entirely. https://t.co/bLx3vdPtBP

[James Cham @jamescham]

Everyone thinks it is US vs China or Democrats vs Republicans but the real fight is clearly Yale Law School vs Stanford CS.

[Lina @d0rkph0enix]

🤣🤣🤣

[SwiftOnSecurity @SwiftOnSecurity]

“patient intelligence campaign that invested more resources into subverting him than anyone invested into his project”