← Feed

Posts

• View post

  "https://bobdahacker.com/blog/fifa-hack da hätte Fifa wohl mal unsere IT-Security Assignments mitmachen sollen..." (anonym:e Student:in) Ich möchte das mal als positives Feedback zur Lehre gewertet wissen. Bildung: wichtig weil effektiv.

• View post

  Auf dem Koggethon 2026 haben drei Teams sich ein enges Rennen um die Spitze beim Zerlegen des OWASP Juice Shops geliefert.

• View post

  Tag der Vertrauenswürdigen Systeme an der Hochschule Bremerhaven. Die Student:inn:en des Studiengangs Master IVS stellen die Ergebnisse des Semesterprojektes vor. 2026-07-07T12:30 (CEST) Vor Ort oder https://bbb.hs-bremerhaven.de/rooms/xob-hmz-qux-tac/join 13:00 stellt sich das Projekt "Simulation von Roro-Terminalprozessen in Bremerhaven" vor. Wenn ich es richtig verstanden habe, dann wird dabei SuMO (Simulation of urban Mobility) genutzt um Land- und Seeverkehr zu verknüp...

• View post

  Today I reviewed results from the current assignment: build an automated CA, and I must say I have mostly been impressed by the results and the thoughtfulness of students. First they had to code a simple HTTP-like server (and I recommended doing it in bash). Then they had to use openssl to handle the CA-operations. And finally they had to implement a hand-crafted Challenge-Response-Protocol for authorization. The latter used the results from a former assignment that included coding bignum-ari...

• View post

  I wanted to report regularly on the preparations for the next semester. There is a project and a course in system security to be prepared. And as usual I want to improve the material I have at hand. System security is split up in two parts: Vulnerabilities and Countermeasures — or Attack and Defense, if you want. For the masters project I have proposed to set up PalaestrAI in the lab to train attack and defense agents — or at least explore the methods available nowadays. Let's see what...

• View post

  Nur eine kurze Erinnerung, am 2026-09-10 ist ab 11:00 Uhr bundesweiter #Warntag. Eine gute Gelegenheit Testwarnungen von echten Warnungen unterscheiden zu lernen - vorher.

• View post

  @jerry Rule 15 is the most important rule.

• View post

  So much for the regularity of updates. The second is a week too late already. After finding a brief moment to install and test-run PalaestrAI (as well as browsing through the code to get a feeling for the terminology of agent, brain, muscle and such) we started with the scenario for the next semester. Alas, there will be no time to migrate to a newer cluster computer. But, I have finished grading of all written exams last week. Now there are only 14 papers from the masters course to be graded...

• View post

  This is exacrly the right hanger for the cleaning cloth for the creative whiteboard.

• View post

  Just barely finished the first of (hopefully) 12 Jupyter Notebooks for self-study and experimentation in next semesters "Mathematics 3" Course. Although this will only be a single-shot lecture, I am having way to much fun building this (and, yes, nothing teaches better than teaching yourself). Well, I should be doing other stuff, but a day full of oral exams earned me this evening. This notebook, and probably most of those to come, is based on "Probability" by Jim Pitman. If...

• View post

  I am slow in adopting all the shiny new technologies. (I actually went "backwards" to vim somewhat 10 years ago, after having been forced to work in one of those big IDE-things, eclipse I think it has been. Even emacs seemed bloated afterwords, though I had long years of happy relation with the latter. No hard feelings there.) Turns out that it's good I could not remember the name "openclawai" that has been recommended to me by a fascinated coding-per...

• View post

  Quickly, I have to absolutely urgently to help the chair of the board of GÉANT, who inexplicably unexplained cannot access his geant-email and thus has to borrow a presidents(! no less) gmail-account, with something utterly urgent! !k! Europe, no, the world is at the brink of cyber-apocalypsis. #scamoftheweek Is this some insufficient elaborate scam for busy professors? You are out of luck, I have grading work to attend to. There is no other task on my schedule for today — because I will use...

• View post

  Wrote a very short tutorial on taskwarrior. https://informatik.hs-bremerhaven.de/lafischer/tutorials/2026-02-11-taskwarrior.html

• View post

  Category Theory is cool and if only because you can abbreviate it as "Cat Theory". Started re-reading "Category Theory for the Sciences" by David Spivak with a friend. Read the foreword for the first time and immediately got this nice quote from it: “when we formalize our ideas, our understanding is clarified. [...] And if we are ever to get to the point that we can input our ideas into computers, we will need to formalize these ideas first.” Very much wha...

• View post

  Hamburg GI-Sicherheit. Leider einen Tag später. Workshops waren gestern.

• View post

  Nice, short read on vulnerabilities in two password managers. (Others seemingly have not been addressed.) Weaknesses like "missing authentication" might raise some hairs. https://arstechnica.com/security/2026/02/password-managers-promise-that-they-cant-see-your-vaults-isnt-always-true/ Short commercial for the standard Unix password-manager https://www.passwordstore.org/ here. Main advantage in this context is that the actual software is simply combining trusted and tested t...

• View post

  It seems every military organisation has to do #stravaleaks at least once … These days it has been the french. Maybe we should provide strava with the Nobel Peaceprice. They seem to make military operations much more risky. Maybe this leads to (significantly) less war. https://www.lemonde.fr/international/article/2026/03/19/stravaleaks-le-porte-avions-charles-de-gaulle-localise-en-temps-reel-par-le-monde-grace-a-l-application-de-sport_6672445_3210.html

• View post

  Not only students grow at this university. Its "applied", keep that in mind. Put them in last week.

• View post

  Ongoing

• View post

  Short: I had to rotate my OpenPGP-keys. The current key is now 63F831BAAAFEA6B63D9514E441D8FF5258F8FB4A Get it from the usual keyservers. Long: I am switching from GnuPG to sequoia-pgp and at the same time I had two expired subkeys. A ``sq key rotate`` did not produce the results I intended (new subkeys) and adding two new subkey did not seem to be importable to thhunderbird. The easy way out was to generate a completely new key — also as a test to see if this one could be imported into th...

• View post

  Let me borrow from Bruce Schneier @Schneier_rss: ‘We don’t issue letters of marque on the high seas anymore; we shouldn’t do it in cyberspace.’ [1] He has gotten struck by a sentence in the 2026 US Cyber Strategy (linked in [1]) which seems to imply that the White House (signed by DJT) is actually planning to somehow incentivize private companies to attack adversaries in the "cyberspace". (Sorry, I still cannot write the word "cyber" without flinching, I have...

• View post

  Temperatur im Büro heute 31°C.

• View post

  Wenn du mein Betriebssystem unter Kontrolle hast, wieso musst du mir das in einem PDF mitteilen? Ich fände es beeindruckender, wenn da einfach die klassische Erpressernachricht auf dem Bildschirm auftaucht. Ausserdem ist das PDF das du mir geschickt hast kaputt. ;-)