Replying to
@VeroniqueB99@mastodon.social I envy this man. My new hero.
Remote
Xavier Ashe 
@Xavier@infosec.exchange
mastodon 4.8.0-alpha.3+glitchPronouns: He/Him
What am I doing now:
- #Infosec Executive in Financial Services
- #Privacy Advocate
- Member of #EFGA, #ATL2600 (founding member), #DC404, #DC770, #DC706
- Father of 8 kids including 🇭🇳, 🏳️🌈, 🏳️⚧️, ♾️
- #Speaker
- #Mentor
- #Backpacker
- NA #Miata owner
- #Goyishe
- #Gamer
- #Polyamorous, #Queer and #ENM
- #BDSM, #Dom, #Rigger
- #Moderator of infosec.exchange
Finger me at rubix1138@happynetbox.com
Stuff I've done in the past:
- #GeorgiaTech Alumnus (Computer Engineering)
- Board Chairman TAG Information #Security Society
- #UU Lay Minister Emeritus
- #Ironman #Triathlete
- Former #IBMer
- #Writer, published via IBM Press and Gartner Publications
- Infosec #Startups
- #CISM, #CISSP, #ITIL, #SOA, #MSCE, #CCNA, #Security+, #Network+, #A+
- World #Traveler (27 countries and counting)
Other tags that color my life:
#LGBTAlly
#Hufflepuff
#BlackLivesMatter
#TransRights
#ADHD
#PolyAm
#tootfinder
#fedi22
1609 Followers
1160 Following
50 Posts
Joined November 14, 2018
LinkedIn:
Blog:
GitHub:
Atlanta Cybersecurity Discord:
Last week I attended management training at work. Got all excited about my job.
Then I come back to my job and reality sets in.
I have a safe, but boring job. It pays pretty well. They don't work me to death.
But I have zero influence to fix anything. I'm not allowed to fix any problems except my own team's problems. I haven't been on any decent projects in years, and can't get promoted because I can't get on anything impactful. They don't promote much anyway, because every new leader has to bring their cronies.
I want to accept that my job has no growth potential, because it's a safe place to be. Damn them for sending me to leadership training and getting me excited to make a difference in my career.
Man, did I have a blast at @bsidesatl@infosec.exchange. First off, I had a great showing for my talk on Neurodiversity in Security. Slide, bibilography, and my research has been posted on the BSides Atlanta discord: https://discord.com/channels/1131429246141743155/1555966595443064933
Then I got invited to record a episode of Down the Security Rabbithole Podcast (DtSR) with Rafal Los.
Then I joined the CTF put on by DC864 and got 3rd place!
Then I won a raffle and am now typing on a new Keychron v6 Max!
The Atlanta hacker scene is just amazing. It was great seeing old friends and making new ones.
I did a #neurodiversity talk yesterday at @bsidesatl@infosec.exchange. Here are the resources I shared with them:
Job Accommodation Network (JAN) — free, confidential, real people. https://askjan.org/ · (800) 526-7234
JAN sample request letters (the one from the talk; names no diagnosis) — https://askjan.org/articles/Sample-Language-for-Accommodation-Request-Letters.cfm
Your state vocational rehab agency — keeping your job and moving up both count. Georgia: GVRA https://gvs.georgia.gov/ · 1-844-367-4872
Mental Health Hackers — quiet spaces at security cons https://mentalhealthhackers.org/
Know your own profile (free)
Monotropism Questionnaire — https://monotropism.org/
CAT-Q (masking) — https://embrace-autism.com/cat-q
VIA Character Strengths — https://viacharacter.org/
Write a "working with me" doc. Model: UK Civil Service Workplace Adjustment Passport
Asking & if it goes wrong
JAN: Alternatives to Telework — https://askjan.org/articles/Finding-Alternatives-to-Telework-as-an-Accommodation-Interactive-Process-Tips.cfm
JAN: Dos & Don'ts of Disclosure — https://askjan.org/articles/Dos-and-Don-ts-of-Disclosure.cfm
JAN: Request Denied, What Now? — https://askjan.org/publications/consultants-corner/Your-Accommodation-Request-Was-Denied-What-Now.cfm
EEOC filing time limits — https://www.eeoc.gov/time-limits-filing-charge
Five books
Explaining Humans — Camilla Pang
Unmasking Autism — Devon Price
How to #ADHD — Jessica McCabe
Neurodiversity at Work — Theo Smith & Amanda Kirby
Is This #Autism? — Henderson, Wayland & White
Just remember: You don't have to be exceptional to deserve a quiet room.
This thread wins the internet today. @foone@digipres.club takes on the #GlorifyRing app.
https://digipres.club/@foone/116993416422991310
Quoting
the annoying thing about android reverse engineering is that I do it JUST infrequently enough that each time I do it, I completely blank on which tools I need to do it.
I'm like "okay, I've got the APK, now I just need to take it apart in... jd-gui? do we still use that or was that only in 2018?"
Open quoted postReplying to
@infoseclogger@infosec.exchange I often pick non-tech projects (like learning how to fix my old Miata) just to find that balance. AI has helped. I spend less time in my seat as my local assistant does a lot of the heavy lifting now in my homelab.
Then when I need extreme balance, I go on a backpacking trip for a week.
Replying to
@GossiTheDog@cyberplace.social None that's I'm involved with, but I moved out of IR and back into engineering. All the incidents I'm brought into and nothing to do with real AI threats. However, most of the busy work I have during the day are all caused by stupid humans responding to the perceived AI threat.
Replying to
@h4r1337qu1nn@infosec.exchange @veilamp@masto.hackers.town @Wrewdison@masto.hackers.town Looks great so far. I'm concerned with privacy. How would someone be able to discover friends anonymously?
Replying to
@arstechnica@mastodon.social My dad had a small notebook that he carried around in his front pocket. Any time he saw a new URL in newspapers, magazines, books., he would write it down. That's how we discovered new web sites.
The World Wide Web turned 35 today, August 6, 1991. Were you on the Internet before HTML? Boost to find how many old farts are on Mastodon!
The World Wide Web turned 35 today, August 6, 1991. Were you on the Internet before HTML? Boost to find how many old farts are on Mastodon!
Replying to
@drsbaitso@infosec.exchange And this is more important than having phishing resistant authentication?
The reason I ask is that I'm a security engineer tasked with helping protect accounts like yours. What situation would you start using passkeys?
Replying to
@VeroniqueB99@mastodon.social I carried by son, who was 13 at the time, 6 hours down a mountain when he had a really bad sprain (we were afraid it was broken). Then I went back up the mountain to get our gear.
Yeah, I would have had to file another bankruptcy if I had called for helicopter evac.
Replying to on labyrinth.zone
Replying to
@dick_turpin@mastodon.org.uk If you can swing both, you'll find a lot more bugs if you use a different model to do code reviews and QA. Write the code with Claude, test with Codex.
Replying to
@berkes@mastodon.nl I'm sorry, what's your point? I'm building great software and my family has a private AI assistant. And my investment was only $1200 for the 3090 and about $30/day in electricity, which only went up about $2-5 when I upgraded my video card.
Home LLMs aren't free, but its not the doomsday scenario you painted.
Replying to
@dick_turpin@mastodon.org.uk Eh, there are so many people that refuse to learn AI. I think knowing how to produce decent work with an LLM is a valuable work skill now.
Replying to
@beyondmachines1@infosec.exchange "How was day at school?"
"It was good."
My family and I have built our own personal AI. It hasn't replaced parenting, but it sure does a great job going through the bagillion emails my kids get.
Replying to
@berkes@mastodon.nl you do know that you can run all this at home. I'm only spending $20 a month with any provider at any given point, just to learn about the different platforms. I'm writing tons of software for me and my family using a 3090. I think it's a really accessible technology.
Replying to
@brown@infosec.exchange true dat. But if I were to see his ghost at the strip club, I wouldn't even pause. Seems like someplace he would spend eternity.
Replying to
@hollie@social.coop That's amazing! These are the things that makes #mastodon the best social media platform!!
Replying to
@bschorr@infosec.exchange Not sure sure how well copilot does, but I have a local setup that pretty damn awesome. And I have ADHD and apraxia, but it understands me pretty well.
Replying to
@n_dimension@infosec.exchange yeah, that's been my operating model for a while now. Have opus write the plan, the implement in a sonnet subagent. The biggest limitation is that subagents can't do Human In The Loop prompts, where the session pauses to ask the operator a question. So I don't use it as often as I'd like.
One good use case for haiku subagents is when going through a large dataset. Like when I data mine my session logs to do measurements on how well my tools are working, I have opus spin up parallel haiku agents so that I can span out to my homelab fleet a quickly get data back.
Replying to
@ra6bit@infosec.exchange I was tracking until 'dimerization'. Having a kid with a rare metabolic disorder has you learning all sorts of new words.
First OpenAI, the Anthropic, now #AISI let's an AI hack things, then releases an incident report/press release.
https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
Replying to
@foone@digipres.club poor programming and the complexity of banking stacks. Knowing when to use step up authentication is hard enough. But its crazy how most banking apps are a dozen or more third party apps on the back end.
@ml@ecoevo.social ouch. is that even a livable salary in California?
Replying to
@stux@mstdn.social @davidrevoy@framapiaf.org I always lose count after I giggle when I hit 69.
Replying to
@odd@sunny.garden I wanted to reply that couldn't have been from the nineties... Surely its from the eighties. It came out in 1992. Fuck I'm old.
Can you believe Quake came out only 4 years later? That's a lot of change for 3D graphics.
Replying to
@wafflesies@infosec.exchange I'm about 90% done with that plan. I have a de-googled GrapheneOS phone, only use mastodon and discord for social media, and try to go to at least 1 meetup a week.
Replying to
@h4r1337qu1nn@infosec.exchange @veilamp@masto.hackers.town @Wrewdison@masto.hackers.town How can we get the public beta?
Replying to
@north@xn--8r9a.com 95 in 45! Wheeeeeeeee!
Coming back one from Florida, I was with a pack of cars on the turnpike and we were all going way too fast. I forgot that I wasn't on the turnpike when I got back on 75 and crossed in to Georgia. Got a friggen super speeder ticket. That was a painful ticket. You have to pay the local cops and the state.
Replying to
@monniele@infosec.exchange that's a very click bait-y title. Your full article is pretty good, but there no reason to scare people that banks are mapping everyone WiFi.
Replying to
@Laukidh@infosec.exchange if you are anti-ai, you may want to wait. 27.0 turns on all the AI settings and many of them cannot be turned off. Moat folks are hoping 27.1 comes with more opt out switches.
Replying to
@drsbaitso@infosec.exchange Its funny that most people complain about not having phish-resistant controls like passkeys. Why are you so resistant to using these workflows?
Replying to
@brown@infosec.exchange That's when you write your message on a cocktail napkin and have the stripper take it over to John McAfee.
Replying to
@phurd@infosec.exchange True, but the payouts are still real. https://cyberpress.org/github-pays-100000-bounty-for-critical-rce-flaw/
Replying to
@Taco_lad@aus.social Application control usually isn't the right control for scripts. What risk are you trying reduce?
Replying to
@swearyanthony@mastodon.social The reality is that those people are in the hands of the fascist government, so they will face no repercussions - unless it makes the rich richer.
Replying to
@kevinrothrock@infosec.exchange Nestle is going to take away all their clean water if they aren't careful. How funny would it be that a corporation could take down Putin, but NATO and the UN are useless.
Replying to
@wafflesies@infosec.exchange I am poly, but my wife jokes that I date AI now. I'm in between girlfriends, which leaves more time to hack around. Plus, not dating allows me to save money for memory and storage. Heh, yeah I'm a geek.