Please tell your friends about federated social media site that speaks several fediverse protocols thus serving as a hub uniting them, hubzilla.eskimo.com, also check out friendica.eskimo.com, federated
macroblogging social media site, mastodon.eskimo.com a federated microblogging site, and yacy.eskimo.com an uncensored federated search engine. All Free!
Joy Metzler left the Air Force as a conscientious objector over U.S. support for Israeli atrocities in Palestine and joined a 40-day Veterans for Peace hunger strike for Gaza. She says it is crucial we escalate our protest to stop genocide.
Comrades, if you stop receiving posts from one of our accounts, please visit our website to check the available accounts: wordsmith.social/protestation/…
In an exclusive interview with New Eastern Outlook, Director of Communications for the Country Government in Kajiado, Kenya, Paul R. Tobiko talked about
No. Because your first mistake was calling it "naughty". When it's perfectly valid, acceptable and shouldn't be seen as out of the ordinary or somehow 'bad'. 😜
It’s always good to remind libertarians that Milton Friedman was one of the founders and scions of the outsourcing movement. He preached profit as a social good and attacked businessmen who thought otherwise as socialists undermining free society. One of the worst scumbags of all time.
Parcel giant UPS said on Thursday it will offer voluntary buyouts to its full-time U.S. drivers as part of the largest network reconfiguration in its history — a sweeping overhaul that includes cutting 20,000 jobs and closing 73 facilities.
Dang. Sounds like they're either losing business, or getting rid of a bunch off people so that they can, eventually, get self-driving trucks. Of course, the self-driving trucks are still a couple of years away. 😄
RT @UltimaShadowX@x.com: You all laugh now, but in 5 years they'll add Skibidi Rizz to Umamusume and she'll have the most cracked unique skill in the game.
The Trump Administration is working with State and Local Officials on the ground in Texas in response to the tragic flooding that took place yesterday. Our Secretary of Homeland Security, Kristi Noem, will be there shortly. Melania and I are praying for all of the families impacted by this horrible tragedy. Our Brave First Responders are on site doing what they do best. GOD BLESS THE FAMILIES, AND GOD BLESS TEXAS!
Sheikh Naim Qassem, Secretary General of Hezbollah has rejected the call on the part of the Lebanese government for the resistance group's disarmament, saying that "we are not man of surrender."
Tribunal for Palestine against Germany pledges to bring the guilty “before the judges of the nations.” In the tribunal’s closing session, twelve leaders made symbolic accusations against the Federal Republic of Germany and its institutions.
Exigeons le rétablissement de la page Facebook de Mr Mondialisation !
Mr Mondialisation est avant tout un média en ligne, l’un des rares médias humanistes vent "debout" face aux logiques marchandes et aux monopoles de l’information.
This insult from that stalker guy finally processed...
Umm... My name isn't a Japanese name. How TF would it be "weeabo" or "anime"? Does he just assume 4 syllables = Japanese? I can't think of any 4 syllable anime names. 🤷♀️️
Also, I didn't come up with it. It was one of the few decent gifts from my blood family.
Also, I'm from New England. I had my name long before I got out here.
A poor assumption based on that your name somewhat looks like I guess Mikado? It’s amusing how much people continue to talk when they are given no response.
Cara's Encounters. A shared perspective from two brilliant minds, early decoders of the ongoing crisis, united by a shared passion for anthropology, curiosity, panoramic vision... and humor.
The hacker that found his college application might just save New York City from communism. Also, did you ever notice how these journalists like to find camera angles to give people they like halos? It's not very subtle.
I never thought that accounting could be that easy and amusing until I installed GnuCash. The amusing part begins when debits and credits do not match or when one buys shares just to have more things to track with GnuCash. In other words, GNU/Linux gaming is—as fellow gamers may say—"poggers".
We had to move our #Coleus #plants a few weeks ago because the rats-with-hooves (city deer) mowed them down. They have recovered very nicely in their new safe zone.
The Ministry of Health in the Gaza Strip announced on Friday that the death toll from the Israeli aggression has risen to 57,268, in addition to 135,625 wounded since October 7, 2023.The Ministry said in a statement: “138 martyrs and 452 wounded arr
Il a l'expérience du terrain, et bien avant gaza depuis plus de 25 ans la bien-pensance ( y compris à gauche) lui crache dessus, pour ses positions humanistes contre la connerie humaine.
I know bsky is not everyone's jam. But I promise wafrn will do the best to protect you from stupid shit they do. The main wafrn instance has blocked jd vance as example ;D
Exciting! I've made an effort to let go of Insta for both privacy and hatred of Zuck's policies, which left me stuck on Tumblr to look at any fanart/fandom content. Hopefully this could replace people's need for Tumblr in a few years, especially since they also do a shit job of caring about their users.
Edit: Knowing the context of the name is hilarious, wish I was there for the Tumblr exodus. I will be sure to spread to other platforms about this wonderful service.
Well, tumblr died out in 2017 because they said "NO PORN!!!"
And all the blogs died.
It's like Dr Cox said: "If you take all the porn off the internet, there'd only be one website left. www.bringbacktheporn.com and nobody would visit because it doesn't have porn."
So. Does WAFRN have porn? And also.....why are these things ALWAYS named with weird hard to pronounce names? Come see my new website Drufyflezak!
i was big in the david karp era fandom tumblr and loved it during gleek tumblr and spn tumblr days (i still have an account but don't use it as much) so i'm definitely going to look at this (as someone that also uses bsky, i like the idea that it's integrated with atproto too. i trust that it's trans and queer friendly too? :^
Fantastic idea! I miss Tumblr terribly ever since the Great Porn Ban of 2018, even though I never even reblogged or followed 'adult' blogs. I just wanted to reblog holsum and funny fanart, but fuck giving into puritan corpo censorship.
What's the moderation policy on genocide denial and the like? I hate having to ask this, but having heard too many people deny the Holodomor on here, I feel it necessary to make the inquiry.
For that matter, more generally, are you prepared, in terms of moderation structure, for the massive amount of legitimately disturbing material that's going to pass through the site and will need to be removed if the site grows beyond a few hundred users? I would hate to join and then see this crash because of (completely understandable) moderator/admin burnout at the depravity and speed of mankind's worst elements.
its a fedi platform, shit will happen but we have blocked the worst of the wrost on fedi. And we also check registrations for vpns. Registration with vpn is not allowed for safety
This guy's videos are what got me to get on Tumblr. Though I just end up using it to scream into the void because nobody ever comments or reblogs with added content.
Is registration on the wafrn website backlogged? I submitted a registration bout 12 hours ago, and the registration page said to wait a few hours for review. Got nothin in my email just yet. Not that I'm antsy, and there's no rush; just hoping to know when I should follow up to log in :u
I didn't get any email confirmation about my submitted registration, I realize. I refrained to keep from spamming, but... Should I actually submit another? 🤐 Edit: think I saw the fdroid app & submitted my registration form there, mentioning in case it's relevant
Thank you for this! I'm not sure how I would've found out about Wafrn otherwise, lol
For me, Tumblr was an online culture different from the ADHD of other journaling/blogging platforms like Instagram or Twitter. You could find conversations in tags, gifs didn't lag my browser to hell, fan content was proliferous there, webpages could be personalized to the lengths you might've gone to in MySpace. It was the place to find fandoms and fandom content, even for the most obscure series. There were no ads. And I felt like gifs/texts of porn and kinks were made more accessible when searched for by tags.
There was no algorithm - discovery of new blogs was just subscribing to tags & maybe following who your followed-people followed, the way the fediverse kinda is.
I felt like the presentation was good to relish each post of content with less distraction, and the pagination + scroll browsing was just enough to keep me addicted.
I see the tumblr culture is already present, congrats! Although I never personally used tumblr, my understanding is that more than features or functionality it was very much the culture that its users cultivated that made that site special.
Millions of people using Windows 10 are facing a tough choice. Microsoft plans to stop offering security updates for the system, leaving countless computers
Ok is what is the "META" answer to grandma's laptop is going to get borked. Put this USB stick in her laptop and press next a bunch of times and she can keep using it. You have 5 lines of text to explain this solution.
I think the trick has to be that somebody who has a bit of technical skill sets the laptop up initially. I did this for my mom a while back, and once I set it up once, it just worked from there on. Non technical users tend to have a fairly small set of things they need to do like check email, browser the web, and play media. Once that's working, they never need to change anything. In fact, they don't want to change anything because they get used to the workflow, and they're comfortable.
It would be great if people set up community centres where people can bring their old laptops, and somebody switches them over to Linux for them.
Ok, what I am hearing is Nixos but with an installer like this
Rufus ISO to usb stick stick usb stick into computer press magical button to boot usb <-- this should be the most difficult part of the process Screen appears, least amount of text possible Ask only the important questions, on a single screen
then one last big scary page "this will erase everything on your computer"
Check "I understand" then press"ERASE BUTTON" (or cancel and reboots)
then it reboots and everything your average grandmother needs right there a google button an office button and that's pretty much it
Cool, so we need two things, The most streamlined installer possible. "Grandma's Universal Nix.Conf"
The installer should be written using 4th grade simple english, no jargon
In the top right corner there should be a language selector.
There should be only one page of questions.
The installer should work completely offline.
The installer should detect all peripherals and modify the nix file accordingly.
The second page should only be tge warning about erasing everything
The installer should detect if a nixos installation already exist. If it does, then offer the user to repair the bootloader
Optionally, the installer coukd detect a windows installation. Check the amount of free space left on the drive.
In this case instead of a wipe, offer to shrink the windows partition and install nixos in the liberated space. Install a bootloader setup for dual boot. Auto mount the ntfs partition and place a shortcut to the c:\user folder on the desktop.
I think we can be even simpler than that. Don't ask any questions. Simply generate the hardware-configuration.nix and have a single configuration.nix that is unchanged:
Some easy-to-use and simple DE. I'm thinking something like lxqt or xfce, maybe Pantheon - but that would be more familiar to Mac users than Windows. KDE seems way too complicated to just have it in configuration.nix without touching it, and it can sometimes break on updates.
Chromium (with pre-installed ublock origin)
Libreoffice
Some flatpak store (so that people can install apps without touching configuration.nix)
Make a simple "update" app that just pops up once in a couple weeks or so, prompts you to click a button and then runs npins update and nixos-rebuild boot, and finally annoys you until you reboot (it should also update to the next stable channel when that becomes available, and make that a big deal so that a user understands it might change some of their workflows)
Set up the bootloader so that if a generation "fails" (some script in the autostart of the DE doesn't set a flag somewhere) on the next boot it boots a previous generation, kinda like Android's A/B slot system but better. I don't think systemd-boot allows this sort of thing, but I think it's possible with a GRUB script
Maybe add a shortcut to open tmate and copy the URL to clipboard, so that you can send it someone in the know and they can help you troubleshoot
Finally, use impermanence to make sure everything outside /home, /nix, and wherever flatpak are stored, is wiped on every reboot and recreated from the generation, so that "reboot it" is a viable troubleshooting strategy.
Installed should be downloaded by going to grandmasnixos.com On the front page, a single click starts to download a single file, that contains everything It is a tailored rufus executable with the ISO that contains everything to make it to first desktop boot When download ends, no internet connection will be required to make it to grandmasnixos desktop
When the file is clicked and a usb stick has been inserted beforehand, the grandmasnixos ISO is preselected, rufus autochooses the usb stick
User only needs to press "start"
The motherboard version is checked against a lookup table, and the user is told
Reboot computer a press $KEY_TO_USB_BOOT and choose to boot the usb key
Installation is a single screen that says "This will erase everything on this computer, to continue, click the checkbox below" [ ] I understand this will erase everything on my computer buttons below [ ERASE AND INSTALL GRANDMASNIXOS ] or [ CANCEL AND REBOOT] (first button only clickable if the checkbox is checked)
(there is an "Options and settings" button somewhere, it does not have to be clicked to continue)
No further user interaction until it boots into a working desktop
There is no password by default, the desktop auto-logs in, no remote access is possible until a password is set, sudo works passwordless
There should be no updating unless enabled, no telemetry, no call home of any kind, the system should be able to work offline and forever without an internet access and never nag the user.
The desktop environment should be something occasional win10 using grandma will not get lost in
Taskbar at bottom Desktop that you can dump files onto and start stuff by clicking those files systray on the right Large font start menu Start menu includes a single settings panels that does everything a user needs (passwords, wifi, power management, update, timezone, language, locale, host and domain name, remote desktop etc..)
taskbar should have pinned the most important apps file browser, browser, calculator, notepad, word-like and maybe a mail client maybe a zoom? client or something equivalent but open source and usable ?
If updating is turned on, it should be very conservative, updates hand curated by grandmasnixos, basically never uses software that hasn't been proven rock solid for at least 6 months. Rolling back any update should be one-click-trivial
On first boot there could be an "out of box experience" screen that allows setting up
wifi password region/timezone/locale/language power settings host and domain name password enable updates enable remote desktop and services open easy user guide
So total, from download to desktop it should be 8 clicks total counting press F9 during boot as a "click"
There should be no updating unless enabled <...> and never nag the user.
I disagree, at that point you might as well continue using Win10. Security updates are the #1 reason to do this. Most computer use nowadays is networked (actually in a browser), and it's super important we keep that updated.
If updating is turned on, it should be very conservative, updates hand curated by grandmasnixos, basically never uses software that hasn’t been proven rock solid for at least 6 months
Eh, this sounds like a lot of work. Probably just use the stable channels, and only manually test when switching to a new stable channel.
Rolling back any update should be one-click-trivial
Agreed, should also be very obvious (like a label on the desktop that says "Issues after update?" and gives you a button to roll back and reboot)
The desktop environment should be something occasional win10 using grandma will not get lost in
This is the main question IMHO. I've not used any DEs for a while, so don't really know which one would fit this best while also being simple and robust.
Yeah basically, a turn key solution where your machine gets wiped and imaged with a Linux distro that does all the basic stuff most people need would be an ideal solution. A good way to look at it would be making sort of a Linux based console for non technical users as opposed to a general purpose computer. Tech people want the latter, but non technical users just want a reliable tool that can reliably handle a few tasks.
Yes, I find it baffling that this does not yet exist. I was installing debian the other day and the incessant one-question-at-a-time installation with long delays between the question was aggravating. In particular since none of these questions really needed to be answered at the time.
Proxmox does it better, but still with annoying questions and limitation like having a mandatory static IP address and making your enter an email address notification. This is all actually optional stuff and it could all be dealt with after the install is completed.
Most consumer hardware on earth does already (Android phones). The problem is those drivers are usually proprietary bullshit that's very difficult to integrate with anything but OEMs kernel fork & Android version. Unfortunately I don't really foresee that changing in the near future, hopefully if Linux becomes more mainstream, Linux phones become too and then we get some progress.
And for laptops/desktops, I think the situation is pretty good already as well. Many mainstream OEMs have an option with Linux pre-installed now, and the drivers there are mostly FOSS. I'm hoping that the problematic part vendors e.g. NVidia and Broadcom step up and provide sources for their drivers - otherwise they will continue to be a buggy mess that most people hate.
Nvidia recently started NVK for Turing and newer and even more recently it was made conformant going back to Maxwell, but that still doesn't give me a lot of hope for everything between Maxwell 1 (so basically just the GTX 750/750Ti for desktop Maxwell 1 cards) and Turing after driver version 580.
Also, Nouveau works for Maxwell 1 and earlier but ymmv with that stack, and it's still not like Mesa RADV and AMDGPU for Radeon cards going back to GCN1.
I've got only one machine left running Windows 10 at home: a desktop PC I use exclusively for gaming. I increasingly look forward to purging Windows from it and installing Bazzite when the EOL date comes around.
#Sozialismus ist eine Geisteskrankheit. Er bedeutet, zu glauben, dass Menschen etwas sind, was sie nicht sind. Er wird durch Neid geschmiedet, durch Heuchelei verwaltet, erzeugt Faulheit und zerstört Wohlstand. Er ist reine Demagogie. |Armando Ribas
Linux is suddenly booming in Europe. April 2024, Linux had a small 2.84% slice of the desktop market in Europe. Fast forward to July 2025, and that share has jumped to an impressive 5.21%. That’s a massive 83.45% increase in just over a year.
When Windows 10 support ends, hundreds of millions of computers won’t get vital security updates. Instead of buying new hardware, people are choosing a different path.
Millions of people using Windows 10 are facing a tough choice. Microsoft plans to stop offering security updates for the system, leaving countless computers
In Russia, state accounts are transferred to Linux forcibly. According to an employee of accounting: when working with documents, you have to do almost 2 times more actions, which slows down the work.
@DearFox to be honest, it blows my mind how any nation could rely on proprietary software from another nation for its essential government work. Either you develop your own or you use open source. Digital sovereignty is a must.
In my personal experience, the generally poor quality of Libreoffice Impress compared to PowerPoint in terms of performance and features is the significant reason why I (and many other universities) cannot completely ditch Microsoft.
Wir freuen uns, die LUDWIG VON MISES INSTITUT DEUTSCHLAND Konferenz 2025 anzukündigen: „Die Freiheitsrevolution in Argentinien“ Eine Blaupause für den Westen Samstag, 11.
🎶 Once upon a time there was a tavern Where we used to raise a glass or two Remember how we laughed away the hours; Think of all the great things we would do.
Those were the days, my friend We thought they'd never end We'd sing and dance forever and a day We'd live the life we choose We'd fight and never lose For we were young and sure to have our way. 🎶 "Mary Hopkins, circa 1968)
« Comparer Jean-Noël #Barrot à un Henry Kissinger ou à un Sergueï #Lavrov, c’est cruel, tant l’un incarne ce qu’est un diplomate et l’autre ce que la #diplomatie ne devrait jamais devenir. Kissinger, disparu en 2023, restera comme un maître des rapports de force, un homme qui savait lire le monde, anticiper ses soubresauts, et bâtir des équilibres durables avec un mélange d’intelligence froide et de cynisme assumé. Lavrov, que l’on peut aimer ou détester, c’est la constance, la redoutable efficacité du professionnel qui domine la scène internationale depuis plus de vingt ans, sans jamais perdre son sang-froid ni son cap.
Et puis il y a Jean-Noël Barrot : l’anti-diplomate par excellence. Agressif là où il faudrait être subtil, agité là où il faudrait peser ses mots, il aligne des déclarations qui sont systématiquement l’exact inverse de la réalité, comme si sa boussole était déréglée au point de toujours pointer le mauvais nord. Peut-être est-ce cela qui l’exaspère tant : de sentir confusément qu’il parle pour ne rien dire, qu’il gesticule sans rien obtenir — alors les yeux s’exorbitent, les traits se contractent, la nervosité éclate au grand jour. Il ne négocie pas : il tempête, il ne convainc pas : il agresse. Le tout au service d’une diplomatie française devenue transparente, voire ridicule, sur les grandes scènes internationales.
Quant à Mark #Rutte, secrétaire général de l’ #OTAN, ses sarcasmes sur la longévité de Lavrov trahissent surtout une gêne : il sait bien qu’en face de lui, Lavrov a des décennies de métier que lui-même ou ses alliés ne pourront jamais rattraper. Et Kaja #Kallas, à la tête de la diplomatie européenne, complète ce tableau d’ #amateurisme : des postures binaires, des slogans vides, aucune profondeur, aucune vision, rien que des leçons creuses données au monde, dont personne ne se soucie. Voici la diplomatie occidentale : des figurants ignares et nerveux. »
“Just as Nazi Germany’s crimes could not have been committed without the technology IBM provided to track, round-up and murder Jews, Romani people and the disabled, Israel’s apartheid and genocide of the Palestinians would not be possible without Microsoft.”
@Günter One could say ants especially know what to eat. They seem pretty intelligent and shouldn't be discounted. They make excellent food testers. The ants that I live among seem to be fans of black tea. I don't use any sweeteners and I'm partial to black teas and I have an electric tea kettle outside and they're always flocking to it. They also do not like sugar free sodas according to my experiments and observations.
HHS Secretary Robert F. Kennedy Jr. and Secretary of Agriculture Brooke Rollins have expressed interest in letting H5N1 outbreaks spread unchecked through U.S. poultry farms. Health experts warn it could lead to a new pandemic.
#Tchéquie #cannabis #marijuana 🇨🇿 La République Tchèque légalise : 1. Possession jusqu’à 100g à domicile 2. Culture de 3 pieds à domicile 3. Utilisation thérapeutique / médicale de #psylocybine
The team behind Trump's World Liberty Financial project has proposed lifting restrictions on the WLFI "governance token" to make it tradeable. I predicted shortly after its launch that if Trump succeeded in gutting the SEC, he would do this.
This would lift the substantial restrictions on the token (non-US or accredited investors only, locked tokens with no secondary sales) that were aimed at sidestepping attention from the previous SEC, and could be enormously lucrative for Trump.
It could also be enormously lucrative for early buyers like Justin Sun or the Emirati Aqua 1 Foundation, who hold $75 million and $100 million worth of WLFI, respectively.
Prior to the Trump administration, a token like this would likely have been considered an unregistered security by the SEC, and its sales illegal offerings.
We built a thing! I spent the past few months building Trusted Signatures, a SaaS product that makes it easy to provide durable signed PDFs at scale.
This makes it easy to prove documents came from who they’re supposed to, unaltered.
✅ AATL and eIDAS compatible signatures (Adobe Reader green check ✅)
✅ Detached CMS support — send only the SHA-256 hash, keep your files local
✅ Accessible via HMAC API key
✅ No full-PDF uploads — just clean cryptography
Perfect for building secure workflows for finance, legal, or compliance — or if you’ve ever wanted a programmable signature API you can actually trust.
Get authentic PDF signatures with the green checkmark in Adobe Acrobat. Incredibly affordable, automated digital signing. Secure, compliant, enterprise-grade.
It turns out the maintaining an OV certificate (needed for signing PDFs) is extremely tedious. You need to create the private key in an HSM (which cost thousands of dollars) and the security protocols required to keep the certificates safe are very onerous. Add to that Timestamp Authorities, CMS creation and maintenance, and the whole thing becomes an expensive hassle. Outsourcing this complexity to a specialist makes a ton of sense.
The value proposition of our business is that we manage these complexities for you at a price so low that it makes no sense to try to do it in house. While the protocols are open and you certainly can DIY, there's no way you can build and maintain this service for less than we can.
Yeah, DocuSign has a bunch of challenges, sender authentication being one. Another is that after everyone has signed, it signs the PDF with its own certificate, which can tell you if the document was modified but not where it came from.
We're looking at solving problems like this as a supply chain issue; it turns out there's a lot of fraud involving doctored PDFs.
For example, if someone sends you an invoice against a valid PO, but they've put in their own account for payment, you're out the money. But if you only accept signed PDFs, you (or better: your systems) can immediately validate that the invoice actually came from the correct source, unmodified.
Another common problem area is real estate fraud: documents pour in from all over the place (appraisals, inspections, bank statements) and people try to put forward fraudulent ones all the time. If they were signed, then the risk of fraud drops precipitously, and even if there is fraud, the senders cannot repudiate the documents and are still on the hook.
We make it so cheap (our price per PDF quickly approach $0.001 per PDF) that there's no reason not to sign everything your organization sends, and to require the companies sending you PDFs to sign theirs.
Avoiding a single loss or lawsuit will cover the cost a thousandfold.
@Brad Koehn ☑️ - You've got what appears to be a useful service. I sent pointers to some of our company people who might be interested. And I've got to revisit into some trust/will materials that could be improved by a layer of content/source integrity protection.
Europe has taken a major step forward in strengthening its resilience to extreme weather events with the successful launch of the Meteosat Third Generation Sounder 1 (MTG-S1) satellite. MTG-S1 will deliver new streams of atmospheric data, enabling earlier, more accurate warnings that protect lives, property and infrastructure.
Most refugees head for a country where there is some link of language, family or community. North Africans stay in France because they have some French. Refugees from what were once UK colonies often have English as a second language."
Surely the language by itself is at best one factor and not a particularly strong one? Approximately zero refugees from the global south have any pre-existing knowledge of German, Hungarian, or Swedish, etc.
I played a minor role in helping to get some peoples’ very private information off of the internet. Small contributions can make a difference. Help when you can.
PostMortem: Data Leak Brandt Kettwick Defense
Type of leak
Azure Blob with the multi-year archive of a law defense firm. Files were readable and indexable for anyone. The leak contained data like search warrants, master case files from law enforcement, interviews with victim, accused and victim of sexual assault cases and much, much more. In total there were several tenthousand documents.
I see the following threats:Confidentiality people seeking legal counsel help is compromised Privacy of mutliple U.S. citizens compromisedVery likely violation of several laws and ethic guidelines
TimelineApril 2025: Leak is dicovered by a security researcher.June 4th 2025: Significance of the leak identified, multiple attempts by the security researcher to close the leak (Email, Web Contact), no reply during the complete incidentJune 12th 2025: A second security reseracher attempts to contact the law defense firm, no reply till the end. Calls to the designated phone number were hung up by the law firm.June 19th 2025: FBI and Hopkins (Minnesota police department) are informed.June 21st 2025: I join the effort. Email directed to the owner of the comany and one identified affected person. Not reply during the complete incident.June 25th 2025: Second security researcher reaches out to the Minnesota Bureau of Criminal Apprehension (BCA). They reply nearly immediately that they will investigate,June 29th 2025: I make a infosec.exchange/@masek/114767… and ask for help to get the attention of the law firm. The second researcher reaches out again to the BCA.July 2nd 2025: Leak is closed. BCA answers that they were unable to get the attention of the law form via phone and email, so they send officers on site to convey the seriousness of the leak. They also say that the law firm had asked their IT department and it denied any possibility of a leak.
Analysis
This is not a complete failure analysis. These are only my own observations. Looking
Failures:The chosen IT department was unable to adhere even to the most basic levels of data security.Even when asked by the customer, the IT department denied the possibility of a leak.The law firm has no proper process to deal with external IT security alerts.Lack of understanding concerning the responsibility on the side of the law firrm. Outsourcing only delegates the work but not the legal obligations.
Impact
It can be safely assumed (due to duration and easiness to discover) that all data on those server is now in the hands of inttelligence services (e.g. Russia, China) and cyber criminals with little care about the privacy of US citizens. Especially for people looking for material to blackmail people, this leak was a gold mine.
Acknowledgments
Thanks to @JayeLTee and @PogoWasRight@infosec.exchange for doing most of the work. A description of the incident from the viewpoint of Dissent can be found databreaches.net/2025/07/04/no…
Furthermore I wish to praise the work of Minnesota Bureau of Criminal Apprehension.
Also thanks to @TonyYarusso and @bkoehn@hachyderm.io for assisting us in getting the necessary attention.
Closing Remarks
It is clearly necessary that we have at least one public contact in each country that investigates and closes data leaks reported to them. The effort to close even the worst leaks is unbearable and currently rests on the shoulders of security researchers and their supporting environment.
Time spent on this leak from my side (without the time for this report) is 4+ hours. My best estimate on the effort of all people involved closing this leak would be in the hundreds of hours. The amount of time spent by the person responsible for the leaking system on security issues: None.
Update 2: PostMortem published here: https://infosec.exchange/@masek/114800897587580803
Update: The leak is closed since July 2nd. Will write a postmortem on Saturday and add a link.
There was a Q&A session after a presentation of a bunch of films by high school students (5 students total) and the first lady that stood up was like, "congrats on you five young ladies for making these films but WHERE ARE ALL THE BOY FILMMAKERS?" 🤡
verita84
in reply to Terry • • •