@adamhotep@infosec.exchange

There's a reason you separate military and the police. One fights the enemies of the state, the other serves and protects the people. When the military becomes both, then the enemies of the state tend to become the people.

-- Commander William Adama, Battlestar Galactica

Photo of Edward James Olmos as William Adama in Battlestar Galactica

Adam Katz
@adamhotep@infosec.exchange

Do not conflate these terms!

Random: Completely up to chance
Arbitrary: Unexpected; seemingly random
Obscure: Generally unknown; topically arbitrary

Humans can't come up with things at #random; we accidentally create patterns. Use a password manager to generate your passwords and passphrases.

Adam Katz
@adamhotep@infosec.exchange

Click-trackers in email "need" to rewrite rewritten links in order to properly determine who clicked them. In longer threads, this gets a bit hilarious.

Here's the final payload at the end of an 18,660-character re-re-re-…-rewrite:
http%2525252525252525252525252525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252525252525252525252525252Fwww.example.com%2525252525252525252525252525252525252525252525252525252525252525252F
(anonymized)

URI percent encoding uses percents, so : is %3A and / is %2F. All of those 25s are from escaped percents; %25 is %, so unescape(unescape(unescape("%25253A"))) gives you :.
That's three layers. The above example has 34 layers.

Adam Katz
@adamhotep@infosec.exchange

How I got into cybersecurity: I ran a small systems group and we had a spam problem. I had a lot of fun fixing it and became a SpamAssassin committer out of it. Then I started attending the MIT Spam Conference. On my ~3rd conference, I responded to three presentations that I had implemented very similar solutions (as FOSS). One talk presented a null result. I told them the concept works great and I could prove it.

That got me a job offer.

Adam Katz
@adamhotep@infosec.exchange

Today's episode of #DemocracyNow is important. #MsRachel, heralded as a modern Mr. Rogers, has opened millions of apolitical eyes to the tragedy in #Gaza. If you can spare an hour, you won't regret it:
https://www.democracynow.org/2025/8/13/ms_rachel

Adam Katz
@adamhotep@infosec.exchange

[University of Florida Researchers] have released 40 solar-powered, remote-controlled robot bunnies in South Florida this month.

https://www.popsci.com/environment/robot-bunnies-florida-invasive-pythons/ via @sambowne@infosec.exchange

The robot bunnies hope to lure the Burmese pythons out of hiding. Image: sfwmd

Two photos side by side. On the left is a rabbit plush toy in a plastic box. On the right is a heat sensor reading of that toy, reading 26.5°, or maybe it says 28.5° (it's hard to make out).

Adam Katz
@adamhotep@infosec.exchange

There's a reason you separate military and the police. One fights the enemies of the state, the other serves and protects the people. When the military becomes both, then the enemies of the state tend to become the people.

-- Commander William Adama, Battlestar Galactica

Adam Katz
@adamhotep@infosec.exchange

Do not conflate these terms!

Random: Completely up to chance
Arbitrary: Unexpected; seemingly random
Obscure: Generally unknown; topically arbitrary

Humans can't come up with things at #random; we accidentally create patterns. Use a password manager to generate your passwords and passphrases.

Adam Katz
@adamhotep@infosec.exchange

Click-trackers in email "need" to rewrite rewritten links in order to properly determine who clicked them. In longer threads, this gets a bit hilarious.

Here's the final payload at the end of an 18,660-character re-re-re-…-rewrite:
http%2525252525252525252525252525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252525252525252525252525252Fwww.example.com%2525252525252525252525252525252525252525252525252525252525252525252F
(anonymized)

URI percent encoding uses percents, so : is %3A and / is %2F. All of those 25s are from escaped percents; %25 is %, so unescape(unescape(unescape("%25253A"))) gives you :.
That's three layers. The above example has 34 layers.

Adam Katz
@adamhotep@infosec.exchange

How I got into cybersecurity: I ran a small systems group and we had a spam problem. I had a lot of fun fixing it and became a SpamAssassin committer out of it. Then I started attending the MIT Spam Conference. On my ~3rd conference, I responded to three presentations that I had implemented very similar solutions (as FOSS). One talk presented a null result. I told them the concept works great and I could prove it.

That got me a job offer.