Goddamn "private mention" is hard to use safely.

[_dm@infosec.exchange]

@adamshostack @mattblaze In the past month, I discovered I:

a) Had accidentally published API keys on a public github repo for months
b) Had misconfigured MTA-STS on one of my email domains even though I co-authored the spec

My conclusion is that users* are in fact idiots and everything is their fault.

* "User" here being, of course, me. :(

[grwster@mastodon.social]

@adamshostack if it’s not a criminally negligent feature it’s damn close

[catsalad@infosec.exchange]

@adamshostack Yeah, @alice and I found that out lol

[spiegelmama@infosec.exchange]

@catsalad @adamshostack @alice Ooh, la...

[adamshostack@infosec.exchange]

@static in what way is it an elegant solution?

[munin@infosec.exchange]

@adamshostack @alice

I don't use it for anything nontrivial; any conversations with anything I'm not OK ending up in public go to Signal.

Not only does this create an actually end-to-end assured container, but it changes the context from Masto's assumed-public to Signal's assumed-private, thus allowing for a separation of content cognitively as well as logistically.

[linuxandyarn@hachyderm.io]

@adamshostack It should be called "tiny email (which sysadmins can also read)"

[alice@lgbtqia.space]

@spiegelmama @catsalad twice 😅

But as long as we're talking privately, I had this weird dream about you Cat—in it we...

@adamshostack

[munin@infosec.exchange]

@adamshostack @alice

This is also why I have a signal username in my profile; I expect to be contacted for anything actually sensitive on that channel.

[rusty__shackleford@mastodon.social]

@adamshostack @mattblaze
@iampytest1

My brother

Re: https://mastodon.social/@rusty__shackleford/116067510513433059

[crapaud@mstdn.social]

@adamshostack
I found this out the easy way: someone @'d me in a private DM and I saw the intended-private message. I recommend this over finding out the hard way.

[countablenewt@mastodon.social]

@adamshostack this is one of the major things I’m personally hoping to accomplish through my own app development

I’ve been working a lot on trying to get private mentions to feel less like they’re just posts and more like a typical DM interface

Hopefully as I refine this and share with the public, along with E2EE which is being worked on separately, we can start to have a better experience for them

Because yeah, right now it’s unpleasant

[alice@lgbtqia.space]

@briankrebs I have publicly "privately" mentioned people a couple times—only one of which was about me dreaming of them. But we ended up dating because of it, so 🤷🏼‍♀️ YMMV.

Then I discovered the merits of having no shame, so now I just say everything publicly 😁

@adamshostack

[evan@cosocial.ca]

@adamshostack agreed.