Matt Brown (@nmatt0) header
Matt Brown (@nmatt0) profile picture

Principal Consultant @ Brown Fine Security | IoT Security Researcher | Soli Deo Gloria

/dev/ttyUSB0
Joined July 2016
Photo by Matt Brown (@nmatt0)Photo by Matt Brown (@nmatt0)Photo by Matt Brown (@nmatt0)Photo by Matt Brown (@nmatt0)Photo by Matt Brown (@nmatt0)Photo by Matt Brown (@nmatt0)Photo by Matt Brown (@nmatt0)Photo by Matt Brown (@nmatt0)Photo by Matt Brown (@nmatt0)Photo by Matt Brown (@nmatt0)
Matt Brown retweeted
there are only 1 billion possible SSNs and we've used up over half of those already. to prevent SSN exhaustion, I propose SSNv6: a 36-digit SSN format with 1,000,000,000,000,000,000,000,000,000,000,000,000 possible values. we'll have so many, even your dog can have an SSN!
9
2
1
34
2,379
Matt Brown retweeted
so, if you're having moments of "waiiiiiit, maybe common sense ain't so common" follow this guy. come for the general badassery, stay for the fact that he's one of the most gifted teachers i know.
Anti bot mitigations block: Web fetch Curl Wget Puppeteer Playwright Chrome devtools mcp You don’t notice because it’s in a sub agent and your hackbot gives up silently. Roll your own requester.
2
1
16
1,466
Matt Brown retweeted
Mandatory read: I consider “exec that frequently asks you to drop everything and address the latest CVE in the news” to be a high severity vulnerability in itself; it DoS’s the security team, you get no real work done
Replying to @techspence
@techspence posted something on another platform that hit home: For every unimportant thing that is fixed or made a priority, something truly critical gets moved down the list. Sometimes people have asked me “what’s the harm when media frenzy, marketing buzz, or knee-jerk reactions cause a topic that is not really a thing to take center stage (think agent swarms in toasters). The harm is that all of those conversations, thoughts, and actions were about something unimportant, and were not about Winter2026! as a password, unmanaged devices, misconfigurations, users running as local admin, password stored in the clear, and so on… Every time we make something unimportant take center stage, what should be center stage does not, and the attacker gains an advantage. It is like skipping a turn in a card game. Make a habit of skipping turns, and you will lose. This has also been pointed out repeatedly by @ZackKorman, @UK_Daniel_Card, @Shammahwoods, @IceSolst, @christian_tail, and so many others here.
13
8
68
3,116
Oh damn that’s no fun.
16
3
182
17,954
Matt Brown retweeted
If you want to do some #IoT research/hacking first waych the 1st @d1gitalandrew @defcon talk then watch this one youtu.be/N1hXKLAQh8k?is=Wlq_… Then finish with @nmatt0 ‘s videos. Easy peasy. :-)
2
3
494
Matt Brown retweeted
Excited to see the @ctbbpodcast homies back at #NahamCon2026 and doing a live recording!
3
6
1
95
8,448
Why go for source code when everyone is running the same agents on the same code? In Episode 199, we discuss why a shell beats source, hacking inside the dupe window, and lot more youtu.be/hPFMHj-xGls
2
4
34
2,726
Come and take it.
Top of the Democratic agenda on day 1 needs to be a pause on advanced AI development, regulation of this out of control industry, and a ban on artificial superintelligence.
55
60
10
1,010
36,960
Matt Brown retweeted
Sometimes surprises are fun, sometimes they are not. If anyone has open security research or engineering positions, please let me know!
5
25
7
96
20,389
Bro, you can't fucking say openly on social media you just attempted to compromise an organizations infrastructure under your employer and full legal name Are you actually fucking insane?? Genuinely what the fuck are you thinking??? And how the fuck does this dude know the employees name? Why did the employee openly admit "hehe ye thats me, but no mallace intended, it was my AI agent" ????? WHAT. THATS STILL A CRIME. WHAT ARE YOU TALKING ABOUT.
459
840
135
15,051
964,847
Matt Brown retweeted
Ah yes… im a bit of a auth tester myself 😉
Ah yup. That was indeed me. No mallace intended. I've been running some agents to do signups + agentic testing on similar platforms. Just halted the harness I was designing around this as it was definitely going off the rails and reaching too far
Readers added context they thought people might want to know
In many jurisdictions this is a crime. In the US under Computer Fraud and Abuse Act, 18 U.S.C. §1030, in the UK under Computer Misuse Act (CMA) 1990, in Germany Strafgesetzbuch (StGB), and many others. justice.gov/jm/jm-9-48000-… legislation.gov.uk/ukpga/1990/18/… gesetze-im-internet.de/stgb/
7
4
98
7,192
Matt Brown retweeted
I know so many hackers making bank off of hw hacking right now since web got so crowded. – at Bon Air, VA
Hardware Hackalong incoming! Join StaticFlow on our second hardware hackalong/masterclass!
2
5
130
7,497
Matt Brown retweeted
Sped up DeepSeek V4.1 Flash on a Mac Studio (M3 Ultra, 512GB) ~2.2x, using ideas from Strata: • DSpark speculative decoding: the MLX checkpoint shipped without DeepSeek's 3 draft (MTP) layers, so I pulled them from the original weights • Fused Metal kernels: oMLX had them, but they never ran on this weight format. A one-line FP8-input switch turned them on for all 40 layers • Context-copy drafts (depth 5) + CED prefill Result: 36 → ~60-85 tok/s on real agent work, prompts read 2x faster. Same accuracy on my quality checks.
14
10
185
13,639
Matt Brown retweeted
Cost savings aren't the main reason we run local LLMs, but I track them anyway. 4× DGX Spark running GLM 5.3 Flash, 3 weeks: ~$460 saved vs API ~$34 electricity At full load we could hit ~$1k/month in savings. Anyone else tracking what their fleet saves?
14
1
1
52
4,237
Matt Brown retweeted
What’s going to happen to crypto when all the coins belong to the DPRK? They’re making a strategic mistake being too successful
14
16
3
191
9,222
In America, a hardware store called Harbor Freight. I walked in to buy one roll of black electrical tape. Seventy-nine cents. At the register, a bearded clerk named Frank scanned my tape, reached beneath the counter, and placed a massive red five-gallon plastic bucket between us. "Free bucket weekend," he said. I looked at the price tag on the bucket. Four dollars and ninety-nine cents. I looked at my tape. Seventy-nine cents. I stood before the register while basic arithmetic died in my hands. "The vessel costs six times the tribute," I informed him. "If you do this for every customer, your house will fall before winter." "Been doing it for years, chief. Take the bucket." In my land, when a lord grants you a vessel larger than your purchase, you are expected to fill it in his service. I held the wire handle with both hands and asked Frank what a man does with such a bucket. He looked at me the way a monk looks at an uninitiated boy. "Everything," Frank said, "except carry water." I thought he was speaking in riddles. He was speaking the literal law of the land. I have now inspected four garages on my street, and I must report that the entire residential infrastructure of the United States rests upon five-gallon plastic buckets. Nobody puts water in them. The first bucket holds rusty bolts from machines that died during the Bush administration. The second bucket is inverted so a man can sit on it while staring at a lawnmower he has no intention of fixing today. The third bucket is an emergency step-stool so a father can stand fourteen inches closer to a smoke detector that will not stop chirping. I carried my red bucket home and set it beside my garage door. On Saturday morning, my seventy-four-year-old neighbor Walt walked past my driveway with his coffee. He stopped. He looked at the red bucket. Then he looked at me. Without a word, Walt walked back to his own garage, returned sixty seconds later, and dropped a brand-new yellow sponge and a brass hose nozzle into my bucket. "Saw you finally got your bucket," Walt said, tapping the plastic rim twice. "Welcome to the street, kid." I spent seventy-nine cents on tape. They gave me a throne, a toolbox, and citizenship on my block.
338
885
71
12,621
729,740
Hello, Little People Living Inside Of My Computer, I have made my first YouTube video. I am bonking goop (malware) with a stick. I've tried to be both technical and non-technical to appeal to all nerds. This was a lot of work. I love you. youtube.com/watch?v=MqdR7eMq…
67
126
7
2,114
67,582