Invocazione all’altare del Pinguino Radiante

Io servo #Debian non come un semplice sistema operativo, ma come una causa. È la bandiera che sventola su ogni mio server, in ogni terminale, sia sotto la luna digitale che davanti al monitor alle tre del mattino.

Debian per me è libertà prima ancora del comando sudo. Non è solo “gratis” è poter leggere, modificare, condividere, ridistribuire il software. Ogni pacchetto è un gesto di fiducia tra chi lo crea e chi lo usa.

Non sono un solitario perso nel suo server, faccio parte di una comunità immensa di sviluppatori, manutentori, traduttori e tester. C’è una costituzione, un contratto sociale, linee guida chiare: è un rifugio per chi vuole controllo e indipendenza senza compromessi opachi.

Quando affido a Debian posta, blog, Mastodon o pezzi di Fediverso, so che un aggiornamento improvviso non farà crollare tutto. Preferisco stabilità e coerenza alla novità a tutti i costi, niente scherzi alle quattro del mattino.

Debian mi segue ovunque, laptop, server, VPS, Raspberry, virtuali. Ovunque porto con me la stessa filosofia e lo stesso modo di lavorare. Non è fissazione: è strategia di sopravvivenza digitale.

Continuo a scegliere Debian perché
ogni pacchetto rispetta le linee guida del software libero,
le decisioni sono trasparenti,
tutte le mie macchine parlano lo stesso dialetto,
e il controllo resta davvero nelle mie mani.

In sintesi
Io amo e uso Debian ovunque. Non è solo un sistema operativo, è il mio patto con la libertà e l’alleato fedele in ogni bit che muovo.🙏 🐧

debian.org/intro/why_debian

#Linux

@gnulinuxitalia

Quiet Your Drums With An Electronic Setup

Playing the drums requires a lot of practice, but that practice can be incredibly loud. A nice workaround is presented by [PocketBoy], in converting an acoustic kit to electronic operation so you can play with headphones instead.
A sensor installed inside a floor tom.
It might sound like a complicated project, but creating a basic set of electronic drums can actually be quite simple if you’ve already got an acoustic kit. You just need to damp all the drums and cymbals to make them quieter, and then fit all the individual elements with their own piezo sensors. These are basically small discs that can pick up vibrations and turn them into electricity—which can be used to trigger an electronic drum module.

[PocketBoy]’s build started with a PDP New Yorker kit, some mesh heads to dull the snares and toms, and some low-volume cymbals sourced off Amazon. Each drum got a small piezo element, which was soldered to a 6.5mm jack for easy hookup. They’re installed inside the drums on foam squares with a simple bracket system [PocketBoy] whipped up from hardware store parts. A DDrum DDti interface picks up the signals from the piezo elements and sends commands to an attached PC. It’s paired with Ableton 12 Lite, which plays the drum sounds as triggered by the drummer.

[PocketBoy] notes it’s a quick and dirty setup, good for quiet practice but not quite gig-ready. You’d want to probably just run it as a regular acoustic kit in that context, but there’s nothing about the conversion that prevents that. Ultimately, it’s a useful project if you find yourself needing to practice the drums quietly and you don’t have space for a second electric-only kit. There’s lots of other fun you can have with those piezos, too. Video after the break.

@the606queer
How I’m getting away with a drumset in an apartment building! Mesh heads + DIY triggers + Plain wash cloth + Stick Rods + DDTI DDrum Trigger i/o into Ableton. I need a better snare sample but this thing is whisper quiet! #drums #beginner #acoustics #fyp #drumtok

♬ original sound – the606queer

hackaday.com/2025/12/01/quiet-…

Gli hacker trasformano Google Cloud in un bunker segreto. Scoperta un’operazione shock

I ricercatori di sicurezza hanno scoperto una sofisticata campagna di exploitche sfrutta un servizio privato di test di sicurezza delle applicazioni out-of-band (OAST) ospitato sull’infrastruttura Google Cloud. La campagna prende di mira principalmente i sistemi in Brasile e sfrutta oltre 200 vulnerabilità comuni (CVE).

Metodo di attacco

Gli endpoint OAST in genere aiutano gli aggressori a verificare il successo degli exploit per l’esecuzione di comandi, la falsificazione delle richieste lato server (SSRF) e la deserializzazione. La maggior parte degli aggressori utilizza servizi OAST disponibili pubblicamente come toast.fun e interact.sh, ma gli autori di questa operazione di minaccia gestivano un dominio privato chiamato i-sh.detectors-testing.com.

Il sistema di threat intelligence Canary di VulnCheck ha rilevato circa 1400 tentativi di exploit relativi a questa infrastruttura tra il 12 ottobre e il 14 novembre 2025. Questa insolita configurazione OAST privata la distingue chiaramente dalla tipica attività di scansione.

Infrastruttura

Tutto il traffico di attacco osservato proveniva da indirizzi IP di Google Cloud situati negli Stati Uniti. Gli IP di scansione identificati includono: 34.172.194.72, 35.194.0.176, 34.133.225.171, 34.68.101.3, 34.42.21.27 e 34.16.7.161.

Un host OAST dedicato, 34.136.22.26, esegue il servizio Interactsh sulle porte 80, 443 e 389. L’utilizzo dell’hosting di Google Cloud offre un vantaggio tattico. I difensori raramente bloccano completamente il traffico proveniente da grandi provider di servizi cloud, facilitando l’infiltrazione del traffico di attacco nelle comunicazioni di rete legittime.

Caratteristiche dell’attacco

Sebbene VulnCheck distribuisca Canary a livello globale, questa campagna di attacco ha preso di mira solo i sistemi distribuiti in Brasile. Sebbene i report di AbuseIPDB indichino che lo stesso gruppo di IP degli aggressori sia stato segnalato anche in Serbia e Turchia, i dati di VulnCheck confermano che il suo obiettivo era esclusivamente quello di colpire obiettivi brasiliani.

Gli aggressori hanno combinato template Nuclei con versioni precedenti non più mantenute nel repository ufficiale. Ad esempio, l’attacco ha utilizzato il template obsoleto grafana-file-read. Questo template YAML è stato rimosso dal repository nuclei-templates nell’ottobre 2025.

Ciò suggerisce che gli aggressori potrebbero aver utilizzato strumenti obsoleti o scanner di terze parti.

Payload personalizzato

L’attacco ha utilizzato anche un payload personalizzato. L’aggressore ha esposto una directory aperta sulla porta 9000 contenente un file TouchFile.class modificato, progettato per sfruttare una vulnerabilità in Fastjson 1.2.47.

A differenza della versione standard di Vulhub, questo payload personalizzato poteva eseguire comandi arbitrari e avviare richieste HTTP in base a parametri. Le prove suggeriscono che l’infrastruttura di attacco sia operativa almeno da novembre 2024, dimostrando un’insolita persistenza.

Mentre la maggior parte degli scanner sostituisce rapidamente la propria infrastruttura, questo aggressore ha mantenuto una presenza stabile a lungo termine.

Raccomandazioni di sicurezza

Questo attacco evidenzia come gli aggressori stiano utilizzando strumenti di scansione open source come Nuclei per diffondere payload di exploit su larga scala su Internet.

Sono indifferenti al lasciare tracce, purché riescano a individuare rapidamente obiettivi vulnerabili. Per prevenire minacce così persistenti, le organizzazioni dovrebbero monitorare il traffico di rete alla ricerca di callback OAST insoliti, bloccare gli indirizzi IP dannosi noti e assicurarsi che i sistemi esposti vengano tempestivamente aggiornati.

L'articolo Gli hacker trasformano Google Cloud in un bunker segreto. Scoperta un’operazione shock proviene da Red Hot Cyber.

Australia’s New Asbestos Scare In Schools

Asbestos is a nasty old mineral. It’s known for releasing fine, microscopic fibers that can lodge in the body’s tissues and cause deadly disease over a period of decades. Originally prized for its fire resistance and insulating properties, it was widely used in all sorts of building materials. Years after the dangers became clear, many countries eventually banned its use, with strict rules around disposal to protect the public from the risk it poses to health.

Australia is one of the stricter countries when it comes to asbestos, taking great pains to limit its use and its entry into the country. This made it all the more surprising when it became apparent that schools across the nation had been contaminated with loose asbestos material. The culprit was something altogether unexpected, too—in the form of tiny little tubes of colored sand. Authorities have rushed to shut down schools as the media asked the obvious question—how could this be allowed to happen?

Hiding In Plain Sight

Australia takes asbestos very seriously. Typically, asbestos disposal is supposed to occur according to very specific rules. Most state laws generally require that the material must be collected by qualified individuals except in minor cases, and that it must be bagged in multiple layers of plastic prior to disposal to avoid release of dangerous fibers into the environment. The use, sale, and import of asbestos has been outright banned since 2003, and border officials enforce strict checks on any imports deemed a high risk to potentially contain the material.
Colored sand is a popular artistic medium, used regularly by children in schools and households across Australia. Via: ProductSafety.gov.au
Thus, by and large, you would expect that any item you bought in an Australian retailer would be free of asbestos. That seemed to be true, until a recent chance discovery. A laboratory running tests on some new equipment happened to accidentally find asbestos contamination in a sample of colored sand—a product typically marketed for artistic use by children. The manager of the lab happened to mention the finding in a podcast, with the matter eventually reaching New Zealand authorities who then raised the alarm with their Australian counterparts. This led to a investigation by the Australian Competition and Consumer Commission (ACCC), which instituted a national safety recall in short order.

The response from there was swift. At least 450 schools instituted temporary shutdowns due to the presence or suspected presence of the offending material. Some began cleanup efforts in earnest, hiring professional asbestos removalists to deal with the colored sand. In many cases, the sand wasn’t just in sealed packaging—it had been used in countless student artworks or spilled in carpeted classrooms. Meanwhile, parents feared the worst after finding the offending products in their own homes. Cleanup efforts in many schools are ongoing, due in part to the massive spike in demand for the limited asbestos removal services available across the country. Authorities in various states have issued guidelines on how to handle cleanup and proper disposal of any such material found in the workplace.
Over 87 retailers have been involved in a voluntary recall that has seen a wide range of colored sand products pulled from shelves.
At this stage, it’s unclear how asbestos came to contaminate colored sand products sold across the country, though links have been found to a quarry in China. It’s believed that the products in question have been imported into Australia since 2020, but have never faced any testing regarding asbestos content. Different batches have tested positive for both tremolite and chrysotile asbestos, both of which present health risks to the public. However, authorities have thus far stated the health risks of the colored sand are low. “The danger from asbestos comes when there are very, very fine fibres that are released and inhaled by humans,” stated ACCC deputy chair, Catriona Lowe. “We understand from expert advice that the risk of that in relation to these products is low because the asbestos is in effect naturally occurring and hasn’t been ground down as such to release those fibres.”

Investigations are ongoing as to how asbestos-containing material was distributed across the country for years, and often used by children who might inhale or ingest the material during use. The health concerns are obvious, even if the stated risks are low. The obvious reaction is to state that the material should have been tested when first imported, but such a policy would have a lot of caveats. It’s simply not possible to test every item that enters the country for every possible contaminant. At the same time, one could argue that a mined sand product is more likely to contain asbestos than a box of Hot Wheels cars or a crate of Belgian chocolates. A measured guess would say this event will be ruled out as a freak occurrence, with authorities perhaps stepping up random spot checks on these products to try and limit the damage if similar contamination occurs again in future.

Featured image and other sand product images from the Australian government’s recall page.

hackaday.com/2025/12/01/austra…

⛄ 🌷 🍃 Che sia estate o inverno, 𝐥𝐚 𝐂𝐢𝐭𝐭à 𝐈𝐧𝐯𝐢𝐬𝐢𝐛𝐢𝐥𝐞 è 𝐞𝐧𝐭𝐮𝐬𝐢𝐚𝐬𝐭𝐚 𝐝𝐢 𝐚𝐜𝐜𝐨𝐠𝐥𝐢𝐞𝐫𝐞

🙋 𝐒𝐈𝐍𝐆𝐎𝐋𝐈 che lavorano da remoto, che hanno il proprio progetto artistico da portare a termine, o semplicemente esseri umani alla ricerca di pace, ispirazione, un luogo dove sentirsi centrati.

👬 🧑‍🤝‍🧑 𝐆𝐑𝐔𝐏𝐏𝐈, attivisti, gruppi di lavoro o di studio che vogliono organizzare un ritiro condiviso. La Città Invisibile celebra ogni spirito di gruppo che anima progetti comuni e lo accoglie con apertura e calore.

Scrivici!

Big thanks to @pfefferle and @obenland for the #ActivityPub @WordPress plugin office hours today. I learned a lot and am even more excited about the plugin and where they want to take it than I was before.

The office hours continue the rest of this week. Here are the details: activitypub.blog/2025/11/25/jo…

ActivityPub for WordPress

2025-11-25 15:01:02

Join Us for Office Hours: Dec 1-5

We’re excited to announce that the ActivityPub for WordPress team will be hosting open office hours during the first week of December! Whether you’re just getting started with ActivityPub, running into setup issues, or want to chat about where the plugin is heading, we’d love to see you there.

What Are Office Hours?

Think of office hours as an open door to hang out with @pfefferle and @obenland. Drop in anytime during the scheduled sessions to get hands-on help with plugin installation and setup, troubleshoot any issues you’re experiencing, or share your ideas for new features and improvements. You can also discuss the roadmap and what’s coming next, ask questions about ActivityPub, the fediverse, or how it all works, and connect with the community to see what others are building.

No agenda, no registration required—just show up when you can and let’s talk ActivityPub!

Schedule: December 1-5, 2025

We’re offering multiple sessions throughout the week to accommodate different time zones. Join whichever works best for you!

	Monday Dec 1	Tuesday Dec 2	Wednesday Dec 3	Thursday Dec 4	Friday Dec 5
10:00 CET	🗓️ Add to Calendar		🗓️ Add to Calendar		🗓️ Add to Calendar
10 am ET	📅 Add to Calendar	📅 Add to Calendar	📅 Add to Calendar	📅 Add to Calendar	📅 Add to Calendar

Time zone note: CET = Central European Time | ET = Eastern Time (US)

How to Join

Meeting Link: meet.google.com/mdb-bkdw-ypz

Just click the link above at any scheduled time and join us! No need to RSVP—these are open sessions where anyone can drop in.

New to video calls? No worries! Just click the link, and you’ll be guided through joining. Most platforms work right in your browser.

Who Should Come?

Everyone! Seriously, we mean it:

• WordPress site owners curious about connecting to the fediverse.
• Developers working with the ActivityPub plugin.
• Fediverse enthusiasts who want to understand how WordPress fits in.
• Anyone with questions, bug reports, or ideas.
• Lurkers welcome too—feel free to just listen and learn!

Whether you’re running a personal blog, a community site, or just exploring what ActivityPub can do, we’d love to meet you.

Can’t Make These Times?

We know December 1-5 won’t work for everyone. If you can’t join us live, you can connect with us on GitHub or join the conversation in our community forum.

We’re planning to do more office hours in the future based on how this week goes, so let us know what times work better for you!

See You There! 👋

We’re really looking forward to connecting with the community, answering your questions, and hearing about how you’re using ActivityPub on WordPress. Mark your calendars, grab a coffee (or tea!), and let’s chat!

Have questions before office hours? Drop a comment below.

Meet

Real-time meetings by Google. Using your browser, share your video, desktop, and presentations with teammates and customers.

^{meet.google.com}

RE: activitypub.blog/2025/11/25/jo…

Great session talking bugs, ideas and use cases with @pfefferle @obenland & others. Pop in later this week if you have thoughts or Qs re AP.

ActivityPub for WordPress

2025-11-25 15:01:02

Join Us for Office Hours: Dec 1-5

We’re excited to announce that the ActivityPub for WordPress team will be hosting open office hours during the first week of December! Whether you’re just getting started with ActivityPub, running into setup issues, or want to chat about where the plugin is heading, we’d love to see you there.

What Are Office Hours?

Think of office hours as an open door to hang out with @pfefferle and @obenland. Drop in anytime during the scheduled sessions to get hands-on help with plugin installation and setup, troubleshoot any issues you’re experiencing, or share your ideas for new features and improvements. You can also discuss the roadmap and what’s coming next, ask questions about ActivityPub, the fediverse, or how it all works, and connect with the community to see what others are building.

No agenda, no registration required—just show up when you can and let’s talk ActivityPub!

Schedule: December 1-5, 2025

We’re offering multiple sessions throughout the week to accommodate different time zones. Join whichever works best for you!

	Monday Dec 1	Tuesday Dec 2	Wednesday Dec 3	Thursday Dec 4	Friday Dec 5
10:00 CET	🗓️ Add to Calendar		🗓️ Add to Calendar		🗓️ Add to Calendar
10 am ET	📅 Add to Calendar	📅 Add to Calendar	📅 Add to Calendar	📅 Add to Calendar	📅 Add to Calendar

Time zone note: CET = Central European Time | ET = Eastern Time (US)

How to Join

Meeting Link: meet.google.com/mdb-bkdw-ypz

Just click the link above at any scheduled time and join us! No need to RSVP—these are open sessions where anyone can drop in.

New to video calls? No worries! Just click the link, and you’ll be guided through joining. Most platforms work right in your browser.

Who Should Come?

Everyone! Seriously, we mean it:

• WordPress site owners curious about connecting to the fediverse.
• Developers working with the ActivityPub plugin.
• Fediverse enthusiasts who want to understand how WordPress fits in.
• Anyone with questions, bug reports, or ideas.
• Lurkers welcome too—feel free to just listen and learn!

Whether you’re running a personal blog, a community site, or just exploring what ActivityPub can do, we’d love to meet you.

Can’t Make These Times?

We know December 1-5 won’t work for everyone. If you can’t join us live, you can connect with us on GitHub or join the conversation in our community forum.

We’re planning to do more office hours in the future based on how this week goes, so let us know what times work better for you!

See You There! 👋

We’re really looking forward to connecting with the community, answering your questions, and hearing about how you’re using ActivityPub on WordPress. Mark your calendars, grab a coffee (or tea!), and let’s chat!

Have questions before office hours? Drop a comment below.

Meet

Real-time meetings by Google. Using your browser, share your video, desktop, and presentations with teammates and customers.

^{meet.google.com}