Profile avatar
christian-folini.ch
Web application security guy with a passion for OWASP's open source WAF projects and National Cyber Strategy. Maintains "Swiss Cyber Security" starter pack and cherishes his small collection of medieval helmets.
181 posts 3,239 followers 286 following
Regular Contributor
Active Commenter

Digital integrity mit der #digiges und Jörg Mäder im #lichtspiel in Bern.

Andrew Kochura shared a very simple WAF smoke test with 15 diverse payloads that can serve as a simple indicator of the baseline quality of a WAF. I like the simplicity of this. Furthermore, I like that CRS covers 90% of the payloads by default and 100% at PL2. gist.github.com/kochuraa/fb3...

Dr @lukaszolejnik.bsky.social explores the evolving threat of Russian cyberwarfare & its impact on European security. "Disinformation does not aim for instant change. The real deal is gradual influence including delicate shifts in narratives and fostering divisions." 📖Read: bit.ly/3Gbjgsg

The problem with most machine-based random number generators is that they’re not TRULY random, so if you need genuine randomness it is sometimes necessary to link your code to an external random process like a physical noise source or the current rate of US tariffs on a given country.

A lot of people are tired of democracy and they are flirting with the thought of a strong autocrat at the helm. They dream of a wise Caesar like Augustus, but I think Augustus was an outlier and history tends to head straight for Nero.

Got my new sticker in the mail today. Here we go!

I'm sure somebody wrote a screenplay involving a "Houthi PC small group", but it got rejected as highly unrealistic.

I like the design on this "Houthi PC small group" sticker. #HouthiPC #SmallGroup

quick guide to Signal's disappearing messages settings

There are only very few reasons to prefer Signal over Threema. Now, there is an additional reason: You're only invited to join top secret military planning meetings as a Signal user. While the 🇨🇭 Army uses Threema for communication, I have never heard of a similar breach of rules in Switzerland.

This is going to blow up badly for @springernature.com, the Universities involved and especially Nanasheb Thorat, PhD. cc @ruthwdiamonds.bsky.social

When #LLM hallucinations hit real people and the GDPR. arstechnica.com/tech-policy/...

I'll be hosting a @owasp.org CRS project community call later today / tonight (20:30 CET). It's open for everyone and it would be great to see a lot of faces, old and new to talk about CRS. coreruleset.org/20250203/fir...

After my take on Swissoms claim about 200M attacks per month, it's now @rvgt.ch challenging that statement.

The @swisscom.bsky.social CEO reported 200M monthly attacks on its infrastructure. This can't be true. It's either much more or much less. But certainly not 200M. Here is a German guest piece I wrote for @inside-it.ch that discusses this number. www.inside-it.ch/gastkommenta...

Mathias Peter kicking off @1ns0mn1h4ck.bsky.social 2025 conference today. #INSO25

Switzerland adopts mandatory reporting of significant attacks on critical infrastructures as well as the fixing of reported security vulnerabilities within a basic deadline of 90 days. Coordinated disclosure becomes the standard, enforced by the Swiss NCSC. www.ncsc.admin.ch/ncsc/en/home...

Next Tuesday is Security Meetup at Schiffbau/Zürich …and for our Insomnihack friends, we do a special warm up on Wed 12th next to EPFL - start the con the fun way🤗 @insomnihack.bsky.social #BoT www.beerontuesday.ch?page_id=19

Francis Fukuyama "The End of History" my ass.

The world is going crazy and the motto for this year's @swisscyberstorm.bsky.social conference is "Resilience in a mad, mad world" Tuesday, October 28, 2025, Bern, Kursaal Introducing the topic and opening keynote speaker #MarkBarwinski: www.swisscyberstorm.com/2025/02/27/r...

Ganz starker Auftritt von @philippburkhardt.bsky.social zur VBS-Situation im Echo der Zeit heute Abend. Das fehlt nicht mehr viel zur PUK (wohl v.a. politischer Wille).

Brilliant but devastating editorial in the Financial Times. “In the past 10 days, he [Trump] has all but incinerated 80 years of postwar American leadership. If you are not at the table, you are on the menu. America has turned.”

Nonsense headline by @watson.ch. "Lavabit is believed to be the first technology firm that has chosen to suspend or shut down its operation rather than comply with an order from the United States government to reveal information or grant access ..." en.wikipedia.org/wiki/Lavabit

This a welcome and not unexpected move from Apple. Weakening encryption for one government ultimately weakens it for everyone, particularly given the current geo-political challenges the world is facing

If the US administration destroys existing initiatives and re-prioritizes the resources to new goals, this will invariably affect the global cyber security situation. @lukasmaeder.bsky.social has a thoughtful scenario what might happen in @nzz.ch. A few highlights. 1/n www.nzz.ch/pro/trump-bi...

There are few Swiss politicians I respect as much as @meretschneider.bsky.social. I do not necessarily support her policies, but she is considerate, funny and she has no fear to stand up against power. What I miss are many other Swiss politicians supporting her in this shitstorm in public.