A few things to keep in mind today:
— We have no idea of why/who re: Wed’s assassination.
— Today is the anniversary of a tragic event that has enabled much of the harm caused by the GOP this year.
— Trump is an adjudicated rapist & was involved at least in some way in the mass sexual assault of children.
Oh, and never let anyone forget what happened on January 6th, too.
Details: https://dailydrop.hrbrmstr.dev/2025/08/07/drop-691-2025-08-07-short-sweet/
ENISA published docs for their European Vulnerability Database (EUVD) — https://euvd.enisa.europa.eu/apidoc.
I’ve got an easier-on-the-eyes version that supports light/dark mode and includes sample API JSON results at https://rud.is/euvd-api/. The Quarto markdown source for it can be found at https://rud.is/euvd-api/euvd-api.qmd.
I need to make an MCP (Model Context Protocol) server for the API, but not everyone wants an MCP server, so there’s a TypeScript NPM package for it — https://www.npmjs.com/package/@hrbrmstr/euvd (source: https://codeberg.org/hrbrmstr/euvd-ts). This comes with the added benefit of making it easier/cleaner to build an MCP server. Friends don’t let friends make icky Python-based MCP servers.
I also need to integrate it into pipeline stuff at $WORK, so there’s also a Golang API wrapper & CLI @ https://codeberg.org/hrbrmstr/euvd.
READMEs in both repos have all the details.
Meet Suriest — a new REST API service for validating Suricata rules, designed to be run by organizations to streamline rule validation workflows. Suriest supports Suricata 6.0 and later and offers features like secure configuration, S3-compatible storage for logging validation attempts, and a simple HTTP API to validate rules programmatically. While the project is intended for deployment within your own environment, there’s a live instance already available for immediate use at https://sigchk.hrbrmstr.app/validate-rule. You can test it easily with a curl command like:
curl --silent --request POST --url https://sigchk.hrbrmstr.app/validate-rule \
--header "Content-Type: application/json" \
--data '{"rule": "alert http any any -> any any (msg:\"Test Rule\"; content:\"test\"; sid:1000001; rev:1;)"}'
This live service currently runs Suricata 7, since Suricata 8 is still in beta. For full details on setup, configuration options (including S3 logging), and API usage, check out the README in the repository at https://codeberg.org/hrbrmstr/suriest. Suriest offers a practical, scalable solution for Suricata rule validation that integrates well into security operations and development pipelines.
MCP servers let you wire up external services/APIs in a standard way for LLM/GPT tool-calling and other forms of automation.
I made a basic, but fairly comprehensive CISA KEV MCP server that I go into the details a bit more of here.
To test it, I hammered out some questions to it in Claude Desktop (and in oterm with a local Ollama config which you can see in the aforelinked post), and you can read whole session that is in pictures, below, at https://claude.ai/share/d73aa2be-a536-4c9d-977d-ea80ec6dce15, but these are some of those convos:
(I posted this on LI, but I like to own my content, so am also posting here.)
The cybersecurity community deserves better than what we’re witnessing at RSAC 2025, today.
While Kristi Noem delivers today’s keynote, the absence of traditional cybersecurity leaders from agencies like NSA and CISA speaks volumes about shifting priorities in our field. This contrast becomes even more troubling when viewed alongside recent developments with Chris Krebs. The former CISA director — widely respected for his defense of election security — has faced unprecedented retaliation: security clearances revoked, his employer SentinelOne effectively blacklisted, and federal investigations directed into his tenure for simply upholding the integrity of our democratic systems.
Meanwhile, Secretary Noem — who has publicly committed to “reining in” CISA’s disinformation efforts and called its election integrity work “shocking” — receives our industry’s most prestigious speaking platform. Her tenure at DHS has featured more political theater than substantive cybersecurity leadership — or just leadership in general — prioritizing spectacle over the technical expertise and collaborative approach our field demands.
RSAC has always represented rigorous, forward-thinking discussion about defending critical infrastructure and fostering trust in technology. By elevating political figures who undermine the very principles our community stands for — while one of our most principled voices faces silencing — we’re accepting a dangerous new standard.
The cybersecurity field requires leaders who value expertise, accountability, and the defense of democratic norms. We must ask ourselves: what message are we sending about our professional values when we applaud those who work to dismantle the very protections we’ve built?
Every individual involved with RSAC who had a part to play in this decision should be deeply, deeply ashamed of themselves.
ONYPHE has made available a free API and free MMDB download of their new Geolocus database. It provided IP address metadata in the form of:
{
"abuse":
[
"amzn-noc-contact@amazon.com",
"aws-routing-poc@amazon.com",
"aws-rpki-routing-poc@amazon.com",
"trustandsafety@support.aws.com"
],
"asn": "AS14618",
"continent": "NA",
"continentname": "North America",
"country": "US",
"countryname": "United States",
"domain":
[
"amazon.com",
"amazonaws.com",
"aws.com"
],
"ip": "3.215.138.152",
"isineu": 0,
"latitude": "37.09024",
"location": "37.09024,-95.712891",
"longitude": "-95.712891",
"netname": "AMAZON-IAD",
"organization": "Amazon Data Services NoVa",
"physical_asn": "AS14618",
"physical_continent": "NA",
"physical_continentname": "North America",
"physical_country": "US",
"physical_countryname": "United States",
"physical_isineu": 0,
"physical_latitude": "37.09024",
"physical_location": "37.09024,-95.712891",
"physical_longitude": "-95.712891",
"physical_organization": "Amazon.com, Inc.",
"physical_subnet": "3.208.0.0/12",
"physical_timezone": "America/Chicago",
"subnet": "3.208.0.0/12",
"timezone": "America/Chicago"
}
Since it’s way more efficient to use the MMDB file than the API, I built a cross-platform CLI tool for it: https://codeberg.org/hrbrmstr/geolocus-cli.
also with binary releases: https://codeberg.org/hrbrmstr/geolocus-cli/releases
Code is also available via Tangled Knot: https://tangled.sh/@hrbrmstr.dev/geolocus-cli
Usage:
# Download the latest Geolocus database
geolocus-cli download
# Look up IPs from a file
geolocus-cli lookup -i ips.txt -o results.json
# Process IPs from stdin and output to stdout
cat ips.txt | geolocus-cli lookup
# Output in CSV format
geolocus-cli lookup -i ips.txt -f csv -o results.csv
# Output in JSONL format (one JSON object per line)
geolocus-cli lookup -i ips.txt -f jsonl -o results.jsonl
# Disable session caching
geolocus-cli lookup -i ips.txt --no-cache
CLI options:
Commands:
download Download a fresh copy of the geolocus.mmdb database
lookup Lookup and enrich IP addresses from a file or stdin
Options:
-h, --help Show help information
-i, --input <file> Input file containing IP addresses (one per line)
-o, --output <file> Output file for results (defaults to stdout)
-f, --format <format> Output format: json, csv, or jsonl (default: json)
--no-cache Disable IP caching for the current session
Maine 2025 Ballot Questions Redux
If you want to or do vote “yes” for question 1, you are not a real American, you are not a real Christian (if you profess to be one), you are not a decent human. You are at the very least a classist; you are also very likely a racist/bigot, and you have zero ability to think critically or with evidence. You hate Americans serving in the military or in any type of foreign service. You also very likely don’t look in the mirror since if you did you’d likely slap yourself for what you believe.
If you want to or do vote “no” for question 2, you are anti-life (never, ever use the words “pro-life” to describe yourself if in my presence…it will end very badly for you), have no ability to use evidence to make decisions, and should never work in any profession that requires any level of decent judgement. Given your lack of mental acuity, your own firearms should be removed from your possession and you should likely be forced to take an annual driver’s test to ensure your mental acuity is up to snuff.
Decent people are for honest, free access to exercising their right to vote as an American citizen, and decent people are for sane gun regulations.
Now, excuse me while I go early voting to help ensure you continue top indeed be losers in life and also these initiatives.