Christian Folini
@christian-folini.ch
Web application security guy with a passion for OWASP's open source WAF projects and National Cyber Strategy.
Maintains "Swiss Cyber Security" starter pack and cherishes his small collection of medieval helmets.
Maintains "Swiss Cyber Security" starter pack and cherishes his small collection of medieval helmets.
For a couple of days I see a new wave of attacks hitting our WP installation. Hundreds of IPs hitting /wp-login.php. Like 10 times the normal amount of requests despite fail2ban blocking them really fast.
The best defense (and there are many layers of defense) has been installing WP in a subfolder.
The best defense (and there are many layers of defense) has been installing WP in a subfolder.
November 10, 2025 at 8:19 AM
For a couple of days I see a new wave of attacks hitting our WP installation. Hundreds of IPs hitting /wp-login.php. Like 10 times the normal amount of requests despite fail2ban blocking them really fast.
The best defense (and there are many layers of defense) has been installing WP in a subfolder.
The best defense (and there are many layers of defense) has been installing WP in a subfolder.
Reposted by Christian Folini
I'm exploring new engagements! If your team needs expertise in cybersecurity, risk assessment, tech policy, regulations (GDPR, etc.), tech standards, strategic insight, or Comms/PR, let's talk! Open to contract, or flexible roles. DM/email at [email protected].
April 9, 2025 at 2:30 PM
I'm exploring new engagements! If your team needs expertise in cybersecurity, risk assessment, tech policy, regulations (GDPR, etc.), tech standards, strategic insight, or Comms/PR, let's talk! Open to contract, or flexible roles. DM/email at [email protected].
Reposted by Christian Folini
On a Saturday night I stumbled across something on the internet that made me feel like ****** my pants. A giant dataset of real surveillance operations targeting 1000s of people across nearly every country. Unraveling it and the mysterious company behind it has consumed 1.5 years of my life
October 14, 2025 at 4:49 PM
On a Saturday night I stumbled across something on the internet that made me feel like ****** my pants. A giant dataset of real surveillance operations targeting 1000s of people across nearly every country. Unraveling it and the mysterious company behind it has consumed 1.5 years of my life
Later today, I'll be hosting a ModSecurity / CRS community call
luma.com/8yc1p543
We'll be talking about success metrics, WAF testing and other integration questions.
luma.com/8yc1p543
We'll be talking about success metrics, WAF testing and other integration questions.
CRS Community Call · Luma
A video call where the CRS dev team gets to meet their community face-to-face. A place for information exchange and questions for both newbies and experienced…
luma.com
September 22, 2025 at 8:07 AM
Later today, I'll be hosting a ModSecurity / CRS community call
luma.com/8yc1p543
We'll be talking about success metrics, WAF testing and other integration questions.
luma.com/8yc1p543
We'll be talking about success metrics, WAF testing and other integration questions.
Reposted by Christian Folini
“E-ID explained, Teil 1: Wieso und wie? - #dnip” https://dnip.ch/2025/08/27/e-id-explained-teil-1-wieso-und-wie/
August 27, 2025 at 5:15 AM
“E-ID explained, Teil 1: Wieso und wie? - #dnip” https://dnip.ch/2025/08/27/e-id-explained-teil-1-wieso-und-wie/
Reposted by Christian Folini
In der heutigen Freitagskolumne für #dnip habe ich mich der #eID gewidmet. Dabei untersuchte ich die Argumente der Gegner:innen und unterzog sie einem Faktencheck.
Die meisten davon ziehen nicht, weil sie die Vorlage gar nicht betreffen. Von mir gibt's ein "Ja" am 28.9.
dnip.ch/2025/08/15/v...
Die meisten davon ziehen nicht, weil sie die Vorlage gar nicht betreffen. Von mir gibt's ein "Ja" am 28.9.
dnip.ch/2025/08/15/v...
Vogt am Freitag: Gespenster - Das Netz ist politisch
Kommerzielle Auswertung, massenhafte Datenspeicherung, Überwachung durch Tech-Konzerne: Die Gegner der neuen E-ID malen ein düsteres Bild. Aber die meisten
dnip.ch
August 15, 2025 at 6:24 AM
In der heutigen Freitagskolumne für #dnip habe ich mich der #eID gewidmet. Dabei untersuchte ich die Argumente der Gegner:innen und unterzog sie einem Faktencheck.
Die meisten davon ziehen nicht, weil sie die Vorlage gar nicht betreffen. Von mir gibt's ein "Ja" am 28.9.
dnip.ch/2025/08/15/v...
Die meisten davon ziehen nicht, weil sie die Vorlage gar nicht betreffen. Von mir gibt's ein "Ja" am 28.9.
dnip.ch/2025/08/15/v...
Reposted by Christian Folini
An Open Source sustainability story in two slides. (for a coming talk of mine)
Slide 1: car brands using #curl
Slide 2: car brands sponsoring or paying for #curl support
Slide 1: car brands using #curl
Slide 2: car brands sponsoring or paying for #curl support
August 14, 2025 at 6:35 AM
An Open Source sustainability story in two slides. (for a coming talk of mine)
Slide 1: car brands using #curl
Slide 2: car brands sponsoring or paying for #curl support
Slide 1: car brands using #curl
Slide 2: car brands sponsoring or paying for #curl support
Guess who's going to the circus tonight.
August 3, 2025 at 2:31 PM
Guess who's going to the circus tonight.
Reposted by Christian Folini
Do I know anyone near Bern Switzerland that I can meet up with in Vegas next week, to take a book to my friend? I mailed him one months ago and it never arrived. I don't want him to wait 3 more months. Let me know!
July 31, 2025 at 9:48 PM
Do I know anyone near Bern Switzerland that I can meet up with in Vegas next week, to take a book to my friend? I mailed him one months ago and it never arrived. I don't want him to wait 3 more months. Let me know!
Reposted by Christian Folini
Die NZZ ist einer der grössten Datenhändlerinnen der Schweiz. Dark Patterns at its worst. Stell Regler auf off bei Standort-Weitergabe und IMMER NOCH sind gewisse Advertising Tech-Firmen auf ON eingestellt. Das sind alles übelste Datenschutzverstösse. Der EDÖB hat leider aufgegeben bei dem Thema.
July 27, 2025 at 11:54 AM
Die NZZ ist einer der grössten Datenhändlerinnen der Schweiz. Dark Patterns at its worst. Stell Regler auf off bei Standort-Weitergabe und IMMER NOCH sind gewisse Advertising Tech-Firmen auf ON eingestellt. Das sind alles übelste Datenschutzverstösse. Der EDÖB hat leider aufgegeben bei dem Thema.
Switzerland is starting a project test #ECollecting / the electronic collection of signatures for referendums. The Federal Chancellery launched a public participation process and they recruited me to moderate this dialogue.
www.news.admin.ch/de/newnsb/vy...
www.news.admin.ch/de/newnsb/vy...
Die Webseite veröffentlicht alle Mitteilungen der Departemente und Ämter, sowie Daten der Medienkonferenzen des Bundesrates, der Bundesverwaltung, der Parteien usw.
www.news.admin.ch
July 26, 2025 at 6:09 AM
Switzerland is starting a project test #ECollecting / the electronic collection of signatures for referendums. The Federal Chancellery launched a public participation process and they recruited me to moderate this dialogue.
www.news.admin.ch/de/newnsb/vy...
www.news.admin.ch/de/newnsb/vy...
Reposted by Christian Folini
The final two parts of my blog series about delivering training at conferences have now been released!
You can check them out on the @BounceSecurity website now!
You can check them out on the @BounceSecurity website now!
July 17, 2025 at 11:30 AM
The final two parts of my blog series about delivering training at conferences have now been released!
You can check them out on the @BounceSecurity website now!
You can check them out on the @BounceSecurity website now!
#pastpuzzle 345
🟩🟩🟩🟩 (0)
▪️▪️▪️▪️
▪️▪️▪️▪️
▪️▪️▪️▪️
1/4 🥇
www.pastpuzzle.de
The question is always whether historians have advantages in trivia quizzes - like pastpuzzle.
Today: yes
🟩🟩🟩🟩 (0)
▪️▪️▪️▪️
▪️▪️▪️▪️
▪️▪️▪️▪️
1/4 🥇
www.pastpuzzle.de
The question is always whether historians have advantages in trivia quizzes - like pastpuzzle.
Today: yes
past puzzle
Errate mithilfe von 4 historischen Ereignissen das gesuchte Jahr. Ein von Wordle und Geschichten aus der Geschichte inspiriertes Spiel.
www.pastpuzzle.de
July 4, 2025 at 11:14 AM
#pastpuzzle 345
🟩🟩🟩🟩 (0)
▪️▪️▪️▪️
▪️▪️▪️▪️
▪️▪️▪️▪️
1/4 🥇
www.pastpuzzle.de
The question is always whether historians have advantages in trivia quizzes - like pastpuzzle.
Today: yes
🟩🟩🟩🟩 (0)
▪️▪️▪️▪️
▪️▪️▪️▪️
▪️▪️▪️▪️
1/4 🥇
www.pastpuzzle.de
The question is always whether historians have advantages in trivia quizzes - like pastpuzzle.
Today: yes
Another hour and we're ready. Deer shank on a spit.
June 29, 2025 at 8:36 AM
Another hour and we're ready. Deer shank on a spit.
OWASP awarded me with a distinguished lifetime member award last week.
I am deeply thankful for this recognition and the support by the OWASP CRS team that made this possible.
I am deeply thankful for this recognition and the support by the OWASP CRS team that made this possible.
June 2, 2025 at 3:40 PM
OWASP awarded me with a distinguished lifetime member award last week.
I am deeply thankful for this recognition and the support by the OWASP CRS team that made this possible.
I am deeply thankful for this recognition and the support by the OWASP CRS team that made this possible.
On my way to the @owasp.org WAF day and the OWASP AppSec EU conference in Barçelona.
If you're around, please come and say hello!
If you're around, please come and say hello!
May 27, 2025 at 9:53 AM
On my way to the @owasp.org WAF day and the OWASP AppSec EU conference in Barçelona.
If you're around, please come and say hello!
If you're around, please come and say hello!
Reposted by Christian Folini
I'm coming to Switzerland! Join me at the Microsoft Azure Zürich User Group in only a few weeks from now: www.meetup.com/de-DE/micros...
[In Person] Troy Hunt Have I Been Pwned Alpine Grand Tour Zürich , Di., 17. Juni 2025, 18:00 | Meetup
**IN-PERSON** Troy Hunt meetup at **Kraftwerk in Zurich**
This meetup is a collaboration between several Swiss User Groups:
[Azure Zurich User Group ](https://www.azurezur
www.meetup.com
May 27, 2025 at 12:04 AM
I'm coming to Switzerland! Join me at the Microsoft Azure Zürich User Group in only a few weeks from now: www.meetup.com/de-DE/micros...
Reposted by Christian Folini
Pope Francis wanted to ensure that a new pope yielded the same result. This means the papacy is idempontiff
finding out that
(1) francis I stacked the college of cardinals with his picks so the voting body skewed (more) liberal
(2) the conclave is limited to voting cardinals under the age of 80
has been mildly upsetting lol. there should be absolutely no takeaways for modern society in the vatican
(1) francis I stacked the college of cardinals with his picks so the voting body skewed (more) liberal
(2) the conclave is limited to voting cardinals under the age of 80
has been mildly upsetting lol. there should be absolutely no takeaways for modern society in the vatican
May 8, 2025 at 7:41 PM
Pope Francis wanted to ensure that a new pope yielded the same result. This means the papacy is idempontiff
Reposted by Christian Folini
I spend a chunk of my time explaining how open-source, when you do it on purpose and have a publicly available code repository, strongly disincentivizes you from taking these silly and dangerous shortcuts.
We should not underestimate the power of shame and public oversight.
We should not underestimate the power of shame and public oversight.
The source code for the TM SGNL apps (basically a backdoored version of Signal used by Trump officials) is public! Since it's open source, I've pushed it to github for easier research micahflee.com/heres-the-so...
Here's the source code for the unofficial Signal app used by Trump officials
Yesterday, I published an analysis of what I could publicly find about TM SGNL, the obscure and unofficial Signal app used by Mike Waltz, and presumably also by Pete Hegseth, JD Vance, Tulsi Gabbard, ...
micahflee.com
May 4, 2025 at 12:51 AM
I spend a chunk of my time explaining how open-source, when you do it on purpose and have a publicly available code repository, strongly disincentivizes you from taking these silly and dangerous shortcuts.
We should not underestimate the power of shame and public oversight.
We should not underestimate the power of shame and public oversight.
What I find intriguing about hiring disguised North Koreans is that they excel in their job since you hired an entire team.
May 4, 2025 at 5:45 AM
What I find intriguing about hiring disguised North Koreans is that they excel in their job since you hired an entire team.
Digital integrity mit der #digiges und Jörg Mäder im #lichtspiel in Bern.
April 17, 2025 at 5:10 PM
Digital integrity mit der #digiges und Jörg Mäder im #lichtspiel in Bern.
Andrew Kochura shared a very simple WAF smoke test with 15 diverse payloads that can serve as a simple indicator of the baseline quality of a WAF.
I like the simplicity of this.
Furthermore, I like that CRS covers 90% of the payloads by default and 100% at PL2.
gist.github.com/kochuraa/fb3...
I like the simplicity of this.
Furthermore, I like that CRS covers 90% of the payloads by default and 100% at PL2.
gist.github.com/kochuraa/fb3...
Lightweight Bash script to test basic WAF (Web Application Firewall) protections against common SQL injection and XSS payloads. Use this to quickly assess your web application’s surface against low-ha...
Lightweight Bash script to test basic WAF (Web Application Firewall) protections against common SQL injection and XSS payloads. Use this to quickly assess your web application’s surface against low...
gist.github.com
April 16, 2025 at 2:24 PM
Andrew Kochura shared a very simple WAF smoke test with 15 diverse payloads that can serve as a simple indicator of the baseline quality of a WAF.
I like the simplicity of this.
Furthermore, I like that CRS covers 90% of the payloads by default and 100% at PL2.
gist.github.com/kochuraa/fb3...
I like the simplicity of this.
Furthermore, I like that CRS covers 90% of the payloads by default and 100% at PL2.
gist.github.com/kochuraa/fb3...
Reposted by Christian Folini
Dr @lukaszolejnik.bsky.social explores the evolving threat of Russian cyberwarfare & its impact on European security.
"Disinformation does not aim for instant change. The real deal is gradual influence including delicate shifts in narratives and fostering divisions."
📖Read:
bit.ly/3Gbjgsg
"Disinformation does not aim for instant change. The real deal is gradual influence including delicate shifts in narratives and fostering divisions."
📖Read:
bit.ly/3Gbjgsg
Russian cyber and information warfare and its impact on the EU and UK
Dr Lukasz Olejnik explores how Russian cyber and information warfare poses a growing threat to the EU and UK, highlighting its tactics, long-term goals and the need for stronger defences.
bit.ly
April 16, 2025 at 9:34 AM
Dr @lukaszolejnik.bsky.social explores the evolving threat of Russian cyberwarfare & its impact on European security.
"Disinformation does not aim for instant change. The real deal is gradual influence including delicate shifts in narratives and fostering divisions."
📖Read:
bit.ly/3Gbjgsg
"Disinformation does not aim for instant change. The real deal is gradual influence including delicate shifts in narratives and fostering divisions."
📖Read:
bit.ly/3Gbjgsg
Reposted by Christian Folini
The problem with most machine-based random number generators is that they’re not TRULY random, so if you need genuine randomness it is sometimes necessary to link your code to an external random process like a physical noise source or the current rate of US tariffs on a given country.
April 9, 2025 at 7:15 PM
The problem with most machine-based random number generators is that they’re not TRULY random, so if you need genuine randomness it is sometimes necessary to link your code to an external random process like a physical noise source or the current rate of US tariffs on a given country.
A lot of people are tired of democracy and they are flirting with the thought of a strong autocrat at the helm. They dream of a wise Caesar like Augustus, but I think Augustus was an outlier and history tends to head straight for Nero.
April 4, 2025 at 3:32 PM
A lot of people are tired of democracy and they are flirting with the thought of a strong autocrat at the helm. They dream of a wise Caesar like Augustus, but I think Augustus was an outlier and history tends to head straight for Nero.