Nostr notes by Adam Shostack :donor: :rebelverified:

First day on the Bluesky infrastructure team! I hooked up ...

2026-04-16T21:55:02Z

First day on the Bluesky infrastructure team! I hooked up OpenClaw, and it has some amazing ideas about scaling and optimization!

🎼 "Something for rich men, something for poor men, ...

2026-04-15T01:20:02Z

In reply to nevent1q…cr8u
_________________________

🎼 "Something for rich men, something for poor men, something for everyone...a comedy tonight!"

Nostr event nevent1qqs8d57kge9c5d400u9x63080rnugzgdx9466vtsxg0emtlhupq0r5szyzrmpzl53htrnnewdsemgmucz345faqwqknfvf6qz2s4j33nnpph6w30xrv

2026-04-04T16:36:01Z

Agency obviously includes the right to repair. The right to ...

2026-03-25T20:19:48Z

In reply to nevent1q…r8uk
_________________________

Agency obviously includes the right to repair. The right to repair must include the right to interoperate and build new clients. Looking at Slack, discord, and so many others.

Nostr event nevent1qqsfzpkzrwk8nqw92v3freypmf4ypqpm49wqukq056hqxt0c6gld5pgzyzrmpzl53htrnnewdsemgmucz345faqwqknfvf6qz2s4j33nnpph6afz49x

2026-03-23T01:02:52Z

Howcome ICE is getting paid while TSA isn't?

... It's ... overinflated.

2026-03-11T23:57:15Z

In reply to nevent1q…z96y
_________________________

... It's ... overinflated.

If I were to recommend one cryptography book for implementors in ...

2026-03-10T16:47:40Z

If I were to recommend one cryptography book for implementors in 2026, would it be:

Has Jack Dorsey ever run a profitable company? That seems sort of ...

2026-02-27T04:37:55Z

Has Jack Dorsey ever run a profitable company?

That seems sort of relevant in evaluating his claim that AI changes everything.

To be fair, maybe "delete my inbox" is acting in ...

2026-02-23T16:27:46Z

In reply to nevent1q…2lzz
_________________________

To be fair, maybe "delete my inbox" is acting in accordance with human interests? 🤣

Nostr event nevent1qqs8xvlkxmfea2sr2efsw66v7d049szn6zt2njgnzcc8kcs9a4gk4jqzyzrmpzl53htrnnewdsemgmucz345faqwqknfvf6qz2s4j33nnpph65yh79p

2026-02-18T00:00:04Z

Goddamn "private mention" is hard to use safely.

If anyone has a list of mastodon profiles for those authors, ...

2026-02-07T18:50:43Z

In reply to nevent1q…55fr
_________________________

If anyone has a list of mastodon profiles for those authors, I'd be grateful.

Locus's 2025 recommended reading list is now available at ...

2026-02-07T18:26:08Z

Locus's 2025 recommended reading list is now available at https://locusmag.com/2026/02/2025-recommended-reading/ -- lots of authors I like where I'd missed their releases.

I believe there’s a correlation between “running Telnet in ...

2026-01-22T21:15:36Z

In reply to nevent1q…tt9s
_________________________

I believe there’s a correlation between “running Telnet in prod” and “would fail to notice a bull in their china shop”. I’ve absolutely seen attackers use a lack of encryption (found sniff.c where it shouldn’t have been) would they use it today? Who knows.

I hear your 1970s remote access program has a problem other than ...

2026-01-22T20:44:52Z

I hear your 1970s remote access program has a problem other than it was designed in the 1970s and isn't encrypted or authenticated?

A few years ago, I discovered that macos had stopped shipping /usr/bin/telnet and no one noticed, and there's a reason for that.

If -froot is a concern, please ask why.

When you say “do I trust” I’m pretty sure they’re public; ...

2026-01-18T19:42:50Z

In reply to nevent1q…pxk9
_________________________

When you say “do I trust” I’m pretty sure they’re public; they’re aggregated on https://clearsky.app/.

Agencies like NASA, the Peace Corp, and the global support and ...

2026-01-18T00:27:06Z

Agencies like NASA, the Peace Corp, and the global support and assistance offered by the CDC, the NTSB and plenty more are America putting our best foot forward.

They were the core of our soft power and our ability to win friends and influence people — another American idea that was so good that we forget where it came from.

aww, sorry

2026-01-13T23:22:40Z

In reply to nevent1q…x8z8
_________________________

aww, sorry

vscodium is vscode without the crap.

2026-01-13T23:15:16Z

In reply to nevent1q…2qrv
_________________________

vscodium is vscode without the crap.

They... vested.

2026-01-12T22:30:35Z

In reply to nevent1q…zmlx
_________________________

They... vested.

Nostr event nevent1qqstp7ye4vf52peaxswg0th3pc3nwfqrcgwa0hecnw4n98095vs73cszyzrmpzl53htrnnewdsemgmucz345faqwqknfvf6qz2s4j33nnpph6auphtj

2026-01-11T02:31:57Z

start with gratitude that they included you and spelled your name ...

2026-01-06T19:16:53Z

In reply to nevent1q…e2s8
_________________________

start with gratitude that they included you and spelled your name right! 🤣

My editor is probably going to ask me to change this sentence, so ...

2025-12-26T21:38:18Z

My editor is probably going to ask me to change this sentence, so I'll share it with you.

"If you have no privilege escalation issues because you’re already running as root fucking fix that shit."

I've been thinking about #GPS jamming and radio waves. Could ...

2025-12-21T18:39:42Z

I've been thinking about #GPS jamming and radio waves. Could jamming activity bounce off the ionosphere and impact other areas?

I somewhat expect that the frequencies in use are designed to go through the ionosphere, and so "no," but also finding bits about scintillation causing accidental errors.

Eg, https://novatel.com/tech-talk/ionospheric-scintillation/redundancy-and-resiliency-against-ionospheric-scintillation

and https://agupubs.onlinelibrary.wiley.com/doi/full/10.1029/2024SW004217 shows 3d errors of up to 30 meters

If I understand this morning's news properly, we're ...

2025-12-19T15:20:47Z

If I understand this morning's news properly, we're invading Venezuela because they nationalized some American oil company's assets and gave it to Venezuelan companies. In unrelated news, America has nationalized TikTok and given it to American companies.

https://fortune.com/2025/12/18/venezuela-oil-trump-chevron-seized-assets-blockade/

https://www.bbc.co.uk/news/articles/cgexp1q8wn1o.amp

I know there's a long academic literature on the question of ...

2025-12-08T00:12:12Z

I know there's a long academic literature on the question of "do programmers make similar mistakes." Has that work been extended to security? Do programmers make the same sorts of security mistakes when writing similar programs?

I love Roddenberry's aspiration for the future, especially ...

2025-12-07T18:17:40Z

In reply to nevent1q…e82w
_________________________

I love Roddenberry's aspiration for the future, especially the radical acceptance that people are created equal and should be treated with respect and compassion, even if they're black or blue or have green blood. I love the way he used science fiction to tell stories about the current day in ways that TV wouldn't otherwise do.

Of course at some point, prioritization of society's resources becomes a source of conflict even if it's no longer over food or shelter, and I think he chose to not grapple with those problems to focus on the possibilities.

I wasn't aware that you'd worked on that film! Is it a ...

2025-12-07T17:12:40Z

In reply to nevent1q…zefp
_________________________

I wasn't aware that you'd worked on that film! Is it a story you've told?

Star Trek has no freakin’ idea about how tech works, part ...

2025-12-07T16:57:00Z

Star Trek has no freakin’ idea about how tech works, part 1701/♾️ https://mastodon.fixermark.com/@mark/115668489113085020

If you’re serving a big meal today, take a second to garnish. ...

2025-11-27T20:00:07Z

If you’re serving a big meal today, take a second to garnish. The little bit of work will delight your guests and make everything look more appetizing!

Perhaps the most amazing aspect of this story is that they ...

2025-11-25T01:01:34Z

In reply to nevent1q…a2nq
_________________________

Perhaps the most amazing aspect of this story is that they (twitter) knew because they were sending money, and no one stood up to say “hang on”

Don't skip the CSRB please.

2025-11-20T22:30:15Z

In reply to nevent1q…8s44
_________________________

Don't skip the CSRB please.

If this really works, I'm ready to go back to thinking like ...

2025-11-14T15:52:53Z

In reply to nevent1q…6f0f
_________________________

If this really works, I'm ready to go back to thinking like an attacker!

🤣

(cc Viss (npub12as…yvvc) )

Nostr event nevent1qqspa6yz5ew57c4a8geuhdzlu7ga83zgpndqkk590x2nh29msgdz0hczyzrmpzl53htrnnewdsemgmucz345faqwqknfvf6qz2s4j33nnpph62ll7ur

2025-11-13T02:33:15Z

We have always been at war with Venezuela.

The word “selling” may be doing a lot of work in the sentence ...

2025-11-04T14:43:02Z

In reply to nevent1q…2je3
_________________________

The word “selling” may be doing a lot of work in the sentence “we are not selling your data to the us gov”

Have they retracted it? Their press office ought to know.

2025-11-01T01:07:37Z

In reply to nevent1q…mp7w
_________________________

Have they retracted it? Their press office ought to know.

No, the movie is not all about how a drone army is a bad idea... ...

2025-10-25T22:03:14Z

In reply to nevent1q…c04y
_________________________

No, the movie is not all about how a drone army is a bad idea... it also (checks notes) talks about the evils of tariffs, and how power without responsibility will corrupt people.

Indeed! Change is hard and it's easier to be distracted. ...

2025-10-15T16:40:04Z

In reply to nevent1q…2gje
_________________________

Indeed! Change is hard and it's easier to be distracted. Still, I think the numbers for adblocker adoption are pretty stunning and tie back to the very visible improvement in speed and web page functionality.

I think your assessment of "pretend to care, but ...

2025-10-15T15:31:11Z

In reply to nevent1q…r2mt
_________________________

I think your assessment of "pretend to care, but don't" is wrong.

20% of users have an ad blocker, 10% pick a 401k if not the default.

Everyone make sure your pi-hole is blocking jeep, and shame ...

2025-10-12T15:33:14Z

In reply to nevent1q…2nrt
_________________________

Everyone make sure your pi-hole is blocking jeep, and shame anyone who hasn’t installed Linux on theirs? 🤷

"I have just signed a deal which will keep the Empire out of ...

2025-09-27T18:22:46Z

In reply to nevent1q…707w
_________________________

"I have just signed a deal which will keep the Empire out of Cloud City forever."

“Modern attackers are using ai to drive undetectable ...

2025-09-20T21:10:36Z

“Modern attackers are using ai to drive undetectable attacks!”

Modern attacker, “nah this works fine”

It’s a small thing but Alaska Air no longer has any scotch, ...

2025-09-19T02:19:46Z

It’s a small thing but Alaska Air no longer has any scotch, because tariffs.

Looking briefly at this work ...

2025-09-18T15:30:31Z

Looking briefly at this work https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/ do I understand right that a root cause is that Microsoft rolled out Azure with symmetric authN and each machine has, not the public key associated with the actor token, but a reusable symmetric key?

Can you say more about what categories you're thinking of? I ...

2025-09-13T19:45:24Z

In reply to nevent1q…y76z
_________________________

Can you say more about what categories you're thinking of?

I don't remember any features in tin or rn that would attempt to prevent say, quoting a post.

I think this goes far beyond Mastodon. Maybe part of it is that ...

2025-09-13T17:21:41Z

In reply to nevent1q…9qjc
_________________________

I think this goes far beyond Mastodon. Maybe part of it is that when computers were rare and networks were mostly wired, the control divisions were more visible?

one of the things I've learned in teaching threat modeling is ...

2025-09-13T17:13:05Z

In reply to nevent1q…vgqv
_________________________

one of the things I've learned in teaching threat modeling is that boundaries are a very hard concept for a lot of people. I wish I knew why.

Another way to say this: What, precisely, is the policy language ...

2025-09-13T16:51:36Z

In reply to nevent1q…t2hd
_________________________

Another way to say this: What, precisely, is the policy language or algorithm you're going to deploy, and where will it be enforced?

The issue is you cannot control clients. The clients are under ...

2025-09-13T16:46:10Z

In reply to nevent1q…cd9l
_________________________

The issue is you cannot control clients. The clients are under the control of the people who write them and are on the far side of a boundary from you.

Maybe you can limit (at the server) posts that contain links to other posts, images of other posts, url shortners that link to other posts, but you’re in an arms race and you’re not deploying effective controls.

It won’t work. (Dunking on mastodon here, not Don. ) ...

2025-09-13T16:43:41Z

It won’t work.

(Dunking on mastodon here, not Don. ) https://techhub.social/@BrentD/115197950000197643

Nostr event nevent1qqszhpkcmehmttzrkrw2sdxvw5mkygu26e2vt2f37qtahd9lqa59quqzyzrmpzl53htrnnewdsemgmucz345faqwqknfvf6qz2s4j33nnpph6fqvvhx

2025-09-09T00:49:43Z

In reply to nevent1q…f33g
_________________________

Generally later is better and also, look through a camera. The ...

2025-09-02T00:56:37Z

In reply to nevent1q…kq78
_________________________

Generally later is better and also, look through a camera. The ccd will pick up things your eyes won’t. A phone camera works great.

New blog, Threat Modeling Tools https://is.gd/2CloIJ People ...

2025-08-25T16:52:03Z

New blog, Threat Modeling Tools https://is.gd/2CloIJ

People frequently ask me what threat modeling tooling they should use. My answer is always: The best threat modeling tool for you is the one that solves a specific problem that you can articulate. To help you articulate the problems, this is one part of a two-part series. The second post will dive deep into LLMs for threat modeling.

Threat modeling tools generally fall into four groups:<li> General purpose tools like whiteboards or Google docs</li><li> Programmer threat modeling tools tools (eg, pytm)</li><li> Individual/small team threat modeling tools (eg, MS-TMT or Threat Dragon)</li><li> Enterprise threat modeling tools (eg, IriusRisk)</li>

(1/5) https://is.gd/2CloIJ

My plan in wa went up by roughly 11%

2025-08-23T03:28:44Z

In reply to nevent1q…00qw
_________________________

My plan in wa went up by roughly 11%

Nostr event nevent1qqsz4yrwprgay9a0fejw900f75cmushpth92857shqsuf5r9fa8twvqzyzrmpzl53htrnnewdsemgmucz345faqwqknfvf6qz2s4j33nnpph6cfj5ak

2025-08-20T20:36:45Z

Does lockdown mode protect against the latest apple vulns?

Seems reasonable: "Our findings reveal that the standalone ...

2025-08-18T15:18:18Z

Seems reasonable: "Our findings reveal that the standalone LLM introduces nearly 9x more new vulnerabilities than developers, with many of these exhibiting unique patterns not found in developers'code. Agentic workflows also generate a significant number of vulnerabilities, particularly when granting LLMs more autonomy, potentially increasing the likelihood of misinterpreting project context or task requirements. We find that vulnerabilities are more likely to occur in LLM patches associated with a higher number of files, more lines of generated code, and GitHub issues that lack specific code snippets or information about the expected code behavior and steps to reproduce"

https://www.semanticscholar.org/paper/Are-AI-Generated-Fixes-Secure-Analyzing-LLM-and-on-Sajadi-Damevski/235c52bdef09f6fec47a17fcdbc072ff6a5bd275?utm_source=alert_email&utm_content=LibraryFolder&utm_campaign=AlertEmails_WEEKLY&utm_term=LibraryFolder&email_index=0-0-0&utm_medium=59735069

If someone wants to commit to buying the answer, locking it in a ...

2025-08-14T15:21:39Z

If someone wants to commit to buying the answer, locking it in a safe deposit box and throwing away the key, I'll throw $50 at the effort.

https://www.washingtonpost.com/entertainment/art/2025/08/14/kryptos-code-k4-solution-jim-sanborn-auction/

One of the hats I wear is editor for the @npub1dqd…8xy4 ...

2025-08-09T14:59:33Z

One of the hats I wear is editor for the DEF CON (npub1dqd…8xy4) Franklin Hackers' Almanack. If you see talks that policymakers should know about, please let me know here, tag me, etc.

I'm already seeing great stuff on voting security, resisting back doors, irresponsible behavior by thin-skinned vendors.. what else should I see?

https://defconfranklin.com/

No, NANOG is the plumbers union, Frankenstein is the mailing list ...

2025-07-04T01:16:02Z

In reply to nevent1q…npel
_________________________

No, NANOG is the plumbers union, Frankenstein is the mailing list management software infrastructure.

At least they’re not lying by putting the word “safe” or ...

2025-06-27T17:18:53Z

At least they’re not lying by putting the word “safe” or “secure” in the title. https://infosec.exchange/@aristot73/114740659439119629

@npub1gv2…tlwl in ...

2025-06-26T14:34:09Z

Simon Willison (npub1gv2…tlwl) in https://simonwillison.net/2025/May/21/chatgpt-new-memory/ you say "only works if you're on a paid plan." That's no longer the case. WFM on Chatgpt free.

Your toot is premature.

2025-06-25T02:26:15Z

In reply to nevent1q…eu4n
_________________________

Your toot is premature.

> Presidents of both parties have muddied the water on ...

2025-06-22T00:26:54Z

> Presidents of both parties have muddied the water on unilateral presidential military action, but an attack on a sovereign nation with barely even a pretext of a lawful reason, no congressional involvement or even interest, and no UN involvement would be a new low for “checks and balances.”

--- https://bsky.app/profile/jamalgreene.bsky.social/post/3ls5fvfcb622q

This is a really awful situation for many authors. If you like an ...

2025-06-01T14:38:39Z

This is a really awful situation for many authors. If you like an author whose books are available anywhere else, buy elsewhere. (There’s an argument in thread for buying through Boundless, but I think it throws good money at bad actors.) https://wandering.shop/@clacksee/114606754167072778

As a side note, many states also have address confidentiality ...

2025-05-11T19:20:33Z

In reply to nevent1q…5h3g
_________________________

As a side note, many states also have address confidentiality programs to protect victims of domestic violaence, police, judges, and others. Eg, https://www.sos.wa.gov/statewide-programs/address-confidentiality-program-acp

This season of #andor sets aside childish things, and brings ...

2025-05-11T16:15:17Z

This season of #andor sets aside childish things, and brings great writing, acting, and cinematography to #starwars in a way that the universe has always deserved and rarely gotten.

If you're not watching it, this is some of the best TV I've ever seen. I enjoy a lot of Star Wars, and do so understanding that most of it is fun and somewhat lighthearted in a very dystopian world.

Eric Geller has an amazing 11000 word analysis of this week's 3 episodes of #Andor.

https://ericgeller.wordpress.com/2025/05/10/andor-season-2-review-episodes-7-9/

This is literally the message of 30 years of reporting on wiretap ...

2025-05-05T03:19:49Z

This is literally the message of 30 years of reporting on wiretap laws by Matt Blaze (npub1jsl…93xu) Steve Bellovin (npub13x3…jdre) Susan Landau and many others: designing these systems is exceptionally hard. That’s part of why the systems to handle classified data are so expensive. https://newsie.social/@bespacific/114451910633689677

This May the Fourth, remember that rebellions are built on hope. ...

2025-05-04T19:27:31Z

This May the Fourth, remember that rebellions are built on hope.

I think this would be great for browser innovation, as everyone ...

2025-04-23T16:22:01Z

In reply to nevent1q…vv5t
_________________________

I think this would be great for browser innovation, as everyone realizes how important competition is.

The most important part of CVE is not the unique number, but the ...

2025-04-16T16:56:58Z

The most important part of CVE is not the unique number, but the funding and expertise to run a credible program that assigns a unique number. The unique number was the center of what Dave Mann called a “concordance,” and I believe this is subtle but crucial: The value of CVE is not as a database, but as a stable way to cross-reference between databases and other tools. Dave and I have had many conversations about books having an ISBN, a UPC code, a Dewey number and a Library of Congress number. They serve different goals, and are managed by different groups.

I mention the books because assigning unique numbers in a stable way is harder than you'd expect.

Sorry, this is ... not right. "“What the CVE lists really ...

2025-04-16T04:26:20Z

In reply to nevent1q…m6uc
_________________________

Sorry, this is ... not right.

"“What the CVE lists really provide is a standardized way to describe the severity of that defect"

CVSS provides that. CVSS analysis is typically provided by NVD, not CVE, CVE started as a naming system, and that's the program's most important role: identifiers. Severity is... priority 2.

Nostr event nevent1qqsgv7mlfdssqvdghfz26xjqqv2spcyqy3hrq03dzulq6q5klg9czeqzyzrmpzl53htrnnewdsemgmucz345faqwqknfvf6qz2s4j33nnpph660kzwz

2025-04-15T21:59:47Z

In reply to nevent1q…jxct
_________________________

https://www.csoonline.com/article/566149/congress-pushes-mitre-to-fix-cve-program-suggests-regular-reviews-and-stable-funding.html

The variance in CVE funding, has been a crime, and the stability ...

2025-04-15T21:58:29Z

In reply to nevent1q…jxct
_________________________

The variance in CVE funding, has been a crime, and the stability MITRE has provided has been quiet heroism.

And so it's important, when Chris Krebs is being attacked ...

2025-04-12T15:47:13Z

In reply to nevent1q…5ggn
_________________________

And so it's important, when Chris Krebs is being attacked from what's been called "the bully pulpit," that we advocate for Mr. Krebs, but not because we like him or think he's a fine fellow, or even because he's under attack. (Although those are reasonable reasons to come to his defense.)

We advocate for Mr. Krebs because he did his job professionally, took in the available facts, and made a judgement call. Any penalty for that call should be carefully adjudicated.

There's no evidence that he made that call in violation of professional norms. There's no evidence he was wrong. There are plenty of people (such as the aforementioned Ellis and Giuliani) who have cause to dig for such evidence. But none exists.

If this logical chain holds, then this isn't a political question. It's a question of: do you want to be able to call yourself a professional?

I do, and I stand with Mr. Krebs.

(5/5)

In the case of the 2020 elections, Chris Krebs had a relatively ...

2025-04-12T15:33:16Z

In reply to nevent1q…fqe7
_________________________

In the case of the 2020 elections, Chris Krebs had a relatively simple judgement call to make, and he did so. "“I’m here to tell you that my confidence in the security of your vote has never been higher.”"

https://apnews.com/article/election-2020-virus-outbreak-donald-trump-politics-elections-b28083c7d0c65aa80d23e23c50c75687

His judgement was borne out by, most importantly, the lack of contradictory facts, and the intense effort to discover those facts. Had those facts been available, Jena Ellis would still be a lawyer, and Rudy Giuliani wouldn't be bankrupt.

https://www.youtube.com/watch?v=92HlaEvLmgM&pp=ygUGI2FwYWVq
https://www.reuters.com/legal/judge-ends-giuliani-bankruptcy-heightening-legal-risks-2024-07-12/

(4/5)

Professionalism emerges in a public conception because, in times ...

2025-04-12T15:28:30Z

In reply to nevent1q…02p5
_________________________

Professionalism emerges in a public conception because, in times of stress, individuals display the characteristics of professionalism. By acting that way, they make a case that they qualify. That qualification isn't the a system of formal training, although that helps. Quoting the judge from that previous piece, there's an need to earn professional status as people "conduct themselves as members of a learned, disciplined, and honorable occupation."

(3/5?)

My starting this thread with a summary of what professionalism ...

2025-04-12T15:22:06Z

In reply to nevent1q…sth2
_________________________

My starting this thread with a summary of what professionalism entails is intended to illustrate this sort of thinking. In fact, there's a nuanced conversation about if computing meets the requirements of a profession. (For example, https://cacm.acm.org/opinion/software-professionals-malpractice-law-and-codes-of-ethics/ )

(2/4?)

Judgement is an important facet of professionalism. There are ...

2025-04-12T15:14:45Z

Judgement is an important facet of professionalism. There are areas where we need people to make judgement calls despite incomplete information, inconclusive or contradictory indicators, and other complications that lead us away from algorithms to human judgement.

In the traditional professions, including law, accounting, medicine and even engineering, we teach people to make those judgement calls as part of their education. That involves ensuring they have the available facts, that they can discuss how they came to a decision, and that they'll stand by it until those facts change.

Today's "history is boring" lesson: The Declaration ...

2025-04-07T23:14:03Z

Today's "history is boring" lesson: The Declaration of Independence lists "For transporting us beyond Seas to be tried for pretended offences" as one of the reasons Independence was important.

I’m not an attorney but that seems like thin gruel on which to ...

2025-04-03T15:54:32Z

In reply to nevent1q…566a
_________________________

I’m not an attorney but that seems like thin gruel on which to ignore a problem. I hope you have it in writing for the plaintiffs attorneys

had additional comments on linkedin ...

2025-03-31T18:27:27Z

In reply to nevent1q…765v
_________________________

had additional comments on linkedin https://www.linkedin.com/feed/update/urn:li:activity:7312494851726462976/?commentUrn=urn%3Ali%3Acomment%3A(activity%3A7312494851726462976%2C7312501615515574274)&dashCommentUrn=urn%3Ali%3Afsd_comment%3A(7312501615515574274%2Curn%3Ali%3Aactivity%3A7312494851726462976)&dashReplyUrn=urn%3Ali%3Afsd_comment%3A(7312534119316369408%2Curn%3Ali%3Aactivity%3A7312494851726462976)&replyUrn=urn%3Ali%3Acomment%3A(activity%3A7312494851726462976%2C7312534119316369408)

Is it normal for a university to memory hole a former ...

2025-03-29T15:38:32Z

In reply to nevent1q…hluy
_________________________

Is it normal for a university to memory hole a former professor's pages? I thought the norm was to keep scholarship present, but possibly mark it as an inactive page.

I’ve heard (from someone I trust) that his university web pages ...

2025-03-29T14:23:21Z

In reply to nevent1q…4x9h
_________________________

I’ve heard (from someone I trust) that his university web pages were all taken down and colleagues don’t know where he is.

Nostr event nevent1qqsqh6eyqdjnka09j7vw3sr40mu76yae73alwzrfqgznp8fcuk8ggmszyzrmpzl53htrnnewdsemgmucz345faqwqknfvf6qz2s4j33nnpph60jqsnv

2025-03-25T23:06:47Z

I think the Wiz state of cloud security survey is unlikely to do ...

2025-03-16T16:39:49Z

In reply to nevent1q…vjhh
_________________________

I think the Wiz state of cloud security survey is unlikely to do a useful compare and contrast with the state of datacenter security. 😜 Are exposed Ivanti/Fortinet/Palo Alto devices worse than exposed buckets?

IOW how should we think about the relationship between cloud and on-prem?

(My answers, https://cra.org/wp-content/uploads/2025/01/2024-2025-CRA-Quad-Paper_-Lessons-for-Cybersecurity-from-the-American-Public-Health-System.pdf and more generally, https://shostack.org/resources/cyber-public-health ... I need to flip that page so its newest first.)

Let's break your two parts apart: 1 - surveys show that ...

2025-03-16T15:28:44Z

In reply to nevent1q…3v7w
_________________________

Let's break your two parts apart:

1 - surveys show that people fail at basic security practices

2 - cloud is expensive.

On 1 Incidentally, which surveys, which practices? But fundamentally: I believe that we can cut the word cloud without altering the sentence:

"industry surveys show that a vast number (possibly majority) of ---- users still fail at extremely basic security practices."

I'm largely focused on the ones we can see, including ...

2025-03-15T16:59:12Z

In reply to nevent1q…ajpf
_________________________

I'm largely focused on the ones we can see, including side-effect-free code, migrating from filesystems to other data stores, immutable deployments, configuration as code, configuration in version control, getting away from spaghetti in legacy data centers...

The more I look at the amazing new security boundaries that cloud ...

2025-03-15T16:43:15Z

In reply to nevent1q…m5cc
_________________________

The more I look at the amazing new security boundaries that cloud providers are building, the more amazed I am that anyone would think of building on classic patterns without them.

Why would anyone allow new (production) code to store data on a filesystem in 2025? There are better patterns.

I mean, seems reasonable? If the Texas state lottery has the ...

2025-03-07T03:42:10Z

In reply to nevent1q…6kn7
_________________________

I mean, seems reasonable? If the Texas state lottery has the wrong odds table, how is that the fault of people who buy all the tickets?

Appsec Roundup Feb 2025 @npub1dqd…8xy4 the Harris School of ...

2025-03-03T20:01:20Z

Appsec Roundup Feb 2025

DEF CON (npub1dqd…8xy4) the Harris School of Public Policy (and yours truly) released The DEF CON 32 Hackers Almanack, reviewing some of the key policy lessons from DEF Con 32 talks and villages.

(1/6, full post https://shostack.org/blog/appsec-roundup-feb-2025/ )

I don't understand how Microsoft can ship code thsi bad. ...

2025-03-01T18:28:59Z

I don't understand how Microsoft can ship code thsi bad.

Just bought "Historyhound" for better searching of ...

2025-03-01T16:28:54Z

Just bought "Historyhound" for better searching of browser history, and cross-browser searching.

Highly recommended.

https://www.stclairsoft.com/HistoryHound/index.html

“Aid and comfort to our enemies”

2025-02-28T22:49:57Z

In reply to nevent1q…jqmn
_________________________

“Aid and comfort to our enemies”

I’m old enough to remember when Ronald Reagan stood in front of ...

2025-02-28T19:21:03Z

I’m old enough to remember when Ronald Reagan stood in front of the Berlin Wall and said “Mr Gorbachev, how much of east Germany’s minerals are you willing to give us?”

Remember when Barbara Streisand brought her lawyers into some ...

2025-02-25T00:33:33Z

Remember when Barbara Streisand brought her lawyers into some dumb dispute and made the whole thing funnier?

Yeah, apparently you're not alone in having forgotten about that.

And no, I'm subtooting someone else's client because it's a freaking target rich environment.

I said most of what I wanted to say, in long form, in a series of ...

2025-02-13T01:05:27Z

In reply to nevent1q…2dk4
_________________________

I said most of what I wanted to say, in long form, in a series of posts. (https://shostack.org/blog/category/election2024) I don't feel like short-form posting captures what I want to say.

I mean, Wired often puts their "hyperbole" in quotes ...

2025-02-09T00:16:32Z

In reply to nevent1q…cyt4
_________________________

I mean, Wired often puts their "hyperbole" in quotes attributed to named sources, who happen to be Federal contractors with armies of cleared staff. Don't you?

Is there a reason not to look? ...

2025-01-23T22:23:31Z

In reply to nevent1q…2hle
_________________________

Is there a reason not to look?

To build on what Raven said, you can often present a focus on ...

2025-01-21T23:27:02Z

In reply to nevent1q…hrgr
_________________________

To build on what Raven said, you can often present a focus on clarity rather than ethics, and get people to see the ethical dilemmas and go do something else. This is less satisfying than a good table flip, but comes with a paycheck and a chance to do it again.

Just had a stainless table knife shatter … while cutting a ...

2025-01-12T18:37:27Z

Just had a stainless table knife shatter … while cutting a sandwich. It looks like maybe water got in through a small crack?

Re “only” part, I think I’ve seen allegations of “local ...

2025-01-09T22:42:18Z

In reply to nevent1q…qyvy
_________________________

Re “only” part, I think I’ve seen allegations of “local network” access, with the ability to read WiFi names, being cross correlated for location purposes. Haven’t dug in. (Edit: was wrong. see thread)