Loren Kohnfelder

Author of Designing Secure Software: A guide for developers
#securedesign

日本語: ローレン・コンフェルダー
Book: https://designingsecuresoftware.com/

Last Notes

2026-07-31 18:35:32 UTC

- reply

The attempts at positively spinning this become Onion-worthy parody [https://designingsecuresoftware.com/writings/ai-agent-parody/] and these events certainly normalize [https://designingsecuresoftware.com/writings/commonplace/] AI agents running amok in the future.

2026-06-29 20:51:13 UTC

- reply

Do the standard EULA "as is" terms generally in effect create moral hazards by removing liability from the relationship to the customer? No doubt all "AI" and other software providers believe they are doing their best (that they use "reck").

2026-05-24 22:43:13 UTC

- reply

I'm sure Disney's threat model included "pipe taking off raised arms". I wonder if Walt was aware that the park was traumatizing kids...

2026-05-24 19:27:29 UTC

- reply

Sorry to have retriggered a childhood trauma. I hope you have broken the spell but if not - for all whom you have infected with Lime & Coconut - try [chewing gum](https://pubmed.ncbi.nlm.nih.gov/25896521/ ).

2026-05-24 18:35:52 UTC

- reply

Have you ever taken Disney's ride, It's a Small World. That's mine, and it plays over and over throughout the entire ride, forced to listen because there is way out until the end.

2026-05-12 23:12:32 UTC

- reply

Maybe what's new is awareness leading to concern: we've had this "rock and hard place" choice for many years. Everyone saw it coming but did nothing: the proverbial boiled frog.

2026-04-15 16:14:12 UTC

- reply

Mine

2026-04-06 22:34:30 UTC

- reply

Wow, that's such a coder thing; you can imagine the for loop: for (day = firstdate; day < lastdate; day++) ... basically like starting a numbered list at 0 to match array indexing.

2026-02-12 19:46:10 UTC

- reply

What a bizarre future timeline we are living in, hiring a person online to close the door of the self driving car you hired online.

2026-01-28 15:46:19 UTC

- reply

I see seeds of how to fix it in here: "Users need to become aware of the tricks that lock them into platforms, and they need to break free." and @npub1fdr…lvhs points out this requires interoperability. However, I see not evidence that even a few percent, if that, care enough to do so. More promising:
"the early Internet thrived on cutting out the middleman" this is hard but possible - decentralization - and the resulting innovation and diversity might be enough to turn things around over time.

2025-11-20 23:59:37 UTC

- reply

That's an excellent point ... and you have the rough plot of a dystopian sci-fi novel there. I'm not sure he controls all copies at this point, it sure would be tempting for a minion to squirrel away a copy on the side.

2025-11-20 23:55:04 UTC

- reply

💯 to that - and it's very unlikely that it's properly secured. Any guess at what it'd sell for on the black market?

2025-11-18 20:08:02 UTC

- reply

I think the one thing we can deduce from just this with certainty is that "the software system that handles traffic for several of its services" was not properly tested. If there is a fixed "expected size of entries" then you must define and test the case of exceeding that (ignore the excess? raise a priority alert? etc.).

2025-10-12 18:12:37 UTC

- reply

I wonder if they considered a rollback option for drivers, even limited to N days, seems that sure would've helped.

2025-09-05 17:05:46 UTC

- reply

You'd know better than I, but transparently publishing their process for taking pitches might help. Why doesn't Wired require "a proper fact-check process" for an article from a new contributor, that's an optional step? Publishing before paying the writer (which raised suspicions)? This isn't a hot breaking story. Process could fix this but the mea culpa includes no mention of changes made to prevent in future, just "should generally" have been caught. AI isn't the root problem here, a hand crafted version would have worked just as well.

2025-07-21 18:53:43 UTC

- reply

Yet again we can only wonder, "Do they not know or not care?" You'd think in the age of social media this would be less, not more common.

2025-03-31 18:42:30 UTC

- reply

Same here, when my book on software security was published it soon appeared on some "Best 10" list that appears to just be "Most recent 10". For a second I felt flattered - flattery is a powerful trick. What sort of people do that?