Going to start using "load-bearing" instead of "cool" and "sick" in regular conversation

LLMs don't have to be able to replace red teams. AI companies just have to convince enough of the market that they can.

Claude API issues are the new us-east-1 outages.

Went to a turtle hospital in Key West today. They drown if they eat plastics that ruin their buoyancy. They develop tumors as we contaminate the water. They get hit by boats/jet skis and become permanently paralyzed. Sometimes it's hard to keep caring about security.

Marketing designs at RSAC were wild this year

Sometimes I wonder if I could ever go back to just being a good people manager. I miss leading and developing teams, but I will never miss the mountain of billable work that usually comes with consulting.

The whole TryHackMe/NoScope thing got me thinking about what training was like when I was a young lad and the changes I've seen in how people learn. 🧵

Fork this repo. github.com/rexrodeo/ame...

Purple team exercises are my favorite work when they go well. Few things burn me out harder than when they're set up to fail and I have to run them anyway. I wrote up the specific failure modes I've seen repeatedly, on both the client side and the consulting side. 🧵

I really love breaking into buildings, but when clients have asked me about the specific threat model, I haven't had a great answer. Here's my attempt at figuring it out. empiricsecurity.substack.com/p/oceans-ele...

Oh, this? Yeah, I only use AI on the command line. I’m a bit of a power user. ChatGPT? I’ve heard of it, but Claude just sort of gets me, you know? Plus it understands my Vim commands, so the mental load is almost nonexistent. Vim? Yeah, hard to explain, you might be better off with the web UI.

Spicy blog drafts I've had in the hopper for a long time: - How to Fool Your PCI Auditor and Get That Bag - Continuous Pentesting or Just Continuous Vulnerability Management? - Your Executives Make Phishing Easier For Me and My Friends - A Song of Supply Chains and Drive-By 0-days

If @bsky.app could add TOTP as an MFA option instead of emailing me a code that is not only case sensitive but doesn't use a font that clearly differentiates between uppercase O and the number 0, that would be fantastic.

We’ve all seen it: the "compliance-first" mindset that checks every box while leaving the front door wide open, but out of scope. If you’re tired of the theatre and actually want to move the needle, give this a read. empiricsecurity.substack.com/p/how-shadow...

One more stressful event away from making disappearing into the woods part of my personality

Have you guys checked out your Kroger 2025 Wrapped yet

beep beep boop

Some of the best hackers I know still manage to overestimate their expertise in completely unrelated fields, medical science being a big one. I can go from soaking in some arcane tech wisdom to fielding batshit takes about vaccines in the span of a few seconds with some of you guys. Why?

Every time I go on a podcast as a guest, I spend the next 24 hours trying to remember if I said anything painfully stupid that will tank my career.

Does Bluesky really still not support TOTP? Can I stop having to copy a code from my email and remove the backticks that it includes?

STOP CALLING IT VISHING AND SMISHING YOU SOUND LIKE A FUCKING TODDLER BABBLING NONSENSE ITS PHISHING OR SOCIAL ENGINEERING REEEEEEEEE

Watch out for people who take your personal growth personally.

Working on a conference talk

"nano is for babies" - crontab

It's a personal conviction of mine that, for how much of the tech industry operates out of Atlanta, there is a serious lack of quality security conferences and communities. But I know some people trying to change that.

Most fun I've ever had speaking at a conference, hands down. If you were there at @wildwesthackinfest.bsky.social , you were the best audience a guy could hope for. www.youtube.com/watch?v=Vrtp...

I would simply write memory-safe code

Laptop numpads are psychotic, why do I have to overextend my right shoulder just to type

Finally getting around to watching Chernobyl and all I see is a bunch of MBAs making fun of technical experts and high-fiving

If there's anything I can count on BlueSky for, it's showing me all of the stuff I've painstakingly worked to not have to look at on Twitter.

"In addition, ChatGPT doesn’t just itself fail to recognize the difference between fact and fiction, it presents these answers to people who are themselves unable to discern the difference." lmnt.me/blog/the-dys...

A little tired of getting random junk in conference "swag bags", can I opt out? I don't need fifty branded drawstring bags that I'm just going to donate and might eventually end up in a landfill.

iPad babies can be any age.

Hey Gemini, which spreadsheet does this company store passwords in

imagine still using OOP when you could vibe-code functions and structs

Some of my favorites from Zion National Park. Taken with Kodak Portra 400.

I wish Signal would find a way to make their service censorship-resistant. Can't help but feel like completely abandoning countries that demand encryption backdoors is the wrong move. Better to refuse AND make service use as hard to restrict as possible.

Mudge is the Obi-wan Kenobi that the industry needs right now. Stop what you're doing and read this blog.

Got my personal site running (again) in its new forever location. Any tech writing I do that isn't explicitly meant to be customer facing will be there, including but not limited to: - Rambunctious research - Pontification - Snide commentary - Corporate criticism

The Security Conversation - The value of offensive security work is fully realized by participation in the security conversation. aff-wg.org/2025/03/13/t...

Use social engineering to get your competetive friends back to their gym routine and PR #wehackhealth

Them: It's just a leg day Me: www.youtube.com/watch?v=BuIF...

Nothing will make me stop listening to someone faster than if they they do 👏 this 👏 clap 👏 thing.

TSA: you can opt out, but we delete the face ID photos right after we take them, so it's all good either way

I wonder how many attack surface management products would have never existed if Nuclei wasn't MIT licensed.

Come to @wildwesthackinfest.bsky.social track 3 tomorrow to hear about #Nix or you'll never be able to make Arch users feel inferior

alias head='sed 11q'

I really hate what business turns people into. Over the last several years, I've discovered I'm friends with more and more people who really do not like each other.

“how do i become more technical?” fuck something up & fix it. repeat