New video on GitHub Actions supply chain attacks and what you can do! www.youtube.com/watch?v=4pYB...

State Of Open Con is coming to Edinburgh this Friday! There's a pretty amazing speaker lineup (and then there's me, but you can't have everything), so please do come join us. Free tickets are available for community, students and anyone in-between jobs. stateofopencon.com/edinburgh-so...

Bruce Schneier wrote (or paraphrased): If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology. His point was that security is a process, not a product. It lies in the interaction and intersection of systems.

I despair with tech sometimes. I spent time colour grading a video, only for it to look completely different in VLC/Quicktime. Why? Something to do with colour gamuts and gamma that I really don't want to understand. 😭

I wrote up a blog with my thoughts on how serious the mythos thing is and some advice for worried engineering teams. www.chainguard.dev/unchained/pr...

Everyone's talking about LLMs finding and exploiting security vulnerabilities. I wanted to see how real the threat actually is, so I tried the dumbest possible prompt on my own code. And it found a significant vuln 🫣 www.youtube.com/watch?v=t6f7...

Struggled with a crossword because "verb that sounds like its first letter" was apparently not "pee".

More and more people I deeply respect and have learned a lot from over the years feel like they are speaking into a void, to the point where they are losing motivation to continue making content, which got me to write my first post on my site in over a year... www.kevinpowell.co/article/tell...

A few weeks ago Sam Altman said: "We see a future where intelligence is a utility like electricity or water and people buy it from us on a meter and use it for whatever they want to use it for" www.businessinsider.com/sam-altman-a...

Cloudflare released a great post on their findings with Mythos, which I recommend reading to understand how to do an effective security review on a large codebase. blog.cloudflare.com/cyber-fronti...

1/ I’m still processing what’s going on in tech at the moment. I used to feel at home in that world. It used to feel incredibly creative and positive. Now it’s increasingly full of bugs, dark addicting patterns and AI slop. 2ality.com

This is going to be a really fun conversation with @adrianmouat.com and @sublimi.no at the @openuk.bsky.social SOOCon event in Edinburgh! We’ll be looking forward to your questions and thoughts on this fast-moving security topic

I'll be speaking at SOOCon 26 on the Road in Edinburgh on 5th June. I'll be joining Andy Martin and @lizrice.com for a fireside chat on "The Mythos Effect", and how things might never be quite the same again... Tickets: stateofopencon.com/edinburgh-soocon26

I'm amazed there's not a dozen replies of "curious to hear what happened here!" I guess most people have more restraint than me on blue sky 😅

Briefly looked at X and it's just AI talking to AI. I really don't get the point of having AI leaving vacuous replies to everything pretending it's coming from a person. It's just embarassing.

I'm relieved to see that Mythos only found one vulnerability and a bunch of bugs in curl. This would indicate that there's not a never-ending stream of security issues in projects — it is possible to have a secure project with current tooling.

I take this back. Claude is being a t*** today and I'm not sure it's better. "thesis is asserted, not argued" indeed.

A person I know (and who is? was? a good professional al) left an AI-generated comment under my LinkedIn post. Full-on AI slop. I asked: why do this? He replied. It’s because of “engagement.” People are burning their profession al reputation, paying for AI tools, for nothing

I'm happy to be back in the ambassador game, this time as part of @openuk.bsky.social. OpenUK has been doing a fantastic job championing open source software, hardware, data, AI, and open standards to help grow the UK's digital economy.

I NEED to post about the absolute madness that the Guardian perpetrated to mark its 30,000th cryptic crossword. Namely: * the cryptic crossword itself, which pointed to: * a hidden message in the quick crossword, which pointed to: * an editorial about cryptic crosswords, with …

This is a great video to watch if you're wondering why I'm concerned about the next few months in security www.youtube.com/watch?v=1sd2...

It's going to be a little ironic if we have an economic crash not because the AI companies are overvalued but because their models got everyone hacked.

Grammar is important.

I need a Scottish llm that doesn't blow smoke up my a**

As someone who has suggested using cooldowns to mitigate some attacks, I did enjoy this article arguing they are a poor solution and moral problem: calpaterson.com/deps.html Cal suggests using upload queues instead, which I would agree with.

This is tragically beautiful.

"[the AWS] control panel is a labyrinth designed to extract billing upgrades". Love this article on running lean (including LLMs) by Steve Hanov stevehanov.ca/blog/how-i-r...

For anyone that hasn't seen it yet, the For You feed is a better replacement for the default feeds. bsky.app/profile/did:...

Parenting milestone achieved: woke up and nearly screamed because the 3 year old had silently come into our room and was standing next to my head quietly staring at me

🔥 @rkatz.xyz taking no prisoners today lol

thought this comment on hacker news about the energy race was interesting

New #GOTOpodcast 👇 @adrianmouat.com & @charleshumble.bsky.social on the real state of container security. • Why containers are hard to secure • Why scanners don’t solve the problem • What’s changing now • The practices that work • Lessons from real incidents
 🎧 gotopia.tech/podcast

#GOTOpodcast: @hollycummins.com, @abangser.bsky.social & @adrianmouat.com discuss • Why security often frustrates developers • Why security fails when added late • How platform engineering can help • The next big risk area 🎧 Listen in: gotopia.tech/podcast

Mildly impressed I managed to describe the Swiss cheese model without a picture!

This months newsletter is now out! 🎉 ✨ February 2026 ✨ https://cloudnative.now/2026-february/

Excellent article from @charleshumble.bsky.social, a must-read for all developers leaddev.com/ai/nobody-kn...

I regularly see people wondering how it's possible that there are so many musicians and writers and film makers and artists from a tiny nation like Iceland. And the answer is really simple: State funding for art education and artists. I literally get a salary from the government to write books.

I spoke with Bhavin Shah a few weeks back for the Kubernetes Bytes podcast. We covered a bunch of topics including CVEs, the different vulnerability databases, and how platform engineers can use Chainguard images to protect against CVEs. www.kubernetesbytes.com

My hot take on why the "latest" tag is sometimes the best tag to use! #containers #kubernetes #devops

I spoke with @charleshumble.bsky.social a few weeks back for @gotocon.com We dived into a wide range of security and container topics, from why containers came about and how vulnerability scanners work, to SBOMs and the evolution of Distroless into @chainguard.dev images youtu.be/9NUOiL48hbo?...

Security vs DevEx? False choice. @abangser.bsky.social, Adrian Mouat & @hollycummins.com explore how teams can build systems that are both secure and great to work on. youtu.be/EGSMP2UodKM?...

i'm torn on this. on one hand: yes, i feel this. i'm doing coding side projects again and i haven't done that for a decade. on another hand, the kind of burnout i get from overusing claude is unlike anything before. i'm learning to find a balance

For those of us struggling with feeling devalued as programmers with the rise of AI, I present the following quote from Paul Graham: "In programming, as in many fields, the hard part isn't solving problems, but deciding what problems to solve."

I've told this story on ContrabandCamp but it's worth sharing for BHM because it's one of the greatest stories ever. A thread.

Probably the most complex piece of self assembly furniture I've ever built was my kids toy kitchen.

Stockholm, I have entered your maw. I'm also talking at the cncf Meetup tonight if anyone is interested! community.cncf.io/events/detai...

@danlorenc recently wrote a blog on Gastown, which is Steve Yegge's attempt to build a "workspace manager" for coordinating AI agents. www.chainguard.dev/unchained/ga...

@chainguard.dev Assemble returns! Chainguard's flagship conference is coming to NYC. Come join us in March for talks & community events on the future of secure software (and especially secure container images). assemble.chainguard.dev/event/2991fc...

Live in LESS THAN AN HOUR Come learn you some jj 😄

I'm sure some of you use the excellent @renovatebot.com to update dependencies in repos. But if you're calling Renovate from a GitHub action, you probably had to create a Personal Access Token (PAT). And PATs are a form of long-live token, my thoughts on which are summed up by this GIF.