TikTok's latest illegal 'life hack' seems to be 'dispute credit card transactions for free stuff' and legality aside I am here to beg you: Do not do this to small businesses. It really fucks them over in ways you may not be aware of beyond stealing from them (which is, to be clear, what this is).🧵

As AI scales, how do we secure its complex supply chain? IST’s latest memo tackles the next frontier: AI Bills of Materials. IST Adjunct @allanfriedman.bsky.social spoke to @cyberscoop.bsky.social on why a fragmented approach to AI transparency will stall progress before it even starts. 🛡️ Read more:

@dcunitedofficial.bsky.social love the hosting of a free watch event! Super cool! Making everyone register for Ticketmaster and tripping all my privacy plugins - slightly less cool.

GitHub dismissed security reports on flaws now exploited by supply-chain worm, researchers say via @alexmartin.bsky.social & @therecordmedia.bsky.social

Old computers can’t be removed or replaced and getting the malware off them safely today is 15000 words complicated

A great presentation by @pylos.co at @istorg.bsky.social ‘s Critical Effect on how botnets are being used as a “neutral web” for staging and battlegrounds for OT attacks. This requires rethinking our tools, policies, and doctrines.

I'm at @istorg.bsky.social's #CriticalEffectDC event today. Looking forward to some good sessions on OT cybersecurity — and, of course, talking to Paul Roberts, @snlyngaas.bsky.social, @kimzetter.bsky.social, and @maggiemiller.bsky.social during our panel about covering this era of cyber threats.

Very excited about our new paper. If you don’t know AIBOM, check it out. If you have been working on it, would love your thoughts on this pathway to make it a reality.

I don’t always go for AI images, but a recent signal group discussion inspired me. “AI Snake Oil - Don’t bolt on security without it!”

Dungeon Crawler Carl von Clausewitz “In the dungeon everything is simple, but the simplest thing is difficult - goddammit, Donut” “War is but a continuation of policy by other means. You will not break me” “The dungeon is the primordial enmity and rage of the people”

really he's just going to coffee with friends. excel mistakes everything for a date

Some leftover crabs from Memorial Day crab feasts —> crab roe angel hair pasta. So rich and delicious.

oh my talking lion this really recontextualizes some shit

Incredible quote from Wyden, that it is time to "start treating the adtech industry as a national security threat."

i keep seeing this post floating around and... it's just not accurate? the reason that there are a bunch of disused canals around the midwest is that they were obsoleted by better canals over the following 200 years. Commercial shipping in the Erie Canal indeed peaked and declined... in 1951

We need more walkable, mixed-use datacenters. Like community gardens, people should be able to experience the joy and satisfaction of cultivating their own hardware. Big Cloud has alienated the connection people felt with their computers. Kids should know what it's like to swear at rack mount rails.

OSS burnout claims another project. On 2 Apr, an entitled user angrily asked the burned-out maintainer of nvim-treesitter to “go switch to something that doesn't require interacting with people”. The maintainer replied “OK” — and archived the repo, stopping development of nvim-treesitter.

New unified conspiracy theory: DB Cooper is Satoshi and also Jia Tan. They invented a new way of hiding the money, and then to start hacking to cover their tracks.

I get that there is a theoretical privacy value to Bitcoin ATMs. But in practice, in a world where it's easy to get a Coinbase account, their main purpose seemed to be to charge heavy fees for confused scam victims who didn't understand crypto.

Again, Bugmaggedon isn't actually in full swing and bug reports are already unmanageable.

Fantastic thread linking Taiwanese independence, the state of the chip market, and the stability of the US economy.

It's not "signs of AI generated writing" it's IOCs (indicators of Claude).

JOHN FOGERTY: I wanna know, have you ever seen the rain JAMES TAYLOR: okay, you’re not gonna fucking believe this

Friends: in light of recent news, may I encourage you to get the Shingles Vaccine if you are eligible (over 50 or have immune system issues) & encourage others in your life to get it. Shingles took me out for two whole months last year and was incredibly painful. Still get shooting nerve pain.

I think two things are true: thoughtful, experienced human architects for large-scale, production-level codebases are absolutely critical. BUT ALSO people with lower-level dependencies (👋) have had doors opened for them that were unimaginable a couple of years ago with huge positive implications.

This week in P-hacking

@watermanreports.bsky.social follows up on something a lot of us noted: OT companies don't appear to be involved in early access to the newer exploit-focused capabilities from frontier labs, despite needing more advanced notice and more nuanced exploration of exploits www.ot.today/ot-cybersecu...

Hooked onto spring produce this year. In addition to fun with ramps, I managed to find some fiddleheads for sale. So we get some tasty pickles.

Local asparagus is here! A slightly schmancy brunch with a quick hollandaise.

20 lb of usda prime brisket. Going to be a late night tonight, but a delicious dinner tomorrow.

Let’s go Spirit!

Good thing nobody uses those commit shas for compliance or regulatory bookkeeping or anything important like that

Update: bus fire in 9th street tunnel. (Also, proud of myself for being able to clock that as 9th from across the river.) wtop.com/dc/2026/04/b...

Anyone know what’s on fire downtown?

If you have been in a class of mine in the last decade or so you've heard me rant about these devices. #HardwareHacking www.darkreading.com/ics-ot-secur...

A common thread among newer cyclists is realizing just how awful drivers are. There are things you simply don't notice — behavior that has been normalized — when you mostly drive. Biking, walking, or rolling through the world changes that.

Fascinating but of history that informs contemporary policy.

Ramp season! So delicious, but can be a bit of a pain to clean.

In 1999, I was playing a decker in Shadowrun, and tried to distract a guard by hacking a water fountain to overflow, and my GM said "why would a water fountain be on the network? That's fucking stupid. No you can't try." Well it's 2026 and I just want you to know, Phil, that I FUCKING CALLED IT!

Happy World Quantum Day Folks - to celebrate we are releasing our latest open quantum hardware project: The ‘Entropy Loop’ This is a USD $35 open source Quantum Random Number Generator made using off the shelf fiber optics and a raspberry pi pico - in a credit-card sized package!! Link below...

Are you ready? The CFP, call for volunteers, Pros vs. Joes Registration, and room block are all open. Finally, registration is now officially open too. Full details online: https://bsideslv.org/ Join us August 3-5, 2026.

Most clients struggling with AI governance are struggling because they haven't fully defined their enterprise data governance requirements. You can't code "people will use their judgment" into coherent AI governance, as much as you might want to.

Aw yeah. ‘Bout to get nonna up in here.

LLM-found vulnerabilities don't need panic, they need faster patching. Equip your developers with AI tools for code comprehension, triage, and testing. Defenders have full source access — LLMs amplify that advantage. The bottleneck isn't technology, it's adoption. secwest.net/ai-triage

“…the moment presents an opportunity to address shortcomings in how software is currently developed.” That’s absolutely correct. Code quality is cyber 🥦 and this is just another way to remind the industry that you gotta eat your vegetables.

The technical debt repo man is coming for all orgs, especially those that don’t have robust patch creation & management — & it’s clear we can’t keep cranking out these bugs in the 1st place. Stay hydrated, ops teams, & tip your doordashers well as we brace for impact of the #AI vulnpocalypse

Come for the updated graph, stay for the very balanced and reasonable Outlook section, which matches and reinforces my risk assessment: it's unlikely we'll see a CRQC in 2030 but not unlikely enough. So we ship. sam-jaques.appspot.com/quantum_land...