This is a phenomenal post on the philosophy and real benefits of education.

Tired: the meeting could have been an email. Wired: This email could have been both written and read by an LLM.

A great case study on the "blast radius" of a supply chain risk. Ignoring "is Anthropic bad," think about how unprepared we are to deal with a major supply chain risk. We haven't gotten much better since Kaspersky ban. You can't defend what you don't know about. anthropic.netrise.io

The "e-bikes are cheating" trope is just "protected bike lanes are unnecessary because I rode all over the place without them" for a new era: A mix of gatekeeping and survivorship bias that allows the person invoking it to defend their perceived status.

Some rare good news in cybersecurity. The foundation of the vulnerability management ecosystem is secured, thanks to some great work by our embattled friends at CISA. Great reporting by @metacurity.com www.csoonline.com/article/4142...

CISA delays cyber incident reporting town halls due to shutdown federalnewsnetwork.com/cybersecurit...

@cillic.bsky.social - we were apparently the only people to ever order this voluntarily, and we killed the bottle.

Impressed by the new zerodayclock.com effort/collective/call highlighting that the window between vuln and exploit now must be assumed as t=0. The call to action is solid, though sadly nothing terribly new. Secure by design, adapt policies and practices. Liability, eridacate classes of vulns.

The thing about the Taliban is that it's probably best understood as a Pashtun ethnic movement rather than a religious one. The Afghanistan-Pakistan border divides the Pashtun tribal lands almost exactly in half, leaving Pashtuns as ethnic minorities in both Afghanistan and Pakistan.

I’ve always felt that the pizza index was one of the more BS-laden OSINT stories. Google only measures in-person activity, and the pentagon fast food places have surge capability by design.

I googled “Weather” and instead of the weather widget, Google gave me an AI summary of a week old weather report from an unknown location in Alabama.

BSides Edmonton needs some volunteer organizing staff, specifically a CTF co-lead is that you? is that someone you know? docs.google.com/forms/d/e/1F...

HUGE NEWS! 📣 The "father of SBOM," @allanfriedman.bsky.social, is joining Anchore as a Board Advisor! We sat down with him to discuss the future of #SoftwareSupplyChainSecurity and what comes after SBOM.... https://anchore.com/blog/anchore-welcomes-sbom-pioneer-dr-allan-friedman-as-board-advisor/

Surround yourself with good people. Pay it forward. Hug your friends every chance you get. Purge toxic people from your life.

Critical Vulnerabilities in VS Code Extensions Threaten 128 Million Developer Environments

When everyone talked about quitting tech and becoming farmers that was not what we meant

Table next to me at the coffee shop are senior firefighter policy folks talking about CERTs (community emergency response teams) and the language is similar enough to infosec that my ears won't stop firing cyber interrupts into my conscious brain.

I am notoriously bad at predictions (curse of the expert, etc.) but I am going to say with some confidence that the pattern in all computing hardware is that companies expand to meet the current level of demand and, inevitably, there's a crash and overcapacity

Hell yes!  Many of us have been following this story from the beginning, and I'm SO glad to see it resolved finally... arstechnica.com/security/202...

With Trump admin scrapping requirement for software vendors to attest to their products' security, agencies must now decide how (or even whether) to require those assurances. My new story looks at what that could mean for software security in govt & beyond: www.cybersecuritydive.com/news/white-h...

People of DC: This is a great, frequently updated, zoomable map of where the snow plows are, and how recently they've been on any given street. Based on our experience, it's accurate. We saw a truck, and then the map status of our street changed. Check it out citizeninsights.geotab.com#/dcsnowgov

A gorgeous 2 mile walk across DC and the National Mall to make it to Day 2 of @districtcon.bsky.social and the entertaining keynote by Daniel Ridge. Feels pretty special… “hackers now a-bed Shall think themselves accursed they were not here,”

If anyone is making the hard choice not to attend @districtcon.bsky.social because of the weather, I will happily buy your badge.

"Prompt Engineering" is starting to feel a lot like just... engineering. It’s less about finding magic words and more about managing state, memory, and flow control. We’re back to building state machines, just with fuzzier logic.

Good summary of yesterday’s hearing on Cyber Offense and Deterrence. Testimony seemed good and hit important points, but it’s still not clear to me “public private partnerships” look like for offensive-oriented deterrence. industrialcyber.co/critical-inf...

Non-deterministic additions to amateur-drafted contracts seems like a bad idea…

look upon my works, ye mighty, and let me know what you think

Spending a Sunday defrosting a freezer and replacing the door gasket. Also discovering some fun things tucked away in the depths: really good butter, duck quarters, bags of pitted tart cherries.

The spirit of Ea-nāṣir lives on ;) londondaily.com/trader-buys-...

The first two hours this morning

When you’ve stayed up later than your bed time to celebrate properly with good people. Happy New Year, friends.

At the gpg.fail talk and omg #39c3 You can just put a \0 in the Hash: header and then newlines and inject text in a cleartext message. Won’t even blame PGP here. C is unsafe at any speed. gpg has not fixed it yet.

Holy shit, I didn't think I could love Brandi Carlile more, but this is -amazing-. youtu.be/VnstFOTGJgc?...

The world needs more songs about how the lead-up to Christmas is just kind of chaotic.

They say “It's better to stay silent and let people think you're a fool than to speak and prove you are one,” but I’m an empiricist…

It’s the “season of love and giving”…but this year, doesn’t it seem more like a “season of fear and taking”? Like many of you, I’ve been saddened by the human impact of draconian government budget cuts and how angry many housed Americans are at unhoused Americans. 🧵 1 of 9

How many sleeps until Christmas is very much a function of how ambitious your nap agenda is.

Tour de Tacos Twenty-five is commencing.

this is a good reminder of how things that are shitty but have been accepted as normal and inevitable can actually turn out to be abnormal and evitable with some science, time, education and political will

Why am I spending time trying to drive more transparency into the semiconductor and manufacturing supply chain? Because inventory is Step Zero in dealing with risk. We need HBOM now. "The discovery highlights the fragility of “black box” components in automotive supply chains."

It’s almost impressive that we still have to explain this. Yes, OSS is a critical part of supply chains, but the responsibility is on the downstream user to understand the risks. Want more? Join the project and/or directly support it.

you, uh, do not crowdsource investigate a potential security incident in public. least of all when it pertains to peoples' offline identities and real-world locations. this could have been handled with a private group of maintainers, but was not.

speaking of reminders: I think open source authors should have the absolute right to withdraw their work and personal information from circulation, and no argument about "supply chain security" overrides this bsky.app/profile/stev...

Hey Millennials, you should congratulate Gen Alpha on their first successful kill

This isn't just a usability issue, it's a security issue too. Most people don't pay Adobe to do this. They download a slew of sketchy utilities bundled with adware (or worse) trying to get the job done.

Did an eggnog taste test, and was surprised to find that I liked the supermarket brands over our local creamery.

I have to say, pentesters do a great job. Every pen I've ever bought has worked

Good morning! When we say ‘more than books,’ we really mean it 😂 Proud of what our libraries make possible every day! 💪🏽

Almost 1,000 people are without power after the basement of a Safeway grocery store in Wheaton, Maryland, flooded with 300,000 gallons of water, according to officials. nbc4dc.com/lN2l2wo