Some of y’all remember the chaos we had in trying to decide whether to camel case it or not. Or, even worse, which way to orient canonical examples of a dependency tree: top-to-bottom, or bottom-to-top. Collective action is hard; the English language and good design are also hard.

Apple Music’s new automix feature not only isn’t very good, it’s bad enough to be distracting.

Incredible must-read analysis of the Collins Aerospace incident by Günter Born (which relies heavily on work by @doublepulsar.com). It concludes by pointing to Cyfirma's assessment that Alixsec, Scattered Spider, and the Rhysida ransomware were the culprits www.borncity.com/blog/2025/09...

1/ Hi, I'm TProphet. I write the Telecom Informer for @2600.com. A lot of people have been asking me about www.nbcnews.com/politics/nat... given that I'm somewhat knowledgeable in the area. Here's my take: I'm kind of astonished that this is public, and it isn't normal that it would ever be.

I do think a bit about DDoS'ing a phone network as an effective tactic that rarely gets attention but could cause significant chaos. And remember this?

Peak late summer vegetables from the farmer’s market, about to be made more delicious.

When we launched in 2018, the first piece on the site was part one of our four-part oral history of the L0pht. We were able to rescue that series from the archives. Here's that first part again. Enjoy! decipher.sc/2025/07/24/w...

Taking a week off to drink wine and cycle the coast and hills around lovely Santa Barbara.

I’m not sure I agree. Data breach is an important problem - I wrote one of the first studies on economic impact back in mid 2000s—but the disruption of operations can have a much bigger $ impact on the biz, and involves lives for critical infrastructure like hospitals.

No time to make proper frites this Friday night, so I indulged in a particularly scary but potentially novel culinary heresy: “Moules Tots” Reader, it works.

Technically a Caesar cipher is military-grade encryption. They don’t mention *which* military

If you’re around Black Hat / BSides, come by and say hi!

The 3rd speaker at a public event today just said from the stage “I love you, Allan, but [SBOMs won’t solve this problem]!” On one hand, it’s nice to be an avatar for a security concept, but on the other hand, we did fail in our messaging that SBOM isn’t supposed to solve all our problems.

For anyone that is on their way to Vegas for Black Hat — if you have respiratory problems, prepare. Wildfires in Santa Barbara have smoke moving through the city. Here is a picture from a hotel room, I could see the mountains clearly yesterday. You see any 🏔️ in this pic?

@brysonbort.bsky.social on “From me to we” in cybersecurity: we glorify red team but they are really QA. For those of us on blue team, networks, GRC… “pen testers are there to check your work”

A little delayed, but en route. Excited to see many of you this week! Ping if you want to meet up.

This Saturday’s chill work vibes are brought to me by Ellen Allien. Some nice 00s techno and IDM are good for focusing and organizing.

Hi friends! I have some bittersweet news to share. Sorry to be leaving CISA but very excited for some new opportunities. www.meritalk.com/articles/cis...

Gearing up for the annual security pilgrimage to Vegas. I’ll be at BSidesLV, DEF CON, and maybe even a bit of Black Hat. I still have a few slots left on my calendar: let me know if you want to talk supply chain security. (Shiny jacket optional)

Introducing SBOM Play: A Privacy-First SBOM Explorer with Vulnerability & License Insights cyfinoid.com/introducing-... A fully client side browser based SBoM Explorer. more details on the link. #SBoM

One of my students sent me the latest quantum factorization record, and I have to admit: I’m shook. eprint.iacr.org/2025/1237

This is actually the best case scenario for connected devices. And why I argue so vehemently that consumers should be told when they buy something how long the manufacturer plans to support it.

May have bought too many ribs…

Astérix and Obelix do canicule

Ready to compete at DEF CON 33 but not sure where to start? Join WISP for a virtual session on July 10 on how to enter, prepare, and thrive in @defcon.bsky.social contests. Hear from past winners, judges & contest organizers! Register now: lu.ma/8thx43yp

Kasey Chambers gives one helluva show, and The Birchmere is such a lovely venue. Thanks to @sunnysweeney.bsky.social for the delightful extended opening set!

A fascinating point by Prof Bill Scherlis: 
Bolt-on security is hard to do well, but it’s easier to bolt on security after the fact than it is to bolt on resilience.

every dependency only becomes critical once it breaks and takes everything down. until then, it's just sitting in the SBOM.

Great summary of the food analogies we’ve been using since the beginning of SBOM and related issues.

I predict pies in our future…

The regional qualifier for the Nathan’s Hot Dog eating contest—the winners will be at Coney Island in July 4th. This is… not an attractive sport. The men’s winner at 48 in 10 minutes.

The @ilpfoundry.bsky.social Internet Law Trivia Night is back on Wed July 30. Get your tix. 🏆 The best in Internet Law and Policy will battle head to head. Join quizmaster @kurtopsahl.bsky.social, Foundry fellows, and DC’s Internet Law and Policy community. www.eventbrite.com/e/foundry-tr...

One of the more amusing aspects of smart fridge discourse is how far the damn things contain dual-use components that can be weaponised for military purposes

FBI warns about hackers breaching IoT devices and adding them to the BadBox 2.0 botnet, successor to a network disrupted last year. The intrusions into these devices (mostly made in China) occur through pre-purchase tampering or downloading of backdoored software updates. www.ic3.gov/PSA/2025/PSA...

Great overview of quantum computing and cryptography. If you have heard of this, and want to know more, read on:

hype cycle was so long in the renaissance you could drop a Virgin and Child with Saints in 1400 and dominate for a century before some guy comes along with a The Birth of Venus

Sunday brunch: tacos with the last of the brisket burnt ends and a strawberry-mozzarella-basil salad.

New summer coffee habit: double shot from the bialetti moka over ice, with homemade lemon rind syrup.

Brisket trimmings = beef cracklin = some pretty damn amazing gravy for Sunday morning biscuits.

Allan’s corollary to Clarke’s 3rd law: Debugging any sufficiently advanced technology involves magic.

Announcing the opening of the Pros V Joes call for players! Since we’re going for an extra half day, this year, the PvJ team is going to bring you that much more learning and fun! Call for Joes: forms.gle/pdDTs9ft8P... Call for Pros: forms.gle/9LDubL8mNT...

We're honored that @defectdojo.bsky.social has chosen Dependency-Track as one of the top #opensource tools in the #SCA category this year. Here's the press release with all the other great tools on the list. www.businesswire.com/news/home/20... #SBOM #CycloneDX #OWASP

We’re planning two full days of content on Monday and Tuesday (Aug 4-5) w/ a half day of sessions on Wednesday (Aug 6). The pool party is still Wednesday night, but keep checking our schedule as we get close to show, as our evening events will spread out over two days.

Tried my Saturday-evening-cooking martini with smoked Kalamata olives and just a touch of the brine. Not bad…

Glorious ramp season. @allanfriedman.bsky.social

Jamon the Dog is ready for summer, even if he’s not quite sure how chairs work.

A gorgeous evening for the Washington Spirit home opener and a great crowd.

A decent place to watch a spring storm from and catch up on some work. Guessing that more than a few of you recognize the view across the Anacostia river.

Watching an ENISA conference on cybersecurity standards and standardization. One panelist tried to argue that anyone who can’t afford a €200 ISO doc should do something else. 
In other news, I did not know that I could do the New York mafia-style “OOOOH! HEEEY!” reaction without thinking about it.

A cooking theory question: Traditional western (French) braises call for browning meat before slow cooking in liquid. Traditional Asian (Chinese) braises call for blanching meat before slow cooking. Is the Asian style for impurities / soup clarity, or do we think there are flavor reasons?