Friends: in light of recent news, may I encourage you to get the Shingles Vaccine if you are eligible (over 50 or have immune system issues) & encourage others in your life to get it. Shingles took me out for two whole months last year and was incredibly painful. Still get shooting nerve pain.

I think two things are true: thoughtful, experienced human architects for large-scale, production-level codebases are absolutely critical. BUT ALSO people with lower-level dependencies (👋) have had doors opened for them that were unimaginable a couple of years ago with huge positive implications.

This week in P-hacking

@watermanreports.bsky.social follows up on something a lot of us noted: OT companies don't appear to be involved in early access to the newer exploit-focused capabilities from frontier labs, despite needing more advanced notice and more nuanced exploration of exploits www.ot.today/ot-cybersecu...

Hooked onto spring produce this year. In addition to fun with ramps, I managed to find some fiddleheads for sale. So we get some tasty pickles.

Local asparagus is here! A slightly schmancy brunch with a quick hollandaise.

20 lb of usda prime brisket. Going to be a late night tonight, but a delicious dinner tomorrow.

Let’s go Spirit!

Good thing nobody uses those commit shas for compliance or regulatory bookkeeping or anything important like that

Update: bus fire in 9th street tunnel. (Also, proud of myself for being able to clock that as 9th from across the river.) wtop.com/dc/2026/04/b...

Anyone know what’s on fire downtown?

If you have been in a class of mine in the last decade or so you've heard me rant about these devices. #HardwareHacking www.darkreading.com/ics-ot-secur...

A common thread among newer cyclists is realizing just how awful drivers are. There are things you simply don't notice — behavior that has been normalized — when you mostly drive. Biking, walking, or rolling through the world changes that.

Fascinating but of history that informs contemporary policy.

Ramp season! So delicious, but can be a bit of a pain to clean.

In 1999, I was playing a decker in Shadowrun, and tried to distract a guard by hacking a water fountain to overflow, and my GM said "why would a water fountain be on the network? That's fucking stupid. No you can't try." Well it's 2026 and I just want you to know, Phil, that I FUCKING CALLED IT!

Happy World Quantum Day Folks - to celebrate we are releasing our latest open quantum hardware project: The ‘Entropy Loop’ This is a USD $35 open source Quantum Random Number Generator made using off the shelf fiber optics and a raspberry pi pico - in a credit-card sized package!! Link below...

Are you ready? The CFP, call for volunteers, Pros vs. Joes Registration, and room block are all open. Finally, registration is now officially open too. Full details online: https://bsideslv.org/ Join us August 3-5, 2026.

Most clients struggling with AI governance are struggling because they haven't fully defined their enterprise data governance requirements. You can't code "people will use their judgment" into coherent AI governance, as much as you might want to.

Aw yeah. ‘Bout to get nonna up in here.

LLM-found vulnerabilities don't need panic, they need faster patching. Equip your developers with AI tools for code comprehension, triage, and testing. Defenders have full source access — LLMs amplify that advantage. The bottleneck isn't technology, it's adoption. secwest.net/ai-triage

“…the moment presents an opportunity to address shortcomings in how software is currently developed.” That’s absolutely correct. Code quality is cyber 🥦 and this is just another way to remind the industry that you gotta eat your vegetables.

The technical debt repo man is coming for all orgs, especially those that don’t have robust patch creation & management — & it’s clear we can’t keep cranking out these bugs in the 1st place. Stay hydrated, ops teams, & tip your doordashers well as we brace for impact of the #AI vulnpocalypse

Come for the updated graph, stay for the very balanced and reasonable Outlook section, which matches and reinforces my risk assessment: it's unlikely we'll see a CRQC in 2030 but not unlikely enough. So we ship. sam-jaques.appspot.com/quantum_land...

“I will NOT sacrifice the Oxford comma. We've made too many compromises already; too many retreats. They assimilate the em dash and we fall back. They capture ‘not just X but y’ and we fall back. Not again. The line must be drawn here! This far, no further!”

Hi Friends! You have one week to submit to @dianainitiative.bsky.social, an amazing infosec conference, online this year. I understand that they are particularly interested in Red Team talks, so please circulate to those who would be interested. sessionize.com/tdi-online-2...

Volt Typhoon right now:

Somehow I failed to remember to observe the 10th anniversary of the npm left-pad outage. Pour one out. Also, NPM stands for "nicely propagates malware" - just ask DPRK cyberjockies. arstechnica.com/information-...

A very happy birthday to everyone who spent time to pick something other than Jan 1 for their fake birthday! Many happy returns, and I hope you get a free ice cream cone somewhere. (Do they still do that?)

Got to see Whitfield Diffie speak this morning; love to see this clear illustration of how the public key magic works.

Last day of RSAC conference. Once more into the breach [response and recovery AI tooling sales talks]!

“Shadow AI is like regular AI, but with cooler hair and music.”

The Linux Foundation Announces $12.5 Million in Grant Funding (via Alpha-Omega and OpenSSF) Anthropic, AmazonWebServices (AWS), GitHub, Google, GoogleDeepMind, Microsoft, OpenAI to Invest in Sustainable Security Solutions for #OpenSource openssf.org/press-releas...

10 years from left pad to Trivy scanner compromise and it's like we've learned so much about 3rd party risk. 🫥 github.com/aquasecurity...

@k8em0.bsky.social blows away @bsidessf.org by singing a very sarcastic “You’ll Adapt” to the tune of Hamilton’s “You’ll be back.” Her talk did not shy away from the potential human impact of a massive shift to automation, and the need to think about politics in this context.

Wow, 10 years. I’ve had to retell this story to folks who haven’t heard it, as one of the first wake-up calls for SW supply chain.

Everyone I know with practically any knowledge of global supply chains be like:

@allanfriedman.bsky.social #BSidesSF mystery resolved. Cancel the search drones! (Unless they've got a Hardware Bill Of Materials, of course!)

Amazing opening keynote at @bsidessf.org by my old con buddy Anna Westelius making the strong and energizing case for *optimism* in a very tumultuous time for the security community. Full summary here: www.linkedin.com/posts/allana...

2006 internet: RSS feeds, forums, communities of hobby blogs, where people post about interior design, fashion, and music for free 2026 internet: sponsored content, paid partnership, buy my merch, try my supplements, invest in my crypto, click link in bio to unlock the secrets of life for $30

March 20th is Fred Rogers' birthday. Be a beautiful neighbor, or maybe even just spend some time figuring out how and planning to be the best neighbor you can.

A very interesting proposition by @aelkus.bsky.social and quite believable. Good coders who are using llm tools have already observed that there are some important non intuitive things to add to prompts to get better (and more secure) code.

A nice moment in the McRary Institute Cyber Summit. Army Cyber Advisor Brett Pugh acknowledges that CISA and its hardworking expert staff are carrying on with their critical mission without getting paid.

“I hope one day companies will think more long term and strategic and not chasing quarterly numbers”

An excellent profile in courage, and a true patriot.

Of all the things a mysterious large steel cylinder could do, suddenly emerging has to be one of the worst.

This is a phenomenal post on the philosophy and real benefits of education.

Tired: the meeting could have been an email. Wired: This email could have been both written and read by an LLM.

A great case study on the "blast radius" of a supply chain risk. Ignoring "is Anthropic bad," think about how unprepared we are to deal with a major supply chain risk. We haven't gotten much better since Kaspersky ban. You can't defend what you don't know about. anthropic.netrise.io