I guess part of the reason that reading code can be harder than writing it is that what you really need to understand isn't necessarily *in* the code, you're kind of inferring the understanding you need *from* the code. Again, we keep conflating the work with the artifact of it, and the value […]

While I'm thinking about work, a piece of advice for startups thinking about security: fix your project management and roadmapping process before/at the same time as bringing someone in to help with security, especially if that person is not getting put in as a peer to the CTO with the swing to […]

I've been instituting exactly this kind of cooldown/delay on dependency updates at all of my clients for four or so years and I'm glad to see more people talking about it: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

Chatting with a friend about Cloudflare's intermittent outages today, they brought up an interesting point: How many organizations have started relying on Cloudflare to do basic security blocking and tackling stuff, like stopping SQL injection attacks at the edge? Maybe your devs were lazy at […]

Has anyone looked at doing large scale newsletter type distribution over signal (not admin-only groups)? I know @thecontinent does it, but I'm not sure if they're using a third party client or what.

I’ve been testing a theory: many people who are high on #ai and #LLMs are just new to automation and don’t realize you can automate processes with simple programming, if/then conditions, and API calls with zero AI involved. So far it’s been working! Whenever I’ve been asked to make an AI flow […]

Has anyone here ever tried to get GrandMA3 OnPC working on Ubuntu on emulation? If so, how, and how was performance?

Two years ago, I wrote at very great length about how this played out in Myanmar. It is so upsetting to see how many of the same dynamics are at work here now. https://erinkissane.com/meta-in-myanmar-full-series

This thing that 404 is writing about in the US—the dehumanizing fake content created purely because Facebook pays people to make it? https://www.404media.co/ai-generated-videos-of-ice-raids-are-wildly-viral-on-facebook/ It has a direct precedent in the Myanmar genocide and has been widely […]

"If normal people don't get tripped up by it, what use are my 1337 skilz?" is not a good design principle.

RE: https://indieweb.social/@bonfire/115507615653471686 What @bonfire are working on is impressive and important and y'all should consider supporting their crowdfunder! Bonfire was absolutely the top contender for my work building New_ Public's Local project (https://newpublic.org/local); in […]

600,000 already killed. Two thirds are children. Trump’s and Musk’s and the cowardly Republican legacy. And it keeps giving. #Trump #Musk #GOPMurderers #usaid #USpol

I'll take a break from the politics now for a brief word from our sponsors: If you're a startup beginning your security journey and you're interested in help building a security program — not just from a technical security architecture perspective but also in terms of structure, hiring, and […]

The guy who got famous betting against the housing market in 2007 just before that bubble burst - played by Christian Bale jn “The Big Short” - just wagered $1 billion on the collapse of the AI boom. www.wsj.com/livecoverage...

This is sometimes read as "look 'AI' isn't working". But the opposite is true. _This_ is what "AI" is _for_. Push down labor power, push down wages, make employment more insecure. https://www.theregister.com/2025/10/29/forrester_ai_rehiring/

I know it’s overwhelming right now, but kick in your rational brain and risk measures and then evaluate if things are the same or as good as they were a year ago, ten years ago, etc. Is this something you would have considered normal or noteworthy? Is this what you’d expect from the gov or media?

Hey, so as a veteran and incident responder I need to warn you to pay attention to something in America. The human brain is resilient. While you’re watching kids get dragged away from the parents and people being beaten in the streets, you’re accumulating trauma but also being desensitized.

“People aren’t misguided to want shelter from surveillance and harassment, or to seek high-context, community-centric moderation; all echo-chamber punditry notwithstanding, those are necessary conditions when life online has such direct and dramatic effects on the character of our offline […]

Hilarious side effect of the OpenAI pivot to porn plus the Swedish ban on online pornography purchases: Paying for ChatGPT in Sweden may be a criminal act soon.

@deviantollam Do you have faraday gloves for your chips?

@effi The biggest attack against the civil liberties you claim to care about in Finnish history is happening right now and you only bothered to comment on one proposal with the most limp-wristed bit of policy critique I've seen in ages and you've done absolutely nothing to sound the alarm bells? […]

So last night I just found out that the far right Finnish government is planning on gutting limits to police use of malware, wiretaps, undercover infiltration, and police/military intelligence data sharing, and eliminating some or all of the constitutional protections around personal […]

Breathe more deeply #obliquestrategies

Not only is this an illustration of Morris's rule, but also my First Rule of Hacking: "If you think it can't possibly be implemented that badly, check anyway."

30 years ago, Bob Morris, then a senior scientist at NSA, gave a keynote talk at the CRYPTO conference (the leading conference for academic cryptographers). He opened by telling us he would reveal the NSA's first rule for cryptanalysis (which certainly got our attention). "First", he said […]

Ok so I have a new theory about the plague of frogs

I am reminded, these days, that ethnographic studies of engineers have shown an elevated tendency towards authoritarianism and terrorism, and that there's no reason why open source would be different.

RE: https://mastodon.social/@mariafarrell/115333913079023817 Well this is admirably concise and direct by Germany's justice ministry. "Chat control without cause must be taboo in a state governed by the rule of law. Private communication must never be under general suspicion." THANK YOU […]

FOX NEWS IDIOT: If you thought the masked "Former Antifa Member" Jesse Watters had on last week looked familiar, there's a reason for that... #OMG...He was also the masked "former gang member" and masked "Gaza resident" Watters had previously interviewed […] [Original post on mastodon.social]

The number of "resistance" authors publishing on Substack remains dissapointing. I'd mutter something about the master's tools but y'all are actively donating lumber.

There are certainly good -courses- that can supplement a strong IT foundation and existing experience and credentials. Especially on targeted topics. But if it sounds too good to be true it is. You’re not landing a SOC job on a 6 month bootcamp, these days.

I guess I haven’t clearly articulated this in writing, but friends do not let friends without substantive IT work experience and/or a credible IT degree take cybersecurity career bootcamps in 2025. They are up to no good. Shenanigans. Malfeasance. They are not a safe way to get a job.

the biggest problem we *already have* in open source right now, which we have oversimplified into the term "supply chain security", is the lack of understanding that putting a dependency in your project's dependency set (package.json, pyproject.toml, requirements.txt, cargo.toml, etc) is not […]

Delighted to see China getting ahead of the game and banning scraping that circumvents technical restrictions and some kinds of deceptive advertising and monopolistic platform practices. Them claiming global enforcement scope (enforced by among other things market access bans) is also an […]

I cannot even start on the historical racial violence that runs on unabated in our lives, with the horrific treatment of especially black and native women. The numbers are right there, in black and white, of deaths in childbirth, of poverty, of despair. I just don't care about Charlie Kirk, not […]

42 years ago today, on September 26 1983, Lt. Colonel Stanislav Petrov of the Soviet Air Defense Forces made the incredibly brave choice to disobey the letter of his orders and ignore the early warning system he oversaw. By declining to report an apparent US launch of five missiles, he likely […]

DarkSky Int'l has posted instructions on how to submit a letter to the FCC **DUE TODAY** https://docs.google.com/document/d/1E-DHPfikf438a3tiWCNeOBThyBjBGFtXuyPcWoUVw1w/edit?usp=sharing And they've also posted a sample letter you can copy and paste […]

I can vouch. I sent registered letters to Target during pandemic to demand they enforce in-store COVID rules. It worked. Via Bsky randos: Address: Disney-ABC Home Entertainment & Television Distribution 500 S. Buena Vista St. Burbank, CA 91521-3515 response to this: "Been a soc media mgr […]

I do not know another way to express to people that trying to appease fascists by “being a good minority” or totally deferring to them publicly has saved absolutely no marginalized group or profession in human history. They are coming after us anyway. Even if you l scold peers for not being nice.

A CVE should be assigned whenever an attacker publishes a malicious package update to a distribution, it’s a released software artifact with malicious intent and must be tracked.

Proton Mail Falls Under U.S. Jurisdiction If you read their Terms of Service, at first glance, they reference the laws of Switzerland. However, because they now have offices in the United States — along with registrations, trademarks, copyrights, and patents in the U.S. — they also cite U.S […]

Ding dong the witch is dead

After seeing a workshop using a crappy pseudo/proprietary forensic web capture toolkit for law enforcement, I was disappointed by the lack of open source tooling to have a sane forensic collection for web capture. Following a discussion with @rafi0t he did […] [Original post on infosec.exchange]

🕑 **EU Citizens have 4 days: the clock is ticking!** European countries are finalizing their positions on Chat Control **this Friday.** If your country supports Chat Control, it is vital you contact your representatives and voice your opposition to […] [Original post on mastodon.neat.computer]

Very sad to see that the Finnish public health authority is continuing its ongoing practice of criminal negligence around COVID: https://yle.fi/a/74-20181617

This was a very rough piece to write, despite it just being the next piece in my AI series. *insert all the damn content warnings here* (OK, maybe not for genocide. Yet.) It's about how AI interacts with people, rather than how people interact with AI […]

The more I think about age verification, the more I see it as a broken and dangerous model. - Large players will exploit it to collect even more personal information. Think of the already unnecessary cookie collection happening today—this will only be bundled and abused further to validate […]