I am honored to share the 2026 Pulitzer Prize for Best International Reporting with Dake Kang, Byron Tau, Aniruddha Ghosal and Garance Burke for our reporting revealing how Silicon Valley largely designed and built China's surveillance state and enabled human rights abuses.

Big changes to Android and Chrome VRP: - focus on high-impact, reproducible bugs with low/no reward for lower impact - big prizes for full chains with some annual limits - PoCs required It’s the end of an era, but the start of a new one. bughunters.google.com/blog/evolvin...

This is coming from a place of warmth and acceptance… -It’s ‘sleight of hand’ -It’s ‘bated breath’ -It’s ‘lo and behold’ -It’s ‘one fell swoop’ -It’s ‘brass tacks’ -It’s ‘free rein’

Also, there was a similar investigation a few years ago that didn't get the press it deserved. Researchers linked the murder of Mexican journalist Fredid Roman Roman to SS7 tracking as well: www.haaretz.com/israel-news/...

yay, preorders for my next cookbook are now available! (it's coauthored with the owner of a beloved Oakland Asian American bakery, Bake Sum!) bookshop.org/p/books/bake...

Most sessions from this year's Open Source Cryptography Workshop last month in Taipei are now posted on the Internet Archive. You can find them, and photos, on the workshop's site: oscwork.shop/2026 #rwc2026 #rwc #oscw2026 #oscw

Exactly this

Newsrooms should not block the Internet Archive. Any public service publisher should not block the Internet Archive. If anything, we should all be directly supporting the Internet Archive.

Škoda's DuoBell is designed to avoid collisions between cyclists and pedestrians preoccupied by their podcasts. www.wired.com/story/skoda-...

Refreshed gift link www.economist.com/leaders/2026...

Hall of fame FT correction

Absolutely incredible Nutella ad.

Pls help spread the word: "Scholarships are open to investigative reporters & editors living & working in Africa, Latin America (Central & S. America & the Caribbean), and Asia." journalism.columbia.edu/summer-inves... (And, yes, I'll be teaching the Reasoning About Risk & Security session.)

Excited that my grad student @shreyasminocha.me's work on Age Verification has been accepted to IEEE S&P! You can read about it in Ars Technica: arstechnica.com/tech-policy/... Preprint: mikespecter.com/assets/pdf/A...

Telebit Trailblazer

In its continued commitment to ethics, security and public trust, CJS has named Anika Collier Navaroli, ’13 M.S., the Craig Newmark (@craignewmark.bsky.social) Assistant Professor of Professional Practice and Director of the Craig Newmark Center for Journalism Ethics and Security.

For Tokyu Hands 50th anniversary, illustrator Enya Honami created a new cross-sectional floor guide. Check it out if you’re in Shibuya:

AI coding is an earthquake for software security. Not a tremor. The kind that liquefies the ground beneath your feet. We're mid-shake and most people are still debating if it's real. 🔗 github.blog/news-insight...

Enthusiastically recommend this PZ blog post for anyone pondering tech risk in the real world. It's full of dry understatement like "Gaps in vendors’ understanding of their attack surface is a common source of 0-click vulnerabilities" & spotlights miscellaneous misaligned industry incentives.

The image we’ve all been waiting for. It is now officially 2026 in Tokyo 🎉

We have all been S-tier rickrolled Absolutely extraordinary commitment to the bit H/T @riana.bsky.social

Attestation, What It Really Proves and Why Everyone Is About to Care unmitigatedrisk.com?p=1114

Great culture can save lives. Literally. Amazing letter in today’s @thetimes.com about Tom Stoppard

Dear Lazyweb: What's the current state of encrypted DNS with modern browsers/OSs? Links welcome! (boot for reach, SVP!🙏 )

PSA: tips to protect yourself from scams on Signal. Every major comms platform has to contend w phishing, impersonation, & scams. Sadly. Signal is major, and as we've grown we've heard about more of these attacks--scammy people pretending to be something or someone to trick and abuse others. 1/

Last week, MIT released a sketchy, vendor-funded report claiming more than 80% of ransomware was powered by AI. I had a deadline and didn’t get to read it when it first came out. Now I’ll never get to read it. People pointed out so many methodological problems that they pulled it offline. 1/x

Whomst among us hasn't at some point exclaimed PLEASE SEND THEATER CRITIC OR SYSTEM ADMIN ?

Japan's "Mundane Halloween" costume contest is back! Each year website DailyPortalZ holds a contest where people dress up as something super duper ordinary. Here's a thread of some of my favorites from the 2025 contest! #MundaneHalloween

I, too, am team No You Don't Hydrate And Get Back In There

I didn’t plan to break news. I just looked out the window. I was flying out of DCA and saw the East Wing being demolished. I took a photo, posted it, and by the time I landed, it was on CNN. It's wild how fast one moment can move — and how something so ordinary can make the world pay attention.

Western man is externalizing himself in the form of gadgets. —Dr. Benway, in Naked Lunch by William S. Burroughs

Encryption without key rotation is just sparkling obfuscation

The screen caused much more than a great flattening: it accelerated to breakneck speeds, eliminating much space for contemplation. A reason for some preoccupation with craft is to reclaim a bit of that. Because fine-tuning turns out to affect quality.

Today, my research group @ Georgia Tech released a paper on vulnerabilities in Tile --- the second largest device finding network after Apple's AirTags. You can read about it in Wired, reporting by @kimzetter.bsky.social! www.wired.com/story/tile-t...

The supply chain attacks will continue succeeding until FIDO increases…

I've been struggling through the process to FOIA my own data from CBP. They keep asking for identity verification, but don't respond to queries about the ID submission process (which is where I'm stuck). Has anyone been through this and can help?

Some unused cover ideas for this week's issue

Presenting the most comprehensive list of Chinese fonts made in Hong Kong since the year 2000 💘:

While most vendors ship timely patches for vulnerabilities reported by Project Zero, they don’t always reach users. Today, we’re announcing Reporting Transparency, a new policy to encourage downstream fixes googleprojectzero.blogspot.com/2025/07/repo...

Time to find the right journalist(s) for live hacking demo video pieces. If you're coming to DEF CON and want a scoop, lmk: 1. How AI voice clones are currently being used to target Execs and their orgs in the wild for wire transfer fraud, passwords, and document stealing & how to stop it

Simply epic. What extraordinary commitment to the bit.

37yrs ago, our second single from Vivid, Cult Of Personality, was released - July 14, 1988! Thank you to every fan who’s ever cranked it to 11, moshed to it, studied the lyrics, questioned authority, and demanded more. This song belongs to all of you now. #LivingColour #CultOfPersonality

As more journalists are driven out of their jobs, I keep hearing this drumbeat of "it's ok -- they can start their own newsletter or publication." Some can. But becoming your own business is a huge job, and will eliminate many talented reporters from the public sphere. Here's why. (1/5)

Are you there?

I keep telling people that Ao3 should be better known in the open culture community but uh not like this 😂 Original post: hachyderm.io/@vashti/1147...

Ibaraki prefecture’s veteran toy poodle police dog Anzu was recognized yesterday for finding an elderly man who had gone missing in the woods at night. After being dispatched, Anzu located the man in 45 min just from the scent of his pajamas.

And don't forget: cryptography is a tool for turning lots of different problems into key distribution problems. Key distribution (including rotation) problems are way harder than I would have expected before touching actual real-world systems /6

“Everything simple is false. Everything complex is unusable.” Ugh. What a great quote. via en.wikipedia.org/wiki/Map%E2%... via @danhon.com