Every Microsoft Entra tenant is weird in some way, but every IT admin is convinced they’re totally normal. We have thousands of customers at Pistachio, and we still meet admins who surprise us. “Of course we put company name in the email field and email in department”

@wyden.senate.gov thought you might be interested. Microsoft Copilot allowed users to bypass the audit log and Microsoft did nothing to disclose that: pistachioapp.com/blog/copilot...

If you have an audit log and you have an API, then requiring the “enterprise package” to access the audit log via the API isn’t cool. Specifically: GitHub.

If you are at #Blackhat can you please go by our booth, I bought way too much merch and don’t want to look like an idiot.

Not knowing things about technology is a great way to feel young. I’m not ignorant, it was just “before my time” (2019).

Giving a vendor time to fix a vulnerability makes sense, but I can’t help but feel the practice is being abused and therefore produces worse security outcomes. When large orgs want to move fast they absolutely can; taking 90 days to fix a vulnerability is a choice.

Every time a VC posts “AI-first companies can build billion dollar businesses with 10 people because they can use AI agents, not people, to scale”, I’m tempted to send them a deck that is a pure operations play. Put your money where your mouth is. “Walmart but AI”

If AI is so good at writing code, why is Gemini 2.5 pro only available on the global endpoint? Why does batch processing for 2.0 work everywhere BUT global? Why can’t I fine tune 2.5? Can’t some PM at Google just vibe code these things for me?

Are we fine sharing screenshots from the other place? If so, one comment: skill issue.

If everyone is supposedly building cutting edge AI apps, then why are all of the AI models’ APIs and client libraries so poorly documented and buggy? It really gives away how little people are doing with AI beyond the very basics

One good thing about AI is that encourages people to think more about building “software that does the job for you” instead of “software that enables you to do the job” and I think that is long overdue.

I wrote a blog post on how to use deploy your go application from the terminal using systemd https://egreb.net/posts/deployment-with-go/ #go #golang

What the hell is SharePoint? I just wanted to put some files in a folder so people could access them, and now it is asking me to make a website.

I wrote about what it is like to build a product that the end user doesn't really want, and why gamification isn't a solution to that: https://pistachioapp.com/blog/you-cant-gamify-security-awareness

How do I harass an airline on here if brands don’t use bluesky

A lot of the conventional wisdom of the startup world comes from an era fundamentally different from today, but lives on because the winners of that era are the VCs of today.

Gamification can alter behavior within some macro goal a person already cares about. That’s the point product teams keep missing. The person has to already care.

Do I just give an invite code to the startup I work at so we starting getting some brands here, or…

It feels awkward sending out invite codes to people now. “Yea uh so here is the code for the social media platform that for some reason hates new users”

That joke about posts loading here really slaps, glad they decided to pin it to the top of the what’s hot feed for the last 12 hours

TIRED: Killing your service’s third-party apps WIRED: Killing your service’s first-party apps

I actually didn’t finish reading this tweet so I missed the dumbest part, which is that he is giving new users the lowest rate limit.

I wrote some stuff about whitelisting domains for attack simulations, and why Google and Microsoft are bad: https://pistachioapp.com/blog/think-twice-before-whitelisting-for-attack-simulations

I wrote about prompt injection attacks https://pistachioapp.com/blog/How-Do-We-Solve-AI-Prompt-Injection-Attacks-It-is-a-Secret

<3 Oslo shutting down the entire transport network so some NATO people can motorcade through the city.

Hot take: Bluesky should get rid of the “what’s hot” tab now, and not wait for all of the custom algorithm options to launch.

Launching a new thing soon: pistachioapp.com

The fact that standup is divisive is hilariously absurd. Whether it is helpful or not, it’s 15 minutes max. Let’s not pretend your time is so optimized and efficient that 15 minutes is a major problem.

Happy 17th of May to those who observe

Is there some name for the phenomenon when people debate the risk of low-probability, high-cost events as if they’re debating which of two outcomes are most likely? Because that’s what is happening with debates about AI safety.

Code review is for checking if you wrote the code correctly, not to fight about what the “correct way” is. If it is at all debatable you should be discussing it in advance and along the way.

Microsoft has absurd permissions on the graph API and won’t fix it unless I get a lot of upvotes on this. Please help. https://feedbackportal.microsoft.com/feedback/idea/fa151860-046f-ed11-a81b-6045bdaf6a9e

It’s cool to think that Norway is going to have its very own FTX. Very fun to watch

I wrote a blog post about Elon’s announced feature of letting media publishers charge on a per-article basis. Spoiler: It won’t work. https://zkorman.com/posts/twitter-and-single-article-purchases/7

Lifting (not a lot of) weight

I don’t believe in moats, at least not in tech.

I was previously the head of tech at a media company. The issue with single article purchases wasn’t the tech, it was the numbers.

Confession: I still don’t understand langchain.

Yikes

Yann’s whole argument on AI risk is really just about him wanting to get to make the decisions about risk without public oversight.

So how do we stop the growth hacker, “9 billion people use ChatGPT but only 1% are writing effective prompts” crowd from coming here?

What percentage of unicorns still had all of the original founders at the company and in real c-level roles? I would love to see that number broken down by the experience of the founder prior to starting the company.

Not to alienate anyone, but why does every account that started following me follow 40k other accounts? Is 40k the number of users here?