Here’s to 2026

I don't make many predictions, but I think here is a slow pitch directly over the plate... As more companies turn to using AI generated code, criminal hackers and digital incident responders will be overwhelmed with work. #infosecmemes #dfirmemes

Cursor CEO Michael Truell warns that “vibe coding” advanced projects may create “shaky foundations” and eventually “things start to kind of crumble” fortune.com/2025/12/25/c...

Please tell me QR codes and juice jackers are on the list!

🎁 🎄 🎅 All I want for Christmas is… links to the #hacklore you keep seeing 👀 You know the advice. Everyone repeats it. No one questions it. Send it my way, and spread the word: www.hacklore.org 🙏

☕ Here's your morning cup of hacklore! ☕ 😂 www.pcworld.com/article/3014... Learn what really works against the most common attacks, and sign up for the newsletter! www.hacklore.org

I also want to say thank you to the person who introduced me to the French word 'beaucoup' this year. It means a lot.

🚨🧰 Small businesses, this one’s for you. I made a few small updates to my cyber guidance for small businesses, based on recent conversations. Feedback is very welcome. medium.com/@boblord/cyb...

I wrote CISA’s Cyber Guidance for Small Businesses at the start of 2023. I’m biased, but I still think it’s one of the best starting points for organizations that aren’t sure how to begin a cybersecurity program. But if you could change one thing, what would it be? www.cisa.gov/cyber-guidan...

MITRE has released its 2025 “CWE Top 25 Most Dangerous Software Weaknesses” study! cwe.mitre.org/top25/index.... How is the software industry doing? Here are some thoughts: medium.com/@boblord/rec...

I don’t think we as a society have thanked @papapishu.bsky.social for obtaining, ripping, and uploading a master copy of the essential Ricky Jay And His 52 Assistants, Jay’s 1997 HBO special and the best distillation of his one of a kind talent archive.org/details/rick...

Wow. This is an absolutely terrifying read. We now live in an age when a single company can, through what appears to be plain old bureaucracy, can more or less brick your entire digital life.

Most people should use a password manager, but there's no one-size-fits-all recommendation. ssd.eff.org/module/choo...

@zackwhittaker.com has some last-minute security and privacy gift ideas. He includes what NOT to buy, and includes a reference to Hacklore.org. Thanks Zack! this.weekinsecurity.com/last-minute-... 🎅 👕 Stop Hacklore T-shirts make great stocking stuffers! 👕 🎅 www.bonfire.com/stop-hacklore/

The "AP Cybersecurity Course Framework" document contains some hacklore about "The Dangers of Public Wi-Fi". If you have contacts there, can you please connect me? 🙏 apcentral.collegeboard.org/courses/ap-c... Hacklore Central contact info: www.hacklore.org/about

🎅 🎁 A Stop Hacklore t-shirt makes a perfect Christmas gift for that special someone who stayed off the naughty list by not spreading hacklore! 😂 🔐 www.bonfire.com/stop-hacklore/ www.hacklore.org

It’s time again for me to listen to my favorite cybersecurity podcast. Well, it’s technically about automotive safety, but I can’t help seeing the parallels to software safety. I hope you find it enlightening too! 💥 🚗 99percentinvisible.org/episode/nut-...

If you have recently taken your cybersecurity awareness training, did you see any examples of hacklore?  I’m collecting real examples of hacklore in the wild.

What if cybersecurity experts wrote PSAs for elevator safety? 🛗💥😱 medium.com/@boblord/psa...

@troyhunt.com Hi Troy! Any chance you'd have some time to update this website with the latest status? I'd be curious which of the top 2,000 websites do not correctly support HTTPS. 🔐🙏 whynohttps.com

What if cybersecurity experts wrote PSAs for seatbelts? 💥 🚗 medium.com/@boblord/if-...

"…the time to evaluate and implement passkeys is now… adoption offers not just enhanced security but also a competitive advantage in user trust…" "…embracing passkeys isn't merely an upgrade; it's a fundamental recalibration of our approach to… security." allsafeus.com/elevating-mfa-w...

As a card-carrying old lady yelling at clouds on the topic of public wi-fi (and not scaring people about it), excited to see it at the top of this very good list.

📨 The first Hacklore newsletter is out! 📨 We are taking on outdated cybersecurity advice for everyday people and replacing it with guidance grounded in how attacks actually happen. Join the community that wants to make security common sense. Read/subscribe here: buttondown.com/hacklore/arc...

No surprise that Casey Ellis and Trey Ford do a great job of explaining the thinking behind the hacklore.org project in a fun and accessible manner. They also do it in just 15 minutes! Well worth your time. 🙏 Bugcrowd Security Flash: The HackLore Project www.youtube.com/watch?v=NOfV...

Just imagining how much better it would be if ALL news stories about vaccine-preventable illnesses were illustrated with pictures of people with the disease, not pictures of needle injections. If you must show something that people will find scary & unpleasant, make it the disease, not the cure.

Looking forward to the family's annual viewing of the two best Christmas movies: Three Days of the Condor, and The Conversation. 🕵️🎄

Thanks for the #hacklore shoutout!!

Guess who is dressing up tonight‽ And it would not be complete without a Hacklore.org QR code. (Be sure to scan on public WiFi!)

All I want for Xmas is for Signal to run on my ARM based Chromebook. 🎅 💪💻🙏

🎅 ✈️ 🚃 🚗 How can friends and family can keep their online accounts secure during the holiday and travel season? This article does an outstanding job of explaining what really keeps accounts safe vs hacklore. 🙏 www.thetimes.com/article/cfd5... More info: www.hacklore.org 🔐 📢 Spread the word! 📢

Very excited that the Risky Business podcast has a shout-out to the Hacklore project! Here's a link to that segment: www.youtube.com/watch?v=3YC5... Thank you @patrick.risky.biz and @metlstorm.risky.biz! 🙏 www.hacklore.org

🎉 The FCC took down its page on juice-jacking! 🎉 www.fcc.gov/juice-jackin... Let's continue to call out how these scare-stories distract from real systemic risks, and the simple things people can do to dramatically reduce the chance of compromise. 🔐 More info: www.hacklore.org/letter

If juice-jacking were real, we would see exploitation. If exploitation were happening, we would see victims. Where are these victims‽ Are reporters even asking phone makers for comment‽ How many cases have ever led to prosecution‽ www.fox2detroit.com/news/what-is... Real talk: hacklore.org

This. News. Report. Has EVERYTHING! Criminals juice-jacking in airports! Booby-trapped public-wifi! And just when you thought you heard it all: Knock knock! Who's there? Use a personal VPN! (Actual expert advice: www.hacklore.org) www.youtube.com/watch?v=Wn9q...

For tried and tested cybersecurity tips tailored for your concerns and devices, you can of course always check out SecurityPlanner.org and some of the other resources on the Hacklore site.

This campaign aims to tackle persistent security myths in favor of better advice cyberscoop.com/hacklore-org...

📢 Announcing hacklore.org 📢 It’s time to retire outdated cyber advice! More than 80 cybersecurity veterans have signed an open letter urging a shift from folklore to guidance that actually helps people avoid the most common attacks. 🔐 Blog: medium.com/@boblord/let... Site: www.hacklore.org

Open sourced Zork today opensource.microsoft.com/blog/2025/11... and ran it on a swarm of containers in the cloud 😂

Dear Lazyweb: What's the current state of encrypted DNS with modern browsers/OSs? Links welcome! (boot for reach, SVP!🙏 )

It's time to make HTTPS the web's default, and reap the full security benefit from years worth of HTTPS adoption! security.googleblog.com/2025/10/http...

🦃 Thanksgiving is coming up in the US. 🦃 What are you thankful for in software security? I wrote about the welcome progress on memory safety defects. What other areas are moving in the right direction? #SecureByDesign medium.com/@boblord/29-...

📢📢📢 The VulnCon conference has announced their call for speakers! 📢📢📢 I really enjoyed the past VulnCons and learned a ton from speakers and participants. If you work with CVEs, please consider submitting a talk before the deadline! 🔐 www.first.org/conference/v...

If you have not seen it yet, @alilleybrinker.com posted a fantastic and thoughtful article on memory safety. 🔐 queue.acm.org/detail.cfm?i...

Sometimes when people ask me why I’m wearing a mask I say I’m traveling or have some important thing soon and can’t afford to get sick and miss it and that’s pretty much always true but I think it would be nice if it were more normalized to just say “I don’t want to get sick” and leave it at that

Happy Memory Safety Day to all who observe. 🔐

Secure by Design software: It’s time to stop patching and start preventing. One year left before "Smashing the Stack" turns 30—let’s make it count! 🔐💪🛡️🗓️ medium.com/@boblord/29-...