I'm writing this post while connected to the airport wi-fi. Is that OK? Am I in danger? 🤔🔒

“Official statistics are a public good…Over the long run, there’s no replacement for the government. No private-sector company has the incentive to produce trustworthy official statistics that are available to everybody at no cost.” www.nytimes.com/2025/08/08/b...

Not to pile on, but every 'c' in 'Pacific Ocean' is pronounced differently.

Defeatist logic often masquerades as insight or realism. Don't fall for it.

You can't add salt to the dough after the bread is baked.

Reading the news of hacks lately, it occurs to me that someone should invent a form of identification that resists phishing. They could call it something like, “phishing resistant MFA”. Something that protects accounts even when the user does what the hacker says. What do you think? 🤔

💔❤️

📅 500 days from now will mark the 30th anniversary of Aleph One’s “Smashing the Stack for Fun and Profit”. 🛡️ Today, CISA and NSA released a joint guide on reducing memory-related vulnerabilities in software. 🙏 www.cisa.gov/resources-to... 💭 How much progress can we make before this milestone?

What cybersecurity games are publicly available? I'm thinking about board or card games that might include topics like secure software development or network defense (like TTX games). All replies are appreciated. And don't assume I've heard of something great. Feel free to repost! 🙏

Once hacklore, now forgotten: why did we stop telling people to shut down their computers for safety? medium.com/@boblord/the...

I'm going to have to spend more time with this excellent blog post by Adam. The part on effective communication is worthy of contemplation. I wonder how we practice, and how we ensure the people we're talking to are using the same communication playbook.

"Create an image that summarizes what you know about me."

Some perspectives on the concept of "human error": www.youtube.com/watch?v=Ygx2...

We created a safer AV1 decoder, rav1d, by forking the dav1d decoder and rewriting the C code in Rust. It works great except our Rust is 5% slower than the C. We're not sure why so we're offering a $20k bounty to figure it out and make the Rust code faster. www.memorysafety.org/blog/rav1d-p...

+++ Twin Peaks - 35 Years Ago Today - (8/04/90) +++ Dale Cooper: Who's the lady with the log? Sheriff Truman: We call her the Log Lady. TwinPeaks first aired on ABC 35 year's ago today. 8th April 1990. #twinpeaks #davidlynch #markfrost #otd

Looking at your work today, are you using local data to make local decisions that will only have local outcomes? What could you change to create bigger outcomes?

Is it too soon for enterprise software customers to demand Y2038 testing and resilience? If so, what date should they start demanding it? 📆

I'm sensing something... the picture is getting clearer... AHA! Was it a 𝙢𝙚𝙢𝙤𝙧𝙮 𝙨𝙖𝙛𝙚𝙩𝙮 defect? 🎩 🪄 ⚡

Still not over David Lynch.

Starting today my Zotero web app has started showing PDFs in a tiny frame rather than expanding to fill the window. This only happens on my Chromebook, not MacOS Chrome. It must have regressed in the past couple of days. Any ideas?

"'I divorced my first husband because he didn’t like the film,' Rodgers said." Fair.

Love getting the repeated workplace training reminder emails, which include links to the trainings in question, wherein I am told that I should never click any links found in emails.

Time to make C the COBOL of this century

Happy Twin Peaks Day to all who celebrate! 🗻🗻🦉🌲🪵 🍒🥧☕️🍩 🕵🏼‍♀️ 👍🏻

MacOS security peeps: Given the improvements in MacOS security over the past 5+ years, are you still using Little Snitch? If so, what unexpected or illegitimate activity have you prevented? 🙏

The default is "no security" with Chrome extensions, at least in my recent personal experience. There's no way the average person has the tools or background to assess this type of risk.

We're in the consumer HTTPS endgame. We need to finish the job so I can be certain all my mobile traffic is protected. Please join me in asking the OS and browser makers to keep pushing and to finish the job in 2025, perhaps by Halloween! 👻 🔐 https://buff.ly/41qPpUM

if a product is secure by design, then it should — by practical definition and as a fact of operational reality — not require endless configuration training or reconfiguration on the part of the customer in order for it to be safe. improving code quality is cyber broccoli that you just gotta eat.

I want to have Google Docs read my docs aloud to me but there's no good native feature. The extensions I looked at require **excessive** permissions. Any recommendations?

If we mean "passwords", can we just say that rather than using the overly broad term "credentials"? Let's all speak a little more plainly.

I'm tired of reading about "sophisticated actors" who just asked for and were given the admin password. Has anyone produced a classification scheme to rate threat actors *and* the tactics they used? "Sure it was a Class 1 threat actor, but they just used a Class 4 attack vector". Links welcome!

I have never once run a phishing sim. I refuse to use the word. I put it in air quotes and say scam by text or email etc Tech and cyber has been about deflecting blame to anyone else but themselves- which is what sims are. Blaming people when the system they use should protect against issues.

Where do I complain about this issue? 🤔

Just watched 5 ads on Amazon Prime after signing up for the ad free subscription Dec 30th. What a country.

🏆 The Cyber Policy Award™ for U.S. Domestic Policy Impact goes to Lauren Zabierek, Jack Cable, and Bob Lord, for their work on Secure by Design while at CISA, alongside Jim Richberg and Taylor Roberts for their efforts in advancing the private sector pledge. Congratulations! #CyberPolicyAwards

I'm sensing something... the picture is getting clearer... AHA! Was it a 𝙢𝙚𝙢𝙤𝙧𝙮 𝙨𝙖𝙛𝙚𝙩𝙮 defect? 🎩 🪄 ⚡

Imagine shipping a note taking app in 2025, and adding screenshot capabilities (OMG YAY!) and then saving the screenshots in JPEG and not PNG. 😖

More thoughts of David Lynch: one time sitting at the counter at the RR Diner, a slender man walked up to me, handed me a blue rose, said nothing, and then left. Just to me and not to anyone else in the diner. Was it the cherry pie and damn fine coffee that gave me away? Truly a Twin Peaks moment! 🦉

If you’re grieving David Lynch as hard as I am Take this as a sign: Best way to honor him is to craft something cool and weird. Write the thing you were scared to write. Or paint or film it or whatever. He approves.

I hear David Lynch's voice as I read his quotes today. 💔 🗻🗻🦉🌲🪵 🍒🥧☕️🍩 🕵🏼‍♀️ 👍🏻

Thinking of David Lynch and my pilgrimages to Twin Peaks. 😭

Check out Cloudflare's Secure by Design pledge update about how they are reducing entire 𝙘𝙡𝙖𝙨𝙨𝙚𝙨 of vulnerability. They emphasize their "prevent, not patch" philosophy, and efforts to build frameworks that empower developers to write safer code. Lots to ponder! 🤔

𝙏𝙧𝙚𝙖𝙩 𝙖𝙡𝙡 𝙣𝙚𝙩𝙬𝙤𝙧𝙠𝙨 𝙖𝙨 𝙝𝙤𝙨𝙩𝙞𝙡𝙚. This is no longer a paranoid theory, but today's objective reality. Wired article on phone surveillance: https://buff.ly/4jcAqEY My case for encrypting all the things: https://buff.ly/4iA9i25

Chris Beattie did a nice write up on hacklore and introduced me to a "scientific" paper about the dangers of public wi-fi. 👻 🤔 🤣 https://buff.ly/40nwVUB

I’m surprised this type of false advertising is legal.

www.theguardian.com/culture/2025... #TwinPeaks