On February 24, 1989, FBI Special Agent Dale Cooper arrived at the wonderful town of TWIN PEAKS to investigate the murder of Laura Palmer. The events that he would live there from that moment would mark the course of his life forever. #TwinPeaksDay

#TwinPeaks Day

Happy Twin Peaks Day to all who observe! I'm looking forward to some damn fine coffee and cherry pie! Wish I lived closer to the RR Diner. Best pie in the tri-counties! 🗻🗻🦉🌲🪵 🍒🥧☕️🍩 🕵🏼‍♀️ 👍🏻

📰 When headlines fixate on “zero-days,” they distract from the real question: What is the manufacturer doing to prevent *recurring* classes of coding error? 🤔 Drama focuses on the Villains. Accountability focuses on how the Vendors make the product.

This site from the Government of Canada promotes some classic #hacklore. Does anyone have contacts in the appropriate department? I'd like to help them update their guidance. 🙏🔐 www.getcybersafe.gc.ca/en

🧟‍♀️ Still giving out zombie advice about public wi-fi? Still warning about evil baristas hacking people's devices in the cafe? Check out hacklore.org for the guidance that will actually help everyday people stay secure online. 🔐

It’s time to retire the phrase “sophisticated threat actor”. 🌴 🍹 🏄️ Let's get beyond vague adjectives that celebrate the villains 🙄 and start talking more about how software design can play a role in keeping people and organizations safe. 🔐 medium.com/@boblord/tim...

How is this still possible? I use almost no extensions for this exact reason.

What software companies are not CNAs for their own products, but should be? And why? 🤔 Boost for reach. 🙏

Tired of zombie cybersecurity advice that should have been dead and buried by now? 🧟 Stop letting the undead waste your time. Visit hacklore.org for the cure! Real-world threat models. No fear theater. Just the facts. 🔐 Boost to your network! 🙏

🔥 Killer post about hacklore from Huntress 🔥 www.huntress.com/cybersecurit... They write, "Drop the lore, defend the core". Brilliant!! 🔐🙏

I can't stop thinking about Isaac Asimov's story "The Feeling of Power" from 1958. en.wikipedia.org/wiki/The_Fee...

The showed us cute missing dogs & we consented to turning our doorbell cameras into a mass human tracking system. Mark my words, Ring's Search Party will become the next Flock. Only instead of just being sketchy cameras installed in parking lots, it will be everywhere. That's their play.

📣 Spread the word! 📣 Don't forget to subscribe! buttondown.com/hacklore/

full res

Both times I used Claude today it gave surprisingly bad answers. In this response, it claims that the current year is 2025.

Me: Claude, help me troubleshoot this Enigma machine. Claude: Test with rotors removed - Remove all rotors and press the problem keys. If lights now work, the issue is in the rotor stack. If they still don't work, the problem is in the keyboard contacts or lampboard wiring. Me: ...

Apologies for the spoilers, but desperate times call for desperate action! 😱 🔐 Someone needs to send the NYT the correct answer to this puzzle: www.hacklore.org/passwords It's not 2010 anymore, but you wouldn't know it from all the #hacklore out there... 🤔

#TwinPeaks / Keith Kamikawa

Whoa, San Francisco isn’t a hellhole after all? (by @emilydreyfuss.bsky.social) sfstandard.com/2026/02/06/s...

The personal VPN industry is a textbook case of snake oil for most people, most of the time. It's really fascinating! 🐍🛢️💸

Hey Peakies, OG and new, if you’re looking for the whole story… look no further. #scottmeslowbksy.social

Since the below news broke I've seen some minimize the artistry of Lynch's writing. It calls to mind Paul Schrader's story of being asked by De Laurentiis to rewrite Lynch's unfilmed BLUE VELVET script & replying it was "one of the best scripts I’d ever read...there was no way I could improve it."

The term "root cause" is the label you give to your decision to stop investigating an accident or near-miss.

🧟‍♂️ Time to retire that zombie advice! See hacklore.org! (This post was sent from cafe wi-fi! 😆)

🧟 𝒛𝒐𝒎𝒃𝒊𝒆 𝒂𝒅𝒗𝒊𝒄𝒆 /ˈzämbē ədˈvīs/ 𝘯𝘰𝘶𝘯 Cybersecurity guidance that has outlived the threat model that created it, continuing to circulate despite changes in technology, attacker behavior, or empirical evidence. 🧵...

Give the _ultimate_ Valentine’s Day gift to someone special. 🌹 ❤️ Help them protect their online accounts and devices! 😍 Love means steering each other away from myths and toward what really protects us. 🔐 Learn more at hacklore.org 👀

Cyber threats have evolved over time. If the risk of a particular threat decreases, then our list of top to-do items should reflect the changing landscape. Today @boblord.bsky.social argues that some old advice should be retired as #Hacklore. podcast.firewallsdontstopdragons.com/2026/02/02/d...

🌹 ❤️ Want to give the ultimate Valentine’s Day gift to someone special? There’s no better way than helping them protect their online accounts and devices. 😍 Love means steering each other away from myths and toward what really protects us. 🔐 Learn more at hacklore.org 👀

Why does hacklore persist when we should know better? 🤔 Short answer: Hacklore survives because it fits the incentives of almost everyone involved. Longer answer: medium.com/@boblord/why...

Carey does it again! What a fun time. Take a listen! 📻 🔐 And sign up for the hacklore.org newsletter! 🤓 And OMG that looks like my old TVI-920 monitor! 🤯

This is not a "remote code execution (RCE) flaw". Executing code remotely is what the Villains did right. That's attacker-centric language. We need to focus on what the Vendor did wrong. The software had a "weak authentication" flaw. #SecureByDesign www.bleepingcomputer.com/news/securit...

🤔 Some OSs are not secure by design, so users have to bolt-on "security" apps to reduce risk. But those "security" products run with extensive privileges and expand the attack surface. So their compromise is everyone's compromise. Did I get that right? service.web-safe.link/ahEse7_flash...

This was a ton of fun. Hope you all tune in!

🎉 We just crossed 500 subscribers on hacklore.org — and we’re just getting started. Want to know which security advice is past its expiration date? Check it out! 🔐 👉 Join the newsletter: buttondown.com/hacklore

I was able to get Signal to compile and run on my arm64 Chromebook in the Linux container. But attachments, like images, don't work. They seem to get fetched but don't render. So close and yet...

The CVE Program is transitioning from an era of expansion to an era of quality. What does that mean in practice? Here's my take on what “quality by design” should mean for the CVE ecosystem: medium.com/@boblord/cve...

A number of Washington Post journalists asked for tips from government workers last year and posted their personal phone numbers for @signal.org. Please know that Signal allows you to create a username, meaning you can keep your phone number private. signal.org/blog/phone-n...

Gmail's spam filters seem to be off for me, and every email has the suspicious banner at the top. Anyone else having this problem?

I started Granitt in 2022 to help journalists and other groups of at-risk people continue to do their work safely and securely. Please get in touch if you’re looking for an assessment, policy and process development, training, or presentation. techcrunch.com/2022/07/15/g...

The home of Hannah Natanson, a Washington Post reporter, was searched by the FBI. Her devices were seized. I spoke to @columjournreview.bsky.social about the potential damage and what news organizations need to know. www.cjr.org/news/hannah-...

🦹‍♂️ There is an entire industry of "security" products designed to distract you from deploying phishing-resistant MFA. Organizations that eliminate classic credential theft scams (I don’t like the term “phishing”) can then refactor internal processes, and even eliminate the need for some products. 🔐

Moxie Marlinspike—the engineer who set a new standard for private messaging with the creation of the Signal Messenger—is now aiming to revolutionize AI chatbots in a similar way. arstechnica.com/security/202...

It's so hard for us humans to accept we got something wrong & unwind actions we took / opinions we formed. It feels like it's going to be so painful. And so we tend to stubbornly double down. These days, life often remind me that, in fact, if you own the change w/ humility, it's easy & uplifting.

Passkeys provide an easier, faster and more secure way to log into online accounts than passwords.🗝️ Read more about how the NCSC is keeping pace with evolving technology⬇️ https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-03-keeping-pace-with-evolving-technology

🎅 🛷 🎆 ✈️ Our holiday travel hacklore newsletter is out!​ ​ 📖 Read it here: buttondown.com/hacklore/arc... ✉️ Subscribe: buttondown.com/hacklore/ ​ 🕸️ Spread the word to your networks!

Twin Peaks' Laura Palmer theme gets a cat-piano cover ☕🍒🥧🕵️🪵🌲🦉 boingboing.net/2026/01/09/t...

📢 CVE users: The CVE Program is entering an era of quality. A new proposal aims to normalize date and time fields across CVE records. If you are a CNA or ingest CVE data programmatically, please review. www.cve.org/Media/News/i...

I’m working on the next hacklore newsletter, and the holiday season delivered a fresh wave of peak hacklore! 🎁 😜 📬 If you want fewer security myths and more reality-based advice for everyday people (including ways for you to help!), subscribe here: www.hacklore.org/about

Happy New Year! May it be all that you hope for.