Who else is going to #offensiveAICon tomorrow ?

I'm old enough to remember when Republicans said government talking with a technology company about removing content was censorship.

I'm old enough to remember when Republicans said government talking with a technology company about removing content was censorship.

Yes! www.courtlistener.com/docket/71543... www.courtlistener.com/docket/71543...

This is a really, REALLY good order. It unseals everything but the search warrant affidavits - the part I knew would be hardest and wasn't expecting to get. And even for those, the court says they shouldn't be sealed forever and tells DOJ to file a status report within 90 days. That's incredible.

If you've been following my six-month quest to unseal the search warrants for XiaoFeng Wang's homes, huge news: I won. storage.courtlistener.com/recap/gov.us...

The Wikipedia entry about the ship of Theseus has been edited 2,052 since it was published in 2003. Number of sentences from the original post that remain today: 0 Number of original graphics in this post: 0

A poignant, immensely courageous and most thought provoking essay, by a fellow alumna. College at Age Sixteen: What Is Intelligence For? Simon's Rock College, and the Center for Talented Youth, and the challenge of gifted children. By Lydia Laurenson open.substack.com/pub/lydialau...

As we use AI to scale, we need to know how to threat model to evaluate what the AIs produce. That's why my team and I are revamping Adam Shostack's Threat Modeling Intensive just for OWASP from Nov 3-5, 2025 in Washington D.C. The AI revolution is now. Stay secure from day 1. tinyurl.com/yexsbccm

Hey authors, the official list of Anthropic works is available for searching. secure.anthropiccopyrightsettlement.com/lookup

Sept’s AppSec Roundup: SIM farms fueling swatting, Apple’s Memory Integrity, a sharp paper on LLM prompt attacks, and regulators still fumbling “secure by design.” Progress is uneven—but the lessons are clear. is.gd/Yh9SDW

Excited to be talking AI & SF (incl. killer-love-sex-art bots) with 2025's @clarkeaward.bsky.social winner, Sierra Greer, my fave @drkatedevlin.bsky.social and the Science Museum's Jenny Wong Thurs 2 Oct at 1pm BST at Kings' online AI conference. Tix are free! www.eventbrite.co.uk/e/annie-bot-...

Please - stop doing the screenshot no link thing on Bluesky. This platform does not punish you for posting a URL. You picked up the habit from Meta apps? Stop doing Mark Z's bidding. Link ESPECIALLY to authors, reporters, bloggers, etc. where you quote the work.

How many dimensions can chess have? Asking for a very logical friend.

Scaling threat modeling isn't about perfect methodology—it's about everyone on your team being able to answer four fundamental questions. Don't let complexity prevent you from starting. Begin with these questions and improve iteratively. Full discussion: creators.spotify.com/pod/profile/...

It feels like every year landlords ask "how can we make this situation more miserable for our renters." I hope anyone demanding tenant payroll login information finds themselves in litigation when that data inevitably gets breached.

Marty Lederman is a law professor and former DoJ attorney.

We're baaaccckkkkk... and this time, we have @adamshostack.bsky.social! Join us next month, Oct 29th 14:00 CST, for a meetup on threat modeling: developing them, using them, and publishing them. RSVP to attend: luma.com/6fvp6orm

If I was Donald Trump I would not be drawing the public’s attention right now to my ability to release files

Three tariff announcements tonight, each one is dumber than the last. I don’t even know how to read this except as a way for the White House to exempt US pharma multinationals (who import a lot but are always building *something*) and push out smaller foreign competitors.

Very good. Although it must be mentioned that I still don’t know how to select my own algorithm.

I've looked over the whole 2026 budget, and a lot of stuff jumps out (incredibly, JumpStart revenues will pay for security for FIFA games), but the bottom line is that Harrell's budget is barely balanced. It projects growing deficits starting in 2027—$140M, then $270M, then $374M.

Harrell cites the father of a young man killed at Garfield High School as evidence that cameras are needed. The father of that teenager, Amarr Murphy-Paine, has come out strongly against cameras. Read his quotes here: www.fox13seattle.com/news/cctv-ex...

1/ Hi, I'm TProphet. I write the Telecom Informer for @2600.com. A lot of people have been asking me about www.nbcnews.com/politics/nat... given that I'm somewhat knowledgeable in the area. Here's my take: I'm kind of astonished that this is public, and it isn't normal that it would ever be.

More than 1800 detainees are missing after the closure of Alligator Alcatraz. Their families and lawyers can’t find them and they’ve vanished from the ICE database. Feels like this should be a much bigger story www.miamiherald.com/news/local/i...

I want to write a post about "Documentation theatre", that is, when docs are performative and not really addressing a need nor caring about it.

This paragraph is so funny

Really? That's the pathetic excuse you're going with?

Low-key super annoyed at both regulators and the cybersecurity industry as a whole that incidents at this scale are allowed to be vague on the technical details of how the breach occurred so that peers and other industries can audit and close similar vulnerabilities in their networks

It's a great breakdown of the trailer if you like more focused analyses and learning about the details, but it also addresses the Disney situation and how recent events fly in the face of some of the most fundamental lessons explored in Star Wars.

What if, like the #rapture, but it happened 7 years ago and all the good Christians went to heaven, and this is the he tribulation?

Apparently not. www.science.org/content/blog...

This feels really gross. www.hollywoodreporter.com/movies/movie...

Uhh... Bagram Airbase was built by the USSR, so... good luck with that, I guess?

3. The absolute goat rodeo nature of the meeting itself demonstrates that few if any on ACIP understand their roles and what their votes mean. 4. Many of the members seem to have just realized that making PH policy is a lot harder than tweeting potshots at the CDC.

They’re playing 7500 year old archaeological find bone flutes

Hey so a little teaser, I'm launching a kickstarter for a new compilation at the end of the month and I do hope you'll support it because I'm not sure I'll be allowed to do this again if present trends continue. Hoping to get this one in under the wire.

Never thought Karl Rove would find common ground with me, but he’s welcome, and I hope those who believed him before keep listening.

All models are wrong, but some are useful. It helps to state the goal. A Lego rover is fun — and teaches. A NASA trainer simulates moon gravity. Same object, wildly different ROI. In threat modeling (and life), clarity of purpose beats pretty diagrams. is.gd/Z0Nodf

Will a reporter show this graphic to the next MAGA pol who claims that it's time for "the left" to tone down their rhetoric?

A signed Apollo 15 photo to Boeing sparked thoughts on risk, trust, and engineering. Real recognition, managing uncertainty, and knowing which risks are worth it — lessons we still ignore in modern projects. Are we undervaluing “soft” risks? More: shostack.org/blog/apollo-...

Would you take this bet on a work gig? Handcuffed, forced to lap up water, and the host country says “face no disadvantage” if you come back, as if it were their fault?

Just published: my written testimony from last week’s Senate subcommittee hearing. It covers the extraordinary impact of vaccines, the transparency of our multi-layered safety systems, and the bipartisan support they’ve had - from Washington to Trump. www.msnbc.com/opinion/msnb...

CISA says "Privatizing the CVE Program would dilute its value as a public good," and that dialogue it has had "opened the door to new relationships, conversations, and valuable feedback about the CVE Program." CVE Quality for a Cyber Secure Future www.cisa.gov/sites/defaul...

@micahflee.com catching up on your defcon talk, did you look to see if telemessage's signal client is keeping up with bugfixes from Signal? Your comment re them not updating spring caused me to wonder...

At @hcde.uw.edu, we will be hiring an Assistant or Associate Teaching Professor this coming year! Timing wise, we are hiring for a Sept. 2026 start date, but could be sooner. We are looking forward to welcoming a new colleague! Learn more and apply at apply.interfolio.com/171881

I fuck up in Portuguese all the time. Every single day. I only hope my fuckips seem as cute to people here as I find englitches. Bring shitty to La language learners helps exactly no one.

This is the official spokesperson for the White House, stating that the President hopes to deploy the United States military to occupy every city controlled by the political party that opposes him. Explicitly.

LLMs in threat modeling? Helpful as assistants, risky as decision-makers. I explore how they might nudge, but not replace, real security thinking. Read the post: is.gd/LlsXKm #ThreatModeling #CyberSecurity #AI

(If this is you about to send me that email I know you tried your best and you protested how dumb it was. But compliance doesn’t run on nuance so just send it and let me do the work for you).