(part 3/3) 🪶 Kelly Shortridge - Birds of a Feather: Adapting to the Unknown: Resilience Engineering in a Time of Chaos For more details, see our article on CyberCanon RSAC sessions/signings: www.linkedin.com/pulse/cyberc... #RSAC2026 #CybersecurityBooks

Anthropic’s paper argues reality distortion is rare in software domains, but I’m not so sure. https://aphyr.com/posts/405-trudging-through-nonsense

Big props to Rick Horwitz, Senior Sales Engineer at Fastly, for speaking at FutureCon LA on “Making attackers cry: outsmarting them with deception.” Great insights on using deception to turn the tables on attackers. 👏 Take a look: vimeo.com/1156613679/2...

NEWYORKC.BMF

One of my 2026 goals is to start writing more, so over the holidays I resurrected my old blog and plopped out a post about silly coding interview problems in the Lean theorem prover dijkstracula.github.io/posts/provin...

Free (as in puppy) idea for an enterprising tech journalist/blogger: the 10 year rise of corporatized open source

Following last week’s critical #React2Shell disclosures, two more related CVEs dropped on 12/11. Fastly customers: Based on current info, Fastly’s platform & apps aren’t vulnerable — but orgs should still review their own React + Next.js apps. Learn more here: www.fastly.com/blog/react2s...

www.fastly.com/blog/unparal... This is my first big project since joining @fastly.com and I'm very hype about it. Literally C++ built on _top_ of our Rust SDK, because having access to C++ does, in fact, still open doors to a lot of folks.

A new #Jepsen report: we demonstrate data loss and persistent split-brain in the NATS streaming system, in response to simulated power failures/OS crashes. https://jepsen.io/analyses/nats-2.12.1

In addition to all of the other benefits already reported about NYC congestion pricing, "In the first six months of the program, air pollution – in the form of particulate matter 2.5 micrometers and smaller – dropped by 22% in the Congestion Relief Zone (CRZ)" news.cornell.edu/stories/2025...

🚨 React2Shell Update: Fastly saw a 2,775% spike in attack traffic after the public PoC dropped. Attackers are actively scanning — verify exposure and patch now. Updates: • Expanded Virtual Patch • NGWAF detecting new scanners • Bot Management flagging tooling More intel to come. #React2Shell

⚠️ Friday’s #React2Shell update @fastly.com saw a 2,775% increase in attack activity across our global network between the peak we reported yesterday (Dec. 4th) and 20:00 UTC today (see graph). We recommend you immediately patch vulnerable apps and apply proactive protections to buy time as needed.

You might want to check on your apps. There’s some 🔥 🥒 🔥 spicy unpickling going on …

⚠️ update on #React2Shell After the POC dropped ~21:04 GMT today, Fastly detected a profound proliferation in the # of requests triggering our NGWAF signal for React2Shell (see graph). We strongly recommend you immediately identify and update your React / Next.js apps + apply proactive protection.

There’s a react2shell POC circulating that appears to be viable. Fastly verified our NGWAF successfully blocks this exploit variant. ⚠️ Our initial data points suggest attackers are actively probing for vulnerable apps. ⚠️ Identify and update your React & Next.js apps + layer proactive protection.

the bad news: lots of sloppity slop PoCs (slopocs???) abounding for the critical pre-auth React RCE the good news: more time for you to patch your #React & #Nextjs apps ✨ my write up from yesterday on what to know & what to do: www.fastly.com/blog/fastlys...

last week i remembered that macOS lets you set your own icons and that *I* have the power to delegitimize the professionalism of the software that runs on my machine, so here's a thread of the 16 new icons i've made so far i really forgot how fun it was to just sit down and make art for myself :')

So, in case you haven’t heard, a recent upset of an A320: avherald.com/h?article=52... Was traced back to, of all things, solar flares disrupting an onboard system: avherald.com/files/AOT-A2... The fix is a software patch on most of the 6000 affected aircraft, but it still takes 3 hours to complete

OH in my downtown Manhattan hot yoga class: woman 1, sad: “Yeah, I unfortunately had to move to Boston for work.” woman 2, sincere: “Oh no! Do they even have yoga out there?”

Can you believe I wrote about manager READMEs again? medium.com/@skamille/re... If you hate medium, you can also look at my ancient blogger where the formatting is a bit wonky: www.elidedbranches.com/2025/11/revi...

Keep this in mind when people claim cars mean business — closing Central #Madrid to cars over holidays resulted in a 9.5% boost in retail spending on its main shopping street: STUDY. There was also a 71% drop in air pollution. Via @carltonreid.com in @forbes.com. #citymakingmath #citiesforpeople

on type safety

The Last Couple Years in V8’s Garbage Collector, by @wingolog.org: https://wingolog.org/archives/2025/11/13/the-last-couple-years-in-v8s-garbage-collector #v8 #javascriptengines #garbagecollection #memory #retrospectives

Which podcast is mispronouncing either metric or matrices as metrices

as someone who often thinks in ancient oak-style trees with their sprawling, gnarled branches extending into the blue infinity: I’m so so hyped we launched a way for you to visualize your public API hierarchy as a tree!!! ✨ let us know what you think

💻 Make sense of the chaos with API Discovery 🔍 Managing APIs doesn’t have to be a burden. With just one click, API Discovery takes away the mystery and gives you complete visibility into what APIs are in use on the Fastly edge network. Learn more: www.fastly.com/blog/make-se...

As we recently talked about our security strategy, my teammate made me aware of this post by @shortridge.bsky.social: kellyshortridge.com/blog/posts/o... There's so much wisdom in there, absolutely recommended reading! ✨

Modern Programmers do be getting humbled by the little old lady in accounting who has custom crafted 70 excel sheets that all cross communicate and update each other.

I have often stated that well-implemented memory tagging will be a game changer for memory corruptions. And it seems that with the next iPhone it's finally here: security.apple.com/blog/memory-...

Check out the graphical abstract for a paper recently published in Ecological Modelling. I have papers published in Ecological Modelling. Never again, I guess.

At long last - Phrack 72 has been released online for your reading pleasure! Check it out: phrack.org

👏 Thx to the @python.org for the shout out in their latest blog post on strengthening PyPI security! Their new safeguards against domain resurrection attacks make it harder for attackers to exploit expired domains for account takeovers, a win for open-source security. blog.pypi.org/posts/2025-0...

end of an era. AOL is discontinuing its dial-up internet next month

Ignoring all else, I actually think "it just does stuff" is Bad, Actually. My honest to god thought about work for years and years and years has been "too much doing without thinking, productivity theater, generating just to generate" www.oneusefulthing.org/p/gpt-5-it-j...

For PW, I wrote about the persistent gender gap in fictional animal characters—a pattern I noticed while analyzing 100s of picture books with @puddingviz.bsky.social. It's a more interesting (and pervasive) problem than I first thought. #kidlit #booksky 🔗: www.publishersweekly.com/pw/by-topic/...

WebAssembly Component Model based REPL with sandboxed multi-language plugin system by @topheman.bsky.social github.com/topheman/web...

Asking the OpenAI Whisper audio model to transcribe 30 seconds of silence generates the output "ترجمة نانسي قنقر", which is "translation by Nancy Qanqar". Nancy Qanqar is a volunteer translator of (among other things) many pirated movies, so that invites an interesting conclusion on data sources.

OSDI'26 is adding a new Operational Systems track and aiming for a higher acceptance rate: usenix.org/conference/o... I hope this will help expand the conference's scope and include more papers.

Sharks love our undersea cables. 
Some suspect the weak, low-frequency fields attract sharks like distressed fish. 
 Fiber optics are particularly tasty; AT&T expressed no incidents with “old [copper] cables”.
 In the 80s, telecoms called the incident Jaw's Syndrome.

The late and much missed Ross Anderson once wrote “The idea that complex social problems are amenable to cheap technical solutions is the siren song of the software salesman and has lured many a gullible government department on to the rocks” and I feel that needs to be embroidered and tattooed.

#WebAssembly: Yes, but for What? WebAssembly has found a niche but not yet filled its habitable space. We look at #Wasm wins and losses, identify patterns, and extract commonalities. From those, we predict the future. queue.acm.org/detail.cfm?i... @wingolog.org

The three types of data structures in computer science are FIFO, LIFO, and FAFO.

this is interesting and balanced research and it confirms my priors so i'm sharing it (h/t @jenvalentino.bsky.social) but also it makes sense — LLMs speed up the typing part, which often feels like the bulk of the job, but is actually dwarfed by the thinking part. and these things don't think good

Omg, absolutely incredible reason for AO3 to have been down hachyderm.io/@vashti/1147... (alt text at original)

[Please share with people outside of cybersec] Do you have a horror story when you had to deal with cybersecurity companies / people? This is your chance to vent! → forms.gle/9aX24HrfnEQm... I'm running an anonymous survey to listen to stories and look into the disconnect we sometimes have.

News @bloomberg.com ! The US is investigating an ex-ransom negotiator accused of conspiring with hackers www.bloomberg.com/news/article...

ask for my network: do you love teaching intricate topics to humans? know a friend who does? I'm hiring an empathetic, creative, and collaborative Technical Marketing Engineer to join my product team at Fastly: www.fastly.com/about/jobs/a... don't be shy, pls apply! ✨ @developer.fastly.com

People freaking out when chat gpt says it’s alive