A few of us are (finally!) in the last stages of editing a new book 🎉 and the tentative title is "Creating Safety: How to build with new technologies without shooting yourself (and others) in the foot" Good title? Have a better one?

Security folks: have we considered *not* releasing security patches for the avalanche of bugs we're about to deal with? Hear me out. Given how much faster it's getting to reverse engineer an exploit from a patch and that we're expecting to fix *so* many bugs at once, maybe do a full release.

I don't want to tempt the evil eye or anything, but this paper I'm reviewing for USENIX Security looks amazing. In the good way.

Delve claims "Your CISO's cardiologist will thank you." Spoiler: they will not. www.inc.com/ben-sherry/t...

Incompetent social engineering or silly sales? Ring. Ring. "Hello". Hi! Is Lea Kissner there please? I'm sorry, they are not available. Can I take your information and have them call you back? This is Valerie calling from Dialexica. I represent them, and would like to talk to Lea.

We're looking for a director to handle a huge and fascinating scope with a 70+ person team in LinkedIn security: AI security, appsec, production security, security of the corporate systems, third party security, and handling the corporate identity services.

Are you selling a security product? Can you please do us both a favor and just tell me what it is? Just explain literally what it does and how. Risky Business was kind enough to start a catalogue with useful descriptions for their advertisers, but can we please normalize this? risky.biz/catalog/

People are people. Even if you disagree with them, even if they're confusing to you, even if they hurt you. If you watch people doing this, you can see them ripping out part of their soul. We aren't getting into a better world without *all* of us getting there.

My child has learned that when they yell "are you awake?" late at night the answer is "yes".

I too, have open questions for Lea.

Being willing to look stupid is a superpower

This is my biggest pet peeve about dashboards: what is someone going to *do* when they get this information? If it's "be informed" that's the same as saying "nothing" and why did you even bother?

I have no idea what this person wanted when they called my spouse, but if they ask me for more wipes I also do not know what to say.

A security vendor sent me a pile of paper with many statistics where [citation needed]. For instance.... Why does automating IAM reduce the likelihood of a breach to 5%? From what? And how is that independent from, say, use of passkeys or auto-escaping templates?

Progress in my ongoing effort to decorate the wall behind me with something other than stacks of books. 🧵 for the fun stuff The round thing is the Incident Hat/Bad News hat. I can't remember if I've told this story here, but basically I trained several companies to be scared of a hat instead of me

Folks in privacy engineering and related fields, it's PEPR time again -- submit talk proposals about topics related to designing, building, and understanding products and systems which foster privacy and respect. I'm looking forward to seeing your talks! www.usenix.org/conference/p...

I know perfectly well there are bilingual people at Google, so what were they thinking by having YouTube automatically translate videos with no way to turn it off? Thank goodness they haven't managed to translate every language yet, so I can coherently watch at least some non-English videos

This is one of the nightmares of modern security. We need to know where every single one of those is, what we're trusting it to do and not do, and how to make it stop *immediately*. And every time someone wants to use a new one we need to figure out whether we can trust it as far as we can throw it

Bluesky buddies, I now have a 3D printer in my house, a relatively simple design little counter design I've had sketched out for several years, and a complete inability to 3D model. Does anyone know someone who could work with me to get this together? Happy to pay the going rate, whatever that is.

Prop 13 has had some wild effects on schools in California. Even back when I was in high school in Palo Alto, which is the well-off and education-focused town where Stanford is, they made the chemistry classes enter competitions so people would send us lab equipment.

As a security person, I SO appreciate great bits like this open letter around bad security advice ( www.hacklore.org/letter), especially given that it's got reputable people like @leak.bsky.social signed on. I agree that outdated advice and half-truths are just as bad as giving wrong advice.

I considered adding a picture of my study but the piles of books are sprouting piles of books. And I just ordered some more books.

The comment thread here is the embodiment of :lolsob: There is legitimate promise to LLM-assisted coding, but there are also legitimate risks. Like this. And no one here is malicious!

now everyone together quote @leak.bsky.social

The "Gear" series on the Articles of Interest podcast has convinced me that if for some reason I was in the armed forces (and I wasn't doing the obvious things for me to do) I would want to be in the quartermaster corps. The complexity in clothing alone 🤯 www.articlesofinterest.co/podcast

If my emails ever get leaked, just know that I'm not sub-literate, I'm lazy.

A performance plan (PIP) is incredibly hard on everyone involved. The person going through it, the manager, and *the entire team*. When I'm running one, I deeply want to help the person going through it find whatever's missing so that they do an awesome job and we can keep working together. 1/🧵

Up until a few weeks ago, the conversation virtually always went like this: Them: "why are you wearing a mask?" Me: "because I don't want to accidentally kill my mom. Plus I hear COVID is no fun." Them: *vivid story of how terrible COVID is* It sounds less fun than wearing a mask, y'all 🤷

New life goal unlocked

I hired a director recently and this was my screening question: can you please explain the difference between public-key and symmetric-key cryptography. Virtually all the candidates, who universally claimed security engineering expertise of some kind (some cryptography-related) could not. At all.

"Betteridge's law of headlines is an adage that states: "Any headline that ends in a question mark can be answered by the word no."" en.wikipedia.org/wiki/Betteri...

"Worked for" is an exaggeration here -- while there may be actual staff in this group, these scan centers are mostly operated by victims of human trafficking. This is one of the many reasons we need stronger online security across the board: to break the incentives behind this horror.

Would you like to work on LinkedIn? InfoSec is hiring! We have both manager and IC roles -- and more coming. I'm here because I want to help protect people and not work with jerks. If that's what you like, then I hope you'll join us. Jobs in 🧵

Encryption without key rotation is just sparkling obfuscation

Not being a jerk is a shockingly underrated hiring strategy.

pleasures of the flesh fade, other people however much you love each other will sometimes let you down, the world is filled with sorrows. but from today until the last day of your life, wherever you are if you pay attention there is something new to learn. it's a great comfort.

The number of people who don't seem to realize that people in the same field, even in the same team, talk to each other is astonishing. A security vendor invited me to a dinner with featured guest the "VP of IAM at LinkedIn". There is no such person. I'm so curious who; the vendor wouldn't answer.

TIL that setting LESSSECURE makes you more secure

Fully most of what I travel with for any trip is food, which I am not willing to risk the airline losing, but speaking as someone who packs light to the point where I did a 4-day trip with only a briefcase (pre-having-to-carry-all-of-my-food situation), this is the hard way to travel light!

At one job someone decided to argue with me about whether my pronouns are grammatical. a) yes they are I have citations b) what an extremely odd fight to pick at work In summary, there are so many ways not to be a jerk and not being a jerk is one of my life goals

Vibe coding is a lot easier if you don't care about breaking things

Weird Al: You think your Commodore 64 is really neato Audience dude: IT IS! youtu.be/qpMvS1Q1sos?...

In "people are awesome" news, some UPS drivers helped me find the UPS driver driving around with my medication and he popped over and gave it to me and told me how to find him if I end up with a meds emergency again. Stand up dude and I owe him.

I'm failing to remember enough to Google this, but I could swear there were cases where someone mixed corporate data into personal systems (or vice versa), personal data got dragged into legal discovery, and it was embarrassing all around. Does anyone have a pointer?

The big problem with having agreed to write a book is having to actually write the book

@kendraserra.bsky.social just gave an interesting talk about strong "you will not disclose any security bugs you tell us about" NDAs on some disclosure/bounty platforms I'd add something to that: companies have a real incentive for people to disclose closed vulns 🧵 www.usenix.org/conference/u...

@adamshostack.bsky.social says STOP DOING RISK 😆 (Math says no to a lot of things people do to try to predict risk. If math says no, I do, too) This talk is fantastic, I have so much to think about #usenix

I will admit that I find it endlessly entertaining to watch people try and fail to pick up my luggage -- this 30L backpack has all my food and accoutrements, a bunch of electronics, and personal items for 5 days. Fits under the seat in the airplane *and* provides me my workout for the week.

I hope I'll see y'all at USENIX Security this week, wherein I will be giving a talk complaining about real world challenges (and hoping to get some smart research folks on them)

Pretty much any backpacking is good backpacking, but may I suggest backpacking to the beach?