The number of people who don't seem to realize that people in the same field, even in the same team, talk to each other is astonishing. A security vendor invited me to a dinner with featured guest the "VP of IAM at LinkedIn". There is no such person. I'm so curious who; the vendor wouldn't answer.

TIL that setting LESSSECURE makes you more secure

Fully most of what I travel with for any trip is food, which I am not willing to risk the airline losing, but speaking as someone who packs light to the point where I did a 4-day trip with only a briefcase (pre-having-to-carry-all-of-my-food situation), this is the hard way to travel light!

At one job someone decided to argue with me about whether my pronouns are grammatical. a) yes they are I have citations b) what an extremely odd fight to pick at work In summary, there are so many ways not to be a jerk and not being a jerk is one of my life goals

Vibe coding is a lot easier if you don't care about breaking things

Weird Al: You think your Commodore 64 is really neato Audience dude: IT IS! youtu.be/qpMvS1Q1sos?...

In "people are awesome" news, some UPS drivers helped me find the UPS driver driving around with my medication and he popped over and gave it to me and told me how to find him if I end up with a meds emergency again. Stand up dude and I owe him.

I'm failing to remember enough to Google this, but I could swear there were cases where someone mixed corporate data into personal systems (or vice versa), personal data got dragged into legal discovery, and it was embarrassing all around. Does anyone have a pointer?

The big problem with having agreed to write a book is having to actually write the book

@kendraserra.bsky.social just gave an interesting talk about strong "you will not disclose any security bugs you tell us about" NDAs on some disclosure/bounty platforms I'd add something to that: companies have a real incentive for people to disclose closed vulns 🧵 www.usenix.org/conference/u...

@adamshostack.bsky.social says STOP DOING RISK 😆 (Math says no to a lot of things people do to try to predict risk. If math says no, I do, too) This talk is fantastic, I have so much to think about #usenix

I will admit that I find it endlessly entertaining to watch people try and fail to pick up my luggage -- this 30L backpack has all my food and accoutrements, a bunch of electronics, and personal items for 5 days. Fits under the seat in the airplane *and* provides me my workout for the week.

I hope I'll see y'all at USENIX Security this week, wherein I will be giving a talk complaining about real world challenges (and hoping to get some smart research folks on them)

Pretty much any backpacking is good backpacking, but may I suggest backpacking to the beach?

OH MAN I'M BEING SOCIALLY ENGINEERED IN REAL TIME POORLY

A reporter asked me a question today that started with something like "I know personal brand is a really important part of being a CISO..." and honestly I was floored. I just show up and try to be helpful. I'm not aware of that being a branded activity

Achievement unlocked: gesticulated so passionately about cryptography that my watch thought I was having an emergency support.garmin.com/en-US/?faq=R...

It was Company Kickoff at LinkedIn this week. Pay no attention to the giant hacker lurking over my shoulder.

I do not eat any unsolicited food. I never thought I'd need to point this out. Salespeople: security and privacy people are paranoid as a *career*. Sending us random food is unlikely to have the effect you are seeking.

I recently joined the WE'RE IN! podcast. We covered why phishing-resistant authentication beats training people into submission, how AI is shifting the threat landscape, and how security and SRE can partner to make systems safer and better overall   Give it a listen! open.spotify.com/episode/7L7G...

I need to pick a walk-on song and I'm baffled enough to resort to Safety Dance. There's got to be something better -- help? youtu.be/nM4okRvCg2g?...

Oh hey, I'm speaking at that! Come one, come all, USENIX Security is a fantastic conference and I'm so excited that there's an Enigma track for talks about big ideas in security. (I'm planning to talk about a bunch of lessons I learned the hard way after I left academia, but open to suggestions!)

I'd add "if what the protocol does doesn't make sense to non-cryptographers, then it's not going to be used" (or at least not correctly) There have been a lot of protocols that hide certain information wildly incompletely in a way which I frankly can't explain to a human... so I can't use them. /1

One interesting bonus of more senior roles: you're much more likely to have an exceptionally good manager. Everyone's so busy that you will spend less time with them, but they're more likely to be a great manager. I guess that's what happens when you are looking for increasingly capable org leads 🤷

Flew all the way to LA for a (gluten free) bagel. Worth it.

I can only aspire to the level of knowledge and pedantry required to make a 173-page-long footnote.

I absolutely love @xkcd.com's concept of the "lucky 10000" and I feel lucky both every time I get to introduce someone to something neat and when someone does the same for me. Comic at: xkcd.com/1053/

Me: ok Google, 35 minute timer, please Google: playing 35 minute timer with ambient music on YouTube Music 🎶 Me: 😫

It's an awfully economically inefficient situation when everyone feels like they have to save up on their own to build their own safety net. Just saying. I wonder how much of a boost to small businesses, especially startups, came from more-available health care. It certainly made me more willing.

Has this medical device company never heard of TLS/SSL? 😱 "Only use a cellular internet connection, a trusted Wi-Fi network ... or use a secure internet connection such as a VPN ... Don't use unsecured public Wi-Fi ... Those could expose the Stelo Glucose Biosensor to viruses or hacking."

You will stay here. Residence is futile.

Suddenly my head hurts and I don't know whether to blame the paper I'm reviewing or the contract we're negotiating, but whether it's the statistics or arithmetic that did it, apparently math has betrayed me.

... someone just sent me an unsolicited shoebox with three pieces of paper and a thin mouse pad. What a waste. 😔

We need a better launch calendar (i.e. not built based on email). Anyone have a good one? We're looking to speed up product launch coordination as well as coordinate the reviews from security, trust, legal, etc. (I know TerraTrue but there must be more these days!)

Can every security vendor please put a @patrick.risky.biz style no-BS-marketing-speak description of what the heck your product is on your webpage? I am both a reasonably competent security engineer and have a budget and I'm begging you here.

So I read Character Limit... and all of those stickies in the picture are the places where I wanted to add other bonkers stories. I wasn't in the actual building for any of this (I'd just had surgery on my leg) and it was more than bonkers enough over Zoom.

This. The failure often looks like a focus on purity: either you do things exactly how the designer thinks is right or nothing. One interesting example is tools built for political dissidents. 🧵

The Medicis had a painful joint condition -- but lived in a city with a lot of stairs which prized humility and would have seen accommodation as "princely". So to maintain a public life, they did some wild things, like build a 750m ramp that wound *through* the city. www.exurbe.com/historys-lar...

I'm finally reading Character Limit. Living it once was really enough, but here we are. Send thoughts and prayers.

Paul is totally right that using the term "stress case" for handling human needs that the system might not be built around is helpful -- calling them "edge cases" helps people dismiss them as rare and unimportant, even when they are common and important

If you want to build great products, they need to meet the needs of the actual humans using them. Those humans have wildly different needs -- and thus different threat models. Handling safety for at-risk users is both important for those users and awfully helpful in solving these problems broadly.

I was thinking about replacing all phishing training with: * Dude, the CEO is not asking you for iTunes gift cards * If someone does ask for something weird, check with them over Slack/Teams Yet another win for phishing-resistant authentication!

A large chunk of work questions I get boil down to reasonable expectations, good wording, and trying not to accidentally be a jerk. I point folks to "Ask A Manager", which is full of useful scripts. (Also entertaining. People get up to wild things at work.) www.askamanager.org

I should get a coat of arms with the motto "No one likes it when I'm right"

One of the things I didn't expect when I went to grad school to do math is that I would need to spend so much time paying attention to global geopolitics. Threats are from people, so your threat modeling absolutely must include what's happening to them. You can't do security without it.

A business development guy just offered to tell me more about Zanzibar. I ... didn't even know what to say.

So many ex-Tweeps having so much deja vu today. I'm sorry.

Windy Hill really lived up to its name; I was trying to keep the phone from being ripped out of my hand. (I think I'm also a convert to frameless packs for backpacking. Also please take care of yourselves.)

The radical position that every single human ever born is human and should be treated as such.

Enigma will be back as a track at USENIX Security: https://www.usenix.org/conference/usenixsecurity25/enigma-cfp