titsay
AnasAbdin
Cosmic Funnies
Mike Driver
Sweet Seals For You, Always
d e v o n
★
roma★
izzy's playlists!
Lint Roller? I Barely Know Her
i don't do bad sauce passes
NASA
almost home
art blog(derogatory)
we're not kids anymore.
todays bird
Monterey Bay Aquarium
Kiana Khansmith
@theartofmadeline
$LAYYYTER
seen from United States
seen from United States
seen from Chile
seen from United Kingdom
seen from Canada
seen from Lithuania
seen from United States
seen from United Kingdom
seen from United States
seen from Türkiye
seen from Germany
seen from Morocco
seen from United States
seen from Russia
seen from United Kingdom
seen from Malaysia
seen from Hungary
seen from United Kingdom
seen from Philippines
seen from Brazil
@attritionorg
MSRC; Tell The Whole Story Please
Every so often, it seems that Microsoft Security Response Center (MSRC) likes to stick their proverbial foot in their mouth on the topic of vulnerability disclosure. The root issue is that collectively, MSRC does not seem to appreciate either their own history or the bigger picture. As such they have a myopic view on the topic. The latest comes in the form of a new blog titled “A shared…
Mythos Needs to Shift Left
Over the years I have been part of many discussions around a classic debate around red team versus blue team, the value of penetration testing, and the value they each bring. I started my InfoSec career in 1996 doing pentesting (aka red teaming) a couple years before it really exploded. For nine years that was my life and it often meant working crazy hours. My final gig doing it was with BT-INS…
Vulnerability Embargos Are Dead
Introduction When a researcher finds a security vulnerability that impacts more than one vendor, and they wish to coordinate disclosure with both, it creates a situation where an embargo must be put in place. In this context that simply means that all three parties agree not to make the information public until a given date. This is done to allow both vendors to have a fix ready before…
Calif's Bold Claims; Missing Receipts
Here we go again, more Mythos rumors and claims to unpack. I wrote a lengthy blog on Anthropic, Glasswing, and Mythos just over a month ago but this is about a very specific event and set of claims. A significant reason I am writing this is due to what I believe are poorly written headlines that are based in misunderstanding and/or attempting to sound more dramatic than warranted. It looks like…
Noise2Signal Podcast: Which Does the Squirrel Bring?
For those not familiar, Mehul Revankar recently started a podcast named Noise2Signal. While there are a lot of podcasts out there and it is easy to lose track, this one stands out as Mehul has connections with a lot of folks that are significant in the history of information security. In fact, he interviewed Renaud Deraison who created Nessus and was one of the founders of Tenable. That is where…
Amazon Auto-buy: A Slick New Feature
For half a year now, I have been using a third-party site (Keepa) to track movie prices on Amazon (and a few other sites), waiting for them to drop to the price I will pay. New movies are often released on physical media at fairly absurd rates. Almost fifty dollars for a new release when it was $17 in the theatre? No thanks! So I wait until they get down into a decent range before I do. A few…
Security vs Security Theatre; A Lesson for Abbott
The NVD Shell Game & Schrödinger's Enriched Vulnerability
The Night I Almost Died
Starfleet Academy; The Review
Starfleet Academy (SA), the latest TV show in the Star Trek line, debuted this year with a lot of fanfare and a fair share of drama. The show almost immediately hit the news with cries of it being “too woke”. The Washington Times headline called it a “woke culture war casualty” and Outkick said the show hit “a new low” and that the franchise “just keeps getting worse“. Jonathan Frakes, best known…
Why Data From So Many Breaches Never Sees the Light of Day
Months ago I was chatting with a colleague about a recent data leak (a.k.a. Data breach), as we tend to do in this industry. Those terms are defined by Microsoft as “an unauthorized disclosure of sensitive, confidential, or personal information from an organization’s systems or networks to an external party“. Any time I see an article about data breaches I have flashbacks, and fortunately not too…
InfoSec News (ISN) Mail List History
As early as 1996, I created a mail list called InfoSec News (ISN) which initially was to share news about the industry. At the time, there were no online news sites covering the topic with any regularity and most were hobbies at best. So the original list had many articles that I had typed in by hand from print InfoSec magazines. The list has mostly faded into obscurity; so much so that trying to…
An AI agent destroyed … hey wait a minute!
Yesterday many people ran across a headline that was shocking, and repetitive. This time it read “‘Gone in 9 seconds’: Claude-powered AI agent deletes startup’s entire database“. For myself, the first thing I had to do was check the date of the article because I swore I had just read about this recently. Yep, April 28 so it’s a new one! In a prior blog on the topic of so-called AI, or as I argued…
Don't Call Me Boss
I don’t remember when it started but it was easily five to ten years ago. I’d be in a restaurant typically and a server or cashier would call me ‘boss’. It bothered me from day one because it usually came from a younger kid who presumably didn’t understand all of the connotations behind the word in that context. I certainly felt it was inappropriate but only said something a few times when I felt…
Security Software: Holding the Vault Door Open for Criminals
I have been consistently tracking a fun metric around vulnerabilities since March 19, 2024. Before that I would occasionally mention it during talks or chat, but I don’t think I formally blogged about it before this and didn’t track the exact number. So here we are to discuss the prevalence of vulnerabilities in security software, the very thing designed to protect us. As best I recall, 10 – 20…
Another Wave of Random Thoughts
ATM ATMs have way too many options for many users, and definitely for most uses of the machines by volume. Sometimes, when I put my card in, why are you asking what language I want to use? The same one as last time maybe? And for someone who has the same exact transaction 95% of the time, give me a single button that just says “repeat last transaction” and display what it is. So much time would…
Death Bed Then vs Now; Societal Impact and Contentment
An abstract thought. Our grandparent’s generation seemed content on their deathbed, some with religion, some without. In TV, movies, and books, you see one in a hospital or at home surrounded by loved ones, with a gentle smile. I wonder if that will get much more difficult in today’s age, as society declines and the sense of accomplishing something meaningful declines as well. Two generations…