Forgot I unfollowed everyone way back when 😳 if you see a "new" follow from me that's what happened.

“Patch the planet, we can fix everything” is one of the most misleading, and harmful security initiatives I’ve seen. As if spending billions of dollars cooking the oceans to run swarms of agents spinning their wheels applying hourly? minutely? patches on every abandoned instance across the planet, racing against every incompetent sysadmin - no you will never catch up with human stupidity. And it’s completely the wrong direction. It’s this old school mentality that “I’ll stay in my IT lane, and just update every package and infra” as if this will ever amount to anything. As if this hasn’t been the strategy for half a century. Obviously you’re supposed to patch. But why be a hamster in a wheel spinning idly, while incompetent devs slop-cannon millions of lines of some of humanity’s most atrocious code ever conceived, bypassing every security recommendation, every known best-practice, to meet an arbitrary deadline set by their private equity overlords to ship some inane b2b saas that nobody is going to use, but will get everyone’s data leaked. You won’t patch everything. You won’t catch every bug. You know it’s stupid, it’s a helpless strategy because you don’t want to address the real root cause: making software that doesn’t suck ass. Engineering principles that aren’t guided by psychotic greedy men in suits that just want a return on their investment at the cost of everyone’s data. The problem is nobody gives a shit about breaches. “Cyber insurance covers this”, you send the breach notification, everyone shrugs as if it’s the accepted cost of living in society. So companies have no incentive to care. Some of the most incompetent passionless people become “engineering leaders” that “understand the business” of shipping atrocities, without an ounce of consideration or thought, pure monkey level poop-slinging. The worst code you’ve ever seen is production code, self-merged by the guy thinking increasing shareholder value is how you barely make it across the retirement line. “Move fast and break things” has been one of the most dangerous principles, and an embarrassing one to hold today. We have solutions. The dumbest dev can still ask a coding agent to find, explain, and address security issues in software architecture, and in implementation. And it does a better job than the majority of security engineers I’ve worked with. But they do the opposite. They go AROUND and bypass every security recommendation anyone or anything makes. I’ve seen Claude-generated comments in code saying “this is highly insecure but we have decided to accept the risk” for things with trivial fixes. God forbid, you’re going to have to work with devs. Teach them software design, architecture, planning how components and microservices interact, how to make safe code, how to keep it safe, ultimately just to be considerate. To care a little bit about your craft. “Patch the planet” is a waste of time. Invest in what we ship instead. It’s the ONLY way to make software resilient.

When we can ship substantial improvements in days instead of months, we should ask more around “how great can this be?” rather than “when will this get done?” Stop treating a pursuit of excellence as a threat to speed. Moving fast should raise standards instead of lowering them.

always was ❤️🔒

people really be acting like once all the software vulnerabilities are fixed we've solved cybersecurity 🫠🫠🫠

I know...I messed up my cybersecurity awareness month streak, but I feel like we are all aware enough now, right?

Why do all the @1Password integrations only let you use a personal/family account? I feel like the biggest use cases are b2b right now, except probably Muse.

Full content from our security engineering workshop @BSidesNYC is at seceng.guide/

🎙️ @andrewbecherer on the Build vs Buy decision for security teams in the agentic AI era

need to get the roadster to the @berrics

Roadster nitter.siddz.com/i/broadcasts/1yKAPwNgg…

Wow I haven't been in Kendall Sq. in forever. Who was going to tell me there is so much going on now?

Day 15 of cybersecurity awareness month: support local meetups/conferences! Boston, see you @securitymeetup tonight? Also check these out: @OWASPBOSTON @BASConf @defcon617 @Layer8Con @MinuteConBoston @SecurityBSides Cambridge, MA coming up Oct. 25: bsidescambridgema.org/

Building software in Go with AI has been a delight. Given the number of high quality open source projects and the simplicity / opinionated nature of how to write Go code, the training data for models is highly representative of what good looks like and the outputs show it.

🏴‍☠️ Ahoy InfoSec practitioners! The CFP for #BSidesSF 2027 is OPEN! Got research, a talk, or hands-on workshop to share? Bonus points if you tie it to our theme: Pirates! 🦜 📅 Deadline: Nov 9, 2026 📍San Francisco: April 3 & 4, 2027 Submit here👇 pretalx.com/bsidessf-2027/

I mean...quite obvious...most startups are by default incorporated in Delaware.