More posts
All →
A lot of people are just sitting on zero-day right now
I sat down with Ashish Rajan on the AI Security Podcast after Black Hat. The bit worth writing down: the triage queues are noisy enough that good researchers are sitting on zero-day. Plus export controls, attack graphs, port 3000, and why leaders should go use this stuff at home.
Fragile Foundations: 100 days on the cyber-poor
A 100-day sprint on the AI and cyber disruption of water, power, and emergency care, aimed at operators Josh Corman calls cyber-poor. The threats come from cyber, but most of the fixes come from engineering. If you find bugs for a living, there's a translation job that mostly doesn't exist yet.
Hacker Summer Camp and notes from 63 minutes on the "slopalcious" slopdemic
63 minutes with Aaron Mog on Zero Sum, cut down to the salient points and timestamped: the slopdemic, the two axes, why the vulnpocalypse hasn't happened yet, and who is still hiring juniors.
Notes from Hacker Summer Camp 2026
I've been trying to compile a raft of notes and thoughts into a post, but I'm thinking that the ol' bullet-point dump is going to be the way to go here...
Non-Cooperative Defense and Impermissive Access
wp2shell handed the quiet policy debate about non-cooperative defense its first civilian-scale live-fire exercise.
Wake Me After the Vulnpocalypse
AI industrialized the discovery of vulnerabilities, not the exploitation of them, and that distinction is the whole argument. What we have is a slopdemic. The fragility was always there, and the real exposure is the gap between instant discovery and human-speed remediation.
My moves for Hacker Summer Camp 2026
...and away we go! Here's (roughly) what I'll be up to this week: Monday BSides Las Vegas for the I Am The
Hacker Summer Camp Tips and Tricks
As I've been thinking about Hacker Summer Camp (aka Blackhat, BSides Las Vegas, DEF CON, and all of the associated and adjacent cons and Vegas things) this year, it occurred to me that there are going to a LOT of new founders and operators roaming the desert this year.
The Amended Linus's Law
Marcus Hutchins says LLMs just killed "many eyes make all bugs shallow." He's half-right. Linus's Law was never wrong, it was incomplete: the missing variable is incentive, and AI just gave it teeth on both sides.
You get to choose your hard
Being known for what you're against is easy. Being known for what you're for is hard. You get to choose your hard.
It's con season
It's con season — Black Hat, DEF CON, and the summer security-conference circuit are nearly here. The best research of the year is about
Find it and fix it
A fun exercise: run various models against deliberately vulnerable apps, and eval them on their ability to identify the vulns and effectively patch them — without degrading