tag
#thinking
First principles and philosophy: mental models, worldview, frameworks for understanding
Hacker Summer Camp and notes from 63 minutes on the "slopalcious" slopdemic
63 minutes with Aaron Mog on Zero Sum, cut down to the salient points and timestamped: the slopdemic, the two axes, why the vulnpocalypse hasn't happened yet, and who is still hiring juniors.
Notes from Hacker Summer Camp 2026
I've been trying to compiled a raft of notes and thoughts into a post, but I'm thinking that the ol' bullet-point dump is going to be the way to go here...
The Hitchhiker's Guide to Bug Bounty and Vulnerability Disclosure in 2026
Post-Mythos vulnerability disclosure: a 2026 field guide for vendors and researchers on AI-era bug bounties, slop triage, and rebuilding ecosystem norms.
Thoughts on the #slopdemic
Move over #vulnpocalypse — there's a new term we need to talk about: the #slopdemic. AI didn't invent low-quality vuln reports, but it just turbocharged them, and F/OSS is drowning.
The "irrational asymmetry" in threat behavior
We've traditionally thought about defense through the lens of a financially motivated attacker or a nation state — predictable rewards. Open it to
The top five turtles in a stack of 50
AI defense and code review get the funding, but hospitals still run XP and Ivanti falls over weekly. The security industry is ignoring 45 of its 50 turtles.
Cryptographically enforced disclosure
A speculative proposal: cryptographically enforced vulnerability disclosure using a drand-triggered dead-man switch to make CVD fallback dates unbreakable.
Security-focussed test/fix is basically “sparkling QA”
A short reaction to Firefox's claim that AI-found defects are finite: security-focused test-and-fix is basically QA wearing a fancier hat.
We don't have a slop problem.
The real security problem isn't AI slop — it's that vulnerability research and the broader industry can't prioritize what actually matters in the noise.
Build the tooling. Don't be the tooling.
The AI move in vulnerability research isn't prompting from scratch every run — it's using AI to build deterministic scanners, fuzzers, and analysis pipelines.
Why Security Teams Gaslight Hackers: Disclosure Reality
The cybersecurity industry has a dirty secret: security teams are systematically dismissing legitimate vulnerability reports from ethical hackers. In a recent episode of Hackers
The Compliance Reckoning
AI makes security verification cheap, putting two decades of checkbox compliance, paper pentests, and audit theater under sudden economic pressure.