@briankrebs Don't skip the CSRB please.

@waldo.net Or you know, if you hate shots, there’s a nasal vaccine which is less of a barrier

@sambowne

"once enabled, it’s enabled for all users on the device including other administrators and standard users."

"Agents should always act under the principles of least privilege"

@aram @riana @StanfordCyber @jesse “@ Jesse “ might not be doing what you hope

@briankrebs @dangoodin If this really works, I'm ready to go back to thinking like an attacker!

🤣

(cc @Viss )

Regulation

There are no regulatory updates because the United States of America is unable to fund its ongoing operations and shut down. 2025 United States federal government shutdown (Wikipedia)
Despite that, the FCC deems it essential to reconsider a set of security actions. The letter from […]

AI

Mike Privette has released a new version of his AI Security Shared Responsibility Model.
Benchmarking is hard. See two Arxiv papers, The Illusion of Readiness: Stress Testing Large Frontier Models on Multimodal Medical Benchmarks, (“Leading systems often guess correctly even when key inputs […]

Appsec

Allan Reyes has a longish article, Keeping Secrets Out of Logs, which is quite good, and has nice easter eggs.
Facebook describes how they use monthly “waves” of activity to help teams engage with their privacy work in a blog post, Federation Platform and Privacy Waves. Key concept […]

Threat Modeling

SAFECode and The Center for Internet Security have released a Secure by Design: A Developer’s Guide to Building Safer Software.
Pat Opet of JP Morgan Chase announced a paper on their threat modeling approach (“tradecraft”). You can read that linkedin post, jump to the corporate […]

@ricci @greatquux What a cool find!

Also, I hope y'all have a very strong fireproof box. :)