Allan
@allanfriedman.bsky.social
SBOM Champion. Full service technocrat. Now at @CISAgov, formerly NTIA. Lapsed{engineer, academic, author}. Personal Account. Food, drink, dogs, SBOM
Reposted by Allan
No no no begs every archivist. You are never going to be able to find anything. Please don’t start using emojis in file names. Who asked for this? What fresh hell is next?
November 12, 2025 at 10:38 AM
No no no begs every archivist. You are never going to be able to find anything. Please don’t start using emojis in file names. Who asked for this? What fresh hell is next?
Reposted by Allan
HUGE NEWS! 📣
The "father of SBOM," @allanfriedman.bsky.social, is joining Anchore as a Board Advisor!
We sat down with him to discuss the future of #SoftwareSupplyChainSecurity and what comes after SBOM.... https://anchore.com/blog/anchore-welcomes-sbom-pioneer-dr-allan-friedman-as-board-advisor/
The "father of SBOM," @allanfriedman.bsky.social, is joining Anchore as a Board Advisor!
We sat down with him to discuss the future of #SoftwareSupplyChainSecurity and what comes after SBOM.... https://anchore.com/blog/anchore-welcomes-sbom-pioneer-dr-allan-friedman-as-board-advisor/
November 12, 2025 at 3:01 AM
HUGE NEWS! 📣
The "father of SBOM," @allanfriedman.bsky.social, is joining Anchore as a Board Advisor!
We sat down with him to discuss the future of #SoftwareSupplyChainSecurity and what comes after SBOM.... https://anchore.com/blog/anchore-welcomes-sbom-pioneer-dr-allan-friedman-as-board-advisor/
The "father of SBOM," @allanfriedman.bsky.social, is joining Anchore as a Board Advisor!
We sat down with him to discuss the future of #SoftwareSupplyChainSecurity and what comes after SBOM.... https://anchore.com/blog/anchore-welcomes-sbom-pioneer-dr-allan-friedman-as-board-advisor/
Reposted by Allan
Is there are name for the phenomenon where anything claiming to be something exceptional (e.g. "hot take", "thought leader", "gourmet deli") isn't actually that thing?
November 11, 2025 at 8:11 PM
Is there are name for the phenomenon where anything claiming to be something exceptional (e.g. "hot take", "thought leader", "gourmet deli") isn't actually that thing?
Reposted by Allan
New, by me at this.weekinsecurity.com: I wrote ~3,700 of my finest words on North Korea's remote IT workers, who have infiltrated businesses across the U.S. and Europe and aren't slowing down. Probably the most pervasive cyber threats today.
Here's my primer on how to recognize & combat them.
Here's my primer on how to recognize & combat them.
Thousands of North Koreans have secretly infiltrated US and European companies as remote IT workers
North Korea's secret remote workers are a major threat facing U.S. and European businesses today, taking jobs in Fortune 100 and smaller companies alike. Here's how to recognize and combat the threat.
this.weekinsecurity.com
November 6, 2025 at 1:35 PM
New, by me at this.weekinsecurity.com: I wrote ~3,700 of my finest words on North Korea's remote IT workers, who have infiltrated businesses across the U.S. and Europe and aren't slowing down. Probably the most pervasive cyber threats today.
Here's my primer on how to recognize & combat them.
Here's my primer on how to recognize & combat them.
I’m training my palate to reacclimatize to spicy. What’s a hot sauce that’s one layer up from Tabasco?
November 5, 2025 at 11:36 PM
I’m training my palate to reacclimatize to spicy. What’s a hot sauce that’s one layer up from Tabasco?
Finally have a Sunday free. Anyone in the DC area up for watching the Steelers-Colts game tomorrow at 1?
November 1, 2025 at 9:30 PM
Finally have a Sunday free. Anyone in the DC area up for watching the Steelers-Colts game tomorrow at 1?
Can confirm. Had the occasion to give Joe a hard time about this over the years :) My boss asked me why I was quoted saying “the Internet was on fire”. A damn good story, though.
What I’m saying is I once mixed up @allanfriedman.bsky.social and @joshcorman.bsky.social in a story about a conference call, despite having met both of them in person several times.
November 1, 2025 at 9:00 PM
Can confirm. Had the occasion to give Joe a hard time about this over the years :) My boss asked me why I was quoted saying “the Internet was on fire”. A damn good story, though.
Sigh. Grim news, but a potential wake up call for small operators and the policymakers who love them. It’s time to [quoting @joshcorman.bsky.social] SOS - get our Shit Off Shodan.
Cyberpunks mess with Canada's water, energy, and farm systems
Cyberpunks mess with Canada's water, energy, farm systems
: Infosec agency warns hacktivists broke into critical infrastructure systems to tamper with controls
www.theregister.com
October 30, 2025 at 12:12 PM
Sigh. Grim news, but a potential wake up call for small operators and the policymakers who love them. It’s time to [quoting @joshcorman.bsky.social] SOS - get our Shit Off Shodan.
Reposted by Allan
Too Many Secrets: Hackers Target Sensitive Data Sprawl www.darkreading.com/cyber-risk/t...
Too Many Secrets: Hackers Target Sensitive Data Sprawl
Hardcoded credentials, access tokens, and API keys end up in the darnedest places, prompting a call for organizations to stop over-privileging secrets.
www.darkreading.com
October 28, 2025 at 12:12 AM
Too Many Secrets: Hackers Target Sensitive Data Sprawl www.darkreading.com/cyber-risk/t...
A nice crisp autumn day for playing in the kitchen. Smoked lamb shanks, and breaking down pumpkins for kaddo bourani, the Helmand-inspired candied pumpkin w meat sauce.
October 25, 2025 at 6:06 PM
A nice crisp autumn day for playing in the kitchen. Smoked lamb shanks, and breaking down pumpkins for kaddo bourani, the Helmand-inspired candied pumpkin w meat sauce.
Reposted by Allan
Our new website has launched. We will continue to update the site with information as it becomes available.
https://bsidespyongyang.com/
https://bsidespyongyang.com/
October 20, 2025 at 3:55 AM
Our new website has launched. We will continue to update the site with information as it becomes available.
https://bsidespyongyang.com/
https://bsidespyongyang.com/
Sunday morning chorin’
October 19, 2025 at 3:42 PM
Sunday morning chorin’
Solid summary of the risks we face in our supply chains. SBOM is a powerful tool for software bc it enables automation; we need similar approaches for vendors and third party risk mgmt. Fun hard problem:
Semiconductor supply chain & and HBOM. (Coming soon!)
Semiconductor supply chain & and HBOM. (Coming soon!)
#TechRadar Third-party breaches are a wake-up call for modern cybersecurity https://techrad.ar/ksuJ #Pro
October 8, 2025 at 2:47 PM
Solid summary of the risks we face in our supply chains. SBOM is a powerful tool for software bc it enables automation; we need similar approaches for vendors and third party risk mgmt. Fun hard problem:
Semiconductor supply chain & and HBOM. (Coming soon!)
Semiconductor supply chain & and HBOM. (Coming soon!)
Finally feeling heathy enough to start doing some proper cooking. Thick cut pork chops with apple’n’onion pan sauce, nicely paired with a lovely crisp autumnal evening.
I’m still avoiding wine, etc (pairs poorly with nerve inflammation) but I prepped a batch of pear cardamon shrub.
I’m still avoiding wine, etc (pairs poorly with nerve inflammation) but I prepped a batch of pear cardamon shrub.
October 4, 2025 at 1:29 AM
Finally feeling heathy enough to start doing some proper cooking. Thick cut pork chops with apple’n’onion pan sauce, nicely paired with a lovely crisp autumnal evening.
I’m still avoiding wine, etc (pairs poorly with nerve inflammation) but I prepped a batch of pear cardamon shrub.
I’m still avoiding wine, etc (pairs poorly with nerve inflammation) but I prepped a batch of pear cardamon shrub.
Reposted by Allan
One of my favorite anecdotes from THE PREHISTORY OF THE FAR SIDE: "That doesn't sound like the Jane Goodall we know."
October 1, 2025 at 6:13 PM
One of my favorite anecdotes from THE PREHISTORY OF THE FAR SIDE: "That doesn't sound like the Jane Goodall we know."
Some of y’all remember the chaos we had in trying to decide whether to camel case it or not.
Or, even worse, which way to orient canonical examples of a dependency tree: top-to-bottom, or bottom-to-top.
Collective action is hard; the English language and good design are also hard.
Or, even worse, which way to orient canonical examples of a dependency tree: top-to-bottom, or bottom-to-top.
Collective action is hard; the English language and good design are also hard.
Y'all pluralizing SBOM as SBOMs when you know full well that it's SBsOM
September 26, 2025 at 6:30 PM
Some of y’all remember the chaos we had in trying to decide whether to camel case it or not.
Or, even worse, which way to orient canonical examples of a dependency tree: top-to-bottom, or bottom-to-top.
Collective action is hard; the English language and good design are also hard.
Or, even worse, which way to orient canonical examples of a dependency tree: top-to-bottom, or bottom-to-top.
Collective action is hard; the English language and good design are also hard.
Apple Music’s new automix feature not only isn’t very good, it’s bad enough to be distracting.
September 26, 2025 at 6:03 PM
Apple Music’s new automix feature not only isn’t very good, it’s bad enough to be distracting.
Reposted by Allan
Incredible must-read analysis of the Collins Aerospace incident by Günter Born (which relies heavily on work by @doublepulsar.com). It concludes by pointing to Cyfirma's assessment that Alixsec, Scattered Spider, and the Rhysida ransomware were the culprits
www.borncity.com/blog/2025/09...
www.borncity.com/blog/2025/09...
Nachlese Sicherheitsvorfall bei Collins Aerospace, der Flughäfen lahm legte
In den Abendstunden des 19. September 2025 (Freitag) gab es einen Ransomware-Angriff auf den Dienstleister Collins Aerospace, der für europäische Flughäfen u.a. die Check-In-Systeme betreibt.
www.borncity.com
September 24, 2025 at 12:23 PM
Incredible must-read analysis of the Collins Aerospace incident by Günter Born (which relies heavily on work by @doublepulsar.com). It concludes by pointing to Cyfirma's assessment that Alixsec, Scattered Spider, and the Rhysida ransomware were the culprits
www.borncity.com/blog/2025/09...
www.borncity.com/blog/2025/09...
Reposted by Allan
1/ Hi, I'm TProphet. I write the Telecom Informer for @2600.com. A lot of people have been asking me about www.nbcnews.com/politics/nat... given that I'm somewhat knowledgeable in the area.
Here's my take: I'm kind of astonished that this is public, and it isn't normal that it would ever be.
Here's my take: I'm kind of astonished that this is public, and it isn't normal that it would ever be.
Secret Service agents dismantle network that could shut down New York cellphone system
Agents discovered electronic devices in five locations in and around the city that could be used to disable cellphone towers. The system could also be used for criminal activities.
www.nbcnews.com
September 23, 2025 at 6:49 PM
1/ Hi, I'm TProphet. I write the Telecom Informer for @2600.com. A lot of people have been asking me about www.nbcnews.com/politics/nat... given that I'm somewhat knowledgeable in the area.
Here's my take: I'm kind of astonished that this is public, and it isn't normal that it would ever be.
Here's my take: I'm kind of astonished that this is public, and it isn't normal that it would ever be.
Reposted by Allan
I do think a bit about DDoS'ing a phone network as an effective tactic that rarely gets attention but could cause significant chaos. And remember this?
Malaysian politicians claim tech sabotage as polling begins
Malaysian politicians from both government and opposition camps complained of "dirty tricks" after voting in a general election began on Wednesday, as non-stop spam calls to their mobile phones disrupted communications with party organizers.
www.reuters.com
September 23, 2025 at 12:23 PM
I do think a bit about DDoS'ing a phone network as an effective tactic that rarely gets attention but could cause significant chaos. And remember this?
Peak late summer vegetables from the farmer’s market, about to be made more delicious.
September 6, 2025 at 9:27 PM
Peak late summer vegetables from the farmer’s market, about to be made more delicious.
Reposted by Allan
When we launched in 2018, the first piece on the site was part one of our four-part oral history of the L0pht. We were able to rescue that series from the archives. Here's that first part again. Enjoy!
decipher.sc/2025/07/24/w...
decipher.sc/2025/07/24/w...
‘We Got to Be Cool About This‘: An Oral History of the LØpht, Part 1 - Decipher
In the beginning, there was a hat factory. Factory is probably too grand a word for it, but the space that would eventually become the first home of L0p...
decipher.sc
September 4, 2025 at 3:29 PM
When we launched in 2018, the first piece on the site was part one of our four-part oral history of the L0pht. We were able to rescue that series from the archives. Here's that first part again. Enjoy!
decipher.sc/2025/07/24/w...
decipher.sc/2025/07/24/w...
Taking a week off to drink wine and cycle the coast and hills around lovely Santa Barbara.
August 24, 2025 at 4:39 AM
Taking a week off to drink wine and cycle the coast and hills around lovely Santa Barbara.
I’m not sure I agree. Data breach is an important problem - I wrote one of the first studies on economic impact back in mid 2000s—but the disruption of operations can have a much bigger $ impact on the biz, and involves lives for critical infrastructure like hospitals.
The real problem with ransomware isn’t encryption—it’s the data that walks out the door www.fastcompany.com/91387139/the...
The real problem with ransomware isn’t encryption—it’s the data that walks out the door
In a world where ransomware has morphed into data extortion, encryption is just the bait. The real threat is what’s already gone by the time you realize anything’s wrong.
www.fastcompany.com
August 22, 2025 at 11:47 AM
I’m not sure I agree. Data breach is an important problem - I wrote one of the first studies on economic impact back in mid 2000s—but the disruption of operations can have a much bigger $ impact on the biz, and involves lives for critical infrastructure like hospitals.