From dropping tables to jailbreaking GPTs, some kids just never change. Meet Little Bobby Prompts. 😂

Classic moral hazard problem in internet infrastructure:

Those making critical security decisions don't face the consequences when things go wrong. Meanwhile, 8 billion users bear all the risks.

This misalignment creates predictable problems across any system at scale.

👇

My kids are going to grow up thinking “Shit My Dad Says” was mostly just t-shirts about cryptography, root access, malware, and accountability in Git.

And… they’ll be right.

We fixed secret management! By dumping everything into Vault and pretending it's not a problem anymore....

Has anyone seen our cryptographic keys? They were right here... like, five years ago.

We need to improve our cryptographic security!
Discovers unprotected private keys lying around
Wait... if we have to discover our cryptographic keys, that means we aren't actually managing them?

We secure video game DRM keys better than the keys protecting your bank account.

You get a shared secret! You get a shared secret! EVERYONE gets a shared secret! Shared secrets are not secret!

Why spend millions on cryptography if your keys spend 99% of their life unprotected? We need to fix key management first.

We don’t suck at cryptography - we suck at managing it. Everyone’s obsessing over PQC algorithms, but the real problem is deployment, key management, and lifecycle. PQC is just another spice - without proper management, it’s just seasoning on bad security.

As 2025 approaches, it’s a good time to update WebPKI CA market share. GTS is now the second-largest CA, followed by GoDaddy and DigiCert. The top eight CAs account for 99% of all certificates. Automation is on the rise, making manual enrollment as antiquated as manually renewing your IP address.

The costs of context switching visualized.

(Ok actually it’s 777 fuel efficiency by trip length and number of stops but still!)

Winston says hello from Long Beach Washington.