Adam Shostack :donor: :rebelverified:

adamshostack@infosec.exchange

Author, game designer, technologist, teacher.Helped to create the CVE and many other things. Fixed autorun for XP. On Blackhat Review board.Books include Threats: What Every Engineer Should Learn from Star Wars (2023), Threat Modeling: Designing for Security, and The New School of Information Security.Following back if you have content.

Posts

Post #4387261
RE: https://mastodon.social/@ASegar/117038965891949888 I'm old enough to remember when the first amendment protected free association, and when the Supreme Court Counterman decision limited what counts as a "true threat."
Post #4381708
RE: https://mastodon.social/@ASegar/117038965891949888 I’m old enough to remember when the first amendment protected free association and the supreme court ruling in Counterman.
Post #4261798
RE: https://sigmoid.social/@cigitalgem/117012132756167391 If you want to play in the big leagues you need an event that’s smarter than you
Post #4178898
RE: https://social.linux.pizza/@simonbp/117000560404338238 Look I don’t make the rules but if you skip this opportunity to swiftly make “satellites with attitude problems” jokes that’s on you.
Post #4176357
I'd like to announce that, to the best of our knowledge, @shostackassociates.bsky.social has not been hacked by OpenAI.
Post #4152793
@mattblaze@federate.social We have always been at war with Eurasia
Post #4152768
@mattblaze@federate.social In 1990, telephony was on DHS’s list of critical national infrastructure and the phone company could arrest phreaks.
Post #4147026
Lessons from the OpenAI/HuggingFace AI Security Incident (New blog post: https://shostack.org/blog/lessons-from-openai-huggingface-ai-security, this is post 1/15) Adam Shostack, Shostack + Associates
Post #4117059
benchmarkmaxxing is the new tokenmaxxing.
Post #4098559
If LLMs are like airlines, (high capital cost, low cost of switching, low differentiation), then where's my frequent prompter membership?
Post #4096944
@david_castleton@universeodon.com Hi, thank you for the article! Let me clarify my question: If I'm walking around London, how do I distinguish between a captured French cannon and a bollard made to look like one? In my walks around London, I've never noticed a difference. (I've probably seen the one in the article you linked, which seems much taller than the first one.)
Post #4094293
@dcuthbert@defcon.social @thedarktangent@defcon.social But GDPR WAS GONNA SAVE US!
Post #4093478
@david_castleton@universeodon.com How do you know it's a real cannon versus something made in that style? (Ok, or, in other words, how do you know it's a canonical cannon?)
Post #4072725
I enjoyed reading Kenmore Air's great blog post about how much they're learning from this crash, while rapidly innovating their guardrails for future flights. https://www.seattletimes.com/seattle-news/what-we-know-about-the-kenmore-air-seaplane-crash-in-san-juan-islands/ along with the inspirational linkedin posts about what people learned from surviving a crash. (oh, wait, that's not how airlines do it.)
Post #4066625
Is there a good privacy analysis of smart fire detectors? I seem to recall that Nest had an always-on microphone with cloud data processing, and https://www.popularmechanics.com/home/a37344160/best-smoke-detectors/ lists a kidde unit, but they're part of Ring, who changes their privacy policy in ways I don't like, and simplisecure, whose privacy policy isn't reassuring (lists collection of precise geolocation data) but I haven't analyzed it in depth.
Post #4048114
So if you're not allowed to talk to a lawyer, can you be aware that there's an investigation that's being obstructed? 😇 https://www.theguardian.com/us-news/2026/jul/23/cop-city-protester-phone
Post #4041050
Both these polls are intended to see how people are using the term in the wild. (That is, they're descriptivist, not prescriptivist)
Post #3994353
RE: https://mastodon.social/@fj/116832775686263132 This is really fascinating - uses "alignment" to mean actual human alignment, not "the AI does what we can't articulate." :)
Post #3989964
"driven, end to end, by an autonomous AI agent system" is the new "highly sophisticated"
Post #3947219
Reading about the "Intolerable Acts" that so outraged the founders of this country. One, the Administration of Justice Act, allowed for the King to move trials out of the place where crimes were committed. According to Britannica, "Its stated goal was “the impartial administration of justice in the cases of persons questioned for any acts done by them in the execution of the law, or for the suppression of riots and tumults” in Massachusetts Bay, which it claimed was “disordered...
Post #3936372
RE: https://infosec.exchange/@adamshostack/116943889778558272 Of course, this is a way to build an entirely dysfunctional system in which people who have interesting things to say are driven away, unless that’s why you your going for. #poasiwid
Post #3923892
It’s been a while since I posted these! https://shostack.org/archive/2015/07/the-drama-triangle/ https://shostack.org/archive/2016/04/the-rhetorical-style-of-drama/
Post #3898438
20 years ago, Firefox used to impose a delay before you'd install an extension. That went away, and I'm trying to figure out when and why. Does anyone remember? (A variety of searches around "firefox delay extension" and "security.dialog_enable_delay" aren't getting me anywhere. Old behavoir: https://www.razumny.no/?p=30
Post #3892777
Treating water plants as legitimate military targets is going to backfire badly on the United States.
Post #3873030
RE: https://federate.social/@mattblaze/116932071020131917 Matt Blaze has taken a bullet for y’all by compressing 90 minutes of speech into this summary
Post #3838657
Masterminds! In addition to this, two months before the March breach, Stokes had published to his "Bouquet" user account on the breached platform a photo of what appeared to be his school homework. In the top righthand corner of the homework was the name “Peter William Stokes.” https://www.zetter-zeroday.com/tracking-peter-stokes-and-the-com-allison-nixon-and-her-work-unmasking-cybercriminals/
Post #3822855
This seems to me like the social media version of elsevier.
Post #3821833
Soon! We're going to be releasing a white paper on PHANTOM-B. if you want to be the first to read it, sign up for our "Adam's New Thing" mailing list at shostack.org/contact.
Post #3798006
I agree. A caretaker for the seat is obviously the fourth-worst choice.
Post #3769074
@thedarktangent@defcon.social @jack_daniel@mastodon.social I mean that’s literally our data so you’d have to loan us a great deal of money that we would use to pay you.