← Feed

Posts

• View post

  One day someone will let SeaTac will learn to manage queues efficiently, but today was not that day.

• View post

  RE: https://mastodon.social/@kralcttam/117336706374065569 We've replaced the bureaucratic impediment to rapid action, Stanislav Petrov, with an LLM as part of our strategy of "aggressively identifying and eliminating bureaucratic barriers to deeper integration."

• View post

  Diagrams versus Models (Threat Model Thursday) (New blog post: https://shostack.org/blog/diagrams-versus-models, this is post 1/9) Diagrams are the most recognizable tools and deliverables of threat modeling. (Both functions are important: the working tool of a diagram which helps us ask what can go wrong and the deliverable or record which we keep.)

• View post

  New blog: The Pentagon, China, AI and PHANTOM-B https://shostack.org/blog/the-pentagon-china-ai-and-phantom-b/ CNN has an explosive story with US military having a close call after using AI for false intelligence report. There were planes in the air and the United States was ready to initiate military action against a Chinese ship: It was only just before the planned operation that officials dug deeper into the report put together by a special operations command analyst and found it had been...

• View post

  @deviantollam@defcon.social Have you considered a series trolling the AI to see "Will it be banned for 'gun sales'?"

• View post

  I'm glad to hear that the US is adopting #SI, the System Internationale of measurement, after 40 years of inch-by-inch progress.

• View post

• View post

  @letoams@defcon.social I’ll take “referrants” for $500, Alex, knowing it’s probably a mistake

• View post

  If I hit cancel, are the words un-counted?

• View post

  Diagrams and Common Elements (Threat Model Thursday) (New blog post: https://shostack.org/blog/diagram-common-elements-threat-model-thursday, this is post 1/9) Diagrams have a form, such as DFD, swim lane or C4, which is the case even if they deviate from that form’s conventions. They have style (or lack it). But regardless of the form or style of the diagram, they should have a title block and a key (also called a legend). They can also have a convention of how to represent what’s being worke...

• View post

  RE: https://mastodon.social/@verge/117263656645026334 Is anyone maintaining a page of how to tell car companies to stop? I see dated information at Mozilla and Consumer Reports, and vague and confusing information about "if you don't have a subscription, they're not doing this." In particular, there's a lot of "you can opt out by logging in." Does that mean that the data isn't collected if you don't have an account, or that they're using identity res...

• View post

  Appsec roundup - July + August 2026 (New blog post: https://shostack.org/blog/appsec-roundup-july-aug-2026, this is post 1/10) This end of summer edition leads off with the EU’s release of 83 pages of guidance for the CRA (https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation):

• View post

  Tesla put its breathtakingly ugly Cybercab on Austin streets Thursday: it has no steering wheel, no pedals, and no door handles. Tesla published an emergency guide on its website telling first responders the robotaxi can be pushed to clear a lane, but warns that pushing it over 5mph risks overheating the motor and electric shock. The car must be “caged” before interacting with it. And, “not every high voltage component is labeled.” The guide also says first responders should contact the company...

• View post

  RE: https://mastodon.social/@ASegar/117038965891949888 I'm old enough to remember when the first amendment protected free association, and when the Supreme Court Counterman decision limited what counts as a "true threat."

• View post

  RE: https://mastodon.social/@ASegar/117038965891949888 I’m old enough to remember when the first amendment protected free association and the supreme court ruling in Counterman.

• View post

  RE: https://sigmoid.social/@cigitalgem/117012132756167391 If you want to play in the big leagues you need an event that’s smarter than you

• View post

  RE: https://social.linux.pizza/@simonbp/117000560404338238 Look I don’t make the rules but if you skip this opportunity to swiftly make “satellites with attitude problems” jokes that’s on you.

• View post

  I'd like to announce that, to the best of our knowledge, @shostackassociates.bsky.social has not been hacked by OpenAI.

• View post

  @mattblaze@federate.social We have always been at war with Eurasia

• View post

  @mattblaze@federate.social In 1990, telephony was on DHS’s list of critical national infrastructure and the phone company could arrest phreaks.

• View post

  Lessons from the OpenAI/HuggingFace AI Security Incident (New blog post: https://shostack.org/blog/lessons-from-openai-huggingface-ai-security, this is post 1/15) Adam Shostack, Shostack + Associates

• View post

  benchmarkmaxxing is the new tokenmaxxing.

• View post

  If LLMs are like airlines, (high capital cost, low cost of switching, low differentiation), then where's my frequent prompter membership?

• View post

  @david_castleton@universeodon.com Hi, thank you for the article! Let me clarify my question: If I'm walking around London, how do I distinguish between a captured French cannon and a bollard made to look like one? In my walks around London, I've never noticed a difference. (I've probably seen the one in the article you linked, which seems much taller than the first one.)

• View post

  @dcuthbert@defcon.social @thedarktangent@defcon.social But GDPR WAS GONNA SAVE US!

• View post

  @david_castleton@universeodon.com How do you know it's a real cannon versus something made in that style? (Ok, or, in other words, how do you know it's a canonical cannon?)

• View post

  I enjoyed reading Kenmore Air's great blog post about how much they're learning from this crash, while rapidly innovating their guardrails for future flights. https://www.seattletimes.com/seattle-news/what-we-know-about-the-kenmore-air-seaplane-crash-in-san-juan-islands/ along with the inspirational linkedin posts about what people learned from surviving a crash. (oh, wait, that's not how airlines do it.)

• View post

  Is there a good privacy analysis of smart fire detectors? I seem to recall that Nest had an always-on microphone with cloud data processing, and https://www.popularmechanics.com/home/a37344160/best-smoke-detectors/ lists a kidde unit, but they're part of Ring, who changes their privacy policy in ways I don't like, and simplisecure, whose privacy policy isn't reassuring (lists collection of precise geolocation data) but I haven't analyzed it in depth.

• View post

  So if you're not allowed to talk to a lawyer, can you be aware that there's an investigation that's being obstructed? 😇 https://www.theguardian.com/us-news/2026/jul/23/cop-city-protester-phone

• View post

  Both these polls are intended to see how people are using the term in the wild. (That is, they're descriptivist, not prescriptivist)