@Lee_Holmes@infosec.exchange

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 06, 2026

Replying to @Sempf@infosec.exchange

@Sempf@infosec.exchange Don't forget the chai!

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 05, 2026

Replying to @gvwilson@mastodon.social

@gvwilson@mastodon.social Answered - hope it helps some folks. There are quite a few "it depends" answers in this. If the goal is to compare responses with what is known as being empirically correct, most of these do not have an empirical answer.

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 05, 2026

Replying to on social.scriptjunkie.us

@sj@social.scriptjunkie.us Gross. They also invented renting your car's features to you. And this is just the visible money grubbing... If they're doing this, they're probably selling every bit of customer data and car telemetry they have to the lowest bidder too.

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 04, 2026

Replying to @mkb@mastodon.social

@mkb@mastodon.social It doesn't look like Amazon is offering it on Kindle yet, but the MS Press store does have eBook.

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 04, 2026

Ok, finally captured some thoughts about our new book, Threat Driven Software Development here: https://www.leeholmes.com/threat-driven-software-development/ If you are a Blue Teamer working on developing or securing online services - this is your jam and I hope you enjoy it.

www.leeholmes.com

Lee Holmes | Threat Driven Software Development

4

2

3

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 03, 2026

Replying to @culturednyc@mastodon.social

@culturednyc@mastodon.social Oooh, great catch. Thank you!

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 03, 2026

Replying to @Sempf@infosec.exchange

@Sempf@infosec.exchange Hell yes. It's on the list.

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 03, 2026

Ok, here's the answer to the question that's always on your mind: what treats should you buy when you visit Canada? https://www.leeholmes.com/what-treats-to-buy-in-canada/

0

5

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 03, 2026

Replying to @Blueteamsherpa@infosec.exchange

@Blueteamsherpa@infosec.exchange By flying a drone :) I'm pretty sure they were stoked about flying formation with me. It was hard to tell for sure though because I was 5 miles away out of the restricted airspace, but I could have sworn I saw a glint in somebody's eye.

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 03, 2026

Got to fly with the Blue Angels today :)

0

2

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 03, 2026

Replying to @azonenberg@ioc.exchange

@azonenberg@ioc.exchange OOOOH, make two of the traces output oscillofun

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Aug 02, 2026

Working on a simple online CMS for my Hugo blog - a WYSIWYG Markdown editor based on Quill, and some basic management around that. It still stores the raw backing Markdown files in OneDrive like I was using with Hugo directly. Hooboy is it nerve wracking! 20 years of content that exercises apparently every edge case in Markdown! Thankfully Commonmark has an excellent test suite that I've been able to bootstrap a massive unit test infrastructure with.

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 28, 2026

You've probably been in the situation of weighing the difference between buying something commercially or making it yourself -- and then stumbling on a YouTube of somebody where this is clearly their passion. They've got dozens of videos of how to use these things. Make these things. Perfect these things. This is all they think about, and they also have a little store or Etsy where they sell what they make. The more I think about it, the more I realize: this is exactly the time to Support the Maker. For a small cost over what it would take to do this yourself, you can help somebody pursue their passion. Consider it a thank you. Consider it payment-in-kind for all those videos you just binged. But the world needs more of these people, and this is how you can support them.

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 24, 2026

Replying to @ajn142@infosec.exchange

@ajn142@infosec.exchange The latter.

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 24, 2026

I know it was fashionable for a while for infosec to mock people that use VPNs (ala "Hello, it's 2026. Everything worth securing is transmitted over TLS anyways") but I still think it's an immature absolutist take. TLS doesn't save you when Russia hacks the routers in your hotel to send you to phishing sites rather than actual login pages: https://www.bleepingcomputer.com/news/security/authorities-disrupt-dns-hijacks-used-to-steal-microsoft-365-logins/

3

4

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 24, 2026

Was on the Microsoft Threat Intel Podcast recently with Sherrod, Michael, and Shawn about our new Threat Driven Software Development book. It was really great to have the chance to talk about the whole book end-to-end - https://thecyberwire.com/podcasts/microsoft-threat-intelligence/73/notes

N2K CyberWire

Behind the Book: Threat-Driven Software Development

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠⁠Sherrod DeGrippo⁠ is joined by co-authors Michael Howard, Lee Holmes, and Shawn Hernan for a discussion on their new book, ⁠Threa

1

0

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 23, 2026

Replying to @spacerog@mastodon.social

@spacerog@mastodon.social You're forgetting some other important history - https://www.microsoft.com/en-us/msrc/blog/2010/07/coordinated-vulnerability-disclosure-bringing-balance-to-the-force

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 23, 2026

Application Security is an investment. Operational Security is a commitment. This quote comes from Threat Driven Software Development: I think it perfectly captures the difference between application security and operational security when it comes to services.

3

0

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 21, 2026

Replying to @medwds@infosec.exchange

@medwds@infosec.exchange I really love the heavy blue influence (Blue Team) as well as the graph symbolism (= the way that attackers and defenders should think of systems).

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 20, 2026

RE: https://infosec.exchange/@Lee_Holmes/116925875891679749 Woohoo! Now available at your favorite retailers! https://www.amazon.com/Threat-Driven-Software-Development-Defending-services/dp/0135567386

Quoting

Lee Holmes

@Lee_Holmes@infosec.exchange

It's here! Super proud of this - it is such a perfect package of how to navigate operational security in the services world.

Open quoted post

4

3

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 15, 2026

It's here! Super proud of this - it is such a perfect package of how to navigate operational security in the services world.

14

1

4

1

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 13, 2026

Replying to @lcamtuf@infosec.exchange

@lcamtuf@infosec.exchange I think we're going to find some interesting social norms coming out of this. I just finished writing a book: zero AI for exactly the point you made. But I also just generated an architecture / design doc and fully used AI for it because -- let's be honest -- nobody cares about the prose in those as long as it's correct. People will send transactional email at work that was clearly AI-assisted and I'm not sure how I feel about that.

3

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 09, 2026

Replying to @scottgal@hachyderm.io

@scottgal@hachyderm.io Agree with the points in your post. Also, there's definitely a lot of subtlety to what a 'summary' really means. I was mostly doing the naive approach you called out for a laugh. Would be interested to see what your better pipeline returns for a 10 (and 1) word summary of War and Peace :) https://raw.githubusercontent.com/mmcky/nyu-econ-370/refs/heads/master/notebooks/data/book-war-and-peace.txt

0

2

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jul 09, 2026

There's a famous joke: "I took one of those rapid-reading courses, and was able to read “War and Peace” in 20 minutes! It’s about Russia. Beyond that, I’m vague.” I thought it'd be funny to write a map-reduce algorithm to have LLM summarize the book into 10 words. OpenAI refused to play along 🤣

1

4

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jun 29, 2026

Replying to @lcamtuf@infosec.exchange

@lcamtuf@infosec.exchange I learned about a YouTube niche for AI-generated "hard done by" revenge stories the other day... many of them with hundreds of thousands of views and a replies section that apparently thinks it's all true. WTF. Like https://www.youtube.com/watch?v=cJ9-PFcbfro

2

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jun 25, 2026

@campuscodi@mastodon.social The article is saying that it wasn't digital dynamite, it was something else unspecified (dormant cyber pathogens rearing their ugly head again?) to be used at a later time 🤣

mastodon.social

Catalin Cimpanu (@campuscodi@mastodon.social) - Mastodon

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jun 23, 2026

I've never liked Schneier's phrasing of this: "Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can’t break.". You can't repeat it to somebody that you think it applies to when you want to use it for advice. It's really only good for dunking.

But the advice itself is super solid. Here's a rephrasing that I was actually able to use with somebody and not feel guilty: “Anyone, from beginner to expert, can create an algorithm that they themselves cannot break."

2

0

2

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Jun 22, 2026

Saw Disclosure Day yesterday - it's now solidly in the list of top films of all time to use PowerShell 🥳🥳🎉🎉🎉!

8

0

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · May 01, 2026

Startup: Look at how agile we are! How quickly we can pivot!

2

0

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 30, 2026

Replying to @catsalad@infosec.exchange

@catsalad I did this in stone :)

79

0

16

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 29, 2026

LOL, you think reading it takes a lot of effort - try writing it 🤣

3

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 28, 2026

Love this compilation of "The Defender's Mindset" from John Lambert. John does a lot of hiking and clearly occupies that time figuring out how to phrase things perfectly: @johnlatwc@medium.com

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 27, 2026

Here's one thing AdTech could do to instantly change the content dynamics of the internet: "Unvisit."

Landed on an AI slop page laden with ads and referral links? Click "Unvisit" and they'll never see a penny from your impression.

Got ambushed by a page full of taboola ads and auto-play videos? Unvisit. Can't use the back button? Unvisit.

Unvisit, Unvisit, Unvisit, and punish them where it hurts.

2

0

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 27, 2026

Shout out to my homies that still remember the track numbers on the CDs for their favorite songs.

16

0

4

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 26, 2026

Replying to @adamshostack@infosec.exchange

@adamshostack I think the answer should be "Defensive Design Patterns." Good security architects have built up a bank of these in their head: "It looks like you're writing an updater! Here are some best practices around that." Once somebody makes that connection that they are writing an updater, they can always search the internet (or ask AI) for the best practices part - but having that lightbulb moment is not guaranteed.

3

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 22, 2026

Replying to @malwaretech@infosec.exchange

@malwaretech One of the things I love about this investigation is that it actually imposed cost:

Found malware: reported to AV vendors
Saw abuse of Cursor: reported to Cursor, got the accounts suspended
Saw abuse of ChatGPT: reported to OpenAI
Saw that a front website was implemented / hosted on Anima: reported to Anima, got the account suspended

Props on engaging like that.

12

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 22, 2026

RE: @malwaretech@infosec.exchange

One of the things I love about this investigation is that it actually imposed cost:

- Found malware: reported to AV vendors
- Saw abuse of Cursor: reported to Cursor, got the accounts suspended
- Saw abuse of ChatGPT: reported to OpenAI
- Saw that a front website was implemented / hosted on Anima: reported to Anima, got the account suspended

We don't have to just report on the bad guys. We can actually fight them.

4

0

2

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 22, 2026

Holy smokes! Upgraded to a GAN speed cube with magnetic registration, and it knocked 30 seconds off of my solve time (~ 2 minutes to 1:30) compared to the classic Rubik's Cube model. It's also more fun to use!

1

0

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 21, 2026

Replying to @Aaron@front-end.social

@Aaron@front-end.social This is smart. Browsers should do this by default! I had discussions with one browser manufacturer at one time, and they were like "But the edge cases!" and it was clear that they didn't care about users enough.

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 20, 2026

Replying to @Lee_Holmes@infosec.exchange

Hi Ava!

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 20, 2026

Ok, this is the weirdest thing to notice, but I can't un-notice it. When people use text-to-speech to narrate things, they tend to just pick the first voice that sounds great. Her name is Ava, and I now hear her everywhere :) Most recent example this weekend - the new Link Light Rail station in Seattle.

0

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 17, 2026

Where the hell did irm-iex-ing come from? As in "irm | iex"

Invoke-RestMethod in PowerShell has ALWAYS been a way to get objects out a website that exposes content as JSON, XML, etc.

Invoke-WebRequest is the one that gives you raw text back.

The fact that tools using irm-iex work at all is just a magic accident that converting an object (that's a string) into a string doesn't introduce any artifacts.

3

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 17, 2026

Replying to @agreenberg@infosec.exchange

@agreenberg@infosec.exchange Auto-buy. Can I just give you my credit card and you automatically send me every book you write?

4

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 17, 2026

Just had an internal web application break, and when I dug in through DevTools there was some dependent fetch running into a server error. The server error message provided the internal DRI contact to reach out to for how to engage and report.

This is so. smart. If you've figured out the DRI contact by going through DevTools, you clearly don't need any central helpdesk support on basic troubleshooting like checking your adblocker.

Makes me think of @shanselman@hachyderm.io 's "FizzBin" - https://www.hanselman.com/blog/fizzbin-the-technical-support-secret-handshake

4

0

2

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 16, 2026

Replying to @lcamtuf@infosec.exchange

@lcamtuf@infosec.exchange Congrats!

1

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 16, 2026

This is amazing. An hour ago, had an idea of an app to convert howto videos into descriptive text. Now it's done.

3

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 14, 2026

Replying to @regehr@mastodon.social

@regehr I thought the takeaways were cool: what was "proven" was remarkably secure, the edges around it had some issues. And the proof runtime 🤦 Great example of using two premier security technologies.

4

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 09, 2026

PowerShell Desired State Configuration supports a feature I'm very proud of: you can tell nodes to only allow configuration documents signed by a specified publisher. So if the host these things are pulling their configuration documents from gets popped, you have no risk of company-wide remote code execution unless they also got your signing key.

This saves you from attacks like this that leverage trusted internal supply chains like Group Policy: https://blog.quest.com/how-attackers-abuse-group-policy-and-how-to-thwart-them/

3

0

3

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 07, 2026

Replying to @spacerog@mastodon.social

@spacerog I agree with your point in general. It's odd that you're using a Microsoft case as the example. Microsoft was among the first companies to push for not calling it "Responsible Disclosure" for exactly the reason you point out. https://www.microsoft.com/en-us/msrc/blog/2010/07/coordinated-vulnerability-disclosure-bringing-balance-to-the-force For this specific case, who knows where the difference of opinion was - the github is super low on details.

0

Lee Holmes

@Lee_Holmes@infosec.exchange · Apr 03, 2026

Replying to @accidentalciso@infosec.exchange

@accidentalciso@infosec.exchange I've seen many examples of people using the AI Transformation to make that Digital Transformation happen. Sometimes, it pays to be a laggard :) One friend I talked to works at a non-profit that does 1:1 counselling for folks in need. There are a bunch of restrictions of who can talk to who and who's available when, and all of that scheduling used to be done by hand. This friend -- not a developer by any means -- was able to use AI to create a system for this and move that fully to a digital, automated workflow.

1

0

Lee Holmes

Posts

Lee Holmes | Threat Driven Software Development

Behind the Book: Threat-Driven Software Development

Catalin Cimpanu (@campuscodi@mastodon.social) - Mastodon

Remote instance

Media