Bob Lord 🔐

🌔 The new images from the Artemis II mission are rolling in. 🌖

"Houston... we have microtonality!" 🎶 🎼

✋️ 🔺 🤚

There is an entire industry designed to distract enterprises from deploying FIDO authentication. Why solve the problem when you can "manage" it with "risk informed decision frameworks" that require bespoke products and don't really work? 💸 🔓️

🥱 Tired of zombie advice that won't stay dead? 🧟 Check out hacklore.org for the advice that will keep your online accounts and devices safe from the most common attacks. 🔐

📣 Share the cure with your networks!

🎭 Roses are red, violets are blue, juice jacking isn't real, and neither are half the threats you've been told to worry about. 😜 Happy (almost) April Fools' Day — the Hacklore newsletter is out! 📰

https://buttondown.com/hacklore/archive/hacklore-the-april-fools-edition/

✈️ Headed to RSAC? Don't forget to pack your Hacklore Bingo Card. 🧳

🧟‍♀️ And be sure to send the zombies over to hacklore.org to find the cure. 💊

🧟 We’ve gotten very good at defending against unlikely things. 🧟‍♀️

hacklore.org 🙈

📞 2010 called... 📞 It wants its security advice back! 🤣

hacklore.org 🧟

🔁 Boost to your network to bury hacklore before it rises again. 🧟☠️

I attended Apple’s “Fortify Your App” event, a packed day of guidance for developers on eliminating memory safety defects on Apple platforms. I wrote some thoughts here:
@boblord@medium.com

⌛ Giving outdated cybersecurity advice misdirects people from the tasks that will actually help them be secure. It's time to let go of zombie advice! 🧟‍♀️

📖 Check out https://hacklore.org where you can learn what tactics work against the most common crimes.

📬 And sign up for the mailing list!

The information in a user's Claude account might be more valuable than what's in their mail account... but there is no passkey option? 🤔

📅 It's not too early to start your Cybersecurity Awareness Month planning, especially if that planning involves removing hacklore from your materials. 😉

ℹ️ More information here: hacklore.org

📬 Join the newsletter: https://buttondown.com/hacklore

📣 Spread the word!

It's 2026 and time to stop getting cybersecurity advice from the undead. 🧟‍♂️🧟‍♀️

Ready to let go of zombie advice? Start at hacklore.org! 🔐

Bluesky: https://bsky.app/profile/hacklore.bsky.social

Newsletter: https://buttondown.com/hacklore

📣 Spread the word!! 📣

What's the best web page or video that explains why everyday people do not need to purchase a personal VPN service? 🤔

Happy Twin Peaks Day to all who observe!

I'm looking forward to some damn fine coffee and cherry pie! Wish I lived closer to the RR Diner. Best pie in the tri-counties!

🗻🗻🦉🌲🪵 🍒🥧☕️🍩 🕵🏼‍♀️ 👍🏻

📰 When headlines fixate on “zero-days,” they distract from the real question: What is the manufacturer doing to prevent recurring classes of coding error? 🤔

Drama focuses on the Villains. Accountability focuses on how the Vendors make the product.

@cR0w@infosec.exchange @hotsoup@infosec.exchange Great points! A really great book that describes these incentive structures is Geekonomics by David Rice from 2008. I highly recommend it. David identifies numerous gaps between other sectors and the software sector. It's worth a read!

It’s time to retire the phrase “sophisticated threat actor”. 🌴 🍹 🏄️

Let's get beyond vague adjectives that celebrate the villains 🙄 and start talking more about how software design can play a role in keeping people and organizations safe. 🔐

@boblord@medium.com

It’s time again for me to listen to my favorite cybersecurity podcast. Well, it’s technically about automotive safety, but I can’t help seeing the parallels to software safety. I hope you find it enlightening too! 💥 🚗

https://99percentinvisible.org/episode/nut-behind-wheel/

📢CISA released the second version of its Secure by Design whitepaper.

https://cisa.gov/securebydesign

Want to learn what’s new? Read on! #secureByDesign 🔐

We received a great deal of feedback from software companies large and small, industry groups, our JCDC partners, and of course our international partners. 🌐

The first version was co-sealed by 10 US and international partners, a record at CISA. For this version, 18 organizations co-sealed, demonstrating incredible interest across the globe in finding ways to make software more secure. 🖋️📜

We greatly expanded the section on the three principles: (1) Take ownership of customer security outcomes, (2) Embrace radical transparency, and (3) Lead from the top.

We included more background on the principles, and also some sample artifacts that software manufacturers can use as evidence that they are evolving their processes in alignment with these secure by design principles.

No one artifact alone will be fully convincing, but several of them together may start to paint a compelling picture. 🖼️

As the saying goes, the future is already here, it’s just unevenly distributed. We know that there are many examples of secure by design engineering happening today. 🏗️🔧⚙️🛠️🔐

We urge software companies to read the updated whitepaper, and to share publicly the ways in which they are making the secure by design transformation.

Many thanks to Lauren Zabierek, @jackhcable@mastodon.social, @grantdasher@bird.makeup,
Eric Goldstein, and of course Director Easterly for making this initiative possible. 🙏 And a huge shout-out to External Affairs and their art department. Wow! 🧑‍🎨🎨

More information is available on our blog here:
https://cisa.gov/news-events/news/next-chapter-secure-design