shortridge

shortridge, 3 days ago to Cybersecurity

my new post covers how to get started with chaos experiments without having to larp as sysadmin, disrupt your users, or piss off your execs ✨ https://www.fastly.com/blog/chaotic-good-resilience-stress-tests-at-the-edge

it includes a js code example that verifies super basic #cybersecurity assumptions about your org’s website, like:

🍪 my site requires cookies or auth headers
⚔️ my site does not allow cross-origin requests

so, it’s a great starter experiment to get familiar with the practice — and it clones requests to avoid fucking with prod ✨

wingo, 3 days ago to random

graphviz is a tool to convert graphs to unintelligible spaghetti

shortridge, 7 days ago to random

a confession: I’ve battled mourning doves for months, ever since I bought a bird feeder for my garden and they kept draining it in less than a day.

they are allegedly stupid creatures, but that’s just what they want us to think.

I am plausibly an expert in cyber defense, having written a book and academic papers, lectured at federal agencies and F500s alike — yet the doves thwart my every mitigation.

I planned to write a blog post once I won, but my hope for victory further desiccates daily…

shortridge, 7 days ago to random

tired: too many browser tabs

wired: the system is struggling to absorb and regenerate from anthropogenic stresses

shortridge, 17 days ago to security

went down to the hotel lobby to retrieve my dinner delivery in a yoga outfit + snuggly cardigan + face mask.

some men with #RSAC2024 lanyards exited the elevator as I re-entered; they turned back to look at me and one said (very loudly, very pointedly staring at me) to the other, “I was like, did you hire me a hooker?”

if you are a man attending #rsac, please shut that kind of shit down when your peers do it. let’s not let insecurity rule our #security industry.

shortridge, 16 days ago to random

anyone know the best place around Moscone to get a chai latte? #rsac

shortridge, 23 days ago to Cybersecurity

The 2024 Verizon Data Breach Investigations Report (#DBIR) is out this morning, and I make sense of it in my new post: https://kellyshortridge.com/blog/posts/shortridge-makes-sense-of-verizon-dbir-2024/

I focused on what felt like the most notable points, from #ransomware to MOVEit to web app pwnage to #GenAI and more.

I have insights, quibbles, and hot takes as always — but the fact remains it’s our best source of empirical data on cyberattack impacts. If you’re a #cybersecurity vendor, please consider contributing data to it.

shortridge, 24 days ago to Bulgaria

To my #EU friends, followers, and future allies: I’m keynoting #CraftConf in exactly one month (May 30).

I will bring #cybersecurity heresy — and custom #ChaosKitty stickers — with me to Budapest.

You still have spacetime to buy tickets and bask in software craftship: https://craft-conf.com/2024/talk/disputation-on-the-power-and-efficacy-of-cybersecurity

Let me know if you’ll be attending, speaking, or otherwise proximate xx

shortridge, 26 days ago to random

Me: “I’m lowkey bullish on inexact supercomputing.”

Them: “Intel’s been doing that since the 90s!”

(historical context for the joke: https://en.wikipedia.org/wiki/Pentium_FDIV_bug)

shortridge, 1 month ago to random

my Pilates instructor told me to “check on my gays,” so how are y’all today?

shortridge, 4 months ago to Cybersecurity

I’m in a reflective mood this week and it’s kind of wild to me that I’m known as a “provocateur” in #cybersecurity for takes like:

💡 don’t shame victims

💡 UX matters, a lot

💡we should understand what we’re supposed to protect

💡 if someone clicking a thing on the thing-clicking machine leads to security failure, they are not the foolish one

💡 the best things a security program can invest in aren’t in the RSAC vendor hall

💡 maybe we should start actually proving outcomes??????????

¯_(ツ)_/¯

shortridge, 1 month ago to random

Dan Brown is Perl.

no, I will not elaborate

shortridge, 1 month ago to random

Byzantween Generals 💀

#sigbovik without context

shortridge, 1 month ago to random

I’m watching the #SIGBOVIK livestream and this is hilarious but also where has this been all my life: https://sendmixedsignals.vercel.app/

it’s a tool for weighting the variegated intentions you want to express to a counterparty and synthesizing them into one statement.

A+ for shitposting but also blending in with humans

shortridge, 1 month ago to random

earthquake in nyc was not in my threat model… but I guess that’s the point of fault injection

(☞ ͡° ͜ʖ ͡°)☞

Di4na, 1 month ago to random

I know I am late to it, but I finally read https://kellyshortridge.com/blog/posts/rfi-secure-by-design-response/
Thank you @shortridge for being one of the rare person in this domain that make sense.

You are one of the reason I still write about this. I may not have a lot of hope, but at least I feel less lonely.

(And yes, I do not agree with everything, but faaaaar better than all the other answers)

whereistanya, 1 month ago to random

My new #1 requirement for devices and appliances and machines and robots of every kind is “does not beep at me.”

shortridge, 3 months ago to random

in case there are other nerds out there who haven’t yet read this classic, behold “the case of the 500-mile email” https://www.ibiblio.org/harris/500milemail.html

I adore the “absurd computer-borne mysteries” genre and kindly ask for more content from the annals of y’all’s careers

shortridge, 2 months ago to random

them: where do you want your career to go in the next 5 to 10 years?

me: to become widely known as “The Entity”

aphyr, 2 months ago to random

Ah yes, the two genders