If we analyzed Microsoft Patch Tuesday using the same assumptions industry analysts use with market growth

Okay, I never would have paired it with Stairway, but it kinda works …

https://youtu.be/rAswBqwwhJo

I commented in my personal capacity on NIST’s plans to modernize the NVD. My concern: can small NGOs with no security team figure out if they’re affected, what to do, and without expensive tooling or epic triage/review work? https://www.regulations.gov/comment/NIST-2026-0100-0133

One for the Linux nerds out there:

🎶
Ra-Ra-Rasputin,
ls /usr/local/bin
🎶

New, by me: An OpenAI employee on the product team has been arrested by the FBI and charged with planting a secret recording device in an OpenAI conference room. The Saudi national was arrested last week and fired on Friday after OpenAI allegedly caught him.

More: https://techcrunch.com/2026/10/13/fbi-arrests-openai-employee-accused-of-planting-hidden-recording-device-in-conference-room/

Bypass for ad-blockers: https://archive.is/J7s6j

Gotta lube up these eyeballs so I can read the whole thing

Not now, honey, a new @edzitron just dropped

Be #antifa or be fash

AI agent discovery is becoming a standards problem—and different groups are drawing the boundaries very differently.
I compare the W3C AI Agent Protocol Community Group with IETF DAWN: where they overlap, where they diverge, and why scope may matter as much as protocol design.
https://sphericalcowconsulting.com/2026/10/13/two-approaches-to-ai-agent-discovery/

Ukraine helps move Russia's Yandex data centers to the cloud.

I was thinking about plays in a theatre and how when we watch actors we're also participants. We suspend our reality to watch a story's reality.

When we read a book, we're imagining the world and the people that story takes place in.

Even listening to stories we're imagining worlds, we're participants as we aren't passively taking it in.
It's all sharing our time and imagining. It's social.

Which I think is part of the reason AI slop feels wrong to so many of us. It's not social at all.

Half of the AI patches don't work with Keith Hoodlet and @joshbressers

This paper proves exactly what I have been saying in numerous talks: fixing vulnerabilities properly still requires a clever human involved.

https://opensourcesecurity.io/2026/2026-10-keith-ai-patches/

🤣👇😂👇😉

Interesting how the media keeps referring to the AI companies as "labs" as in "a model escaped the lab.." or "research at the labs shows that..."

'Lab' implies a place where experimentation and 'accidents' understandably might happen. Y'know, like Ebola or Covid.

A 'company', on the other hand, is a place where such 'accidents' are financial iabilities to be avoided at all costs.

See how semantics not only shapes the narrative & public perception but also accountability as well?

Whelm levels:

Ultrawhelmed +++
Hyperwhelmed ++
Overwhelmed +
Eigenwhelmed ✓
Superwhelmed ↑
Equiwhelmed =
Subwhelmed ↓
Antiwhelmed X
Underwhelmed -
Hypowhelmed --
Infrawhelmed ---

Doch rund 99% dieser "Siegel" (Zertifikate) für Schweizer Webseiten werden von ausländischen CAs (Certificate Authority) ausgestellt, über 93% davon von einer einzigen CA, Let's Encrypt, in den USA.

Ohne das Gratisangebot von Let's Encrypt wären wir immer noch weit davon entfernt, dass der grösste Teil des Internetverkehrs heute verschlüsselt ist.

Aber 93% Marktanteil ist ungesund. Und die US-Abhängigkeit dabei auch, gerade angesichts der neuesten Sanktionsdrohungen.
https://trends.builtwith.com/ssl/country/Switzerland

If you’re going to TechCrunch Disrupt this week, you can find me on the stage where @zackwhittaker will be attempting to moderate me

#SilentSunday

Good security should be a customer right, not something customers add at their own expense.