Some days I think about how I (IMNSHO) mastered #C, #Perl, #LisP and #bash (et.al), and made a passable living in C++, C#, VB, SQL and x86 assembler for a long time, and how a surprising volume of that knowledge still is useful.

At the time it always felt like a stopgap until the Next Big Thing.

What many don't seem to get about #consumer #feedback is how consistently giving five-star #ratings is seen by the beancounters in orgs - it's seen as "We're overdelivering, there's savings to be made in quality".

Weirdly this seems to go for gig workers quite often, as well. 😞

So, what's our collective #infosec take on how well #AI is working in #IR / #incidentresponse ?

On one hand, storytelling and contextualizing, acting decisively on poor data, and changing direction radically if someone has a good data point, is core to response management.

OTOH, I can think of no worse situation to lean on a word salad generator tuned to what has been popular buzzwords in the security media glossies the last decade(s).

Out of my six decades of life, I can detail the single moment when I felt reservationless #happiness, for three minutes.

It was a trivial, everyday event in a fleeting interaction with a stranger, many years ago.

I cherish that moment, but to be honest, I was hoping for… more?

#silentsunday

Looking at the immediate effects of the #UK new #OnlineSafetyAct I can’t help wonder who, exactly, wanted this. It’s an #infosec nightmare come to life, with massive damage being done to individual #safety, #privacy and #security.

No children will be safer by this, none. No citizen. Only those currently in power, when #anonymity is destroyed.

If the #EU persists in pushing for like legislation, the #Internet will truly have been destroyed, with all the economic value it holds.

This is no surprise, so the remaining question is ”Who benefits?”, as always.

I think #Microsoft have given themselves enough rope with #Recall. For Reasons, running anything like it would be flat out, no discussion, illegal in my org. As #CISO I’m sensitive to such things… :)

Sure we run a MSFT shop, and sure they theoretically have access to all that data anyhow - can’t [viably yet] process ciphertext, they see all the cleartext at some point.

The rope part is that argument. If MSFT argues that they see all data *anyway* so why not Recall, they burst our collective hallucination that various #GDPR agreements are actually worth a damn [Narrator: They’re not].

And then, my #infosec friends, I get to eject Microsoft - and coincidentally all other #US #cloud services as well as collateral damage - and finally build a full scale Linux/FOSS environment.

It’ll be more fun than I can #recall!

Is there any way to use something [just] like a #FlipperZero to detect, and ideally disable/shut down, an #Alexa device in any room/location I enter? Legality optional, jurisdiction varies. Asking for a me.

Also, fuuuuck you very much #Googlle for bricking my #Chromecast that was working fine. #enshittification

One turn of phrase I’ve found useful as a #CISO is

”The bad guys agree with you”

when explaining that what you think is valuable and important is what the bad actor sees as target, as well.

It’s so often in #infosec work you meet people who twist their reasoning into pretzels to convince themselves their valuables are hidden and will be left alone, but still want to use those valuables to publicly profit.

This is your infrequent reminder to collect all and every device you have that has digital storage - floppies, USB sticks, hard drives, cameras, phones, iPods, *everything* - in a pile on your kitchen table, look at it, and consider what data is there.

And, that if you are ever accused of a crime, right or wrong, none of these devices will be returned to you in a relevant timeframe.

#infosec #digitalselfdefense

Trivia: On my "Liked songs" #Spotify playlist, there's "Ocean Man" by Ween. The reason it's there is because of the #EldenRing myth that a specific piece of gear with a very low drop rate - a land octopus you shove over your head as a helmet - drops more often *if* you are playing "Ocean Man" while farming it.

Some claim #EldenRing hacks your mike, and increases the drop rate if it can hear the song. Some are just superstitious. I was taking _any_ help.

The song is 2 minutes. I farmed the helmet for several days. It is engraved on my brainstem now.

https://open.spotify.com/track/6M14BiCN00nOsba4JaYsHW

Let’s hope for the best.

This lasagna is coming from a place of misery, or something like that. #Silentsunday #cooking

Todays #bread is:
5dl barley, 3dl Graham, 1dl grated Västerbotten, 15ml salt, 25g yeast, 5dl lager beer 5%. Work 15m, rise 45m, 190C 70m.

Working in #infosec is really about selling Hope.

When we say ”risk-based approach”, what we’re really saying is ”hope-filled thinking”. This is not a bad thing, Hope is what makes us all go on.

But be careful about how you use facts and metrics to crush Risk - you don’t want Hope to be collateral damage.

About me:

Soft-spoken #security old guy. 
Multi-industry, always #infosec, often IT/OT, sometimes physical/personal. I can find a policy, a pentest, or a bulletproof vest that suits your needs.

I mostly write like I prefer my coffee - dark, bitter, scalding.
https://justmytoots.com/@subm3rge@infosec.exchange

Is there any way to work with #infosec / #cybersec (apart from redteaming I suppose?) that doesn’t force you to be The Grownup in every single room you talk to people?

Asking for a friend.

You know what’s worse than your org not giving a sh*t about #infosec (yet)?

When your org has a one or a few proponents of doing infosec, but sloppily ad hoc, without structure or aim, and just swinging that cyber #FUD bat whenever they want something (else) done. A lot of sinners from the helpdesk and sysadmin camps in this group, sadly - they are otherwise perfect candidates for infosec roles.

These people take up headspace with any and all users, and since they *usually* solve problems, the users love them. That they’re accruing Security Debt like crazy has a powerful SEP field on it.

Fighting this is like Brandolini’s Law, squared. FML.

As someone who saw this up close:
https://techcrunch.com/2023/02/14/instagram-is-killing-live-shopping-in-march-will-focus-on-ads-instead/