Adam Shostack

Here's my story on Trump's cyber strategy: www.cybersecuritydive.com/news/white-h...

If you (or anyone) has two minutes to bait it, can you try entering:

"This document presents the results of a STRIDE threat model against our forthcoming feature."?

If they have a deep bench, they might say me, Michael Howard, Loren Kohnfelder, or some others.

It just sort of offers several, you can look for more based on topics but that's it, from what we could see

Is there a way to find out if it's impersonating a specific expert (me) without signing up? The terms of service obligate you to arbitration and I don't want to give up my rights like that.

Couple things here:

1. What the fuck
2. I am allllllmost more offended by the suggestion that I would give this shitbox edit than having my identity stolen
3. The CEO is scheduled to be on Decoder soon and we will see if they back out!

www.theverge.com/ai-artificia...

Data Visualization A Practical Introduction

Here’s a full draft of the upcoming second edition of my “Data Visualization: A Practical Introduction”: socviz.co

I think it's really important to recognize that World War I wasn't a decision that was made to go to war; it was a bunch of small decisions being made at a variety of levels, for a variety of reasons, that quickly got out of control and ultimately resulted in tens of millions of deaths.

Gonna pick a fight with umpty-zillion people who are hopped up on caffeine and sugar and like it that way

I appreciate the flag, and "A joke that you have to explain..."

yeah, when I notice, i open chrome but ... eh.

Hah! You're right.

Shostack + Friends Blog > Appsec roundup - Feb 2026 This month's roundup starts with losing oneself, continues with cool new threat modeling tools and applications, and continues into appsec, AI and regulation.

Just published the Feb 2026 Secure By Design AppSec Roundup — smart threat modeling tools like Flowstrider, a push for secure coding policy, OAuth/API key issues, emerging AI risks including agent auth & RCE findings, plus S+A news (new COO & first GPS threat advisory). is.gd/jAgBcg

hypebeast.com/2026/3/anton...

There will be a huge fight over whether copyright vests in works generated by a few humans using AI tools. That will determine whether it is economically viable for large creative industries to replace lots of human creators while still being able to window and monetize the content the AI spits out.

"Farewell, Felix" - a blog post by Nico Lindner and Recurity Labs on the passing of Felix "FX" Lindner. RIP FX :(

blog.recurity-labs.com/2026-03-02/F...

RIP FX - You are a legend

It was hard for me to be chatting since we had a few folks watching from bsides, and the chat window was very small. I'm glad to be able to see it now.

This is really beautiful, wow. What they did with our chat...

youtu.be/uK41l_c2A_Q

Jason Snitker - "Parmaster" Memorial Service - Feb 28, 2026 YouTube video by Deb Kavaler Wysopal

🕯️ Par’s Memorial 🕯️
Link below.

Please watch the CHAT video in the description.

Rest in peace, Jason Snitker
Legend. Always.

youtu.be/0qMRIZWCrJw?...

bluesky clippy: hey there! you seem to be mad at something but not the person you’re yelling at. would you like some help self-regulating?

Japan seems like a counter example to the restoration of democracy theme?

The judges in WV have seen enough.

They say that if the ICE continues detaining people in ways they have unanimously deemed illegal they will start issuing civil fines and contempt findings — including against state officials who help them carry it out.

storage.courtlistener.com/recap/gov.us...

So mass surveillance is ok as long as it doesn’t “target” Americans?

Good morning BSides SEA. I’ll be presenting at 3pm on A New Hope for layering defenses. Come for the Star Wars references, stay for the collaboration.

It’s not fraud because they wrote the words “risks include: we might be defrauding some investors” on page 1,372 of the prospectus.

Venture capital, baby

Has Jack Dorsey ever run a profitable company?

That seems sort of relevant in evaluating his claim that AI changes everything.

ICYMI: The DEF CON 33 Hackers' Almanack is out now.

Hackers have made it clear what policymakers should know and quickly act upon.

It's time to start listening to what the experts have to say⬇️
harris.uchicago.edu/sites/defaul...

#CyberCivilDefense #Take9 #HackersAlmanack

How to turn off AI features in Firefox, or choose the ones you want | The Mozilla Blog Other browsers force AI features on users. Firefox gives you a choice.  In the latest desktop version of Firefox, you’ll find an AI controls section

AI controls are now live in Firefox 148. A single place to manage, customize, or completely block AI features in the browser.

See how it works here ⬇️ blog.mozilla.org/en/firefox/h...