Patrick Thomas (@[email protected])

Software engineer to security consultant, now security partner at @Netflix. Infosec pragmatist.

[Patrick Thomas (@[email protected]) @coffeetocode]

"Penetration Test" is a crazy overloaded term. Important to start w/ discussion of goals and tradeoffs between testers and client team.

[Patrick Thomas (@[email protected]) @coffeetocode]

Thanks for the #BSidesSF Semgrep workshop @enncoded @LewisArdern @onefiftyman . You packed a *ton* into 2 hours. Really appreciate the work that went into it.

[Patrick Thomas (@[email protected]) @coffeetocode]

@bsysop @Bugcrowd @ArmanSameer95 @GodfatherOrwa @mzamat123 Congrats man, that's fantastic. Always a pleasure to see you on the other side of the submissions!

[Patrick Thomas (@[email protected]) @coffeetocode]

@kb_awholevibe Thanks for the interest! LocoMocoSec talks aren't recorded, but here's the deck: https://t.co/Z3IsIvD5gg

[Patrick Thomas (@[email protected]) @coffeetocode]

Woot! Let's do this! I'm really looking forward to sharing this.

[LocoMocoSec: Hawaiʻi Security Conference @LocoMocoSec]

Patrick Thomas, Senior Security Partner @netflix, is speaking @LocoMocoSec next week!

Register now to see his talk 'Productizing Security For Leverage and Scale' on June 30th🤙

⛵ Waikīkī Marriott Resort
🏝️ O'ahu, Hawai'i
☀️ June 27-30th

🌟 @coffeetocode

[Patrick Thomas (@[email protected]) @coffeetocode]

What can we say, twitter-driven development sometimes works :)
https://t.co/W12RcGwa75

Ya'll are good folks. Keep it going!

[security.txt (RFC 9116) @securitytxt]

Exciting news! @Apple joins the list of companies with a security.txt file. Now, we only need @netflix to complete the FAANG list. 🙌

[Patrick Thomas (@[email protected]) @coffeetocode]

@bsysop @Bugcrowd Congrats!

[Patrick Thomas (@[email protected]) @coffeetocode]

Expanded a bit on this over at https://t.co/cNqz0Kf32j

[Patrick Thomas (@[email protected]) @coffeetocode]

I love formal forecasting exercises (esp those run by @Magoo) because they really force you to slow down consider all the potentially relevant facts, and introspect your biases. FWIW I was 80% here, but I think I was undervaluing the "autopilot" nature of modern CI/CD.

[Ryan McGeehan @Magoo]

That's what myself and 26 others sought to gather over the weekend. The panel we put together forecasted a 72.8% belief it would happen. Here's the spread of forecasts

https://t.co/fS70r6WCNf

[Patrick Thomas (@[email protected]) @coffeetocode]

@leifdreizler I wonder too, but I promised myself I wouldn't spend that much time on it 🙃

[Patrick Thomas (@[email protected]) @coffeetocode]

Of the ~950 people I follow on twitter, some hacky profile scraping says that about 60 of those currently have a Mastodon link. So for me that's basically from ~0% to 15% exodus (or at least strongly hedging) in a *week*.

[Patrick Thomas (@[email protected]) @coffeetocode]

@ropnop @nart_nos @hez0_ ...now I just wanna spend the rest of the day ducking with serviceworkers. Also, doesn't this seem like a pattern that could be codified in a browser mechanism the same way httponly is? (Or is it and I just missed it?)

[Patrick Thomas (@[email protected]) @coffeetocode]

@hez0_ @ropnop Nice! TIL about that mechanism. Also, Ronnie's never gonna trust any builtins ever again. 🙃

[Patrick Thomas (@[email protected]) @coffeetocode]

@clintgibler @csima @DanielMiessler @shehackspurple @RachelTobac @evantobac @Jhaddix @lancinimarco @hashishrajan @securibee @QuinnyPig @ollieatnccgroup @_JohnHammond @mikepsecuritee @hakluke @antitree @ramimacisabird @0xdabbad00 @bubblewire @HelloArbit @barschachner @zanelackey @bryansolari @LewisArdern @astha_singhal @manicode @dcuthbert @0xine @__muscles @txs Congrats Clint! You're such an amazing example of everything that's great about this community. Know that you're helping a lot of people.

[Patrick Thomas (@[email protected]) @coffeetocode]

Hah, this makes me feel so much better about my small pile of aborted "I think I should write something about..." drafts.

[Troy Hunt @troyhunt]

Know how many blog posts I start writing but never finish? *HEAPS*! Sometimes the story just doesn't work out as expected, sometimes I calm down and change my mind, other times... I'm a busy guy 🤷‍♂️ Are there any here I really should finish?

[Thomas H. Ptacek @tqbf]

I don’t think there’s a SOC2 rule against banking 50 pre-approved empty PRs for future use.

[Patrick Thomas (@[email protected]) @coffeetocode]

When looking at a big backlog of known work we want to drive, it's *so easy* to just group into themes and call it good. I can think of times I've done that which really, really would have benefitted from asking if the framing leads to an ability to confidently prioritize. 2/2

[Patrick Thomas (@[email protected]) @coffeetocode]

Someone asked today "Is that list of 'goals' *really* a list of goals, or just a some themes of work?"

I *love* that question & the insight behind it. True "goals" help prioritize among possible work, themes really don't. 1/2

[Aaron Boodman @aboodman]

Chrome was delivered without any sprints at all. The team came in at 9 and left at 5 (figuratively, people actually kept their own ~8h schedules) every workday for a couple years like clockwork. No drama. No broken marriages, no broken families.

[Patrick Thomas (@[email protected]) @coffeetocode]

@caseyjohnellis @timb_machine @UK_Daniel_Card Hah, funny you mention that. @ramimacisabird was saying that the other day, and we've been talking about what an updated, more thoughtful/communicative view would look like. What aspects looking most wrong or dated to you now?

[Patrick Thomas (@[email protected]) @coffeetocode]

Congrats to @Resourcely! Clear, exciting product vision at that critical touchpoint of developer velocity, security, and cloud resources.

Very pleased to have joined this round, and looking forward to seeing where @travismcpeak and @0xshellrider take this idea.

[Resourcely @Resourcely]

Hello world! We're on a mission to make cloud security easier for users. See our funding announcement (https://t.co/uBm6JTCAct) and blog post (https://t.co/xXLAUz4Pes) for more details.

We're #Hiring!

[Patrick Thomas (@[email protected]) @coffeetocode]

@deciban Ohhhhh, yes! I remember when TurboIntruder came out, but it didn't stick properly in my brain. I gotta go play with it now. Thanks!

[Patrick Thomas (@[email protected]) @coffeetocode]

Web timing attacks: super cool in principle, still super janky in practice. Seems like TimeTrial (https://t.co/tVkldL3epu) and Nanown (https://t.co/TPKkst2VPm) still best tools, but really janky to get running & require a known-good case. Anyone got suggestions? Banging my head.