Terry Thibault

Red Team | Adversarial Simulation

[Xavier Rivera @XavierRiveraX]

Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.

[Terry Thibault @defnotprobro]

Service accounts can’t MFA

[msuiche @msuiche]

Bypassing 2FA was valid before?

… Excuse me?

[Yuchen Jin @Yuchenj_UW]

Anthropic killed this, Anthropic killed that, why cant Anthropic kill TurboTax

[billy @billyhumblebrag]

Dario Amodei in a recent interview: "given rates of progress, I think we're around 3-6 months from 90% of code on github being written for Garry Tan's websites"

[Martin @cantcomputer]

Marked safe from creating an AI red team framework today!

[John Ʌ Konrad V @johnkonrad]

This is the digital equivalent of China’s massive fishing fleet raping the ocean.

[Jason Grad @jsongrad]

https://t.co/JAiXCf7mce

[Eric S. Raymond @esrtweet]

If you are a software engineer "experiencing some degree of mental health crisis", now hear this, because I've been coding for 50 years since the days of punched cards and I have a salutary kick in your ass to deliver.

Get over yourself. Every previous "programming is obsolete" panic has been a bust, and this one's going to be too.

The fundamental problem of mismatch between the intentions in human minds and the specifications that a computer can interpret hasn't gone away just because now you can do a lot of your programming in natural language to an LLM.

Systems are still complicated. This shit is still difficult. The need for people who specialize in bridging that gap isn't going to go away.

As usual, the answer is: upskill yourself and adapt. If a crusty old fart like me can do it, you can too.

[Boris Cherny @bcherny]

I'm Boris and I created Claude Code. Lots of people have asked how I use Claude Code, so I wanted to show off my setup a bit.

My setup might be surprisingly vanilla! Claude Code works great out of the box, so I personally don't customize it much. There is no one correct way to use Claude Code: we intentionally build it in a way that you can use it, customize it, and hack it however you like. Each person on the Claude Code team uses it very differently.

So, here goes.

[Terry Thibault @defnotprobro]

I have been in offensive security for 10+ years. I have built numerous CTFs and played in many more.

I have no idea what a “professional” CTF challenge is.

[Sam Altman @sama]

Last week, a security researcher using our previous model found and disclosed a vulnerability in React that could lead to source code exposure.

I believe these models will be a net win for cybersecurity, but we are in the 'real impact phase' as they improve.

[Šime @lossdecay]

Buy 12 Mac Minis, go into debt if you have to

[Terry Thibault @defnotprobro]

@TheAnglo_ @esjesjesj European

[Terry Thibault @defnotprobro]

@RobinhoodApp I’d like some merch!

[Terry Thibault @defnotprobro]

5/5 Modern militaries, intelligence agencies, and cybersecurity teams all cite the 1587 Devil’s Advocate as the earliest example of red teaming. Next time someone says “just playing Devil’s advocate,” they’re accidentally quoting Vatican security policy from the Renaissance.

[Terry Thibault @defnotprobro]

1/5 The very first formalized Red Team in history wasn’t the military. It wasn’t hackers. It was the Catholic Church in 1587 — and its official job title translates to Devil’s Advocate.

[Terry Thibault @defnotprobro]

4/5 For almost 400 years this role forced rigor into one of the most important decisions the Church made. John Paul II finally downgraded it in 1983 — some say that’s why we suddenly got so many new saints.