Bruce Potter

CISO, supports @heidishmoo each year as she wrangles @shmoocon, periodic blacksmithing and leather work,

[Crispin Cowan 🇺🇦 @CrispinCowan0]

28 years ago we published StackGuard (stack canaries) that mitigates Aleph One's excellent paper. Now running on nearly every Internet-connected machine.
https://t.co/dReritVDRz

[Bruce Potter @gdead]

I’m keynoting the @hackaday SuperCon this weekend. W00t! Seriously excited for the opportunity https://t.co/UXJHCnyNzf

[Trinity Cyber @TrinityCyber]

Trinity Cyber has already deployed countermeasures for the latest PHP security alert and eMudhra certificate incident. In our latest blog, @gdead provides practical guidance for maintaining protection throughout response efforts.

Learn more: https://t.co/ZIFMXEgwjV

[Bruce Potter @gdead]

@myrcurial @Clinebot Congrats!

[Bruce Potter @gdead]

@HackingLZ Not sure why that’s not standard honestly

[haroon meer @haroonmeer]

We never ambulance-chase, but there's a good reason that smart security teams have suggested honeypots and deception to detect agentic attacks.

Dead simple && Works!

https://t.co/7uNUHJBgDN

[Bruce Potter @gdead]

@antitree Tried something similar a few days ago… mostly trying to identify bike routes. It failed horribly.

[Cycle_OverRide @Cycle_OverRide]

Hey #blackhat #defcon - Do you know there is the Cycleoverride Bike Ride at Defcon? https://t.co/fQHkTSjp9h Join us Friday morning!

[Bruce Potter @gdead]

There very little money in secure entropy but the failure modes are catastrophic. It’s a wild problem.

[Jameson Lopp @lopp]

Generating truly random numbers is a deceptively difficult problem. 12 years ago I participated in crowdfunding the production of the Mycelium Entropy device for that sole purpose. Sadly, few folks cared about this issue and they only produced ~500.

https://t.co/ptqmFhlhq4

[Bruce Potter @gdead]

@supersat @AlaskaAir I had to call to get it resolved, FYI.

[Bruce Potter @gdead]

@unspecific Same for presentation slides…

[Bruce Potter @gdead]

@ZackKorman @anton_chuvakin I think they are unfortunately the only solution right now that can apply guardrails. It’s tactical and definitely not the architecture for the long term. But anything more systemic feels like boiling the ocean to me right now. I don’t like it, but that’s the state of play IMO.

[Bruce Potter @gdead]

@anton_chuvakin @ZackKorman I agree in principle but we have built a resource access permission model that’s rooted in concepts from 50 years ago and has been a crazy patchwork since. If we can solve permissions for agents we will also be solving a huge % of existential security issues.

[Bruce Potter @gdead]

I don’t post much here anymore, but for those that follow me… I’ll be doing a deep dive on OpenTelemetry data and Claude Code instrumentation at 3pm EDT today. https://t.co/RpBcRLO6ps. See you there.

[Bruce Potter @gdead]

@OliviaGalluccii @anton_chuvakin We are doing Claude and Claude Code right now… representing the data in a useful way is really the hardest part. We’ve made some inroads with our internal capabilities and should have it shipped out into the product in a couple weeks.

[Runa Sandvik @runasand]

I started Granitt in 2022 to help journalists and other groups of at-risk people continue to do their work safely and securely. Please get in touch if you’re looking for an assessment, policy and process development, training, or presentation. https://t.co/5eyprsSuBF

[Bruce Potter @gdead]

@anton_chuvakin I reflect upon Steve Bellovin’s very useful quote: “A firewall is a network response to a software engineering problem”

[Bruce Potter @gdead]

@BryceCasperWX What’s the kit you’re using there?

[Bruce Potter @gdead]

@J0hnnyXm4s Holy. Shit.

[Bruce Potter @gdead]

Not entirely sure what @heidishmoo and @pwcrack are doing in this pic. :)

[DEF CON @defcon]

Some more images from the calm before #defconbahrain - our demo labs prepped for demonstration and the info desk ready to inform.

You can find out more #defcon at the #arabinternationalcybersecurityconference here:

https://t.co/5kDiQOPL9D

@NCSC_BH @AicsExpo