Charles Wright

Security and privacy research scientist / engineer. Formerly FUTO / Portland State / MIT-LL... PhD @ JHU.

[Heather Adkins - Ꜻ - Spes consilium non est @argvee]

Nice write up from the Cloudflare team, but the post here is misleading. Patch faster is not the wrong answer, because most teams are patching on the order of weeks or months. You must patch faster than that right now. But I will agree that 2 hours is infeasible beyond the occasional emergency CVSS 10. And defense in depth is a part of the arsenal, now the whole story.

[Charles Wright @hackermath]

@lsanger Heiser's book is weird but worth reading. He makes a very interesting case.

And as a former academic, where the job is basically arguing with smart people, *wow* the dude was an absolute baller.

It's really too bad you never got to talk to him.

[Charles Wright @hackermath]

@lsanger The immediate problem with "no other gods exist" is the Venite, Psalm 95:3.

Also, you can't say "Find me *any* passage" and then walk that back to exclude the main one that you already know is a problem for your position.

[Charles Wright @hackermath]

@lsanger I think you're getting tangled up in the modern vernacular meaning of the word "god" vs "elohim".

[Chris Wysopal @WeldPond]

I just learned the sad news that Peter Neumann has passed away.

Peter Neumann shaped how a generation of security people learned to think about risk. As editor of RISKS Digest, he gave many of us coming up in the 1990s and early 2000s a steady education in the real-world consequences of computer failures. His work made the field more serious, more thoughtful, and more honest. He will be missed.

I first met Peter when we both testified at the 1998 Senate Governmental Affairs Committee meeting on Government Security where the L0pht testified. The combination of Peter and the L0pht made the hearing more powerful even if us hackers stole the spotlight.

Neumann and the L0pht made the same argument from two different directions. Neumann gave the institutional, systems-engineering view: the country was becoming dependent on brittle, interconnected systems that were never designed for security, reliability, or survivability. The L0pht gave the field evidence: here are the actual flaws, here is how attackers think, here is how cheaply and quickly these systems can fail in practice.

Neumann supplied the credibility of a long-time researcher warning that this was not just “hackers breaking into things,” but a structural failure of technology markets, procurement, engineering discipline, and risk management. The L0pht supplied the proof that the warnings were not theoretical. Together, we made the hearing unusually powerful: the academic risk community and the hacker community were telling the Senate the same thing, in different languages, before the rest of the world had fully caught up.

[Dr. Ashley T. Rubin @ashleytrubin]

I don't think we (academics) realize how vulnerable we are. I'm not sure how much longer tenure will last in an era when a) we've lost the public trust (for a lot of reasons, b) college/academia is a partisan political issue, and c) college-educated white-collar workers are losing their jobs to AI. We are in an incredibly privileged position relative to others, but that privilege also makes us far more precarious than most academics realize bc it makes us a target--and the threat is not just conservative politicians gunning for us but the much larger group of regular people who don't mind if we get put in our place or start losing our jobs like similar others or being asked to do tasks we don't want to do.

[Charles Wright @hackermath]

Exhausted zombie Pogi is not something you see very often

[Eurosport.es @Eurosport_ES]

🗣️ La frustración de Pogacar tras ser segundo de nuevo en Roubaix por 'culpa' de Van Aert: "Me di cuenta que sería imposible al 99%"

#ParisRoubaix

[Charles Wright @hackermath]

NEVER DOUBT

[Team Visma | Lease a Bike @vismaleaseabike]

🇫🇷 #parisroubaix

“This victory means everything to me." - Wout Van Aert

Read more in our race report! 📷🗞️

https://t.co/X76boETkR0

[Charles Wright @hackermath]

@MrDanielBuck

[zooko🛡🦓🦓🦓 ⓩ @zooko]

Yep, the Computer Security AIpocalypse is happening. Please be patient with the computer security professionals you know for the next few months, as they’ll likely be busy and stressed about preventing the collapse of civilization. https://t.co/AxuD2hEfBD

[Charles Wright @hackermath]

@JoshuaSteinman I feel like you are asking a question that you already know the answer to...

[Charles Wright @hackermath]

@lsanger This goes back to Popper. Truth was one of the "strong gods" that had to be put down for the revolution.

[Charles Wright @hackermath]

Milan-Sanremo was awesome this year.
* Pog showing that he's human after all
* Pidcock showing that he's one of the top guys now
* Van Aert showing that he's still got it
* Pedersen signing up 5 minutes before the race and still beating literally everyone else

[Michael Seibel @mwseibel]

When youthful energy directs itself toward productive paths it’s amazing what can be achieved. When directed toward the wrong paths it’s amazing how tons of hard work and enthusiasm can produce nothing of value. Trying hard and having a just goal isn’t enough. You actually have to be effective in order to make a difference.

[Charles Wright @hackermath]

I did finally get around to building that E2EE layer btw

https://t.co/ULvX3poOnN

[Charles Wright @hackermath]

A few years ago, I wasted way too much of my time and Eron's money trying to build something on top of Matrix.

Should have built our own E2EE from scratch. Expensive lesson to learn.

[Eron Wolf @eron_wolf]

Would it be fair at this point to declare the entire Matrix project to be a dead end?

Looks like they've had tens of millions of dollars of funding with terrible results. The people involved seem incapable.

[Charles Wright @hackermath]

@eron_wolf They *finally* lost me when it took 600+ messages on a Github issue to add an endpoint for setting data that already exists.

Look up MSC 4133 if you want to see every kind of dysfunctional behavior under the sun.

[Dr Milan Milanović @milan_milanovic]

Someone builds a project management tool with Claude Code over a weekend. Ships it. Tweets "just replaced Jira."

The app works. One user, happy path, localhost. Then two people edit the same record simultaneously, and the data is silently corrupted. They don't know what an optimistic lock is. They never needed to before.

The prototype is maybe 1% of what makes software actually work. The other 99% is what you find after real users show up: race conditions, failed transactions, sessions expiring at the wrong moment, a payment webhook that fires twice and charges someone double. AI didn't cover any of that. It built exactly what you asked for.

And the confidence is the worst part. "Just need to adjust a few things before we go live." The few things you need to adjust are the product. That's like laying a foundation and telling people you basically built the house.

Vibe coding works. For personal tools, throwaway scripts, and prototypes you'll never put in front of paying users, it's genuinely fast and good enough. I use it. But there's a hard ceiling, and it shows up the moment the stakes get real.

Agentic engineering is a different discipline. You're not prompting for code. You're decomposing problems, designing system boundaries, writing specs precise enough that the agent doesn't go sideways. You review everything it builds, because it will make mistakes that only look wrong if you know what correct looks like. You guide it. You catch what it misses.

If you don't know what a distributed transaction is, the agent won't save you. It'll generate something broken with complete confidence, and you won't know until production.

The hard part of software was never writing the first 200 lines.

It never was.

[Charles Wright @hackermath]

I have to admit, I lol'd

[Orin Kerr @OrinKerr]

You may have noticed that when you ask an AI chatbot to evaluate ideas, it often starts with enthusiasm. And when you criticize its enthusiasm, it drops the enthusiasm. I asked Claude (Sonnet 4.6 extended) why it did this, and it had this reply—not news, but worth emphasizing.