Jowabels

They said I couldn't fly. They were right. Like = bookmark.

[derek guy @dieworkwear]

As a general matter, my advice isn't really "go to this store" or "buy this brand." Rather, I encourage people to think about clothes in a certain way.

Let me show you how to shop for a good suit. 🧵

[srnorty @srnorty]

I think his point is that running speed relies to a great extent on a machine that you don't control, that is, your body, where things like tendon attachment points can't be changed. Whereas mathematical ability relies much more on a machine that you construct and can reconstruct if you choose - not your brain hardware, but the software you make in it.

Top running speed is maybe 90% fixed by your accidents of birth; top mathematical ability is maybe 1% fixed by the brain you were born with, and 99% determined by the conceptual machine that ends up getting constructed inside that brain.

[Jowabels @jowabels]

Nice conversation, learned a lot

[David Bessis @davidbessis]

"Tao’s early and intensive study of mathematics" isn't a "reason" but a symptom that, from an early age, he had entered a self-amplifying cycle of math-like cognitive exploration, discovery, pleasure, and addictive investment of his mental energy.

Asking why this happened to him and not to someone else is a bit vacuous, like asking why a hurricane formed on this very day at this very spot, and not the next day at another spot. There are obvious cofactors, like the favorable parenting style of his family, but they only explain a fraction of the variance.

This, by the way, is a normal pattern, a manifestation of Turkheimer's third law.

[jx (ultraviolet) @jx]

In 2017 I left a job, and within a week one of my former employees shut down and physically threw away a system I had set up for some QOL improvements for employees. It was very clearly documented (I've written technical documentation books).

It was a dashboard that showed traffic around the office, weather, if there was a ballgame at the ballpark literally next door (building parking got used for ball games), alerts from IT, live IT system statuses, and links to the ticket system, knowledge base, and employee handbook. It was accessible online or by looking at it on a display I put up on a wall for folks. People absolutely loved it.

My former number two literally took the display down and threw the physical server into the trash. A couple folks texted me asking why I took it down before I left, I said I didn't. They sent me a picture of it in the e-waste bin. I messaged him asking why, he said, he "always hated how transparent it was what we were working on."

He was not picked to be my replacement. The new guy who came in undid more things and then they got nailed in a $200k invoice scam and then he was fired. The company is gone now. :(

[Nathan McNulty @NathanMcNulty]

Another day, another bad set of CIS recommendations

Here are the items you do not want to do in this list:

5.1.5.6 - Ensure maximum certificate lifetime for applications does not exceed 180 days

⚠️ This will silently break cert renewal for all of your SAML based SSO apps...

[Kexun Zhang @kexun_zhang]

more people are just finding out about @slime_framework since glm-5.2. It's been out for so long. It's well designed and battle-tested for many generations of glms.

[Phil Venables @philvenables]

Absolutely fantastic talk on software engineering at a tipping point by Adam Bender from the Google I/O conference.

Some thoughts from a security perspect:

🚨 The 10x Liability Explosion: AI accelerates code generation, which instantly creates 10x more code and a massive new attack surface. Because human code review is becoming a severe bottleneck, security teams must shift toward scalable automated detection and statistical validation.

🔒 Internal APIs are Now Essentially Public: You can no longer rely on network obscurity. Autonomous agents will aggressively hunt for and call any internal data they can access, meaning all internal APIs must be hardened with the same zero-trust rigor as public-facing services.

🦸‍♂️ Centralized Remediation via "Shared Fate": Tightly linked ecosystems, like monolithic repositories, offer a massive defensive advantage. Security teams can deploy a critical patch in a single file and secure billions of lines of code company-wide within a week.

🧠 Regaining "Intellectual Control": Modern systems have grown too complex for human minds to map. AI gives us the power to build continuously updated, interactive architectural models, allowing us to threat-model effectively and ask dynamic "what if" questions about blast radiuses.

🚧 Building Secure Guardrails: AI agents optimize for the easiest path, which is rarely the most secure or maintainable one. Security engineers must build strict "isolation" boundaries for rapid prototypes and strong abstractions that constrain agents from making dangerous architectural choices.

https://t.co/5vVWuuO0IU

[Brian in Pittsburgh @arekfurt]

Network segmentation is one of those things where you really, really, really save effort and trouble baking it into an environment from the beginning.

You certainly can (and should, wherever feasible) rework existing environments to implement it. But don't expect it to be easy.

[Greg Young @gregyoung]

I saw this today and had to giggle.

[Mololuwa | Cybersecurity - (The God Complex) @cyber_rekk]

Novo Nordisk hackers got in through a GitHub token left in a repo

stayed for two months

took 1.3TB of data including unreleased drug formulas and internal AI models

then asked for $25 million

Novo Nordisk said no
so now they're selling Ozempic's secrets on the dark web

a GitHub token did this

[François Chollet @fchollet]

The hardest problems are rarely solved by adding more complexity to the solution -- they are solved by reframing the question until a simpler, clearer answer reveals itself.

[Brian in Pittsburgh @arekfurt]

One of the more important subjects to develop some insight into in cybersecurity is why threat actor groups, at a general level, try to go after the targets they do using the tools & techniques that they do.

Part of that involves understanding the economics of intrusions.
A 🧵:

[Jiří Vinopal @vinopaljiri]

Hello Reversers! 👋🔥
Excited to release my port of @washi_dev awesome #Ghidra #NativeAOT plugin - now running natively in #IDA Pro via #IDAPython! 🧩🐍💙

It parses #ReadyToRun metadata to rebuild the .NET type hierarchy, name virtual methods, and recover frozen strings in a navigable beautiful browser UI! 🥹

✨ Not just a 1:1 port - IDA-native upgrades:
➡️ Live sync FLIRT / Lumina / manual renames 🔄
➡️🏷️ PDB-aware: never clobbers your symbols, full demangled names
➡️🧠 Hex-Rays typing (__thiscall + frozen strings inline in pseudocode)
➡️💾 IDB-cached results (instant reopen) + headless idalib mode
➡️📦 Docs on GitHub; hcli plugin install once Hex-Rays indexes it.

PRs/issues welcome - 32-bit x86 port is on the table if it fits my research. 😉
https://t.co/PEbaG51TZG

#IDAPro #dotnet #NativeAOT #ReverseEngineering #malware #infosec @HexRaysSA @williballenthin

[Mitchell Hashimoto @mitchellh]

Creator of Sqlite on pull requests: "You say, oh, it's free. No. It's not free. What you're doing is asking me ... to maintain it for you, to to document it for you, to test it for you, to maintain it for you for the next 25 years. That's not free." Yep.

Wise words from a wiser man than me. I've told people for the past decade and I have recent posts on here saying the same: the merge button is the easy part. Its the decade+ (Richard says 25 years) that follows where you've accepted the transfer of maintenance thats hard.

[thinkingcap @chrisheatherly]

I’m actually a child online safety expert and was one of the pioneers in this space with Club Penguin and so I feel uniquely positioned to critique this.

The groomer problem is real but it’s also vastly overstated. The far larger issue we saw at Penguin was suicidality or reports of sexual abuse in the home.

There is no solution for lazy/bad parenting. You can implement all the ID laws you want but if parents are going to just hand kids their phones unlocked, those kids will have access to all the same things the parents have unfettered.

What I found is that these draconian safety laws actually make it harder to be an honest operator of kids apps because on one hand it’s so much legal risk and so much user friction that it simply becomes uninvestible as a business.

Parents will just lie to let their kids use the unfettered internet. For example, I have a friend who works in mobile gaming who has two kids, one above and one below the age limit but separated by just 2 yrs, and the two wanted to play and chat together on Roblox - which is reasonable. To do this, he just verified that his younger kid is old enough for the chat feature when he’s not.

This happens all the time and will happen with these laws to. How far do we want to go with this? Scan the face of the user in real-time to make sure it’s not a kid using the device? We could do that but it feels like a massive unwanted intrusion of privacy.

That’s how you know this law isn’t about kids. COPPA and GDPR-K and so forth already make it illegal to allow chat and other grooming vectors to kids.

What’s really being done here is trying to eliminate online anonymity. And this is a far bigger issue that goes to core speech rights because if you cannot criticize the govt anonymously and if wrong speech is a crime then it becomes easy to identify all the detractors of the govt in power, and ban, fine or jail them for speech crimes.

Starmer has already been doing this and he wants to do it at a much bigger scale. Starmer won’t even acknowledge the problem of actual grooming gangs in Britain’s neighborhoods but he’s worried about online grooming?

No he’s not, and this hypocrisy gives away the game. What he wants is to kill online anonymity so he can enforce censorship of his unpopular policies. No politician should have this power.

[Nick VanGilder @nickvangilder]

Reminder: I am no longer posting new red team jobs on LinkedIn and X. I used to post them every week. Instead, they now live on: https://t.co/9sSZTAzVEN. It’s all the same jobs and same content, just updated more frequently, a longer running list, automated pruning, and honestly just easier to keep track of and maintain.

[Nextron Research ⚡️ @nextronresearch]

🚨 New NPM typosquats caught by our artifact scanner: "twcompose-utils" and "classbreeze-utils" impersonating "@tailwindcss/typography".

They ship the real plugin + an obfuscated dropper (AES-GCM + RC4 strings). On require() they fetch an OS-specific native 2nd-stage from 194[.]11[.]226[.]41[:]4000, drop it as a fake "GoogleUpdateService" / "WpnUserSvc.exe", run it detached, and set up Startup-folder persistence on Windows.

C2: https://t.co/7urRO3wgs1

2nd-stage payloads (SHA-256):
agent.exe
e76741a1747dde6b4e4dbc88ca16fc8eb59385b6b18f6c64d1b397dfe0843647
agent-darwin-arm64
d8f8c416ebde7d90088d6029a5b9b88a2a021bf3b99896f205d78732d376ef5e
agent-linux-amd64
cc5c72e90d7eda42e66a54c0197abbba1951561d3d864963b6aca7fe43a0ab06
agent-linux-arm64
22480680a22ba444a3924f906cbec947d11f011200b89ef6b67afd48b4c71d77

[Jorge Maestre Vidal @J_MaestreVidal]

"Cyber wargames, like all wargaming, can convey the wrong training messages. One area in particular to be covered in the after-action game review is that not all the cyber capabilities in the game may be available for operations at a given moment.

The mental model of some players was apparently that cyber weapons are built and then stored for years in a digital warehouse, ready for war. Cyber weapons, like all military tools, are shaped by circumstance and chance. Their effects can vary widely, and even well-designed operations can produce outcomes far from what planners intended. The impact of a cyber-attack is notoriously difficult to forecast"

https://t.co/xyMk34rtvF

[Jowabels @jowabels]

KAT and Wiggins got a ring before Jimmy lmao

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

Developers from Signal (including its protocol's co-creator) along with Microsoft and Harvard unveil Encrypted Spaces, an open-source codebase for a new generation of private collaboration apps. Think Slack, Discord, Google Docs, all end-to-end encrypted. https://t.co/t93oHWn4C3