Shawn Ross

[Shawn Ross @sgtserve]

@jonedmiston Thank you for sharing this. It's inspirational and insightful. I appreciate both the practicality and excellence in this approach and the example you've shared. I look forward to doing something similar with our teams!

[Shawn Ross @sgtserve]

If you enjoy good music and appreciate artists who have honest things to share, I WHOLEHEARTEDLY recommend @prophiphop
He's rawly discussed societal issues for >10 yrs & the 'what to do' question...
More relevant now than ever.
He's been on repeat for me lately.

[Molly Crane-Newman @molcranenewman]

Footage taken by @Steffikeith this morning of ICE agents shoving photographers on assignment at 26 Federal Plaza. One journalist has been hospitalized.

[Shawn Ross @sgtserve]

An article worth reading and pondering.

[David French @DavidAFrench]

"If we’re convinced that political violence comes from only one side of the divide, then the temptation toward punitive authoritarianism is overwhelming. “They” are evil and violent, and “they” must be crushed.

If, however, we accurately understand that America has an immense problem with violent extremism on both sides of the ideological aisle — even if, at any given moment, one side is worse than the other — then the answer lies in reconciliation, not domination. In fact, it’s the will to dominate that magnifies the crisis and radicalizes our opponents." https://t.co/W5osnjz6g0

[Shawn Ross @sgtserve]

@dhh I don't think you'll fit into your 🏎️ like that ...

[Shawn Ross @sgtserve]

I'm not usually a political creature. Please call your Senators and let them know your thoughts.
I called today and let them know my thoughts on the Emil Bove confirmation hearing. If you'd like to know more of my thoughts LMK

[Shawn Ross @sgtserve]

@dhh iPads are just as bad.

[Science girl @sciencegirl]

Types of Coffee

[Shawn Ross @sgtserve]

@jonedmiston I need 50 like buttons

[David French @DavidAFrench]

This is the obviously correct conclusion. It's hard to think of something more un-American than detaining a person for writing an op-ed. Unreal.

[Greg Holder @gregholder_]

We have pasts we can't change and sins we cannot deny. But we are forgiven, redeemed, and made new through Christ!

[Jim Michael @jimmichael]

Humans will always be the weakest link in your security chain… 🤦‍♂️

[Shawn Ross @sgtserve]

@ericweinstein @MrWinMarshall This seems like there is the promotion of the idea that Elon/Trump equivocates with Jesus in this post.
This is poor theology.
Please just don't.
Jesus didn't come to be a Democrat or Republican.

[Shawn Ross @sgtserve]

@MacTheIllest I'm curiously interested, but recovering from 2 herniated discs...which means I can't do many traditional workout routines. I am willing but don't want to take a spot if I can't fully do the program

[Shawn Ross @sgtserve]

I find it incredulous that Microsoft Intune does not have a template for deploying a WPA3 Personal SSID to company devices, with the PSK obfuscated/hidden from the user. I guess I'm blind.
The available 'method' for WPA3 is using XML in an OAM-URI setting.
#silly #citn

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Shawn Ross @sgtserve]

@dhh It's the 'easy' button at first. You 'shortcut' the focused work of building it yourself.
So how do we in the tech community encourage better old-school Internet sharing patterns vs 'modern microwave just SaaS it ignoring cost' models?

[Today Years Old @todayyearsold]

Retweeting for us 25+ folks

[Omar Rizwan @rsnous]

website-making class where you have to recapitulate the history of the web -- week 1 you can only use the very first HTML tags from HTML 1.0 or whatever, then over time you get to use <img>, then CSS, JavaScript 1.0, XMLHttpRequest, etc

[Shawn Ross @sgtserve]

@kelseyhightower He's in need of a way to improve his attractiveness with that group of people. It's an attempt to curry political points.