Sign in

Adam Shostack

@adamshostack.bsky.social
3.1K followers 382 following 862 posts

Threat modeling. BH Review Board. Affiliate Professor, UW. Fixed autorun. Helped create CVE. Not sure why we're building graphs on yet another (effectively) centralized system. infosec.exchange/@adamshostack

PostsRepliesMedia
Reposted by Adam Shostack
Taggart @taggart-tech.com · 27/09/2026
Today is very effectively making the argument for us at IFIN that TLP:CLEAR should be the *default*, and only extremely sensitive intelligence should be withheld. Active exploitation is not a reason to withhold, given the fact that more information always advantages defenders.
0134
Adam Shostack @adamshostack.bsky.social · 26/09/2026
Today in Bluesky vs Mastodon, same tweet, samish time: * Mastodon, 39 boosts, 40 favorites * Bluesky: Zilch. Tell me again which is decentralized and not run by algorithms? infosec.exchange/@adamshostac... bsky.app/profile/adam...
infosec.exchange
Adam Shostack :donor: :rebelverified: (@adamshostack@infosec.exchange)
We've replaced the bureaucratic impediment to rapid action, Stanislav Petrov, with an LLM as part of our strategy of "aggressively identifying and eliminating bureaucratic barriers to deeper integrati...
442
Adam Shostack @adamshostack.bsky.social · 26/09/2026
We've replaced the bureaucratic impediment to rapid action, Stanislav Petrov, with an LLM as part of our strategy of "aggressively identifying and eliminating bureaucratic barriers to deeper integration." mastodon.social/@kralcttam/1...
mastodon.social
kralcttam ☕️ (@kralcttam@mastodon.social)
Happy Stanislav Petrov day! Today marks 43 years since Petrov decided to wait for confirmation before escalating a missile alert up the chain of command in the Soviet Air Defense, preventing nuclear ...
031
Adam Shostack @adamshostack.bsky.social · 26/09/2026
Wait, the story I saw on the internet casts people in a bad light just to start fights and draw attention to the poster? Inconceivable!
000
Reposted by Adam Shostack
Joseph Menn @joemenn.bsky.social · 26/09/2026
Every once in a while I think back to when “stop babies from needlessly dying” wasn’t a divisive position.
0173
Reposted by Adam Shostack
Adam Shostack :donor: :rebelverified: @adamshostack.infosec.exchange.ap.brid.gy · 25/09/2026
No normal human being loves a nameplate.
a headline that refers to a "beloved nameplate"
011
Reposted by Adam Shostack
Erica C. Barnett @ericacbarnett.bsky.social · 25/09/2026
Just a reminder, since Rob Saka keeps saying otherwise, that there ARE ALREADY CAMERAS AT SEATTLE CENTER and that they WERE TURNED ON. There has never been a plan to add specific POLICE cameras at Seattle Center, a sprawling open campus, despite Saka's insistence that they're necessary there.
instagram.com
KOMO News on Instagram: "Seattle City Councilmember Rob Saka wants the city to add public surveillance cameras to the Seattle Center campus immediately. A lack of cameras at the campus - which hosts ...
144 likes, 43 comments - komo4 on September 24, 2026: "Seattle City Councilmember Rob Saka wants the city to add public surveillance cameras to the Seattle Center campus immediately. A lack of camera...
511719
Reposted by Adam Shostack
Larry Osterman @larryosterman.github.io · 25/09/2026
Tumble out of bed, and I stumble to the kitchen; Pour myself a cup of ambition; Yawn and stretch and try to come to life. Jump in the shower and the blood starts pumping, Out on the streets the traffic is jumping, It's folks like me on the job from September 25th. Oh wait. That's not quite right.
021
Adam Shostack @adamshostack.bsky.social · 25/09/2026
Please remember, MIT surveillance cameras were a stepping stone to charging Aaron Schwartz. MIT doesn't seem to.
1100
Reposted by Adam Shostack
Catherine D'Ignazio (she/her/ella) @kanarinka.bsky.social · 25/09/2026
MIT spent $3 million on 500 AI-capable surveillance cameras while laying people off, shutting down libraries, and canceling journal subscriptions. In this article, 4 faculty & I discuss our new arts initiative to celebrate surveillance and repression on college campuses: fnl.mit.edu/how-we-learn...
fnl.mit.edu
How We Learned to Stop Worrying and Love Campus Surveillance – MIT Faculty Newsletter
6357168
Reposted by Adam Shostack
Rima I Anabtawi @rimaanabtawi.bsky.social · 25/09/2026
Locally acquired cases, 170!
2207
Reposted by Adam Shostack
Adam Shostack :donor: :rebelverified: @adamshostack.infosec.exchange.ap.brid.gy · 24/09/2026
Diagrams versus Models (Threat Model Thursday) (New blog post: shostack.org/blog/diagrams-versus-m…, this is post 1/9) Diagrams are the most recognizable tools and deliverables of threat modeling. (Both functions are important: the working tool […] [Original post on infosec.exchange]
A hand-sketched threat model diagram dissolves into a glowing indigo, lime, and orange 3D wireframe cube as abstraction transforms into precise structure.
101
Reposted by Adam Shostack
Daniel Radosh @radosh.bsky.social · 22/09/2026
Gonna be a good week for us know-it-alls who like to tell people that the incredibly useful* phrase patient zero is based on a misunderstanding en.wikipedia.org/wiki/Index_c...
2226
Adam Shostack @adamshostack.bsky.social · 22/09/2026
And you may find yourself in a beautiful house With a beautiful wife And you may ask yourself "Well... how did I get here?"
080
Reposted by Adam Shostack
Boring Manager Rob 🅅 @bourboninexile.bsky.social · 22/09/2026
This joke would have landed perfectly fine if you’d cut it off at the comma. I appreciate that you went the extra mile.
121
Adam Shostack @adamshostack.bsky.social · 22/09/2026
I'm glad to hear that the US is adopting #SI, the System Internationale of measurement, after 40 years of inch-by-inch progress.
271
Adam Shostack @adamshostack.bsky.social · 21/09/2026
The #China #AI near miss story is shocking and worrisome, and Overreliance is an explicit part of the #LLM threat modeling framework that I released back in August. It was preventable — if the folks building these systems are willing to stop and look at a wallet card. shostack.org/blog/the-pen...
shostack.org
The Pentagon, China, AI and PHANTOM-B
Could PHANTOM-B have stopped this close call?
030
Reposted by Adam Shostack
Aidan O’Brien @aidanobrien.bsky.social · 20/09/2026
Skynet becomes self aware meme (3 panel)

18TH OF SEPTEMBER 2026,
AN AI FALSELY CLAIMS A CHINESE
SHIP IS CARRYING NUCLEAR WEAPONS TO IRAN

THE US MILITARY ATTACKS, THE CHINESE RESPOND, WW3 STARTS BEFORE ANYONE REALISES

THE LAST RECORDED EVIDENCE OF HUMAN CIVILISATION
IS A CHATBOT MESSAGE
SORRY, YES, MY BAD, I SHOULD HAVE CAUGHT THAT"
07731
Reposted by Adam Shostack
Adam Shostack :donor: :rebelverified: @adamshostack.infosec.exchange.ap.brid.gy · 18/09/2026
If I hit cancel, are the words un-counted?
A screencap of Google docs word count dialog, with OK and Cancel buttons.
011
Reposted by Adam Shostack
Adrian Tchaikovsky @aptshadow.bsky.social · 14/09/2026
Into the early planning stage of a new book. Bit of a punt, a step away from my previous long-form stuff.
161911
Reposted by Adam Shostack
EricLaw 🎻 @ericlawrence.com · 12/09/2026
babylonbee.com/news/trump-p...
083
Reposted by Adam Shostack
misterpurple @misterpurple.bsky.social · 12/09/2026
Really looking forward to this. My favourite security book by a long margin.
011
Reposted by Adam Shostack
Eric Geller @ericjgeller.com · 11/09/2026
"In retrospect, 9/11 was paradoxically both a respite from and accelerant of polarizations and pathologies that were already well underway by then. It allowed Americans to ignore them for a moment, until they came roaring back with redoubled force." www.nytimes.com/2026/09/10/m...
081
Adam Shostack @adamshostack.bsky.social · 10/09/2026
Doctor Doom shows up at #Seattle city council meeting to speak in favor of our new traffic cameras. #visionzero #ats #flock gizmodo.com/doctor-doom-...
gizmodo.com
Doctor Doom Shows Up to Support Seattle's Surveillance Network
The supervillain offered a timely reminder that Flock isn't the only company doing the eye-in-the-sky dirty work.
020
Reposted by Adam Shostack
Pete Ehlke @rfc822.net · 25/11/2024
"Technical Debt"
A large tree growing through the rungs of a ladder abandoned behind a cinder block building. The ladder cannot be removed without destroying either it or the tree.
0124
Adam Shostack @adamshostack.bsky.social · 10/09/2026
Bread AND circuses? In this economy?!?
152
Adam Shostack @adamshostack.bsky.social · 10/09/2026
Bread and circuses? That's so 2,000 years ago.
010
Reposted by Adam Shostack
Michael Froomkin @mfroomkin.bsky.social · 10/09/2026
If you had told me even 18 months ago that the government would directly censor a broadcast comedian for interviewing an opposition politician, I would have said, "Sure, in Russia." But when you said "No, in the USA," I would have been deeply dubious. We're drowning in the deep end, folks.
235
Reposted by Adam Shostack
Alec Muffett @alecmuffett.bsky.social · 09/09/2026
I know it's the modern style, but if we persist in arguing that "<this> should not be allowed because the minds behind it are a bunch of chodes & dickwads" - as opposed to "the proposition is illiberal, disproportionate & misconceived for <reasons>" - then we WILL lose.
221
Reposted by Adam Shostack
Effin' Birds @effinbirds.com · 08/09/2026
All regular Effin’ Birds tees are $12.50 until Monday, and everything else is 40% off. eatf.art/tees
A t-shirt featuring a painting of a bird above the text "can I please unsubscribe from your bullshit?"
215926
Adam Shostack @adamshostack.bsky.social · 07/09/2026
Isn't Green Lantern's power literally carried in gifts from aliens? Isn't taking alien emoluments banned by the Constitution?
142
Adam Shostack @adamshostack.bsky.social · 07/09/2026
I'm really curious what the electoral college and senate look like after each chunk of this expansion. How many Senators does Haiti get?
020
Reposted by Adam Shostack
Violet Blue® @violetblue.bsky.social · 06/09/2026
I have a couple dozen books in the Anthropic mess. I'm looking at the claims now and about one-third of my books have a random contributor incorrectly listed as a right-holding, payout-receiving author on my book. 😭
1111218
Reposted by Adam Shostack
'Nathan Burgoine (he/him) @nathanburgoine.bsky.social · 05/09/2026
Got my Anthropic log-in today and they've split me into two people, one with my middle name and one without, at 25% each. Also, on two of my books, they've split the publisher into the publisher's company name and the CEO, at 25% each. *twitch*
5205
Reposted by Adam Shostack
Victoria Strauss @victoriastrauss.com · 05/09/2026
My post from earlier today about the craziness around Anthropic claim notices, updated with both of the notices writers are receiving, and a list of literary agents who are trying to claim a share of payouts writerbeware.blog/2026/09/04/a...
writerbeware.blog
Anthropic Copyright Settlement: Publishers Are Making Incorrect Claims on Authors' Payouts - Writer Beware
This week, many authors who are part of the Anthropic copyright class action settlement began receiving notices like these: The one on the right invites authors to review and confirm their claims: jus...
9269186
Reposted by Adam Shostack
Jon Phillips @jowiph.bsky.social · 05/09/2026
I picked up a copy of the collected letters of JRR Tolkien for reasons, and this is the most bullshit table of contents I've ever seen. I'm actively angry that it exists
Contents

Introduction - vii

Foreword to the Revised and Expanded Edition - xi

Letters of J.R.R. Tolkien - 1

Notes - 607

Index - 637
2261761062
Reposted by Adam Shostack
OWASP® Foundation @owasp.org · 04/09/2026
🎉 OWASP is turning 25! 🎂 We're celebrating with a virtual party featuring awesome speakers, community stories, and more! No travel. No hassle. Just log in, learn, connect, and celebrate 25 years of making software safer. Join us! 🥳 owasp.glueup.com/eve... #OWASP25 #AppSec #virtualconference
033
Reposted by Adam Shostack
Delilah S. Dawson @delilahsdawson.bsky.social · 03/09/2026
COVER REVEAL! Presenting Coffee & Conjuring, Book 2 in the Arcadia Falls series of small town witchy Romance! You can read all about it in the second slide. I can't wait for y'all to meet Mr. Fluff. And the hot MC, code name HORSE GUY. Preorder here: www.penguinrandomhouse.com/books/745677...
Coffee & Conjuring is purple with a blue waterfall, a girl and a guy, a pocket watch, some horseshoes, some coffee cups, some books, and an enormous orange cat named Mr. Fluff. It also contains baby raccoons, but they didn't make the cover.The book description reads: 
In this cozy witchy rom-com from the New York Times bestselling author of Books & Bewitchment, a burnt-out young woman—with the help of her small town’s hunky local antiques dealer—works to turn an abandoned hardware store into the coffeeshop of her dreams.

Anxious and overworked, Cait Wolfe lives a high-pressure life as a graphic designer with her fluffy orange cat in Cumberville, Alabama. Things are hectic but sustainable. . . until the creep from work who simply won’t take “no” for an answer moves in down the hall and causes her to lose out on a big client.

Cait knows she needs a change. So when her sister invites her to come to Arcadia Falls, where free lodging, an inherited hardware store, and a magical legacy await her, it’s an easy “yes.”

Except . . . her new property is in dire need of a makeover, and Cait’s not sure her frazzled nerves or her stretched-thin finances can survive the renovation that will give her life the reset she so desperately desires and turn a hoarder situation into a livable apartment and a cozy coffee shop. Lucky for Cait, laid-back local picker and part-time cowboy Brendan McGillicuddy is more than happy to help her fix up the place—and to teach her how to relax while he’s at it.
34210
Reposted by Adam Shostack
Adam Shostack :donor: :rebelverified: @adamshostack.infosec.exchange.ap.brid.gy · 03/09/2026
Diagrams and Clarity (Threat Model Thursday) (New blog post: shostack.org/blog/clarity-in-diagra…, this is post 1/12) Why can’t we take a picture of the whiteboard, have an AI make it pretty, and be done? Sometimes this works […] [Original post on infosec.exchange]
A diagram showing exploration and explanation feeding into design, into as-built and as-operated
111
Reposted by Adam Shostack
Al Yankovic @alyankovic.bsky.social · 03/09/2026
The undeniably greatest DC comic of all time, “Batman / Superman / Weird Al: World’s Weirdest #1,” is out NOW - available at finer comic shops everywhere!
Cover of the DC comic book featuring Superman, Batman, and Weird Al (with his leg around his neck)
724643880
Reposted by Adam Shostack
Joe FitzPatrick @securelyfitz.bsky.social · 02/09/2026
CanSecWest is only a few weeks away. I don't run my Hardware Implants class very often, and rarely outside the USA, so if you want to take it, this might be your last chance for at least a year. If you're considering it but haven't registered yet, let us know asap!
register.cansecwest.com
Applied Physical Attacks by Joe FitzPatrick at CanSecWest 2026 — CanSecWest 2026 Registration
This is a four-day crash course in rapid prototyping for hardware hacking. You'll build upon the basics you already covered in an introductory hardware hacking course and will design and assemble, fro...
165
Adam Shostack @adamshostack.bsky.social · 01/09/2026
Meanwhile, in #seattle, we're installing more surveillance #cameras because we don't care about #privacy or police abuse, apparently. www.seattletimes.com/seattle-news...
seattletimes.com
Seattle mayor orders overhaul of effort to stop road deaths
Last year, 30 people were killed and 221 seriously injured, one of the highest tallies since Vision Zero — with the goal to end traffic deaths — became city policy in 2015.
2135
Adam Shostack @adamshostack.bsky.social · 01/09/2026
My father was killed by a six fingered man.
020
Adam Shostack @adamshostack.bsky.social · 28/08/2026
Oh, are all y'all debating y'all now? Can we get back to, I dunno, measles or Iran or the national debt or something?
000
Reposted by Adam Shostack
Jake Scott, MD @jakescottmd.bsky.social · 27/08/2026
Lots of lies being spread by RFK Jr about the MMR vaccine, even as the US struggles to contain the worst measles outbreak in decades. I go into depth about MMR myths in this @cidrap.bsky.social piece. www.cidrap.umn.edu/measles/cidr...
cidrap.umn.edu
CIDRAP Op-Ed: Measles, misinformation, and what's actually in the MMR vaccine
0126
Reposted by Adam Shostack
Alex White @alexwhite.bsky.social · 26/08/2026
Alas, it would appear 99% of my work on Fireteam Elite 2 didn't make it in. Thems the breaks when you're just a creative consultant. The check cashed real good, though, so would do again. Also, the lead writer was super cool to me!
2273
Reposted by Adam Shostack
Toss @stevenspoints.bsky.social · 26/08/2026
I really cannot think of a greater honor than to have the Muppets say this about you upon your passing
Instagram post from the official Muppets account: Few humans have earned the title of honorary Muppet more than the legendary Tim Curry. As a performer he was unparalleled - witty, charming, unnerving, and deeply funny. We will always consider it one of our greatest treasures to have been part of Long John Silver’s crew. Thank you for everything, Tim.
2295269312870
Adam Shostack @adamshostack.bsky.social · 26/08/2026
The TOC for my new book"Threat Modeling: Designing for Security in an AI World" is live! See how a decade of tech and teaching changed the book. Sneak a peek at the new chapters. Bonus: the first edition TOC is still there. Check it out: shostack.org/books/threat...
0144
Reposted by Adam Shostack
cje @cje.io · 24/08/2026
ICYMI: Bugtraq Is Back: The Original Full Disclosure Mailing List Is Live Again securityledger.com/2026/08/bugt...
securityledger.com
Bugtraq Is Back: The Original Full Disclosure Mailing List Is Live Again
Sophia Antipolis, France, 7th August 2026, CyberNewswire
041
Adam Shostack @adamshostack.bsky.social · 23/08/2026
There's a lot of outrageous here, but perhaps the most bizarre is the elimination of the deminimis rules that make travel with small purchases easy for both Canadians and Americans. Unless, of course, you really hate the idea of people crossing borders.
041