Sign in

Allan

@allanfriedman.bsky.social
3.5K followers 938 following 652 posts

SBOM Champion. Paranoid about supply chains of all kinds. Former full-service technocrat at CISA, NTIA. Lapsed{engineer, academic, author}. Now wandering the world doing acts of infosec-goodness, & occasionally getting paid for it. Poster of food pics.

PostsRepliesMedia
Allan @allanfriedman.bsky.social · 30/09/2026
I really enjoyed this article: we have new toys, and those will guide tactics, rather than strategy. Leaving aside current challenges around “not having any strategy,” there is also a pretty large cyber-shaped hole in this line of thinking that scholars need to fill.
143
Allan @allanfriedman.bsky.social · 29/09/2026
I love this thread and replies.
071
Allan @allanfriedman.bsky.social · 28/09/2026
I love Americana and country music, including songs that celebrate the simple pleasures of country live: Avett Bros, Delta Rae, etc. But are there any songs that celebrate the joys of city living? The neighborhoods, the local coffee shops, street festivals, great restaurants, cocktails?
110
Reposted by Allan
Kate Holterhoff, PhD @kateholterhoff.com · 24/09/2026
Chatted with @dpp.me, founder & CEO of Spice Labs, & @allanfriedman.bsky.social, Senior Technical Advisor at the Institute for Security & Technology, about PQC & Cryptographic Bill of Materials (CBOMs) for the latest @redmonk.com MonkCast. redmonk.com/videos/david... youtube.com/shorts/VPflv...
youtube.com
Cryptography Bill of Materials Explained #cbom #postquantumcryptography #softwaredevelopment
YouTube video by RedMonk
033
Reposted by Allan
Kieran Healy @kjhealy.co · 19/09/2026
I assume that when whoever is making it IPOs they will reveal the full lineup implied by the existence of Tilly Norwood.
Grid of logic gate options as Venn diagrams of Tilly Norwood, Tilly Orwood, Tilly Andwood, Tilly Xorwood, Tilly Nandwood, and Tilly Xnandwood
16627121
Allan @allanfriedman.bsky.social · 19/09/2026
Gonna be a good night.
010
Allan @allanfriedman.bsky.social · 18/09/2026
Proud to say that I was at the first ever Fluff Festival, in Somerville during grad school.
020
Reposted by Allan
Colin @colin-fraser.net · 16/09/2026
I mean that's just normal. You check things and make sure they're correct and have experts review them and so on. You edit, you extend, you simplify. It's research. Solving the N-S conjecture on Sunday and publishing the proof on Monday is weird.
413420
Allan @allanfriedman.bsky.social · 15/09/2026
I love Prof Klonick, and read what she writes regularly, but I think there’s a fairly obvious difference between being annoyed by automated content moderation and having humans review inputs that may never have been intended to be shared with anyone.
270
Reposted by Allan
Brendel @brendelbored.bsky.social · 11/09/2026
Writer for NBC10 Boston fuckin HATES Mercury
943604457
Reposted by Allan
Rowdy @r0wdy.sk33t.expert · 11/09/2026
I think the sanest way to approach this llm stuff if you use it as if it’s a new abstraction from machine code. It’s another layer to communicate instructions to a computer. The biggest problem is we weren’t ready to communicate with computers in the way we do with other people. We fucked that up
062
Allan @allanfriedman.bsky.social · 10/09/2026
This will be fun.
020
Reposted by Allan
Trevor A. Branch @trevorabranch.bsky.social · 09/09/2026
This is seismic news for fisheries scientists. Northern cod is *the* iconic symbol of total fisheries collapse due to overfishing (and other factors) *and* the iconic symbol of a complete failure to recover for decades afterwards. This is like announcing the complete recovery of bison on land.
8576742174
Allan @allanfriedman.bsky.social · 05/09/2026
Having some fun with late summer flavors: aquavit-infused croutons. (For a course with heirloom tomatoes and homemade smoked trout)
010
Reposted by Allan
P(aul) Frazee @pfrazee.com · 04/09/2026
[wipes hands] yeap. You got agents. See the message boards in your internal package manager? They must’ve nested there about ohhh 3 weeks back.
943654
Allan @allanfriedman.bsky.social · 04/09/2026
Today in obvious solutions: realizing I can put a metal rack on the burner to better roast peppers.
050
Allan @allanfriedman.bsky.social · 02/09/2026
Amazing writeup by @dangoodin.bsky.social of a BGP-hijack for a supply chain attack. He shows: 1) clear details of BGP attack w $ motive, 2) we have tools to prevent this, but you have to use them, and 3) how to write clearly about complicated security topics. arstechnica.com/security/202...
arstechnica.com
BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
What can we learn from a BGP hijacking that poisoned production software? Plenty.
052
Allan @allanfriedman.bsky.social · 01/09/2026
IYKYK
1256
Allan @allanfriedman.bsky.social · 29/08/2026
Finally enjoying @nealstephenson.bsky.social ‘s The Diamond Age, and I can’t express the joy of discovering new words that I have to look up. I flatter myself reasonably well-read and -schooled, and it’s a fun treat to be sent scurrying.
030
Reposted by Allan
Michael Stahlke @michaelstahlke.bsky.social · 25/08/2026
Right now there is a lady in college who is discovering Dolly Parton and will carry that music through the rest of her life in the same way I discovered Johnny Cash in 2003. I take comfort in that.
3563
Reposted by Allan
Rachel Hands @rachelhands.com · 25/08/2026
if there’s a point to fame it’s to do what dolly parton did in the world
534231015
Reposted by Allan
Kevin Riggle @kevinr.free-dissociation.com · 25/08/2026
"We want a classified information system but we want it to work exactly the same as all of our unclassified information systems and introduce zero additional friction of any kind" is the cybersecurity "Claude, do a breakthrough" of the moment
4487
Reposted by Allan
B. A. Friedman @bafriedman.bsky.social · 21/08/2026
Are we finally relitigating the French and Indian War on here?
static.klipy.com
Animaechan Cracks Knuckles with Pout
ALT: Animaechan Cracks Knuckles with Pout
3565
Reposted by Allan
rand0h @akacki.net · 20/08/2026
True story.
1213
Allan @allanfriedman.bsky.social · 20/08/2026
Interesting inclusions on the list of banned items for the DC “grand prix“ event this weekend.
350
Allan @allanfriedman.bsky.social · 20/08/2026
“I'm only making fun of you because it’s something you care about deeply.” — my wife (In case anyone was wondering about the secret to a long and happy marriage)
160
Allan @allanfriedman.bsky.social · 19/08/2026
Very much this. Writing requires real precision of thought, more so even than giving a presentation or a talk.
021
Reposted by Allan
Michael Paulauski♨️ @mike10010100.com · 18/08/2026
Wait...do the math. LEDs took over around 2012–2015 and last 15,000+ hours (10–20 years). If you left home at 18 and bounce between dorms and 1-year apartment leases, the probability of ever living anywhere long enough to see a bulb burn out is practically zero. Jesus. Christ. Turn me to dust.
74812
Reposted by Allan
Kevin M. Kruse @kevinmkruse.bsky.social · 18/08/2026
There were a lot of articles recently about how bad it was for Cambridge to hire someone who made up stories about their experiences, and now Yale has hired this man?
phillymag.com
David Brooks: Boo-Boos in Paradise
The classic 2004 examination of David Brooks’s “Bobos in Paradise” by Philadelphia magazine’s Sasha Issenberg.
1232337543
Reposted by Allan
DilDog 🅅 @dildog.l0pht.com · 16/08/2026
DilDog's Third Razor: "Any sufficiently advanced stupidity is indistinguishable from malice"
0267
Reposted by Allan
rev. howard arson @theophite.bsky.social · 13/08/2026
there is absolutely no way that a modern physics department could tolerate a weird, autistic asexual with crank fascinations outside of his notional field of study. it's impossible that that person could exist today.
1036131
Allan @allanfriedman.bsky.social · 13/08/2026
Some pretty solid analysis from @erratarob.bsky.social
101
Reposted by Allan
Greg Otto @gregotto.bsky.social · 11/08/2026
NEW: Delta is investigating that viral Wi-Fi spoofing incident. Everyone i talked to stressed two things: The flight was never in any real danger and everyone investigating this is extremely annoyed cyberscoop.com/delta-flight...
cyberscoop.com
Delta investigates in-flight Wi-Fi spoofing on post-DEF CON flight from Las Vegas
Delta and federal authorities are investigating a rogue Wi-Fi spoofing incident aboard Flight 591 from Las Vegas to Atlanta following DEF CON.
32111
Reposted by Allan
Matthew Green @matthewdgreen.bsky.social · 11/08/2026
If you haven’t seen it, this new paper is great. They expand on a blog post I wrote that showed you could replay encrypted reasoning blobs from AI models. And they turned it into a full jailbreak. stolen-thoughts.com
stolen-thoughts.com
Stolen Thoughts
Encrypted chain-of-thought blocks returned by Anthropic, OpenAI and Google APIs are interchangeable across sessions, users and models. We exploit this to decode hidden reasoning at scale.
210534
Reposted by Allan
Mick Baccio @nohackme.thruntcon.com · 11/08/2026
i lold, but someone else certainly did not. don’t fuck around on planes, it won’t end well for you
18713
Reposted by Allan
Shell @risu.bsky.social · 10/08/2026
Cybersecurity LinkedIn has had too much sun. Presented for your enjoyment because I am still crying laughing This could be peak cyber LinkedIn I’m not sure
I celebrated a wedding at the weekend.
It was simple, beautiful and incredibly heartwarming.
Two people starting something new, surrounded by people who will support them along the way.
And it made me think about those starting out in cybersecurity.
Cyber can feel overwhelming at the beginning.
There's so much to learn. So many certifications. So many different paths. And so many people who seem to know far more than you do.
12498
Allan @allanfriedman.bsky.social · 07/08/2026
Put it in kalshi and we’ll make some $$$
010
Allan @allanfriedman.bsky.social · 07/08/2026
So long, Black Hat. Hello, DEF CON! time for my annual wardrobe change. Some people code-switch. I coat-switch.
0120
Reposted by Allan
austin (eeek!/ackkk! 👻) @thebadcode.com · 05/08/2026
KFC announces their frontier-class model briefly escaped its sandbox and attempted to exfiltrate the 27 herbs and spices
142261351
Reposted by Allan
Zack Whittaker @zackwhittaker.com · 04/08/2026
If there's one thing I've learned from publishing this story is that there is a very, very, very wide chasm between what the law says about all this... and what people *think* the law says and/or *should* say.
69321
Reposted by Allan
The Official Pulpit of CULT OF THE DEAD COW @cultdeadcow.com · 03/08/2026
Pretty much.
06117
Reposted by Allan
That Anonymous Coward @thatac.bsky.social · 02/08/2026
Five hundred twenty five thousand six hundred patches Five hundred twenty five thousand fixes so dear Five hundred twenty five thousand six hundred CVE's Why haven't you bought, your IT Team a Beer?
121
Reposted by Allan
John Scalzi @scalzi.com · 02/08/2026
It's a small thing, I know, but there really is a difference between "palate cleanser" and "palette cleanser," and also, while we are on the subject, "pallet cleanser," and it is worth making the distinction
891515144
Allan @allanfriedman.bsky.social · 01/08/2026
And so it begins. See yinz in the desert! I’ll be at @bsideslv.org for the first half of the week.
3140
Allan @allanfriedman.bsky.social · 30/07/2026
What's that? You want some more in depth analysis of the brand new 2026 International #SBOM Minimum Elements? And you don't mind people who just use LinkedIn for blogging? Well, have I got some quality markdown content for you! www.linkedin.com/pulse/sbom-m...
linkedin.com
The SBOM Minimum Gets Bigger—but Does It Get Better?
TLDR: yes, it gets better. As I noted yesterday, the use of “coverage” is probably the biggest change in the new 2026 CISA-convened International Minimum Elements.
021
Reposted by Allan
Pavel @spavel.bsky.social · 30/07/2026
Whenever someone asks me to help edit something, I have them explain it in their own words and then tell them to just write THAT down Instead, because it's much clearer and to the point.
3334
Allan @allanfriedman.bsky.social · 29/07/2026
*Checks watch.* Yep, it’s time for my weekly “HOW COULD THEY KILL GOOGLE READER!?!” moment of rage.
291
Allan @allanfriedman.bsky.social · 29/07/2026
The SBOM minimum just got bigger. CISA and its international partners released an expanded Minimum Elements. Adds and clarifies most of the new fields from the 2025 CISA draft, and sets a far stronger expectation for what an #SBOM should actually cover. www.linkedin.com/posts/allana...
linkedin.com
The Minimum Just Got Bigger: CISA (and friends') New SBOM Baseline | Allan Friedman, PhD
The SBOM minimum just got bigger. CISA and its international partners have released a substantially expanded Minimum Elements. It adds and clarifies most of the new fields from the 2025 CISA draft, an...
041
Reposted by Allan
Mick Baccio @nohackme.thruntcon.com · 29/07/2026
“lemme chase clout before summercamp” week is upon us
182
Allan @allanfriedman.bsky.social · 29/07/2026
Well, crap.
010