Mark J Cox @ EMFCamp 2026

My retirement day job is looking after the security committee at Apache Software Foundation. So if you're interested in how we're coping after going from getting 50 vuln reports a month to over 800 (yeah those extra 750 are AI) come say hi at #emfcamp (I'll mention it briefly in my Sun talk too, but the talk has nothing about vulnerabilities, security, Apache, or Heartbleed).

I never thought I'd end up writing code that would properly detect Jungle, DnB, Donk, and the like. All our sound to light wearables are set to do four-to-the-floor 100Hzish detection, not missing beats and looking at the #emfcamp schedule, there's more of the former than the latter!

@ben@kwiecien.us they're mostly rubbish. A large number are things that are outside the threat model, repeats. We do get the odd real issue, but those are usually low severity. Stats on the percentage of that peak last month are a bit delayed as triage takes a while, but we'll give all the stats eventually.

@dreamcat@mastodon.me.uk that was a fun game thanks!

@florenciocano@infosec.exchange right! That's actually part of the solution. Each project is responsible for creating their own threat model and we've been working with them to ensure they're published and llm-findable, not just from a list on security.apache.org but in SECURITY.md files etc

I was amazed by the awesome turnout to my #emfcamp talk about giving my voice assistant and attitude, so thanks so much if you came along. If you didn't get to see it the recording is available, link from the notes https://codeberg.org/esoom/viki

@sammachin@chaos.social managed to pick up a pcb, looking forward to trying this!

@dreamcat@mastodon.me.uk sign-up in person or a site?

@Edent@mastodon.social I have like 30 OpenSSL stickers to get rid off into some pile as they're the old font