Space Rogue

Today is L0pht Day. In 1998 7 hackers in suits told the US Senate the internet was a house of cards. We said we could take it down in 30 minutes. They looked at us like we'd landed from another planet.

28 yrs later, the gap between what the security community knows and what decision-makers act on remains a fundamental problem.

Miss you, Peter Neumann. He testified that day too, with decades of hard-earned wisdom. We owe him.

The work isn't done. It never was.

#L0phtDay #InfoSec

Companies will put up all kinds obstacles to responsible disclosure for researchers to get around to make their own lives easier. But they often forget that in the end it is researcher who calls the shots. It is the researchers vuln and they can do whatever they want with it.

https://www.bleepingcomputer.com/news/security/disgruntled-researcher-leaks-bluehammer-windows-zero-day-exploit/#comments

#vulnerability #disclosure #responsibledisclosure #windows #microsoft

First blog post for the new job!

Security Should Be the Path of Least Resistance

Security often creates friction that frustrates developers and users, this can actually make systems less secure because when security is difficult, noisy, or just gets int he way, people bypass or ignore the controls.

https://semgrep.dev/blog/2026/security-should-be-the-path-of-least-resistance/

Do I win?

Reminder to open and setup any gift gaming consoles before Christmas morning. Switch2 took 23 agonizing minutes to transfer data over from the first switch and several hours to download and install old games. #gaming #switch #christmas

The latest episode of 'Where Warlocks Stay up Late" dropped yesterday. Featuring yours truly. The interview goes pretty deep from growing up in Maine, working at Lotus, stories about L0pht you may not have heard before to getting fired from @stake@mastodon.social. Probably the most personal interview I have ever given.

https://www.youtube.com/watch?v=j6jhAugNqvE

#l0pht #spacerogue #warlocks

What if instead of trying to patch stuff that’s broken we fix it before it gets to the user? What if we got security tools to devs that were easy to use, and that could catch, flag, and fix real vulns before they ship?

That’s what excited me about Semgrep, their clarity of vision to build security tools that devs will actually use, and that security teams can trust.

Excited to share that I’ve joined Semgrep as a Staff Security Advocate!

I will be at RSA and BSidesSF, feel free to say hi!

Ok, this is kinda cool/scary/creepy/awesome. Claude knows who I am

"Claude responded: Thanks — that one was genuinely fun to write. Happy L0pht Day tomorrow, Space Rogue. 🖤"

Three hours of blowing, Did six driveways and eight houses worth of sidewalk.
#snow #blizzard

FYI: if you use the handle on your #rsac badge or unusual nickname expect to have to get your badge reprinted and wait in the super long and slow line. They’re verifying that badge names exactly match government ID. Worse than TSA. (I was still able to get her to put “Space Rogue” on it, but she didn’t want to.) #rsac2026

Gen-X to Gen-Z Translation Matrix

Meaning Gen-X Gen-Z
That’s cool Dope Bussin
Lame Bogus Cringe
I agree Word Facts
Nonsense Whatever Cap
True For real No cap
Impressive Tight Goes hard
Weird Sketchy Sus
Funny That’s rich I’m dead
Attractive Fine Baddie

Any others?

Nice to see an old school no-photo policy at #bsidessf. Reminds me of #shmoocon. Yes, in our hyper surveillance culture such a policy might be pointless but it’s a nice thought.

PhoneCon 2026, the Mid-Atlantic Historical Telephony Conference & Expo
When: Sat/Sun July 25-26, 2026
Where: The Computer Museum - Baltimore MD
What: Presentations and talks on telephone history, collecting, and phreaking; displays and exhibits; telephones for sale; tours of the Computer Museum
Why: To celebrate the 150th anniversary of the telephone

Schedules and other event information is available at https://phonecon.org

#telephone #phone #hacker #phreaker #con

In the future everyone will have their own personal AI agent/LLM.

!remindme 40 years

Is anyone else getting anti-Sec vibes from #teampcp ???

I've decided to stop pussy footing around and I am now openly looking for my next challenge.
Interested in a company on the small to mid-size range with a cool story. Ideal position would be a combination of customer outreach, marketing and thought leadership. What ya got? #CyberSecurity

I know I am very opinionated when it comes to booth design, but there are a lot of bad booths this year and I haven’t even walked half the floor yet. #rsac2026 #rsac

I was at the first #bsidessf however many years ago, I’ve missed a few but it’s good to be back. I’ll be walking around or chilling at the #Semgrep booth, come say hi.

Damn, #bsidessf has to have one of the best venues in all of Bsides. Imagine your slides on a 50ft iMax screen.

The arena is empty, except for one man
Still driving and striving as fast as he can

The sun has gone down and the moon has come up
And long ago somebody left with the cup
But he's driving and striving and hugging the turns
And thinking of someone for whom he still burns

- Greg Brown
#cake #distance

How am I only now just finding this subreddit?
https://www.reddit.com/r/ISO8601/

If you missed the keynote at #bsidessf then you missed @k8em0@infosec.exchange actually singing part of her talk!

I know the conventional wisdom, and the historically popular choice, for a candy bag is a pillowcase, but as the person who hands out the candy, let me tell you, it is a very poor choice. It has large capacity, but it’s too hard to open, it drags on the ground and is difficult to carry. The best candy bag is a 2 1/2 gallon bucket. Easy Cary you can set it down easy access.

1. Ineffective use of color and lighting. Do not depend on the venue to provide lighting for your booth. Especially if you put a big arch over your booth and then don’t put any lights underneath it. And for goodness sake, make sure your colors match, standing next to one booth right now with red letters on a green background. #rsac2026

1. Ineffective use of booth space #rsac floor space is more expensive than a New York City apartment. And some companies plop, big, huge monstrosities, right smack dab in the middle of it. Or they hide their people and demos behind walls minimizing traffic flow through their booth. Don’t try to integrate a meeting room into your booth. The show floor is no place for serious meetings.

1. Ineffective or incorrect branding. I should be able to tell what the name of your company is and what you do from 20 feet away. Not just a buzz word or a slogan. So many booths I walk by and have no idea who they are or what they do. Considering the price of a #rsac booth that should be the number one priority.