Tactics to avoid vulnerabilities in the first place: collingreene.com/vulnerabili…
Ai has supercharged the vuln find/fix cycle but its also good at all the other things we can do. This is all obvious stuff people do but I hadn't seen written down
Potentially underexplored effect of ai on computer security: easier to get backdoors into open source software like cve-2024-3094. 100 bots building a year of credibility submitting patches to 100 projects then landing non-obvious backdoor.
Has anyone attempted to estimate the totals number of latent, unfounded, security vulns?
We know how many are found each year, we know the denominator (total code and rate of code change)
The wins of infosec as a field are under discussed, what else goes on this list? libber.org/society_level_inf…
An excellent writeup of what makes data "sensitive" and what that means for security and privacy
strategicsec.substack.com/p/…
The differences between performing privacy and security work in a big company for my fellow computer security people.
collingreene.com/security_an…
I'm still newer to privacy work so this is my "most likely to be wrong" writeup, feedback welcome
Thoughts on how to maximize success as an infosec team that needs to roll out changes people may not like -
collingreene.com/communicati…
Shift left in 60 seconds - libber.org/shift_left_in_60_…
I've had success with shift left as a central strategy of infosec teams for the last n years and attempted a tl;dr of it without marketing fluff
1/ We just published our first Bug Bulletin, the spot where we aim to share cool bugs we found in our own and external code, and how we found them engineering.fb.com/2022/07/2… 🧵
2/Our first report includes cool bugs found by our Red Team X, Bug Bounty team and ProdSec. I’m excited to see our teams’ work out there and shared with the security community. I am also happy to see cool work by our #BugBounty researchers shared cc @samm0uda @phwd_
More info on hacking ar, vr, vc hardware via our bug bounty program
tech.fb.com/announcing-bug-b…
Infosec celebrated at a college football game, a first? @nudehaberdasher where is the cruise+pitt collab? :)
So the coolest thing happened today. @UofMaryland invited my students Kevin Bock, Kyle Hurley, and me onto the field for winning the @USENIXSecurity / Facebook Internet Defense Prize!
Outages won't stop facebook awarding money to good security work, here are this years 3 winners of the internet defense prize: usenix.org/blog/facebook-and…