tumblr.attrition.org

Odds Are You Are Responsible for that Traffic Slowdown

Tue, 01 Sep 2026 11:15:15 -0400

I know, potentially insulting readers in the headline is not a good way to keep people interested, but it’s statistically true. Until recently, when stuck in bad traffic I daydreamed about having a drone or helicopter view to see where the problem is. On occasion I am close enough to the front of the jam to see the cause; absolutely nothing. I’m sure plenty of folks will immediately recognize…

Odds Are You Are Responsible for that Traffic Slowdown

How Much Lipstick Can That CVE Pig Wear?

Mon, 31 Aug 2026 11:15:39 -0400

How Much Lipstick Can That CVE Pig Wear?

Q&A: Modernizing the National Vulnerability Database in the Age of Artificial Intelligence

Mon, 24 Aug 2026 11:15:44 -0400

The last two years of the National Vulnerability Database (NVD) has been tenuous, perfidious, and an outright disaster for organizations world-wide. That isn’t hyperbole unfortunately, as the program has continued to go downhill for more than two years. NVD is no longer a place to get usable vulnerability intelligence. It started back in 2024 at VulnCon, when Tanya Brewer shared an update during…

Q&A: Modernizing the National Vulnerability Database in the Age of Artificial Intelligence

Apparently Turkeys Obtained Personhood According to AI

Mon, 17 Aug 2026 11:15:35 -0400

Apparently Turkeys Obtained Personhood According to AI

Meta - The No Child Left Behind of LLMs?

Tue, 11 Aug 2026 11:15:22 -0400

Intro

Last month, headlines told us about a novel incident where OpenAI’s agents “went rogue, escaped, and hacked” a company during testing. Some are calling it a “watershed moment” for computer security. Details quickly emerged that led some to conclude it was “remarkably easy“. From there it just got more interesting, weirder, and more serious though. Reports say that OpenAI agents “passed…

Meta - The No Child Left Behind of LLMs?

A Word on Microsoft and Vulnerability Exploitation

Mon, 10 Aug 2026 11:15:50 -0400

Intro

Microsoft Security Response Center (MSRC) is the group responsible for triage when researchers report new vulnerabilities. They handle a wide variety of other tasks, but my focus is on their analysis of vulnerabilities in one context or another. That could be the researcher’s disclosure or investigating an actively exploited vulnerability in a customer environment. At some point in the…

A Word on Microsoft and Vulnerability Exploitation

Drowning in EULA, T&S, and Privacy Policy Updates

Wed, 29 Jul 2026 13:44:16 -0400

Introduction

If you use a computer in almost any capacity, you have been exposed to an End-User License Agreement (EULA) before. As far as Internet lore goes they have a special place in infamy and contempt. Even before the Internet as well as the early days it was worse in some ways. When you went to a store and purchased software that came in a box you found yourself facing a Catch-22. You had…

Drowning in EULA, T&S, and Privacy Policy Updates

Research: Hacking-adjacent Incident from 1966

Mon, 27 Jul 2026 18:24:19 -0400

At this point I don’t even remember where I obtained a really poor resolution image of a newspaper page. It’s been on my computer for at least six years, likely much longer. Due to the poor resolution no matter how much you zoom and try to find a sweet spot of readability, the details were too fuzzy. Today, I decided to take another stab at it and try to search it out. I pinged a small group of…

Research: Hacking-adjacent Incident from 1966

Review: A Natural History of Empty Lots by Christopher Brown

Sat, 18 Jul 2026 13:07:10 -0400

Earlier this year a good friend gave me a book, “A Natural History of Empty Lots: Field Notes from Urban Edgelands, Back Alleys, and Other Wild Places” by Christopher Brown. The book follows Brown primarily, occasionally including members of family, after he moved to Austin, Texas and purchased an empty lot in an industrial section of town. From there he learns to better appreciate the nature…

Review: A Natural History of Empty Lots by Christopher Brown

Random Movie/TV Thoughts and Reviews (July 2026)

Thu, 09 Jul 2026 11:15:15 -0400

Spartacus: House of Ashur (2025) is a continuation of the original Spartacus series from 2010 in which Ashur is given an alternate fate than received in the original. This allows a reimagined story ending and launch into the new that finds himself dominus of the very ludus that had previously owned him. Rather than just a repeat with new characters, this series stays local and branches out…

Random Movie/TV Thoughts and Reviews (July 2026)

CISA KEV’s Revolving Door

Tue, 07 Jul 2026 11:15:46 -0400

Some time ago, perhaps last year or two years ago during VulnCon, I made an offhand comment about Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerability (KEV) catalog and how there were more than one vulnerability that had appeared in it and were subsequently removed. I received doubt from someone (Tod Beardsley?) that didn’t think it had happened at all. I…

CISA KEV’s Revolving Door

VDBs: Pedantic Nuances on Version Tracking

Mon, 06 Jul 2026 11:15:17 -0400

I am all about the pedantic nature of running a vulnerability database (VDB). It’s the backbone of running one well as “simply aggregating vulnerability information” is anything but simple. I’ve been outspoken on the issue of perceived simplicity for at least two decades and brought it up in various presentations and blogs. This blog is not new in that I have very briefly covered it in a prior…

VDBs: Pedantic Nuances on Version Tracking

Nature Finds a Way

Sun, 05 Jul 2026 11:18:22 -0400

Nature Finds a Way

YouTube’s Thumbnail Generation Fraud

Sat, 04 Jul 2026 11:15:19 -0400

YouTube’s Thumbnail Generation Fraud

F5 Contributes to KEV Confusion

Fri, 03 Jul 2026 11:15:43 -0400

F5 is a technology vendor that sells a variety of networking technology including security products. With a considerable security portfolio and long tenure in the industry they are well positioned to observe known exploited vulnerabilities (KEV). Their staff frequently write blogs about threat actor activity, exploit campaigns, and associated topics. Unfortunately, while they have great insight…

F5 Contributes to KEV Confusion

We’re Losing the “Cyber” War to Ourselves

Thu, 02 Jul 2026 11:15:32 -0400

It’s hard to pinpoint where the concept of cyberwar originated. In roundabout ways it likely goes back many decades in fiction. As far as citations go, some believe a seminal work is titled Unrestricted Warfare by Qiao Liang and Wang Xiangsui, two colonels in the People’s Liberation Army (PLA). Regardless of when the premise started, the computer-based cold war has been going full steam for two…

We’re Losing the “Cyber” War to Ourselves

And AI Tech Bros Still Want to Gamble…

Wed, 01 Jul 2026 11:15:18 -0400

If you follow even the headlines for so-called “AI” developments, you may have caught a few that talked about how some AI insiders say there is a chance that the technology they are developing will “destroy humanity”. Of course, that term is subjective and could vary considerably from person to person. Does it mean it will destroy what makes us human, the creativity and drive? Or will it…

And AI Tech Bros Still Want to Gamble…

Save the Earth One Napkin at a Time

Tue, 30 Jun 2026 11:15:18 -0400

Save the Earth One Napkin at a Time

The Loquacious Introvert

Mon, 29 Jun 2026 11:15:54 -0400

This is my 1,000th post on this blog! Not counting this post, that is 893,353 words written here over 38 years. Of course, this blog hasn’t been around that long but I made an effort the last few years to consolidate all of my writing in one place and date it accordingly. That means the first “post” of this blog is “WE DIDN’T START THE FIRE” – A NEW PERSPECTIVE which is a paper I co-wrote in high…

The Loquacious Introvert

2026 East Coast Drive (Part 8: Random Notes)

Sun, 28 Jun 2026 11:15:40 -0400

2026 East Coast Drive (Part 8: Random Notes)