Bob Lord
@boblord.bsky.social
Cautiously pessimistic, esp. about cyber things.
The owls are not what they seem. 🗻🗻🦉🌲🪵 🍒🥧☕️🍩 🕵🏼♀️ 👍🏻
Also: 🔐🔑🔒
And of course: hacklore.org
Other account: @hacklore.bsky.social
The owls are not what they seem. 🗻🗻🦉🌲🪵 🍒🥧☕️🍩 🕵🏼♀️ 👍🏻
Also: 🔐🔑🔒
And of course: hacklore.org
Other account: @hacklore.bsky.social
Pinned
Bob Lord
@boblord.bsky.social
· Dec 20
The Quiet HTTPS Revolution
In a recent post, I explained that the websites I visit on my Chromebook are almost all delivered over HTTPS. Better still, 100% of the…
medium.com
Reporters, this is a story worth covering. It might not be as glamorous as high-profile hacks, and it might not attract as many clicks, but it’s important. The quiet adoption of HTTPS has improved online security for billions of people, and it deserves attention.
medium.com/@boblord/the...
medium.com/@boblord/the...
Reposted by Bob Lord
Myth: "Our products are already SbD”
Reality: The incentives and steady stream of breaches make that unlikely.
Reality: The incentives and steady stream of breaches make that unlikely.
October 31, 2026 at 12:02 PM
Myth: "Our products are already SbD”
Reality: The incentives and steady stream of breaches make that unlikely.
Reality: The incentives and steady stream of breaches make that unlikely.
Reposted by Bob Lord
📣 Cybersecurity Awareness Month asks operators to try harder. We spent it asking software manufacturers to ship better.
Since Oct 1, @lzxdc.bsky.social and I have each posted one Secure by Design Story Card a day. By tomorrow: 62 of 90.
#SecureByDesign #CybersecurityAwarenessMonth
Since Oct 1, @lzxdc.bsky.social and I have each posted one Secure by Design Story Card a day. By tomorrow: 62 of 90.
#SecureByDesign #CybersecurityAwarenessMonth
October 30, 2026 at 3:09 PM
📣 Cybersecurity Awareness Month asks operators to try harder. We spent it asking software manufacturers to ship better.
Since Oct 1, @lzxdc.bsky.social and I have each posted one Secure by Design Story Card a day. By tomorrow: 62 of 90.
#SecureByDesign #CybersecurityAwarenessMonth
Since Oct 1, @lzxdc.bsky.social and I have each posted one Secure by Design Story Card a day. By tomorrow: 62 of 90.
#SecureByDesign #CybersecurityAwarenessMonth
In 1962, Rachel Carson published Silent Spring. DDT was a Nobel-winning miracle chemical, sprayed everywhere. Carson showed it climbed the food chain, thinning eggshells of birds that never went near a field. Her title is the harm: a spring with no birdsong.
October 30, 2026 at 11:30 AM
In 1962, Rachel Carson published Silent Spring. DDT was a Nobel-winning miracle chemical, sprayed everywhere. Carson showed it climbed the food chain, thinning eggshells of birds that never went near a field. Her title is the harm: a spring with no birdsong.
Patrick Stewart Visits Twitter's Office: Engage! - Vine
YouTube video by Fun Master
youtube.com
October 30, 2026 at 4:39 AM
Reposted by Bob Lord
Myth: “A secure laptop will cost $10k!”
Reality: Reality: The cost is already being paid, just not by the manufacturer.
Customers buy tools, staff teams, and absorb incidents to compensate for defects they did not create.
Reality: Reality: The cost is already being paid, just not by the manufacturer.
Customers buy tools, staff teams, and absorb incidents to compensate for defects they did not create.
October 29, 2026 at 11:30 AM
Myth: “A secure laptop will cost $10k!”
Reality: Reality: The cost is already being paid, just not by the manufacturer.
Customers buy tools, staff teams, and absorb incidents to compensate for defects they did not create.
Reality: Reality: The cost is already being paid, just not by the manufacturer.
Customers buy tools, staff teams, and absorb incidents to compensate for defects they did not create.
Reposted by Bob Lord
The Visionaries are those who see a better future and are working to build it.
They are the researchers, regulators, advocates, engineers, and executives who believe that software can and must be safer.
They are the researchers, regulators, advocates, engineers, and executives who believe that software can and must be safer.
October 28, 2026 at 11:30 AM
The Visionaries are those who see a better future and are working to build it.
They are the researchers, regulators, advocates, engineers, and executives who believe that software can and must be safer.
They are the researchers, regulators, advocates, engineers, and executives who believe that software can and must be safer.
Reposted by Bob Lord
The EU's Cyber Resilience Act (Regulation 2024/2847) is the first EU-wide law imposing binding product security requirements on software and connected hardware, regardless of where the manufacturer is based.
October 27, 2026 at 11:30 AM
The EU's Cyber Resilience Act (Regulation 2024/2847) is the first EU-wide law imposing binding product security requirements on software and connected hardware, regardless of where the manufacturer is based.
Reposted by Bob Lord
The Vendors:
The Vendors are the software manufacturers who build and ship the products.
Today, most vendors can externalize the cost of insecure software onto customers and society — through EULAs, disclaimers, and the absence of legal accountability.
The Vendors are the software manufacturers who build and ship the products.
Today, most vendors can externalize the cost of insecure software onto customers and society — through EULAs, disclaimers, and the absence of legal accountability.
October 26, 2026 at 11:15 AM
The Vendors:
The Vendors are the software manufacturers who build and ship the products.
Today, most vendors can externalize the cost of insecure software onto customers and society — through EULAs, disclaimers, and the absence of legal accountability.
The Vendors are the software manufacturers who build and ship the products.
Today, most vendors can externalize the cost of insecure software onto customers and society — through EULAs, disclaimers, and the absence of legal accountability.
Reposted by Bob Lord
Myth: “Attackers keep adapting”
Reality: The difference is real. A fire captain fights physics: unpredictable, indifferent, not trying to win. An army captain fights someone who can wait, feint, spend more, and come back tomorrow.
Reality: The difference is real. A fire captain fights physics: unpredictable, indifferent, not trying to win. An army captain fights someone who can wait, feint, spend more, and come back tomorrow.
October 25, 2026 at 11:15 AM
Myth: “Attackers keep adapting”
Reality: The difference is real. A fire captain fights physics: unpredictable, indifferent, not trying to win. An army captain fights someone who can wait, feint, spend more, and come back tomorrow.
Reality: The difference is real. A fire captain fights physics: unpredictable, indifferent, not trying to win. An army captain fights someone who can wait, feint, spend more, and come back tomorrow.
Reposted by Bob Lord
Market Forces & Effects:
The software industry isn't a free and fair market — not when it comes to security.
High switching costs, vendor lock-in, and market concentration reduce competition. Information asymmetries prevent buyers from assessing product security.
The software industry isn't a free and fair market — not when it comes to security.
High switching costs, vendor lock-in, and market concentration reduce competition. Information asymmetries prevent buyers from assessing product security.
October 24, 2026 at 11:15 AM
Market Forces & Effects:
The software industry isn't a free and fair market — not when it comes to security.
High switching costs, vendor lock-in, and market concentration reduce competition. Information asymmetries prevent buyers from assessing product security.
The software industry isn't a free and fair market — not when it comes to security.
High switching costs, vendor lock-in, and market concentration reduce competition. Information asymmetries prevent buyers from assessing product security.
Reposted by Bob Lord
Myth: “It was a sophisticated attack”
Reality: Most breaches described in headlines as a "sophisticated" or "advanced" attack start with an ordinary technique: a phished credential, a social-engineered helpdesk call, a login with no MFA.
Reality: Most breaches described in headlines as a "sophisticated" or "advanced" attack start with an ordinary technique: a phished credential, a social-engineered helpdesk call, a login with no MFA.
October 23, 2026 at 11:15 AM
Myth: “It was a sophisticated attack”
Reality: Most breaches described in headlines as a "sophisticated" or "advanced" attack start with an ordinary technique: a phished credential, a social-engineered helpdesk call, a login with no MFA.
Reality: Most breaches described in headlines as a "sophisticated" or "advanced" attack start with an ordinary technique: a phished credential, a social-engineered helpdesk call, a login with no MFA.
Do not judge me, but Department Story Christmas is back on @somafm.com. I can almost taste the Frango Mints...
Join me!
somafm.com/deptstore/
Join me!
somafm.com/deptstore/
Department Store Christmas (Special) from SomaFM
Holiday Elevator Music from a more innocent time.
somafm.com
October 23, 2026 at 3:20 AM
Do not judge me, but Department Story Christmas is back on @somafm.com. I can almost taste the Frango Mints...
Join me!
somafm.com/deptstore/
Join me!
somafm.com/deptstore/
Sometimes important work happens without fanfare. When CNAs submit CVE records, the system validates them against some basic standards. Last month, that validation code was refactored into its own library.
Common vulnerabilities and Exposures (CVE)
www.cve.org
October 22, 2026 at 10:56 PM
Sometimes important work happens without fanfare. When CNAs submit CVE records, the system validates them against some basic standards. Last month, that validation code was refactored into its own library.
Reposted by Bob Lord
Waiting until November 10th for CVEs and info on what was fixed is great because by the time you get the advisory, attackers who reverse-engineered today's patches will already be on vacation.
October 22, 2026 at 9:00 PM
Waiting until November 10th for CVEs and info on what was fixed is great because by the time you get the advisory, attackers who reverse-engineered today's patches will already be on vacation.
Reposted by Bob Lord
