Claude Can Never Be Held Accountable, But You Can.
The Many Faces of the Security Poverty Line
The Many Faces of the Security Poverty Line
The Security Poverty Line is real. But the field has been thinking in binary for fifteen years. There’s an entire class structure between the cyber 1% and the orgs getting ransomed — including a Valley of Death that’s the most populated tier in the industry and the least discussed.
Dr. StrangeClaw or: how I learned to stop worrying and love the AI
Dr. StrangeClaw or: how I learned to stop worrying and love the AI

We have decades of experience with how we give an EA access to an executive’s life. And the entertainment industry is rife with stories of managers taking advantage of celebs by gaining access to their bank accounts and other aspects of their lives. All of this has made me realize that:

GenAI Threat management is just Insider Threat management, but faster and at scale.

European Sovereign Cloud
European Sovereign Cloud
Early next year, AWS will launch one of the largest changes to its cloud product in decades. For the first time, they will launch a new partition, the European Sovereign Cloud (ESC), open to anyone. This article covers why you might want to use it, what are some of the threats to consider, mitgations, and alternatives to consider.
re:Invent 2025 recap
re:Invent 2025 recap
My breakdown of the key announcements security folks should know about from AWS re:Invent 2025.
Threat Modeling GenAI applications
Threat Modelling Cloud Service Providers in 2025
Threat Modelling Cloud Service Providers in 2025
With the US Government acting in an erratic and hostile manner towards its traditional allies, it makes sense for companies not typically subject to US Jurisdiction to reconsider their threat models when using the big three cloud providers. All of them are US-based companies, and all three conduct a substantial amount of business with the US Government.
Implementing Security Invariants in an AWS Management Account
Farris's Three Laws of Auto Remediation
How AWS needs to change
How AWS needs to change
In previous posts, I took AWS to task for not making the customer’s security Job Zero. This offended some sensibilities, so let me lay out my 95 13 Thesis against the current AWS Culture and how it is neither Customer-Obsessed, nor makes security job zero.
AWS pre:Invent 2024
AWS pre:Invent 2024
It’s once again pre:Invent, that magical season where AWS announces new features related to their legacy products (cloud) before they jump all-in on Generative AI magician gimmicks at re:Invent in Las Vegas. This is my 5th year doing a pre:Invent round up. I almost decided not to do one. pre:Invent wasn’t the GenAI wank-show I expected it to be. In fact, some several exciting features and services were announced.
Effective Techniques for AWS Ransomware
Effective Techniques for AWS Ransomware

In order to profit effectively from a ransomware attack, a threat actor needs to have something to offer in return for payment. This blog post outlines a process to encrypt AWS resources and then revoke access to the secret material until the ransom is paid.

Apparently, this post caused some consternation at AWS, and perhaps this technique is too effective to publish here. So, the original post has been revised to remove the actual scripts, include some mitigations, and provide commentary on how both Public Cloud (AWS Included) and Generative AI are dangerous tools in the hands of the general public and need more regulation.

More on the Microsoft/Sidekick fiasco

AppleInsider | Microsoft’s Sidekick/Pink problems blamed on dogfooding and sabotage. The article posits two questions: Was MSFT trying to pull a hotmail and convert the service to its own products (like it did in the 90s when it converted the stable Unix Hotmail infrastructure to NT4) or was it sabotage by a disgruntled employee. I think it would be pretty damn hard to corrupt the systems, corrupt the data, and corrupt all the backups to the point that recovery isn’t possible.

chris IT Industry , Technology
Read More

Don’t blame the clouds

So it seems like the anti-cloud fanatics are all popping open beers in celebration of MSFT’s failure to restore user data for T-Mobile’s sidekick. I’m not sure I’d blame clouds, cause I’m not sure I’d consider that T-Mobile service a cloud to begin with. Unless you consider your IMAP box at your ISP a cloud, or your corporate exchange server a cloud, or wiki a cloud. Sidekick is a service. Services go down.

chris IT Industry , Technology
Read More

Effectiveness

“When employees are too effective at hiding the consequences of bad management decisions, they act as enablers and do nobody any favors.” -Craig

chris Humor , Quotes
Read More

British PM apologizes for treatment of gay code-breaker

British PM apologizes for treatment of gay code-breaker – CNN.com. No single man did more to win the war in Europe than Alan Turing, who is also the father of modern computing. The fact that closed-minded homophobic bigots caused him to take his life is a tragedy that must never be repeated! Kudos to Prime Minister Brown for acting quickly and decisively once the matter what brought to his attention, rather than trying to weigh its political consequences in the next election.

chris Politics , Technology
Read More

The Hydrogen Myth

An excellent presentation by Georgia Tech’s Stephen Fleming on the economics and physics of Hydrogen as an alternate fuel. Presented at Dragon*Con.

chris Politics , Technology
Read More

67TB for under $8k

Petabytes on a budget: How to build cheap cloud storage | Backblaze Blog. Hint: My birthday is coming up. 🙂

chris Technology
Read More