Adam Shostack :donor: :rebelverified:

Author, game designer, technologist, teacher.

Helped to create the CVE and many other things. Fixed autorun for XP. On Blackhat Review board.

Books include Threats: What Every Engineer Should Learn from Star Wars (2023), Threat Modeling: Designing for Security, and The New School of Information Security.

Following back if you have content.

Website: https://shostack.org
Latest book: https://threatsbook.com
Opsec status: Currently clean
Youtube: https://youtube.com/shostack

Public Key

npub1s7cghayd6cuu7tnvxw6xlxq5ddz0grs956tzwsqj59v5vvucgd7sdgrcqn

NIP-05 Address

adamshostack_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsg0vyt7jxavww09ekr8dr0nq2xk385pcz6d938gqf2zk2xxwvyxlgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsejp2mr

Publishing to

relay.damus.io

nos.lol

nostr.mom

Author Public Key

npub1s7cghayd6cuu7tnvxw6xlxq5ddz0grs956tzwsqj59v5vvucgd7sdgrcqn

Show more details

Last Notes

2026-03-11 23:57:15 UTC

- reply

... It's ... overinflated.

2025-10-15 15:31:11 UTC

- reply

I think your assessment of "pretend to care, but don't" is wrong.
20% of users have an ad blocker, 10% pick a 401k if not the default.

2025-09-13 16:43:41 UTC

It won’t work.
(Dunking on mastodon here, not Don. ) https://techhub.social/@BrentD/115197950000197643

2025-08-09 14:59:33 UTC

One of the hats I wear is editor for the @npub1dqd…8xy4 Franklin Hackers' Almanack. If you see talks that policymakers should know about, please let me know here, tag me, etc.
I'm already seeing great stuff on voting security, resisting back doors, irresponsible behavior by thin-skinned vendors.. what else should I see?
https://defconfranklin.com/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/999/396/386/034/314/original/d407ee005113c1db.webp

2025-04-16 16:56:58 UTC

The most important part of CVE is not the unique number, but the funding and expertise to run a credible program that assigns a unique number. The unique number was the center of what Dave Mann called a “concordance,” and I believe this is subtle but crucial: The value of CVE is not as a database, but as a stable way to cross-reference between databases and other tools. Dave and I have had many conversations about books having an ISBN, a UPC code, a Dewey number and a Library of Congress number. They serve different goals, and are managed by different groups.
I mention the books because assigning unique numbers in a stable way is harder than you'd expect.

2025-04-16 04:26:20 UTC

- reply

Sorry, this is ... not right.
"“What the CVE lists really provide is a standardized way to describe the severity of that defect"
CVSS provides that. CVSS analysis is typically provided by NVD, not CVE, CVE started as a naming system, and that's the program's most important role: identifiers. Severity is... priority 2.

2025-04-15 21:58:29 UTC

- reply

The variance in CVE funding, has been a crime, and the stability MITRE has provided has been quiet heroism.

2025-04-12 15:14:45 UTC

Judgement is an important facet of professionalism. There are areas where we need people to make judgement calls despite incomplete information, inconclusive or contradictory indicators, and other complications that lead us away from algorithms to human judgement.
In the traditional professions, including law, accounting, medicine and even engineering, we teach people to make those judgement calls as part of their education. That involves ensuring they have the available facts, that they can discuss how they came to a decision, and that they'll stand by it until those facts change.

2025-04-07 23:14:03 UTC

Today's "history is boring" lesson: The Declaration of Independence lists "For transporting us beyond Seas to be tried for pretended offences" as one of the reasons Independence was important.

2025-04-03 15:54:32 UTC

- reply

I’m not an attorney but that seems like thin gruel on which to ignore a problem. I hope you have it in writing for the plaintiffs attorneys

2025-03-29 15:38:32 UTC

- reply

Is it normal for a university to memory hole a former professor's pages? I thought the norm was to keep scholarship present, but possibly mark it as an inactive page.

2025-03-29 14:23:21 UTC

- reply

I’ve heard (from someone I trust) that his university web pages were all taken down and colleagues don’t know where he is.

2025-03-15 16:59:12 UTC

- reply

I'm largely focused on the ones we can see, including side-effect-free code, migrating from filesystems to other data stores, immutable deployments, configuration as code, configuration in version control, getting away from spaghetti in legacy data centers...

2025-03-15 16:43:15 UTC

- reply

The more I look at the amazing new security boundaries that cloud providers are building, the more amazed I am that anyone would think of building on classic patterns without them.
Why would anyone allow new (production) code to store data on a filesystem in 2025? There are better patterns.

2025-03-07 03:42:10 UTC

- reply

I mean, seems reasonable? If the Texas state lottery has the wrong odds table, how is that the fault of people who buy all the tickets?

2025-02-25 00:33:33 UTC

Remember when Barbara Streisand brought her lawyers into some dumb dispute and made the whole thing funnier?
Yeah, apparently you're not alone in having forgotten about that.
And no, I'm subtooting someone else's client because it's a freaking target rich environment.

2025-02-09 00:16:32 UTC

- reply

I mean, Wired often puts their "hyperbole" in quotes attributed to named sources, who happen to be Federal contractors with armies of cleared staff. Don't you?

2025-01-23 22:23:31 UTC

- reply

Is there a reason not to look?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/880/007/206/882/107/original/a03690275549d0fd.mp4

2024-12-20 04:20:09 UTC

- reply

I would ask why it’s hard and can we fix those things?

2024-11-28 20:22:02 UTC

- reply

We used to get data like that from the malicious software removal tool and Defender... it wouldn't surprise me if there was a ~50% drop from version to version.. we saw that order of improvement from XP to Vista to 7. Some of it's better code and architecture. some of it is the folks who upgrade are more likely to be on top of other parts of managing their systems.

2024-11-22 15:40:45 UTC

- reply

I mean, "our wifi was hacked" goes back to other umm, Target attacks?

2024-11-18 18:59:54 UTC

new blog, Is Cybersecurity Awareness Month Worth the Money?
As we wrap up another cybersecurity awareness month, I’d like to ask: Is it worth the money and effort? If it is, we should be able to see evidence of that in reductions of successful attacks in October/November, slowly rising over time as the effect of the awareness campaign drips evaporates, and then renewing the next year. The shifts should be bigger than the variance the data shows.
I am quite serious about this. Cybersecurity awareness month was invented by Microsoft’s marketing department, and it now absorbs a huge amount of time and energy:
(1/4)

2024-11-03 22:20:18 UTC

I'm old enough to remember when Americans voted for the candidate they thought would do the best job.

2024-10-20 23:23:55 UTC

- reply

"interest based advertising agreement?" Is your monitor talking to the internet by itself?

2024-09-29 15:34:15 UTC

I find myself really irked by the headline here. The problem is not a "simple website bug", the problem is that they wrote thousands of lines of code without ever thinking about what the trust boundaries are, or should be.
This is a massive design flaw. The idea that cars should be controllable from some mothership is bizarre (and not needed for app control - have a digital signature from the mobile device). The idea that cars are enrolled even if the user didn't set up an account is similarly broken. This isn't a "simple website bug" but a massive failure to consider the security implications of features.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/221/567/638/929/617/original/87a84b902bd02b53.png