Adam Caudill

Security Engineer, Researcher, & Developer. Formerly at 1Password, BSI / AppSec Consulting, Numorian, etc.

Website: https://adamcaudill.com/
Github: https://github.com/adcaudill
Exposera: https://exposera.com/u/adamcaudill

Last Notes

2025-12-16 18:29:49 UTC

I suspect that current unemployment numbers are missing something. The numbers don't seem to reflect the reality I'm seeing on here or on LinkedIn. The number of people looking is higher than I've seen in my career, but the official numbers aren't that bad (4.6% in the US). So let's run a little unscientific experiment.
If you work in tech, or something broadly tech-adjacent, please vote and boost for reach.

2025-11-11 09:37:24 UTC

- reply

I’ve long believed that a few issues are making it unlikely to gain broader adoption:
- “domain names” that are impossible to remember
- lack of good search options to find anything
- too much intentional user effort to make use of the network
There’s a lot of chicken & egg situations, where there needs to be more use to justify efforts (such as building Tor support into more software), which is being held back because of a lack of use. But these things are needed to gain the broader adoption that it could have.
The fact that .onion names are too hard to remember and the lack of good search means that even if more content was available, odds are low of people actually finding it, which makes it hard for people to justify making the content available.
All this to say, I think there are a few usability issues that reduce demand enough that it makes it a questionable investment to host content for Tor.

2025-11-07 14:11:45 UTC

- reply

Nothing I wrote was intended to be ableist or derogatory; if that's how it came across, then I apologise for my lack of clarity.
It's not my intent to ever demean or insult, both as a matter of practice in general, and in this specific case, as the father of an autistic child.

2025-11-07 12:47:02 UTC

- reply

I started to mention the fact that animals show empathy as well, though cut it for brevity. Empathy is so vital to building healthy groups - be it human society or a small group of primates in a jungle. Empathy makes it possible.

2025-11-07 11:35:50 UTC

- reply

When people in power call empathy a flaw, what they’re really saying is that cruelty serves their interests better. We should never let that idea go unchallenged. Empathy isn’t optional - it’s what keeps us human.

2025-11-07 11:35:50 UTC

Lately, I’ve been thinking about empathy - how easily it’s dismissed as weakness by those who mistake cruelty for strength. When someone mocks empathy, what they’re really rejecting is accountability for the harm they cause. Empathy isn’t softness; it’s the discipline of seeing the world through another’s eyes. It’s what allows societies to cooperate, to build trust, to choose care over indifference.

2025-11-04 15:18:02 UTC

Randomly Scheduled Reminder: You should use a tool like Loqseq or Obsidian to keep notes and a journal of your life, work, and what you're doing. Future you will thank you. Having those details handy and searchable comes in handy in so many ways.
My approach: https://adamcaudill.com/2022/06/05/logseq-my-external-brain/

2025-07-16 17:05:22 UTC

I have a friend that’s working on learning Rust, and looking for something more hands on / interactive. What’s the leading option these days?

2025-03-27 12:17:40 UTC

One of the most brilliant and talented women I've ever known once shared a story with me that absolutely shocked me, a story that I think should be heard.
She was hired as a software engineer at NASA, her dream job. Honestly, a dream job for many- it would have bee a dream job for me, before I moved to security. Writing software for spacecraft has to be one of the coolest and yet most demanding jobs in the industry. Yet, her joy was quickly gone, and her spirit deflated.
She was consistently assigned menial, even pointless tasks. Mere busywork at times. Work far below her ability. Work that never gave her the opportunity to show what she was capable of. It didn't take long to find out why.
You see, not long after she was hired, her manager made it clear that he saw women's place as being at home and raising kids. If he was so against women working, why did he hire her? He had a problem, his male engineers had a habit of moving out of the area for higher paying jobs in the private sector. So he started hiring single women in hopes that they'd marry his male engineers, and keep them from moving away.
She had put in a tremendous amount of effort to establish her technical skills, her ability to solve the hardest problems, to prove herself as worthy of one of the most coveted roles in the public sector, to be able to work on cutting edge science and exploration. To her manager, none of that mattered. She was young, single, and he wanted someone that would tie his other engineers to that city. That's all she was to him.
He stated all of that plainly and clearly. He didn't care how smart she was, he didn't care how talented she was. He didn't care what she was capable of. All he wanted was for her to was to meet one of his male engineers, get married, and quit to raise kids.
I was fortunate enough to work with her and see her talent unleashed. I was lucky enough to see what she was truly capable of, and it was a lot. She would have been that manager's best engineer, if he'd given her the chance - if he'd seen her as something other than a means to tie down one of the men he'd hired.
His demeaning and sexist views robbed her of the career at NASA that she dreamed of, and robbed NASA of a brilliant engineer.
At this point, you may be asking why I'm sharing her story, a story that I don't believe was ever shared publicly, instead of her sharing it. Because of one of the other places that women have to fight to be heard: the doctor's office.
She knew something was wrong, she knew something had changed, she was dealing with symptoms of something, but had no idea what it was. Her doctor said it was a minor infection. As treatments failed, she went to a different doctor for a second opinion. Same answer. As the symptoms got worse, she went to more doctors, all said the same thing, Finally, half a dozen doctors later, she found one that was willing to perform even the most basic of medical tests.
It took only a few days to confirm the diagnosis: cancer. It would have been easily treated if diagnosed early, but had already progressed to stage 4. There was no effective treatment.
Because of a sexist manager, NASA lost a fantastic engineer, though the security community gained one of the most brilliant minds in application security that I've ever encountered. Because of doctors that don't listen to women, we all lost her.
(I won't mention her name, as she greatly appreciated privacy in life, though this story should be told and remembered. If you knew her, you're well aware of what a truly amazing person she was, not only as a remarkable talent, but a fiercely loyal friend. I was truly lucky to have her as a friend, and while she's been gone for a few years now, I still mourn losing her.)

2025-03-10 21:56:13 UTC

As people are discussing the issues witth DDoS attacks and attribution, I’m reminded of how the US Government blamed Russia for a DDoS attack against one of their neighbors, which is more accurately (though very indirectly) blamed on me.
Many years ago I complained in an IRC channel about a small website that ripped off the design of one of my sites. A somewhat shady member of that channel happened to control a sizable botnet (with primarily RU IPs). Yep. You see where this is going. (To be clear, I was venting, and didn’t ask him or anyone else to do anything.)
He thought it would be funny to get a little revenge on my behalf. He aimed his entire botnet at that website, and hit the network with so much traffic that it didn’t take down the target server, instead it saturated the core network gear for the country’s main ISP, knocking most of the country offline for several hours.
By pure coincidence, said small Eastern European country was holding national elections the day I complained about the website, something I didn’t discover until years later.
Even the US Government, with all their resources, can’t always tell the difference between a state-backed attack and a teenager “having fun” with a botnet.

2025-02-19 14:13:22 UTC

After a long and restful break since leaving my last role, I'm back to actively looking for new problems to solve. If you know of anyone looking for someone with an extensive background in security leadership, application security, & penetration testing, let me know!
Resume: https://adamcaudill.com/resume/

2024-09-27 14:53:06 UTC

After almost 5 years at 1Password, it’s time for a new challenge. If you know of any interesting remote roles that need extensive leadership experience and application security expertise, feel free to reach out!
Resume: https://adamcaudill.com/resume/