Nick Selby :donor:

EPSD. Co-host, EPSD Podcast; Tech Debt Burndown podcast. Board member, NCPTF. Advisory Board, Sightline Security. Former NYPD Intel. Retired TX popo. Bayern, DE / Bedford, TX

Verification: https://nickselby.com
Website: https://epsd.io
Podcast: https://techdebtburndown.com
Articles: https://authory.com/NickSelby/

Public Key

npub1y5p77plhd7w8t2jn3800z9upc5snsn8rczdt6xh5vp3rceyxmgfq8zhnwm

NIP-05 Address

fuzztech_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsz2ql0qlmkl8r44ffcnhh3z7qu2gfcfn3upx4art6xqc3uvjrd5ysprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyhd37

Publishing to

relay.momostr.pink

Author Public Key

npub1y5p77plhd7w8t2jn3800z9upc5snsn8rczdt6xh5vp3rceyxmgfq8zhnwm

Show more details

Last Notes

2026-04-29 16:48:29 UTC

No matter what I try, the only thing that will force Claude Code to respect its written instructions and guardrails and even a hook injecting reminders is the actual hook preventing it from trying to commit without a changelog. Every. Single. Time. When I hear how this is going to take over the world I laugh and laugh and laugh.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/489/013/431/074/476/original/14c5b885f5519bc4.png

2026-02-06 11:57:42 UTC

Cannot stop watching this. https://youtube.com/shorts/njpCqvK0Q74?si=uFAct8kQFO7xOiYF. cc @npub16kg…afn8

2026-01-01 06:56:55 UTC

There’s serious pressure on executives to implement AI software driven by a genuine belief that AI tools can increase customer engagement and lower costs, and also by plain old fear of missing out. The risk decisions made by executives must be based on a cross-functional risk management approach that enables them to consider all aspects of the business holistically.
I wrote this in Inc. to help non-technical senior executives understand the work required to safely implement AI tools and software.
https://www.inc.com/nick-selby/how-fomo-is-turning-ai-into-a-cybersecurity-nightmare/91261473

2025-12-29 08:39:29 UTC

Stop claiming that SOC is an information security certification. Stop treating SOC2 Type II as an indicator of anything other than achieving SOC2 Type II, a standard created and audited by accountants.

2025-12-27 09:04:25 UTC

Haha. We checked in to a hotel in Prague and when we did, one of our party had a US passport (the rest of us had EU). At 830 this morning two armed immigration police in body armor / load bearing vests knocked in a coply manner on the door of the room where our friend with the US passport was staying. The Popo spoke no English but demanded visa information, saying (understandably but incorrectly) that the person needed a visa to be in Czechia.
The difference in how they were treated here versus how people are treated in America was that here, the immigration police listened and used Google translate to sort things out and ultimately left, satisfies tha no laws had been broken. Also, the immigration police did not hide their faces or their ID cards.
When the US is beastly to all foreign visitors, this is the new normal.

2025-12-26 23:01:18 UTC

I last drank alcohol 8768 days days ago, on Dec 26, 2001. Many things conspired to push me from "Guy who likes drinking" to "Guy who probably shouldn't drink". So 24 years ago, I quit. This post will include some AA stuff, but I'm not in AA - not really. I believe people need to find their own path if that's what works, as it did for me.
I posted this as a thread on Twitter my 20th sobriety anniversary, and to Mastodon in 2023 and 2024, and I post it again today because I see many people saying here that they have stopped or want to stop drinking. I want all of you to see that, even after 24 years, one manages not to drink one day at a time.
You can do it. Days become weeks, then months, then years, then decades. Not all your problems will be over - in fact the hardest part of being sober is not the not drinking, it's the living soberly - I've found that if I had personality issues as a drunk, I have them as a sober person too, so the work isn't over. Not being wasted makes it lots easier to do personal work.
At first, not drinking was hard. I never had anything *like DTs, but I was anxious and it was hard to sleep. For the first couple of years I went to AA meetings, to find like-minded people, then I stopped. I still have very dear friends from that AA group in Munich, Germany.
AA is a personal choice and it's by no means perfect or even great - it's OK if it helps you. It helped to believe that in tough times, I had a group of people to count on, which means a lot. I never believed the "Disease" concept (I think it's a cop-out), and fuck the Christian-centric "God saving me from blah blah." Also, fuck AA's obscenely moronic Christian approach to how agnostics should approach the program, which essentially says, "Get over it, get on your knees and pray," to which my reply is, "Yeah, go fuck yourself." If you like religion, if you like Christianity, that's awesome for you. For me, more religion and genuflection is not the answer to an operational problem.
Yet my attitude towards AA is sometimes contradictory: I feel I don't need the meetings but I've noticed that in times of extreme stress I do go back for a top-off. And today I am attending the same meeting I attended that miserably cold day in 2001. That seems selfish, but hell, there's no rule against it, and I try to give as much as I get, in my own way.
For me, the most important of the twelve steps they recommend are 9 and 10:
Step 9: "Made direct amends to such people wherever possible, except when to do so would injure them or others"
Step 10: "Continued to take personal inventory and when we were wrong promptly admitted it."
Wow, wouldn't it be nice if everyone engaged in those activities?
I am willing to do (and have done) quite a lot for anyone who wants to stop drinking or drugging, as it can be really hard.
Of the horrible, corny, hokey, AA slogans, my favorite:
"There's no problem that is so bad that drinking can't make it worse."
That's very wise. It is particularly worth repeating to the newly sober. As is (cringy as it is) One Day At A Time: it means you're not required to stop drinking/drugging/eating/sexing/what-have-you-ing forever. Just for today.
My three pieces of unsolicited advice for anyone who wants to stop drinking or drugging:
There is as much or as little support as you need, so take what you need. If AA is good for you, do AA; if it's not, don't. A network of like-minded people is great, but these days, with online video, it's easier. If it's not AA, seek something that works for you.
Second, I can't say enough that, "One day at a time" means that you only need to worry about not drinking/drugging/whatever-ing today. Yesterday is past, and tomorrow is in the future. On hard days, consider volunteer service or anything to keep you busy.
Third, help yourself by helping others. Be there for those in your network who need you. I have a standing rule for people I know which is, I sleep and rise very early, so piss off after 9pm unless you need me, in which case, call anytime at all.
A guy in Munich said every day he complained how miserable things were and each day his friend said, 'This too shall pass." One day, the guy noticed everything was great. He said, "Wow, you were right, everything is awesome" and his friend said, "This too shall pass."

2025-12-11 09:24:57 UTC

Golly, that’s so weird: the anti-vaxxer MAGA/MAHA people who fought COVID lockdown and school closings are apparently just fine with keeping their unvaccinated children at home for “weeks” (source: NBC News) during a measles outbreak that was caused because the same anti-vaxxer MAGA/MAHA people prefer a lockdown and school closure to vaccinating their children against measles.

2025-11-08 10:30:32 UTC

It’s funny because it’s true.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/513/611/519/434/590/original/2fe84b10db72c637.jpeg

2025-10-30 08:45:07 UTC

When I was working for a dallas company I asked a senior executive,
“I want to take the team out to dinner, where is the nearest good restaurant?”
And she replied, “New York.” https://mastodon.social/@TexasStandard/115458992905892388

2025-10-22 12:24:07 UTC

- reply

Sounds about right. And it's interesting that the NYPD self insures its vehicle fleet. But if we blew up all the Chevys it's not as embarrassing as losing what was just lost and then having to come clean that we don't even get our expenses back.

2025-10-22 12:21:33 UTC

- reply

One might poll the French people all one wants and still have utterly no idea what the French people think, or perhaps I've spent too much time there in the last couple of years LOL

2025-10-22 12:20:32 UTC

- reply

I suspect it would be about protecting the French government from the loss of the funds they had invested in obtaining and protecting, not (as is currently the case) losing the jewels and all the money - basically optics.

2025-10-22 10:00:41 UTC

- reply

Sure, but not sure that applies here.

2025-10-22 09:18:41 UTC

Well, children (and this is not because I work in the insurance industry): if you have valuable things, you should do your best to obtain and maintain insurance policies on it. That's a tip, kids! You may wish to write it down. https://www.cbsnews.com/news/louvre-heist-stolen-jewels-not-insured-french-government-says/

2025-10-16 12:19:44 UTC

- reply

Ad tech sharing device data, however…

2025-10-16 11:22:23 UTC

Security communications 101: the day after you accidentally create 300 trillion US dollars in stablecoin*, having an article entitled, “Why Trust Company-Issued Stablecoins Are Going Mainstream: the Safest Path for Global Finance” as the lead story on your company blog (and making no mention whatever on the "Newsroom" page) is a poor look in terms of engendering trust.
*Yes. Three hundred trillion dollars https://www.cnbc.com/2025/10/16/paypals-crypto-partner-mints-300-trillion-stablecoins-in-technical-error.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/383/548/596/747/756/original/d72228345d14780c.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/383/555/760/473/282/original/930c608cb4015780.png

2025-10-05 15:28:14 UTC

- reply

THAT IS WICKED COOL!!!!

2025-10-05 08:08:11 UTC

- reply

That’s a flintlock pistol, not a shotgun.

2025-09-28 09:07:39 UTC

“It is always impolite to criticize your hosts. It is militarily stupid to insult your allies.” —Instructions for American Servicemen in Britain, US War Department, 1942

2025-09-27 20:46:45 UTC

- reply

“Holds up” as in hilarious. But the first scene of the first episode shows a man being outed as a spy because his cell phone rings at a symphony concert. Worth every penny. Watching and LOLing

2025-09-27 18:31:11 UTC

Emergency! is hilarious. A 1972 series about LA paramedics. On Amazon prime. I can’t believe how much I used to love this show as a kid. It is execrable.

2025-09-25 15:55:40 UTC

This just in: COVID still sucks.

2025-09-11 07:30:39 UTC

I keep hearing politicians from both US political parties making the manifestly absurd claim that, “This is not who we are.” To the contrary, this is exactly who we are and this is exactly what we do. Admitting we have a problem is the first step.

2025-08-18 01:43:36 UTC

This is beautifully done. And I’m not just saying that because he got the bowl of soup at Vaselka.
https://www.nytimes.com/interactive/2025/08/15/opinion/soup-beauty.html?unlocked_article_code=1.fE8.Qg32.0tmh5pFAYxmh&smid=nytcore-ios-share&referringSource=articleShare

2025-07-29 15:19:27 UTC

Today I used Gemini for the first time. It popped up in a workspace account I am sunsetting, so I asked it:
"I am trying to sunset this email account, but I am concerned about being locked out of seldom-used online accounts that use this email address as an account registration. To help me transfer those to a new email, tell me all the emails I have received in the past 24 months that contain account confirmation, one-time password codes, or other email-address-based authentication messages, then make me a list of the senders and their URL, so that I can address this.”
After it failed spectacularly (it found four; no, one; no six, accounts that qualified) I gave it a new prompt:
Disregard "account confirmation: "one-time password codes" etc, and make the search about identifying online accounts that are registered to this address. Before you begin, ask me any clarifying questions you might have so that you can help me more effectively.”
It asked, “To help me understand what you mean by "online accounts registered to this address" and to make sure I'm searching for the right kind of emails, could you clarify a few things? What types of emails would you expect to receive from organizations where you have an online account? For example, are you looking for emails about:
Account activity or notifications?
Promotions or newsletters?
Order confirmations or shipping updates?
Security alerts or password resets?
Terms of service updates?
Knowing the types of emails you're looking for will help me refine my search terms and provide you with a more relevant list of senders and their URLs. "
So I answered.
It found four. One of them was Google.
Total time: 24 minutes. Well, I mean, let’s be fair — it is Google. Why would I expect them@to understand stuff about email amirite?
Golly! Now I understand why CEOs are so eager to use these magical tools!

2025-07-27 19:09:17 UTC

- reply

I did not say it was accurate. I said it was taught at the police academy.

2025-07-27 06:13:33 UTC

- reply

In the police academy we learned that no one on earth can follow every traffic law for more than 30 minutes of a drive. No one.

2025-07-22 07:40:32 UTC

This is the kind of shit that makes me just detest how Germans approach Web development. This is a link to a legally mandated, compulsory survey of any resident of Bavaria. It is mailed. In the post.
Just think of the literally millions of old people receiving this, and looking at these instructions - the convoluted nature of which is absolutely typical of this kind of thing here. Like, why on earth do they trouble to make an easy subdomain (s) but then make the users type “mz-login” - this is begging for mistakes.
What on earth is wrong with s.bayern.de?
Too simple.
The Registration number is long enough to be used as a unique identifier on a nuclear missile.
The initial password, too, goes against all current usage recommendations and is a complex 12-place string of mixed upper- and lowercase and special characters that oldies can’t see without their glasses. For a one-time password that must be changed to another one requiring complexity on the first login. Three random words separated by hyphens? Too simple. We MUST make this more complex. You know, for “security”
After spending more than an hour answering these ridiculous and invasive questions, I can report that the Haushaltsidentifikationsangabe was totally unnecessary and never asked for.
And note that the postal note containing this information explicitly states that this online survey is NOT optimized for smartphones; one must use a laptop or desktop or tablet. Except there are multiple questions within about Internet use, each of them taking the trouble to specify that a smartphone is an Internet device.
In fact, I find it just as charming as all giddyup that within this online survey is the following question: “Have you used the Internet in the last three months?”
And if you think this is stupid (and I think this is real, real stupid), then you should check out how Germans do online banking registration.
Users. The unfortunate reality of Internet forms. I can only wish upon every state government official who designed, executed, tested, and approved this that they are forced to sit in a windowless room for six months and be forced to answer similarly prepared questions.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/895/751/221/478/866/original/03cb264628f7ece0.jpeg

2025-06-25 14:11:26 UTC

- reply

I just don't understand why every cat on the planet- including, by the way, lions and tigers and jaguars and other big cats - love cardboard boxes.

2025-06-16 07:40:40 UTC

Someone else posted this, which reminded me; if you haven't seen @npub1ly0…d6he on Lawyer. Passport. Locksmith. Gun. (A Talk About Risk & Preparedness) and you're considering protests or, you know, living in the world, you should. Now. https://www.youtube.com/watch?v=6ihrGNGesfI

2025-05-20 17:33:14 UTC

- reply

Thank Goodness President Trump was there to be tough, am I right?

2025-03-08 15:49:13 UTC

- reply

Uh. I hope you mean 20km/h. If you mean pro stunde I get it but 20km per second is fast :)

2025-03-05 11:49:38 UTC

- reply

I’m calling you sarami now

2025-03-05 09:09:13 UTC

Also: I've tolerated this shit for years. Why is it that an airline simply cannot understand where my first name ends and my middle name begins?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/109/038/783/128/887/original/fc1a7f0ba6c32832.png

2025-03-03 21:14:24 UTC

I tried to find this ad for more than a decade because it made me laugh when it came out. The reason was it was DHL, not (as I had thought) FedEx. Anyway it is funny.
https://www.youtube.com/watch?v=aZlmkuk6NX0

2025-03-01 04:19:45 UTC

- reply

Why do you hate freedom?

2025-02-11 06:28:29 UTC

- reply

Yes! It is so strange the things they say are common English (ratatatat, lobo) and things that are just mysteriously omitted (the first time my son played he took one look and said, "Oligopoly" and of course it wasn't there.

2025-02-10 09:59:32 UTC

- reply

Boo. Dont give me facts Wendy, you’ll ruin a perfectly good rant.

2025-02-10 09:54:07 UTC

Seriously, Spelling Bee? Seriously?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/978/982/200/724/690/original/ff02ef2bb44e52cb.jpeg

2024-12-13 18:46:25 UTC

- reply

An old friend once said. I one who has no children should legally be permitted to say “I’m tired.”

2024-11-25 04:31:36 UTC

Consensual searches — I have never understood why anyone says “yes”. Unsolicited general advice: Unless you call the police, don’t talk to the police. https://www.atlantanewsfirst.com/2024/11/21/justice-department-orders-all-consensual-searches-stopped-airports-after-anf-report/

2024-11-24 19:57:29 UTC

Oldie but goodie.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/539/694/531/236/155/original/f27c6465eaaaba30.png

2024-11-22 10:46:56 UTC

In my experience, at its very best, anti-phishing training serves only to maintain the fiction that users -- not leadership decisions not to invest in an effective security fabric -- are the problem. The cynicism of this industry and its customers knows no bounds.
Now come Ho, Mirian, Luo, Tong, Lee, Liu, Longhurst, Dameff, Savage, and Voelker with an empirical study, "Understanding the Efficacy of Phishing Training in Practice," whose stark coclusions include this gem:
“The absolute difference in failure rates between trained and untrained users is extremely low across a variety of training content. Users who receive and complete more instances of anti-phishing training can have an increased likelihood of failing subsequent phishing simulations."
But wait! It also finds that, in addition to making everyone hate security more because they're frogmarched into taking yet another stupid CBT course, there is “[n]o clear benefit from annual security training," as it pertains to users falling for phishing email.
Oh, you should read the pdf.
https://www.computer.org/csdl/proceedings-article/sp/2025/223600a076/21B7RjYyG9q - HT @npub1tw2…vs2v for the link

2024-11-17 10:05:22 UTC

No one knew how complicated politics was.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/497/730/070/664/154/original/aca359f43b7d4ae0.png

2024-11-10 08:35:46 UTC

35 years ago this morning I arrived in Berlin with a sledgehammer and was proud to take part in the destruction of the Berlin Wall.

2024-11-03 13:51:40 UTC

PLEASE RT THIS SO AMERICANS RESIDENT OVERSEAS LEARN OF A LITTLE-KNOWN WAY TO VOTE ABSENTEE AS LATE AS ELECTION DAY!!
I’ve mentioned here before how my Texas absentee ballot was, erm, never received by the Tarrant County Clerk. I gave a call to the always helpful AARO - Association of Americans Resident Overseas - and the always helpful staff there told me of something that, in 17 total years of living abroad, I never knew:
The US Federal Government provides what AARO refers to as an “emergency absentee ballot”. It is available online at https://www.fvap.gov/.
It is good for Service members, their families and overseas American citizens. You download the ballot, enter your personal information and your state, then the candidates for federal elections like President/Vice President, Senator, Representative; and even state offices you wish to vote for.
Print it out, follow the instructions. Go to your local post office and depending on your state, when you have it postmarked by Election Day it will (purportedly) be counted. Spell everything correctly. Be clear. Type if possible (the ballot may be filled in on your computer. Sign with a wet signature. Use the page provided to construct a security envelope. Put that in an envelope addressed to your district clerk (find it online).
Vote.

2024-10-31 12:24:38 UTC

- reply

I guess handgemacht has the same meaning but not the same problem. :)

2024-10-20 16:28:41 UTC

I cannot stop looking at this. HT @samim
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/340/798/069/184/032/original/19864a019a6be23b.jpeg

2024-09-19 15:42:06 UTC

“The people running this war can fuck things up all they want. And as long as we keep getting lucky and making it through alive, they'll just keep repeating the same mistakes.”
- Sergeant Larry Shawn ‘Pappy’ Patrick, Generation Kill, Episode 5, A Burning Dog
How might this quote be applied to the causes of technical debt? Use an extra piece of paper if needed.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/164/985/205/914/599/original/96a48320098ff9fb.png

2024-09-18 15:57:40 UTC

- reply

Read the indictment, there’s lots of actual evidence.

2024-09-18 06:16:01 UTC

- reply

Combs is charged with kidnapping, arson, bribery, witness tampering, forced labor, sex trafficking, transportation and inducement to travel for purposes of prostitution and other illegal sexual activities, possession with intent to distribute, or distribution of narcotics and controlled substances, including cocaine, oxycodone, alprazolam, 3,4-Methy lenedioxymethamphetamine, 4-Bromo-2,5-dimethoxyphenethy lamine, gamma
hydroxybutyric acid, and ketamine, and oh yes, racketeering.
Bury him under the fucking prison.

2024-09-18 06:13:47 UTC

And should you wonder whether Combs was actually engaging in human and sexual trafficking, consider this passage from the indictment:
"... members and associates of the Combs Enterprise helped conceal the violence and abuse by, among other things, assisting COMBS in monitoring and preventing victims from leaving locations, such as hotels or COMBS' residences. These occasions included instances in which a victim was required to remain in hiding-sometimes for several days at a time-to recover from injuries COMBS inflicted, without being publicly observed. Members and associates of the Combs Enterprise also assisted COMBS in locating and contacting victims who attempted to flee his abuse.
"[...] When COMBS' authority or reputation was threatened by the possibility of negative publicity or legal or law enforcement action against him, including in or about late 2023 following public allegations of COMBS' crimes, COMBS and members and associates of the Enterprise pressured witnesses and victims, including through attempted bribery, to stay silent and not report what they experienced or knew to law enforcement.
"On phone calls, COMBS and other members and associates of the Enterprise, among other things, provided these victims and witnesses with a false narrative of events in an effort to conceal COMBS' crimes. COMBS caused these calls to be recorded on at least two occasions."
Indictment, pages 8-9
https://www.justice.gov/usao-sdny/media/1368556/dl

2024-09-11 06:27:55 UTC

As a former law enforcement intelligence official who vehemently opposed (and still oppose) encryption back doors, I am quite concerned about how the widespread introduction of AI to mobile devices will negatively impact the privacy and security of our information. I have long been in solid agreement with [@matthew_d_green](https://ioc.exchange/@matthew_d_green ) on issues around lawful intercept and encryption back doors, and I agree that the threat of AI tools on phones is imminent; I also maintain that the issues society must now consider are different from those previously debated.
A fundamental difference between something like an encryption back door, and the ways in which government and law enforcement will soon seek (in the name of crime prevention and investigation) to leverage ubiquitous AI-on-mobile is the scope of undefinable areas in which we just can’t know how much AI tools can stray from vendor-stated purposes (through means like updates, or as a result of vulnerable or poorly-implemented or -designed code). I further believe that anyone who says that they do know this is, at best, misinformed.
Matt’s post is worth reading: https://ioc.exchange/@matthew_d_green/113113376375410848