Thomas Strömberg

KD4UHP - based in Carrboro, NC

#unix #infosec #bikes #carrboro #motorcycles #photography #hamradio

founder & principle eng @ isotope¹³, ex-Director of Security @ Chainguard & Xoogler

Pronouns: He/Him
Home: https://choosehappy.dev/
My all-consuming startup: https://isotope13.io/

Public Key

npub1mwgrtm0h3hnlfw9hvzqvhfchz9wzy2dvua0q6zr7lqwuxuu6hpms8xvjjk

NIP-05 Address

thomrstrom_at_triangletoot.party@momostr.pink

Profile Code

nprofile1qqsdhyp4ahmcmel5hzmkpqxt5ut3zhpz9xkwwhsdppl0s8wrwwdtsacpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dssdqkyr

Publishing to

nostr.wine

relay.damus.io

nos.lol

Author Public Key

npub1mwgrtm0h3hnlfw9hvzqvhfchz9wzy2dvua0q6zr7lqwuxuu6hpms8xvjjk

Show more details

Last Notes

2026-10-25 13:39:04 UTC

- reply

I should mention that Werewolf is *highly* experimental and still in a massive state of flux (especially on weekends, when I'm actively working on it!). I can't promise it will be useful yet, but it's a great demo of just how far one can go with reduction of attack surface.

2026-10-21 22:13:56 UTC

Since folks are asking: yes, all #isotope13 customers and open-source #atomdrift users were automatically protected from the #litellm supply-chain attack; with gap-free (0ms) detection that nobody else provides.
Still, not everything went according to plan - #postmortem coming soon.

2026-10-12 19:16:09 UTC

Just had a call with a prospect who found us because Claude informed one of their potential customers that our AI (#isotope13) had flagged their software as hostile. What in the 2026 world is this?
Also - it wasn't wrong. It was the classic problem of security scanners accidentally flagging other security scanners as malware. We ran into this a lot with Apple XProtect and #malcontent.

2026-10-09 13:17:28 UTC

So, I recently got nerd-sniped into making my own Linux distribution - focused on declarative security constraints - inspired by #OpenBSD, #NixOS, #Wolfi, #Alpine, and #CrOS - as well as processes like #SOC2 - focused on VMs. The idea is: if you don't declare the behaviors up front, it won't work - including malware and (most) kernel exploits.
I'm not ready to share it yet, but I'm curious - what gripes do you have with Linux distro's today?

2026-10-06 16:39:49 UTC

While working on GDPR/SOC-2 compliance paperwork for https://isotope13.io/ - I got nerd-sniped into making my own Linux distribution.
That's how much I hate working on compliance paperwork.

2026-09-18 02:18:46 UTC

In the 30 years since #Java launched, there has only been 1 attack in which a Java project has been compromised to distribute malware that didn't involve #Minecraft. It turns out that even malware authors have taste.
As someone who has studied every supply-chain attack where an official upstream distribution point was compromised, that's my fun fact to share.

2026-09-12 12:48:57 UTC

- reply

As someone who uses AI tools as a productivity crutch (with the excuse of a debilitating degenerative joint disease caused in part by decades of typing); I feel conflicted every day. I do think we're going to look back at this era though as somewhere between the Dada movement in Art, and the MCSE movement of ~2000 where people listened to radio commercials thinking they could get a high-paying job as a sysadmin just by taking some overpriced course.
It'll be interesting, nonetheless.

2026-09-12 12:39:03 UTC

I have listened to an unhealthy amount of #SkinnyPuppy this week. What have you been listening to? I could use a musical reset and welcome any suggestions.

2026-09-09 00:44:49 UTC

It's not every day that I get to show up my old friends at #Google so hard. This graph demonstrates #atomdrift's uncanny ability to detect 0-day #malware (median sample age 10 h, youngest 0.7 h):
https://cdn.masto.host/triangletootparty/media_attachments/files/117/238/312/888/208/170/original/f4c5e81216a27490.png

2026-08-15 16:50:26 UTC

There aren't many times when my work feels like the Matrix; but flashing the SPI on this Honeycomb LX2 comes pretty close (imagine output like this streaming for 20 minutes).
https://cdn.masto.host/triangletootparty/media_attachments/files/117/100/550/277/179/274/original/f7f1d8ba0b4472dc.png

2026-08-14 20:13:30 UTC

Multiple security vendors reached out this week about integrating #atomdrift.
One asked: "What are your project's principles?". So now we have some:
https://cdn.masto.host/triangletootparty/media_attachments/files/117/095/677/732/243/655/original/6b58ae1a2c1853c3.png

2026-08-07 17:45:11 UTC

In starting #Atomdrift - I've been driven by a single goal: reliably detect the next xzutils-style supply-chain attack, whether created by a human or AI. Our #Scan project was phase 1, and now we're looking for design partners for phase 2. If interested or just curious, DM me.
(Yes, this is a shitty LLM-generated image based on its design doc; plz roast)
https://cdn.masto.host/triangletootparty/media_attachments/files/117/055/456/944/545/128/original/a38aa2a363f2f4c8.png

2026-08-06 22:07:22 UTC

As much as I dislike whoring myself out like this, I could use some help!
#atomdrift just relocated from codeberg to github; so all of our "stars" reset. If you have a GitHub account, take a moment to star our project: https://github.com/atomdrift-project/scan - for better or worse, folks use stars to determine whether a project is worthwhile; this one certainly is.

2026-07-24 12:41:42 UTC

I've been trying to stay quiet about it over vacation, but I'm damned impressed with how #atomdrift is showing up in the malware detection charts. Nothing comes close to it for #supplychainsecurity. Have a question? Leave a comment.
https://cdn.masto.host/triangletootparty/media_attachments/files/116/975/003/048/418/417/original/a8e2f4de0c86f04a.png

2026-07-24 10:01:43 UTC

I've been lazy about blogging this year, but the recent #Codeberg announcement banning LLM-based projects triggered me: https://choosehappy.dev/posts/2026/so-long-codeberg-and-thanks-for-all-the-fish/
[no AI was used in writing or editing this post]

2026-07-06 07:06:47 UTC

Things are not looking so good for the Linux box that serves the #atomdrift API for serving, foraging, and generally managing sample files.
Definitely a shame to be 7000km away from the power button for the next 3 weeks, as it doesn't respond to soft reboot requests.
Kinda wish I'd gotten around to enabling remote ZFS snapshots before I left. 🤦
https://cdn.masto.host/triangletootparty/media_attachments/files/116/871/748/416/262/907/original/b12897da7f7a2406.png

2026-06-22 17:56:29 UTC

TFW when you need to quadruple the storage on your machines because your open-source project is finally successful.
On that note, https://lab.atomdrift.org/ will be down for the next couple of hours so I can upgrade our #OmniOS #PostGreSQL master & #FreeBSD frontend replica to 4TB of NVME so that the drive doesn't fill while I go on vacation.

2026-06-18 12:13:42 UTC

- reply

https://lab.atomdrift.org/ is almost certainly one of them, but we don't poll as aggressively as some. I hadn't considered what it would do to download counts.

2026-06-09 22:17:28 UTC

- reply

Yeah, evidently it would take too much load on their system :(

2026-06-09 21:40:16 UTC

- reply

Oof, that reminds me of having a discussion with Rapid7 when we were SIEM searching.
At the time, their platform had bare-minimum built-in rules for macOS endpoints, so I figured we could just port them via Sigma - except they had some absurdly low limit like ~30 custom rules allowed.
I was told I could possibly get an exemption for ~70. Like, what in the actual fuck?

2026-05-29 18:43:13 UTC

- reply

obligatory htop screenshot.
https://cdn.masto.host/triangletootparty/media_attachments/files/116/659/335/184/028/717/original/12f625e489a585c1.png

2026-05-29 18:09:04 UTC

128 ARM64 cores {Altra Max}, 256GB of RAM, 24 hot-swappable NVME drives; definitely the craziest machine I've ever built. Holy hell, this one is fast #FreeBSD box though.
Why not just rent from the Cloud? After just 33.8 days, the hardware pays for itself versus the equivalent from GCP. That's insane.
https://cdn.masto.host/triangletootparty/media_attachments/files/116/659/199/831/176/650/original/4e7d467d7c331ae3.jpg
https://cdn.masto.host/triangletootparty/media_attachments/files/116/659/200/595/123/837/original/80096e768131a91c.png

2026-05-25 16:36:02 UTC

Beware of geeks bearing gifts; or in this case, npm packages containing reverse-shells (system-user-identifier-cli). It's an trivial find, but a decent demo to show how our open-source detection factory is coming along: https://atomdrift.org/discoveries/2026/05/system-user-identifier-cli/
https://cdn.masto.host/triangletootparty/media_attachments/files/116/636/185/909/178/349/original/3ce3100f61dbe34d.png

2026-05-12 01:00:06 UTC

I always felt like IBM/Lenovo made some of the ugliest computers ever; but damned if their hardware engineering wasn't amazing.
Still, PS/2 ports on a board alongside 10GbE ports is weird as hell.

2026-03-10 21:36:53 UTC

- reply

Probably not - it's running #illumos at the moment :)

2026-03-10 21:19:50 UTC

One of the biggest component upgrades I've ever done: from a 4GB GPU to 96GB. It feels weird to hook such an overpowered beast to a JetKVM rather than a monitor.
https://cdn.masto.host/triangletootparty/media_attachments/files/116/206/963/355/882/552/original/a644de48e05d93fe.jpg

2025-11-02 01:25:35 UTC

- reply

Just curious? What did you hit?
I'm of the opposite opinion at home - I'd rather not have the complexity of keeping their admin interfaces secure (no code to patch; no code to maintain) - I'd adwittedly feel differently in a professional context.

2025-09-15 15:15:53 UTC

The recent NPM compromise highlights a frustrating reality: the security tools exist, but nobody uses them.
I had planned to keep my mouth shut about the affair, but someone DM'd me to ask if the supply-chain attack detection tools I created and open-sourced while at #Chainguard would have caught the attack. Yes—both malcontent and ucd detected it; the latter with surprising precision. [1/3]
https://cdn.masto.host/triangletootparty/media_attachments/files/115/208/965/088/856/657/original/f1acf519b0cf88f5.png

2025-07-24 22:31:26 UTC

- reply

It probably won't help you, but it's worth knowing that https://github.com/rusq/slackdump exists. :)

2025-07-16 01:10:44 UTC

After two weeks of non-stop #AI usage to get my startup off the ground, I'm finally starting to see the cracks in the facade.
It's been great for rapid prototyping in a way that doesn't irritate my osteoarthritis, but asking LLMs to maintain complex state machines is like asking a toddler to clean the house. Both take forever to get anything done, but with AI, entire rooms may suddenly disappear just because you asked it to put away the laundry.

2025-05-13 17:34:16 UTC

That feeling when your employer decides to pay another company to maintain an OSS tool you donated to them and were subsequently banned from contributing to. Ugh.
I hope I can find it a nice home.

2025-04-23 16:42:55 UTC

Step 1 in my my bee-inspired home office rennovation.
https://cdn.masto.host/triangletootparty/media_attachments/files/114/388/275/580/601/566/original/f5dd7d4aad8baf93.jpeg

2025-03-14 01:08:56 UTC

- reply

Coaxing Gemini into emulating BeOS is like dragging a cat around the neighborhood. It really really doesn't want to. As soon as you get it to realistically emulate one command, another mysteriously breaks.

2025-03-13 22:07:36 UTC

For reasons that defy explanation, I placed another weird artifact on the Internet (try it! there is no ssh password).
https://cdn.masto.host/triangletootparty/media_attachments/files/114/157/396/967/500/656/original/8c772dcc4f87e955.png

2025-03-10 14:35:55 UTC

While battling RF noise for my new #hamradio shack - I learned more about RF interference than I will ever retain: http://k9yc.com/RFI-Ham.pdf
If nothing else, it helped me to understand the necessity of a common ground and why you probably shouldn’t place a transceiver against an Ethernet switch.

2025-01-23 20:02:39 UTC

Stolen shamelessly from Reddit.
https://cdn.masto.host/triangletootparty/media_attachments/files/113/879/450/215/654/208/original/f03f38eff4c5ff3d.webp

2025-01-19 15:58:21 UTC

- reply

I depend on Security Keys for the systems that support it - which is great as long as you have a plan for when the keys break (every 4-5 years in my experience, if you travel with them).
I decided to store backup codes this time around, but am trying Ente out for 2FA management. I like having my passwords & 2FA managed by separate apps to lessen my exposure when one gets compromised. It sounds annoying, but in practice I only use TOTP keys ~once a month.

2025-01-19 15:44:30 UTC

Moving all my #2FA keys away from #Authy was not the nightmare that I thought it would be: only about an hour of work.
Not only did I miss having a desktop app, but I had forgotten my Authy password and was down to 1 logged in device.