Tarah Wheeler

♦️ CSO of TPO Group ♦️EFF Board Of Directors♦️US/UK Fulbright Scholar in Cyber Security ♦️ Formerly Harvard, Brookings, Splunk, Symantec. ♦️she/her curmudgienne♦️standard disclaimer regarding personal opinions.♦️Searchable. t AT tarah DOT org

Public Key

npub1wymfdtxa5s0s9n9qg6erez8uajdzt0tknceqkfnmk83vxkl029xqj2dmr0

NIP-05 Address

tarah_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs8zd5k4nw6g8czejsydv3u3r7wex39h4mfuvstyeamrckrt0h4znqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsppyw46

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1wymfdtxa5s0s9n9qg6erez8uajdzt0tknceqkfnmk83vxkl029xqj2dmr0

Show more details

Last Notes

2026-09-05 14:37:33 UTC

Just a weekend thought, apropos of nothing. There have been a lot of times I've been angry at not being included in something I was qualified for, and that anger is worse when it's clear that I've been actively *disincluded* for being a woman. I mostly convert that rage into Achievement Fuel, but it also hurts to see it happen to other women.
When some group or launch or listicle is billed as a gathering of high achievers or the stars of the industry, and it's a dozen or more white men, any woman or person of color who speaks up faces a double challenge. Are they speaking up because they're sour grapes over not being invited? Or are they not collegial or easy to get along with, as made evident by the fact that they're calling out injustice?
If you're a man who finds himself on a manel, speak up. If you're a white woman and you find yourself on a panel of nothing but white women (oh lord, ask me about the egg on my face on this one), speak up. Or better yet, check in advance that the convenor or organizer didn't make a serious mistake without realizing it.
There's room for grace over people's mistakes, but there is no room for not admitting you made one.

2026-09-05 08:45:34 UTC

For all incident responses from now on, I’m going to get on that Zoom call at 2am and begin by saying “Please state the nature of the computational emergency.”

2026-08-28 15:54:17 UTC

Please share: Can someone with the print edition of the Financial Times in the US check to see if my piece is in it and save one for me?
so I have a new op/ed out where I am Big Mad about the have-nots in critical infra, and if it's in the paper version, I would love it if someone would get it for me? I'm in the UK and can't get it myself :/
https://www.ft.com/content/3f154376-fd8b-4255-ac5b-538c5e90fc40
(ain't no thrill like the thrill that'll gitcha when ya getchur picture on the cover of a Rolling Stone ROLLING STOOONNNE gonna buy five copies for my mother)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/173/933/273/169/263/original/a60404f016122219.png

2026-08-07 01:39:12 UTC

Orrrr how about you GFY.
Hacking is a set of survival skills. I am not a computer criminal, I use my skills to help people, and my only crime is that of curiosity.
(Everything else is past the statute of limitations.) #defcon
Thanks and credit to @npub17zx…ecpk for the photo
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/051/659/469/472/343/original/ae209fad766c6a26.png

2026-08-05 22:07:15 UTC

Best damn meme deployment in a MINUTE. Listen up to @npub1g3n…kzaf https://ciaranmartin.substack.com/p/control-ownership-perspective and you should be subscribed to Ciaran’s newsletter.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/045/168/955/960/201/original/413b672737c3baea.png

2026-08-03 20:31:42 UTC

This Friday at DEF CON I host the @npub1m24…d9a3 Poker Tournament, and novices are especially welcome.
We play Fri Aug 7, noon to 3, at the Horseshoe Poker Room in Vegas, with my dad running a beginner clinic at 11. This is not the ESPN boys' club version of poker. The room is safe, surveilled, and respectful, and the dealers are briefed to teach, not judge.
Your buy-in donation is also a full year of EFF membership. Send eff.org/poker to one curious friend.
#DEFCON #EFF #Poker

2026-07-21 01:49:41 UTC

I have a suggestion for folk watching The Odyssey. Treat it like a rock concert and wear earplugs. After the first three minutes I put them in and I heard dialogue much better. The music is So Loud in it, and the dialogue is more intelligible when you’re not wincing.

2026-05-19 19:28:18 UTC

Does anyone have any decent EDR running on an Apple Neo? Logging? I have a small nonprofit org that wants to roll out a fresh fleet of 15 Neos and the arm64 chip in the Neo isn't the same series as the M. I'm looking for actual A18 Pro / MacBook Neo validation, not "it should work" because I've already got Claude telling me "it shoudl work fine" and that reality is not manifesting for an MSP I know working with this issue.

2026-05-12 13:48:28 UTC

Happy ninth anniversary of my-butt-is-numb-and-I-haven't-moved-in-thirteen-hours-and-the-purple-and-orange-carpet-of-this-Orlando-convention-center-is-my-new-home-and-everyone-around-me-has-sunk-to-the-ground-and-everyone-at-this-infosec-con-are-all-sharing-power-outlets-and-cannibalizing-each-others-analogies-for-our-bosses-who-don't-know-what-the-red-screen-means-and-think-the-name-ShadowHunters-is-some-science-fiction-shit-we-all-made-up-and-this-is-so-much-worse-than-we-can-explain-and-oh-god-those-poor-people-in-England day.
#WannaCry 12 May, 2017.

2026-05-08 20:01:30 UTC

@npub19zc…jfcm is in the middle of an active incident. Issuance of new certs has ceased. Heads up. https://letsencrypt.status.io/

2026-04-21 06:07:51 UTC

No, you did not send a numeric code to my email to help me sign in "for my security." You did it because you couldn't be arsed to implement proper app-based authentication.
Control of any email address collapses down to a single factor for authentication. Do better.
#TuesdayCyberGrouse

2026-04-08 17:33:32 UTC

- reply

v interested in this one

2026-03-08 10:44:21 UTC

RE: https://recurse.social/@lindsey/116189776923604763
It’s the same thing many techbros were saying out loud when they founded gig economy companies to do their laundry, cook their food, handle their errands, and clean their homes: “now that I have $app, I don’t need a mom/wife/gf to do it anymore.” It tells you what they thought women were for, all along.
#note1z7k…cd8h

2025-12-28 17:14:08 UTC

PLEASE SHARE: Folks, I need *public domain* or *purchasable stock imagery* photos of especially older women holding signs in protests that essentially say "I can't believe I still have to protest this shit". They *cannot* be CC-licensed - they either have to be public domain or licensed for royalty-based purchase since they'll be in an e-book.
This is an excellent example from Shutterstock: https://www.shutterstock.com/image-photo/older-woman-holding-sign-that-believe-1632293194
And here's another good example from Alamy: https://www.alamy.com/womens-rights-equal-pay-for-women-rally-trafalgar-square-london-england-image62186118.html
What I really, really want is an image I can be sure is from 1912 but if you have any favorite images, show me?

2025-12-23 12:35:54 UTC

So I hacked my way into being Cyber Policy Initiative Senior Fellow at the University of Chicago's Harris School of Public Policy. I'm workin on rural water critical infrastructure cybersecurity.
Do you even hack utilities? Please chat w me. I need to quickly find out where I"m wrong about some of my assumptions.
Still very entertained by the fact that I *finally* got into the University of Chicago. :D
https://cpi.harris.uchicago.edu/2025/12/23/harris-cyber-policy-initiative-taps-top-hacker-to-design-new-security-model-for-water-utilities/

2025-12-11 15:08:46 UTC

If you have a risk register, and your organization does not have an SBOM for your built apps, the lack of an SBOM goes in your risk register. If you don't have a risk register, make one, and add your lack of SBOMs to it.

2025-11-18 20:30:39 UTC

I do this ish for a living, I am an AI developer and researcher, and *I* don’t fully understand the security implications. What hope do regular users have?
https://www.windowscentral.com/microsoft/windows-11/microsoft-warns-security-risks-agentic-os-windows-11-xpia-malware

2025-11-07 15:01:40 UTC

Good news, everyone! The password has been updated to "LouvreWinter2025!" and is now compliant with our password change policies.

2025-08-08 22:14:52 UTC

American critical infrastructure is ten thousand small businesses in a trenchcoat.

2025-08-03 22:14:31 UTC

On my way. #hackersummercamp #defcon #blackhat
Your only guarantee to see me is at the @npub1m24…d9a3 poker tournament. Come one, come all. EFF.org/poker
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/967/134/522/259/038/original/25b7b8ea7e3675cf.png

2025-07-24 01:51:49 UTC

Me, at lunch:
*walks into bodega with screaming fire alarm going off in building*
*shops for sandwich and Monster*
Clerk: “don’t worry about the alarm; it’s just a test.”
Me, dead-eyed, mid-cyber incident response: “I don’t care.”
*exits stage left, pursued by a Jira ticket.*
Yes, it really happened. I recommend the Knuckle Sandwich with pork and jam.

2025-05-19 23:04:44 UTC

“Fuck you, I won’t do what you tell me” I whisper quietly so I don’t disturb the neighbors after hours while I’m processing payroll expense reports.

2025-04-15 04:45:36 UTC

It does bear repeating that “the only unhackable computer is one that’s running a secure operating system, welded inside a steel safe, buried under a ton of concrete at the bottom of a coal mine guarded by the SAS and a couple of armoured divisions, and *switched off*”.
~ @npub1dnd…hzjs

2025-04-14 20:19:02 UTC

Today I explained a potential audience for a tech policy talk to someone as "The Establishmen" and I stand by my typo.

2025-04-14 16:22:10 UTC

Story time: This weekend, someone thought they could harass or hurt me by adding my Wikipedia page to the "Transgender Women Writers" category. You can see that here:
https://en.wikipedia.org/w/index.php?title=Tarah_Wheeler&action=history
But there's an interesting issue here. You can see that immediately upon a change like this to a Biography of a Living Person page, Wikipedia automatically appends a tag cautioning that being added to a “trans” category might be “vandalism.”
How fascinating that the act of adding someone to a category about being transgender is so problematic that it requires an automated vandalism tag.
Now, I don't think you can *accuse* someone of being something that it's not wrong to be. Wikipedia has an accuracy problem, for sure. I don't actually happen to be trans, but I strongly object to the idea that being labeled as trans is something of which to be ashamed, or which must be concealed.
I'm a lot of things. I'm an international hacking champion, a cybersecurity expert, a polyglot, a tanguera, a best-selling author, a well-paid keynote speaker, a public company executive, a foreign policy expert, a WSOP-cashing poker player, a cyberwar scholar, an essayist, a martial artist, a board of director member, an audiobook performer, and a lot of other things that tell you that I’m a congenital overachiever. Two nights ago a woman at a bar hit on me by saying I had a cut-glass jawline, which I found extremely flattering.
So, I'm just. flat. better. than lackluster men online trying to shame me by "accusing" me of something that isn’t wrong. Plus I wear a fedora with superior style.
In related news, feel free to edit women’s Wikipedia pages to add things they have actually done, instead of letting these incels make women’s public personae solely about their own threatened egos.

2025-04-13 02:17:47 UTC

I protest.
https://www.thetimes.com/world/europe/article/diet-worms-climate-change-france-wcsxtr2jj#:~:text=Crunchy%20worms%20au%20paprika%2C%20carrot,and%20other%20leading%20French%20chefs.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/328/250/336/291/547/original/1a677a7c48f92312.png

2025-04-09 16:29:17 UTC

Gentlemen, I appreciate that courtesy isn't dead, and modesty won't forbid me from acknowledging that I look like a total smokeshow today but I beg you to cease holding doors open for me into secured facilities.

2025-04-07 18:30:33 UTC

"what's their email address?" IDK
"what's their phone number?" IDK
"what's their last name?" I don't even know their first name
"I thought you said this was a good friend. What *do* you know?"
I have their Signal handle, their hacker name, and a raft of questionable collaborative activities. #BFF

2025-04-03 16:57:13 UTC

Paste your favorite one liner that also says something about you as a person:
for f in *.flac; do ffmpeg -i "$f" -ab 320k "${f%.flac}.mp3"; done

2025-03-28 03:08:02 UTC

Was doomscrolling and husband says “name some Wayne Enterprises executive who isn’t Lucius Fox and is also kind of sleazy” and I instantly perked up and said “William Earle, at least until the stock buyback” and then realized I’d been nerdsniped. Excellent husbanding, top marks, ⭐️ ⭐️ ⭐️ ⭐️ ⭐️

2025-03-27 04:43:15 UTC

Dark have been my memes of late.

2025-03-19 23:23:20 UTC

Absolutely chuffed to hear that I'll be presenting at @npub1j3q…nnx8 with my good friend Dr. Jon Martin @npub1wch…spkp. He's the digital archivist for the University of Cambridge. We'll be talking about the creation of digital monasteries to preserve knowledge in this age of #enshittification.
Knowledge exists, but it's retreating behind bullshit paywalls, subscriptions, and segmenting into "content" based on its format, instead of being freely circulated online. Jon and I will talk about the history of this new Digital Dark Age, organizations doing good work, and some TTPs to join the good fight!
Thrilled to see @npub1s7c…rcqn @npub1udn…3tjr keynoting, and folk like @npub14ta…8a7c @npub1ly0…d6he there as well!
https://www.bsidesseattle.com/2025-schedule.html

2025-02-24 04:33:45 UTC

Slack channels can be 80 characters and "these-trivialities-demean-me-i-must-away-and-tend-to-my-ravens" is only 62 characters.
Do with this knowledge what ye will.

2025-01-24 21:26:26 UTC

I say this as a CEO: From now on, when children’s health data is compromised because multi factor authentication was not enforced, fire the CEO, not the CISO. I mean, sure, fire the CISO as well, but the CEO bears the responsibility. An update on the PowerSchool breach from the ever-incise @npub1z3l…qvzu https://arstechnica.com/security/2025/01/students-parents-and-teachers-still-smarting-from-breach-exposing-their-info/

2025-01-03 01:36:08 UTC

I know some truly wonderful infosec journalists but here's a thing I need help with: currently, there are essentially *no* news stories out there about MSPs, small business cybersecurity - anything really meaningful beyond "here's a puff piece on a commercial white paper that did sentiment analysis on 70 small biz owners and they're all scared of furrin hackerz" or PR releases on "Google just bought an MSP in Indonesia".
Is there a cyber journalist with a beat that doesn't focus on the big gov and F500 stories?

2024-12-30 01:27:24 UTC

New Year’s resolution: when I’d like a table in a restaurant, I am alone, and I’m asked by the host “is a seat at the bar ok?” I will practice saying “No” as a complete sentence without apology.

2024-12-27 16:13:12 UTC

Clicking on a phishing email is not an “advanced cyberattack.” https://therecord.media/cyberhaven-hack-google-chrome-extension
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/725/668/600/333/136/original/ad864a5bef77ddc3.png

2024-12-23 06:09:20 UTC

It absolutely does not matter what movie, miniseries, Tv show, or play: whatever scene-chewing dame extraordinaire is playing Catherine of Aragon, she is going to steal the whole ass show from whoever is playing Henry VIII.
Tell me I’m wrong.
What’s more; this fact is not only a comment on the staggering imbalance of the relative maturity and political capability of the actual Queen Catherine at the time, but a meta commentary on the level of effort required to succeed as a woman past 40 in acting compared to her male contemporaries.

2024-12-15 01:51:04 UTC

I am a pilot and I am begging you: do not shine lasers at things in the air. You can kill us by blinding us at night. You’re not detecting UFOs; you’re blinding women like me driving beater SkyToyotas, animal rescue pilots, and Angel flights bringing rural cancer patients to hospitals.

2024-12-10 18:07:48 UTC

I'm just preemptively starting every conversation now with "say 'potato'".

2024-12-05 21:45:06 UTC

This is Donation Week, and I want to see your Signature, Technical, and Showstopper donations as our @npub1m24…d9a3 Attack Lawyers defend your rights in a battle for the ages.
Welcome to the Electronic Frontier Foundation.
https://eff.org/angrydollars

2024-12-04 00:37:55 UTC

Oh goodness…schadenfreude? For MEEEE? You shouldn’t have.
No, really, you shouldn’t have. You should have been listening to us all along when we told you this would happen. A lot.
https://www.nbcnews.com/tech/security/us-officials-urge-americans-use-encrypted-apps-cyberattack-rcna182694

2024-11-28 02:14:53 UTC

oh my god this is a utter #infosec banger and it should be heard by every #SOC this wknd
"CISO doesn’t have a clue.
No idea what to do.
He designed our security plan
though he's fallen for every scam
Writes backups straight to tape drive
His password is 12345"
https://www.youtube.com/watch?v=PbD4Q4Z1wwA

2024-11-01 23:27:28 UTC

In a world where enough women are searching “can my husband find out who I voted for” to make it trend in search engines and social media, there should never be a question again about the value of and right to end-to-end encrypted and private personal communication.

2024-10-10 00:20:40 UTC

Good evening to everyone except the excrement who just hacked the Internet Archive.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/280/261/284/875/430/original/2cbd2232d30ef011.png

2024-09-26 13:42:00 UTC

Biden is shipping four more free Covid tests right now. https://special.usps.com/testkits

2024-09-21 18:54:35 UTC

John Mulaney just absolutely burned Dreamforce to the ground. No crumbs.
“You look like a group who looked at the self-checkout counters at CVS and thought, ‘This is the future,’” Mulaney said.
“The fact that there are 45,000 ‘trailblazers’ here couldn’t devalue the title any more.”
https://sfstandard.com/2024/09/19/comedian-john-mulaney-brutally-roasts-sf-techies-and-ai-at-dreamforce/

2024-09-16 00:04:21 UTC

Dear internet: I would like your favorite movies about women overcoming huge/galactic obstacles. Those obstacles should not be dudes.
Good example: Gravity
Bad Example: Kill Bill

2024-09-09 23:55:42 UTC

This is a day where I’m LinkedIn-discovering a lot of people who are claiming to be cyber experts who’ve never held any role other than government policy or investment.
It vexes me when I’m brought in to mop up a situation created by people who’ve never touched a keyboard and yet somehow have been appointed to roles running government cyber policy development. I am greatly vexed.
Ask civil engineers who have built a bridge before making transportation budget policy. Ask doctors who have called a time of death before making medical policy. Ask survivors of abuse before making victim protection policy.
For heavens sake, ask a person who’s hacked a system before making cyber policy intended to fight cyber crime.
EDIT: if you’re in government and reading this and wondering if I’m subtooting you, I’m not. Anyone I’m talking about hasn’t ever heard of the fediverse 🙃🙃🙃 and I am absolutely shading them.

2024-08-27 04:04:01 UTC

I was talking to someone today who only knows Michael Sheen from Good Omens and his pandemic videos with David Tennant. All yall Gen Z babies who think Michael Sheen is an adorable blonde angel—you didn’t know Lucian. If you haven’t seen Underworld, I suggest you expand your horizons this lovely Halloween season. Bonus: Bill Nighy toothily fanging the scenery beyond all hope of dramatic redemption.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/031/981/884/511/051/original/3ff873e4a8b06702.png