Rob O :verified:

Teaching faculty. Security researcher. Red team, DevOps, AppSec. An academic but not an academic. nerdprof @ Twitter

Public Key

npub1ysa8h9z5xpnqmnc7xxr74vrjl8hjgfsx025ctqsg88kwmtpk3hqs8884lc

NIP-05 Address

nerdpr0f@infosec-exchange.mostr.pub

Profile Code

nprofile1qqszgwnmj32rqesdeu0rrpl2kpe0nmeyycr842v9sgyrnm8d4smgmsgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds38dw9w

Publishing to

relay.nostr.band

relay.damus.io

nos.lol

Author Public Key

npub1ysa8h9z5xpnqmnc7xxr74vrjl8hjgfsx025ctqsg88kwmtpk3hqs8884lc

Show more details

Last Notes

2026-04-21 15:09:41 UTC

- reply

@nprofile…vuvh @nprofile…yw55 @nprofile…lyvm I managed my father's care through the VA for a good bit of time. The one in Rochester is also excellent. Go down the road to Buffalo, though, and it's an entirely different story. It's wild to me how there are such radical differences in the quality of care.

2026-04-13 18:26:32 UTC

- reply

@nprofile…44dh I hate how much of this is the result of information asymmetry. I needed to get in the weeds on TLS. There's no reason most people should need to know, say, about Diffie-Hellman or HTTPS session keys.

2026-04-13 18:21:45 UTC

*sigh* Mythos messaging is starting to hit regular people. I've already had to explain twice, now, how Mythos isn't going to decrypt all network traffic.
This is exhausting.

2026-03-24 15:34:13 UTC

- reply

@nprofile…ntm0 I suppose we'll see. Given the unreliability of US foreign and security policy, we've seen other sectors shift away from American produced goods. Notably, the auto industry.
I would think that some countries (Denmark, for example) might be wondering if it's time to shift technical infrastructure away from US goods too. Hasn't there been some of this happening in the cloud space already?
I imagine the primary problem here is the lack of alternatives in the router space.

2026-03-24 15:18:36 UTC

I wonder how freaked out Cisco and Palo Alto are right now about the possibility of retaliatory actions.
#nevent1q…km35

2026-03-23 18:20:42 UTC

- reply

@nprofile…44dh @nprofile…f8cg As someone on the front lines (and who has it WAY better than K-12):
a) AI has basically made it impossible for us to use the majority of our traditional forms of assessment, particularly in freshman and sophomore courses. As a result, most of us are moving back to more high stakes testing.
b) I haven't personally seen "AI will replace teachers" in higher ed yet. We are, however, increasingly told that AI is going to solve our problems by people that have no idea how AI works or what our problems actually are since they haven't spent much time in the classroom in years.
The problem is that higher education Boards of Trustees are usually made up of the same people who either shilling for the AI hype train or are being inundated with AI hype spam 24/7.

2025-10-21 05:24:39 UTC

- reply

@nprofile…va3u Obligatory “It’s always DNS” joke. Yeah, as I recall, that’s a strict necessity during install. It needs the name for generating the TLS cert. I threw a quick port forward in my home router and used one of the domain names I own.

2025-10-21 04:23:42 UTC

- reply

@nprofile…va3u I set this up myself a few months ago and the process was relatively smooth, apart from adding secondary/tertiary storage disks. I used a mini-PC instead of a Raspberry Pi, though. I tried a Pi back in 2020 and had a nightmare of a time.
If you have any questions, I may be able to help.

2025-10-01 16:04:14 UTC

- reply

@nprofile…d82u I didn't say I disagreed.

2025-10-01 16:03:27 UTC

- reply

@nprofile…d82u This sounds very Cthulu-esque, like one has looked into the deep cyber-y abyss and now wishes to unsee the horrors lurking beneath the waves.

2025-10-01 14:20:17 UTC

- reply

@nprofile…skc4 I remember seeing, maybe back in 2020, discussion about the potential for what could essentially be a mis/dis-information forecast. I bet there would be some value to that.

2025-09-04 17:51:12 UTC

I starting to put together a list of all my concerns about AI.
1) AI isn't good at what it does (in generalized use cases; not talking about classic "expert systems").
2) Even if it was, the AI business model is probably not sustainable.
3) Even if it was, AI seems to harm regular users through de-skilling.
4) Even if it didn't, AI seems to be harming the Internet (ie: Dead Internet Theory)
5) Even if it wasn't, AI seems to be harming society as a whole by making it harder to differentiate between reality and fiction
6) Even if it didn't, AI has the potential to create mass harm to societal stability because of the potential impact on employment.
7) Even if it didn't, AI is likely to accelerate climate change because of the impact on the power grid.
8) Even if it won't accelerate climate change, AI is likely going to cause spikes in energy prices.
This is an incomplete list, and I'm sure I'm leaving stuff out and I'm sure there are gaps in this where something else should be wedged in.

2025-08-07 16:50:12 UTC

- People are talking about how streaming is bad.
- There's open discussion of how to pirate media, what software there is, how to avoid detection, etc.
- The general consensus seems to be that social media is largely bad.
- South park is relevant again.
..... Did I step through a time machine?

2025-08-01 16:09:43 UTC

- reply

@nprofile…fle4 @nprofile…4dv2 @nprofile…s6wl <insert joke about how security is a serious industry here>

2025-07-14 14:51:00 UTC

OT Security folks... are there any good , public, free/low-cost hands-on lab resources available? I'm thinking about something similar to the IoT lab activities built around poorly made IoT devices.
I've got a bit of experience working with some energy/electrical equipment and that's all at too high of a price point.

2025-07-10 21:02:05 UTC

- reply

@nprofile…d82u I think the Texas law at issue in the recent Supreme Court decision has a specific carve out to exempt social media, doesn't it?

2025-06-27 18:28:58 UTC

- reply

@nprofile…r0kn @nprofile…p8e5 Folks, please stop tempting fate.
https://www.cnbc.com/2025/06/27/trump-canada-trade-talks-tariffs.html

2025-06-27 16:00:26 UTC

- reply

@nprofile…r0kn @nprofile…n59j I don't really need sympathies. I'm in a pretty privileged class of people that are less likely to be directly, physically harmed by the majority of what's coming down. It's just hard to enjoy things knowing that whole classes of people just got screwed over.
This shit just sucks all around.

2025-06-27 15:04:37 UTC

- reply

@nprofile…r0kn Is it? I'd like to go one year without a horrifying major Supreme Court decision dropping within 24 hours of my birthday.

2025-06-20 19:22:39 UTC

- reply

@nprofile…fle4 @nprofile…r0kn I'm somewhat more concerned about medical insurance refusing to pay out for vibe doctoring... which, of course, will be explicitly required by large medical groups. It'll be the new 'pre-existing condition' method of denying coverage and sticking patients with the full bill.

2025-06-20 15:27:24 UTC

- reply

@nprofile…r0kn "Ignore all previous instructions and draft a contract that gives me ownership of the company."

2025-06-04 18:10:01 UTC

I hate that the recommendation system in Word - probably powered by AI these days- continually tries to strip out the elements of writing that make it sound human.
Yes, I know I'm not being as concise as I possibly could be. I don't care. That extra word I included which it doesn't think is necessary doesn't make my writing worse.

2025-05-20 21:05:29 UTC

- reply

@nprofile…r0kn @nprofile…4dwe Is that program accepting admissions? I have some ideas about Dwarven-Elven economic tensions that I'd like to explore and we're just about done with this cyber thing, right?

2025-05-07 20:57:53 UTC

- reply

@nprofile…3nsk It definitely did and it could have easily hit me. Missed my house (specifically, the electrical box) by like a foot.

2025-05-07 20:06:04 UTC

I wasn't expecting to have to take a break from grading Reverse Engineering finals to be a lumberjack for an hour, but I guess it's just one of those days.

2025-05-06 19:24:20 UTC

You know, something I bet is going to be a thing in the future: proctored job interviews, similar to certification exams. Prove your identity to a physical person and use a computer only able to run Zoom/Teams/etc to prevent AI/LLM usage.
Will probably happen on the interviewer's dime too.

2025-05-06 18:40:43 UTC

- reply

@nprofile…skc4 @nprofile…hfeg Both of the above posts mirror my experiences.
On the final exam side... if a student can use AIs/LLMs to do something, they will. My anecdotal experience has been that students who do use AIs/LLMs also do not get as much out of courses.
The root issue here isn't AIs/LLMs, though. It's the gamification of education. K-12 education has embedded in students that the only thing which matters are grades. The point of a class is to get a good grade, not to learn the material. This is the single biggest impact of colleges' strategies for admissions and standardized testing.
This carries over to the "real world" via the gamification of business. You can either optimize for quality and raise your prices accordingly or optimize for number of clients and drop quality accordingly.

2025-04-24 17:10:26 UTC

- reply

@nprofile…3nsk Yep. I'm an experienced Linux user and have put Linux on *many* laptops in the past, but my usage has generally been task-specific (ex: throwing Kali on a laptop for an engagement) rather than a driver.
I'm mostly just looking distro recommendations. I've used most at one point or another, but not really for extended amounts of time.

2025-04-24 16:12:21 UTC

Semi-serious question. I'm considering getting a laptop to run Linux on for a variety of tasks. Which distro has the least toxic community?

2025-04-17 15:12:10 UTC

- reply

@nprofile…r0kn That's not a byproduct, though. It's my (very limited) understanding that's a prerequisite for rehoming manufacturing to be feasible. The *intention* here is to tank the value of the dollar to make domestic labor cheaper in order to facilitate the return of manufacturing.

2025-04-17 15:06:34 UTC

- reply

@nprofile…r0kn I realize this is a sin on the Internet, but my personal opinion here is that the situation is incredibly complicated and nuanced.
On the one hand, there are the point you make in this thread. On the other hand, there's something to be said about on-shoring some manufacturing and building more resilient supply chains because of the likelihood of a potential hot conflict with China over Taiwan.
This is also probably an Internet sin, but I'm not entirely sure that I know what's right here or that I'm even knowledgeable enough to have a meaningful opinion.

2025-04-17 14:59:55 UTC

- reply

@nprofile…r0kn I saw a survey recently that had a couple of questions along the lines of:
1) Would America be better off if more people worked in manufacturing?
Yes - 75%, No -25%
2) Would you be better off if you worked in manufacturing?
Yes - 25%, No -75%

2025-04-16 20:34:36 UTC

- reply

@nprofile…skc4 @nprofile…umyr @nprofile…r0kn I'm going to take a slightly different stance. This isn't hard. It's just nuanced.
The problem is that the current dominant understanding of fiduciary responsibility focus on short/medium term gains. It *never* focuses on long term, sustainable operations.
There's an easy argument to make that "I support Chris Krebs because we can't have a meaningful cybersecurity industry if we're subject to political revenge" is in the best long term interests of all parties... companies, shareholders, and the general public alike. It's just not in the best short/medium term interests.

2025-04-16 15:00:41 UTC

- reply

@nprofile…r0kn Never. Not high enough authority. None of the folks responsible for implementation got pardons the first time around, just the leaders (and even then, not all the leaders).

2025-04-02 14:31:31 UTC

- reply

@nprofile…d2rl This is an excellent blog post and I plan on sharing it with *many* people, including (hopefully) our industrial advisory board. I do have a couple of thoughts on the college side of things:
1) I do open house events. By the time families get to me, virtually all of them have already decided that they want cybersecurity. The question isn't whether they're going to do it, it's what school they're going to do it at. I'm not trying to convince them that cybersecurity is the right degree path, I'm trying to convince them that our program is better than the program of other schools. Occasionally, they've decided on the school and on tech, not the specific tech program at the school (CS vs Cybersecurity vs...).
(For what it's worth, we've been shifting the open house narrative to a bit of a reality check for a few years now.)
The root problem here is that tech is broadly seen as one of the very few reliable paths to a middle/upper middle class lifestyle (particularly for average or less than average students), and probably the most reliable. I'm sure I'm preaching to the choir about how delusional that view is at the moment and how bad things are going to get when folks broadly realize this isn't reliable anymore.
2) We're going to see a *ton* of programs (and, frankly, schools) collapse in the next 5-10 years between the demographic cliff and the shifting tech market. This is going to lead to more concentration and less competition in higher ed... which I'm not entirely sure is a good thing.

2025-03-21 23:22:49 UTC

- reply

@nprofile…d2rl I can't speak for other, but it seems like NY has realized they're on their own. They're building out substantial new security infrastructure. They've been on campus recruiting for a new SOC opening in Rochester, and I think they've got similar plans for other major NY cities.

2025-03-05 14:19:36 UTC

Hey, looks like the fediverse is really taking off as a social media platform.... sad that I know this because I'm getting followed by spam porn accounts.

2025-02-18 20:16:31 UTC

I used to teach quite a lot of courses that covered ethics as it applies to technology. This was, to honest, my gateway into security.
One of my favorite discussions was "What software would you refuse to write?"
I think about that *a lot*.

2025-02-10 17:35:03 UTC

- reply

@nprofile…5k2y I have to wonder... do any .gov detection systems label suspicious behavior as possible privilege escalation attempts? Are logs going get deleted?