Shostack + Friends Blog

External changes will be driving appsec in 2023. It’s time to frame the decisions in front of you. (05 Jan 2023)

Thoughts on the last 747, and engineering culture. (30 Dec 2022)

Looking at a threat model for curl, the command line web client. (29 Dec 2022)

A new paper on how fast, cheap and good can combine into something we usually discount. (28 Dec 2022)

More thoughts about AI and threat modeling (25 Dec 2022)

A straw goat that has not been burned. (25 Dec 2022)

The best gift for 2023 (23 Dec 2022)

Pointer to Adam’s latest Darkreading article (22 Dec 2022)

Usable security matters (21 Dec 2022)

Books that I read in the fourth quater that are worth your time include several about safety with lessons for cybersecurity (19 Dec 2022)

Interesting space news, including ISS and 3d printed engines (18 Dec 2022)

Legal commentary on the Second Death Star Project (16 Dec 2022)

Threat Modeling for UX Designers with Adam Shostack on Heidi Trost's podcast (14 Dec 2022)

The OpenAI chatbot is shockingly improved — its capabilities deserve attention. (09 Dec 2022)

Text captured from GPT-3 (09 Dec 2022)