9 results for “boblord”
Myth: “Attackers keep adapting”
Reality: The difference is real. A fire captain fights physics: unpredictable, indifferent, not trying to win. An army captain fights someone who can wait, feint, spend more, and come back tomorrow.
You fight an intelligent adversary by changing the landscape and raising the cost of their campaign. That argues for secure by design, not against it. Eliminating the Lucky 13 (see UV-01) does both; patching instances does neither.
Thirty years in, adaptability explains the pressure. It does not excuse the outcome.
Until incentives shift, the market will reward unsafe software.
Market Forces & Effects:
The software industry isn't a free and fair market — not when it comes to security.
High switching costs, vendor lock-in, and market concentration reduce competition. Information asymmetries prevent buyers from assessing product security. The result is a classic market failure:
Myth: “It was a sophisticated attack”
Reality: Most breaches described in headlines as a "sophisticated" or "advanced" attack start with an ordinary technique: a phished credential, a social-engineered helpdesk call, a login with no MFA. The sophistication is rarely in the intrusion, it's in the story told about it afterward.
Elevating an opportunistic break-in to a spy-movie threat actor moves attention away from the mundane design failure that let it happen, an outcome that benefits the manufacturer whose product failed.
Do not judge me, but Department Story Christmas is back on @somafm !
I can almost taste the Frango Mints...
Join me!
Thanks to everyone who made that project happen!
https://www.cve.org/Media/News/item/blog/2026/10/20/CVE-Program-Validation-Library
Sometimes important work happens without fanfare. When CNAs submit CVE records, the system validates them against some basic standards. Last month, that validation code was refactored into its own library.
Now that the validation code is its own library, CNAs can run it in-house to ensure their CVE record submissions will not be rejected. It's also now easier to add additional validation code to raise the bar on record quality.