
Covenanter | ADHD |#InfoSecTrust|Ex-@AlbanyMed @GEResearch @Adobe @TenableSecurity @ZionsBank @Squarespace @Zendesk | CFP @BSidesLV | Wrestler | CTF/MTG Player
grooming 2x DEFCON 3rd Beard
Joined November 2012
- Tweets45.4K
- Following197
- Followers1.8K
- Likes33.1K
Pinned Tweet
REMINDER. I am a #Covenanted #Reformed #Presbyterian #Christian born again in 1999. If you want to know what I believe: thewestminsterstandard.org/t…
£ulzk¥ retweeted
I spent 48 hours in SF hanging out with billionaires, data labs and AI founders and execs running $1B to $100B companies.
My observations:
1. Sooo MANY stories of data brokers making like $2M a WEEK selling company data to labs. I can't tell if it's the beginning or a bubble, and I kept wondering which niches are left. Digging into it actively.
2. At dinner, someone asked the table, "If a new model drops next month, does your company get better or worse?" HALF the table went quiet! I think that's the best question to ask about any AI startup right now.
3. The bar people talk about now is hitting $1B in revenue in 12 months (I guess that's the new unicorn?). What I didn't hear much about is retention. AI revenue can come in fast and leave fast, and I think we're going to see a lot of stories of AI companies with huge revenue and terrible retention.
4. It's pretty clear we're living through the reinvention of the computer. The model is the CPU, the harness is the operating system, and skills and plugins are the apps. Thinking about it that way makes it easier to see where the whitespace is.
5. We're maybe 12 months from an agent that can watch you work for a week and then do your job without any instructions. The screen recording plus agent memory plus local model combination makes this possible right now.
6. Agent harnesses feel like the new GPT wrappers, in a good way, especially vertical ones. The best teams I talked to treat the model as swappable. One founder walked me through routing different models to different jobs: one for taste and visuals, a cheaper one for the everyday stuff, another for text.
They use prompts they can move across models over fine-tuning, and A/B test the output on what users actually do with it: do they edit it, export it, share it? A vertical harness is basically four things: the connectors for that industry's data, evals written by people who know the work, rules for what the agent can and can't touch, and a clean screen for a human to review. The model is maybe 20% of it.
7. There's a lot of reverse engineering going on/cloning going on more than I've ever seen. People are decompiling software and rebuilding it with agents, and someone showed a suite of like 10 apps that are worth $5B+ each all that he cloned open source. Me and everyone are still thinking through what it means when software gets this easy to copy.
8. My guess is the value moves to data. If the software can be rebuilt quickly, what's worth paying for in a legacy SaaS company is the years of customer data and workflows inside it. Some SaaS companies are secretly data companies.
Gets me thinking about how do you truly value data for this saas companies? Like if we were buying these dying saas companies at 2x ARR before (as example), maybe there is a better metric. Idk, just thinking out loud here.
9. It feels like a good chunk of legacy software won't make it to the agentic era, especially anything built around people clicking through a lot of screens.
10. Every company I talked to wants to pipe its internal data into one place and expose it to agents through MCP. Then they look at the data and realize it's a mess: five versions of the same customer, old Slack channels, PDFs nobody can search. Cleaning that up feels like a big consulting opportunity!
11. A lot of founders are building the basic building blocks for agents: APIs, data layers and tools. Some of the companies I saw barely have a UI because the main user is an agent. I really believe the startups that build primitives to this agentic era will do extremely well. Building blocks is the best way to think about it.
12. Labs can get plenty of training data, but it's harder to get real examples of agents failing inside companies. Whoever has those logs has something valuable.
13. Someone running a big consumer company told me the next fight is over memory. The model that remembers the most about you wins, and the smartest model matters less than people think.
14. Physical AI came up a lot. Astra I think was the first model that got people into AI can actually do CAD, and I think a lot of people are thinking what does vibe manufacturing really look like. The line I keep thinking about came from a robotics founder: the hardest problems in AI are deployment problems now, not research problems. Their robots work on their own, call a human when they get stuck, and every one of those calls becomes training data.
15. Cybersecurity companies are having a moment and are actually cool companies to build now, especially the ones that clean up after a breach. Every agent with access to your systems is a new door into your company, and a lot of those doors were left open.
16. Some startups are worth more dead than alive now. A shutdown company with 5 years of Slack, email and code can get paid for licensing all of it. I wouldn't be surprised if founders start factoring that into when they shut down.
17. People are starting to talk about monetizing the agent web. It feels really early, but when the most popular user of the internet is an agent, what startups should you be building?
18. I think agent insurance is coming. Once an agent makes an expensive mistake, insurers will want audits before they cover anyone.
19. Several people said the hire they want most is someone with taste who can write evals. The models are getting good at generating ideas, so the hard part is judging which ones are good.
20. New trend I observed: startup raises VC, uses venture dollars to become a creator, startup fails, founder falls back on being a full-time creator and incubates other products bootstrapped.
21. Getting SIGNIFICANT distribution is HARD right now. Founders are sponsoring buses, buying billboards like crazy and throwing parties with famous DJs to get noticed. Kinda feels dotcom era in that sense.
Attention is what's scarce! The growth guy going viral sharing his UGC strategy from Wispr Flow is a good example. It's the sauce everyone wants, and I truly believe there are probably only 50 people on the planet who know how to scale these types of businesses efficiently in this era.
Always good to get that dose of SF. I felt sooo lucky to have such an incredible trip during such an incredible time in building businesses. Surreal in so many ways.
Happy to be home and locked in.
Until next time!
£ulzk¥ retweeted
Has anybody applied to the Claude program for security researchers and have they found out yet?
My application is in review for two days now.
A friend of mine has this quote on his website, and I can’t help but think that it is such a beautiful expression of a proper Christian view of technology used for Christ’s Kingdom…. In this case, a webpage:
“Do not settle here. A page can hand you a book, a definition, a place to start. It cannot sit with you when your marriage is breaking, or bury your father, or put bread and wine in your hands and tell you Christ was broken for you. What a page can do is hand you Scripture for that hour, and then send you to the church.”
#ChristSavesSinners #JesusIsKing
£ulzk¥ retweeted
Your job may be surviving on inertia. Your resentment won’t extend the runway. What do you actually want to do with the intelligence now at your disposal?
£ulzk¥ retweeted
OpenSSL 4.1 adds post-quantum cryptography, drops Itanium, and patches MSVC 2013 quirks. Essential, thankless plumbing quietly keeping the internet functional for another week.
9to5linux.com/openssl-4-1-pr…
£ulzk¥ retweeted
🦔An NYU mathematician says OpenAI used his own progress against him to beat him to one of the biggest unsolved problems in mathematics. Tristan Buckmaster had been working toward a Millennium Prize proof using OpenAI's Codex when information about his progress reached OpenAI.
Days later, OpenAI published a full proof of the same problem using the same uncommon approach, after burning $22.5 million in compute to get there. When Buckmaster confronted them, exec Sébastien Bubeck allegedly said "Why would you ruin your career?" and "If you don't want me to be nice, then I don't have to be nice."
My Take
OpenAI spent $22.5 million to solve a problem with a $1 million prize. They didn't do this for the bounty. They needed a headline that says "our AI solved one of the hardest problems in mathematics" and they needed it before someone else got credit. They started days after they heard about Buckmaster's progress and took the same uncommon approach he'd pursued for months. That's hard to explain as coincidence.
Buckmaster did his work inside Codex. OpenAI reserves the right to train on Codex data. They admit they can't rule out that his usage helped improve their models. So a customer used their product, potentially handed them the roadmap, and then OpenAI outran him with $22.5 million in compute he could never match. I don't know if any of this was intentional. But if you're a researcher and you just watched this happen, I don't think you'd keep your best ideas inside someone else's product.
Hedgie🤗
techcrunch.com/2026/09/08/op…
£ulzk¥ retweeted
USA Wrestling will host a Silver Coaches College at the U.S. Olympic & Paralympic Training Center in Colorado Springs, Colo., Oct. 28-31—Online registration is now open to eligible members. #usawrestling go.themat.com/usFh0
AI WILL TAKE OVER THE WORLD!
Also:
"You're correct in calling this out, that was poor form and the system is still constrained to an unusable degree. So the honest answer is: I over-normalized the system and substituted my judgment for the exact recommendations
we had just discussed. The resulting bounds are coherent, but I did not follow the agreed process closely
enough."
LOL
£ulzk¥ retweeted
Bill Maher is at it again…. Making sense!🙌🏻
He’s quoting the DSA party with their agenda!
As he said “they’re supposed to scaring you INTO voting for you!” 😜
They might as well put out we’re all for communism! Oh they did! 😳
This won’t end well! Be careful how you vote!👊🏻
£ulzk¥ retweeted
macOS security blindly trusts entire processes, letting malware inherit full permissions via dylib injection. The defensive alpha is intercepting executable mmap events before host code ever runs.
objective-see.org/blog/blog_…
Yo @SnoopDogg you need to remake "The Next Episode"..... Because, you're literally living the next episode.
La-da-da-da-dah
It's the one and only D-O-Double-G
La-da-da-da-dah
You know I'm reppin' for the G-O-D
🙏
£ulzk¥ retweeted
California politicians wanted to make sure fast-food employees earned their “fair share”—and that’s when 557,000 workers across 30,000 restaurants got an economic reality check.
This!
600+ patches a month isn't fixing software, it's the industry admitting AI now writes bugs faster than humans can name CVEs for them.
theregister.com/columnists/2…
£ulzk¥ retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
£ulzk¥ retweeted
Let’s say it bluntly: psychology and psychiatry are largely a scam, and a mafia, or a sect…
From Mr Commonsense:
In 1973, eight perfectly healthy people walked into different psychiatric hospitals across the United States. They were not ill. They had no history of mental disorder, no crises, no hidden pathology. Yet no one inside those walls was able to see it.
It was an experiment—one of the most disturbing and consequential in the history of psychiatry. Designed by Stanford psychologist David Rosenhan, it began with a simple yet unsettling question: is it really possible to reliably distinguish mental health from mental illness? Can professionals trained to recognize madness tell the difference when the person standing before them is, in fact, sane?
To find out, Rosenhan recruited eight pseudopatients. They were ordinary people from varied walks of life: a painter, a housewife, a pediatrician, a graduate student in psychology, three psychologists, and a psychiatrist. Rosenhan himself was among them. They lied about only one thing. Each claimed to hear voices. Nothing more. No bizarre behavior, no delusions of grandeur, no emotional collapse—just three words heard in their minds: “empty,” “hollow,” “thud.” The voices were described as unfamiliar and of the same sex as the speaker. Beyond that single fabricated symptom and a few false biographical details for privacy, everything else they said about their lives was true.
All of them were admitted. Some to underfunded public hospitals in rural areas, others to respected urban university facilities, and one to an expensive private institution. Across twelve different hospitals in five states, the result was the same. Seven were diagnosed with schizophrenia. One, the only patient admitted to a private hospital, received a diagnosis of manic-depressive psychosis. Not a single one was recognized as healthy. Not one.
Immediately after admission, they stopped pretending. They behaved normally. They cooperated fully with the staff. They spoke truthfully about their experiences, reported that the voices had disappeared, and asked to be discharged. It was not possible. The staff no longer saw people. They saw diagnoses. Every ordinary action was reinterpreted through the lens of illness. Writing notes on the ward? Obsessive or compulsive behavior. Standing quietly in the hallway? Pathological attention-seeking. Being polite and cooperative? A controlled façade consistent with the disorder. Even the simple act of waiting for lunch was sometimes recorded as oral-acquisitive behavior.
The power of the label was absolute. Once the diagnosis had been written, reality itself seemed to bend around it. The pseudopatients were given nearly 2,100 psychoactive pills during their stays—mostly tranquilizers and antipsychotics—which they discreetly discarded. They experienced the profound depersonalization that comes from being treated as a diagnosis rather than a person. Staff rarely made eye contact. Conversations were brief or nonexistent. The patients felt invisible, reduced to case notes and medication schedules.
Yet the real patients noticed. Some approached the pseudopatients and whispered, “You’re not like the others. You don’t belong here.” A few even suggested they were journalists or professors investigating the hospital. The people labeled “insane” saw what the experts could not recognize.
The average length of hospitalization was 19 days. One person remained locked inside for 52 days. Each passing day confirmed the same truth: the label was more powerful than reality. When the pseudopatients were finally released, almost all left with a diagnosis of schizophrenia “in remission.” The illness was not declared cured or mistaken. It was merely dormant. The stigma remained.
When Rosenhan published his study—“On Being Sane in Insane Places”—in the journal *Science* in January 1973, it caused an earthquake. The psychiatric community erupted in outrage and denial.
1/2
🚀 Mission complete.
#BSidesLasVegas 2026 has officially returned to Earth. What an incredible voyage it was.
For more than 12 years, I’ve had the privilege of serving, helping brilliant people step onto the stage and share the ideas, research, lessons, and stories that move our security community forward.
This year’s retro-space adventure was powered by an extraordinary crew: our speakers, trainers, mentors, alternates, volunteers, organizers, sponsors, and every attendee who brought curiosity, energy, and kindness to the Tuscany.
To every presenter who trusted us with your work: thank you.
To the #BSidesLV Staff crew who handled every schedule change, technical challenge, unexpected asteroid, and last-minute course correction: you were phenomenal.
And to the entire BSidesLV community: thank you for once again proving that the best part of cybersecurity isn’t the technology, it’s the people.
The stages are quiet.
The badges are packed away.
The spacecraft is back in the hangar.
But the conversations, friendships, and ideas launched this week will keep traveling far beyond Las Vegas.
Until the next mission. 🪐
#BSidesLV #BSidesLasVegas #Cybersecurity #InfoSec #SecurityCommunity #SpeakerOps #Community
(See you at DEF CON)
£ulzk¥ retweeted
Replying to @blackwinghq
@blackwinghq researcher @0xFBFBFBFB landed 4 CVEs in the latest huge Apple security update.
CVE-2026-64747 is beautiful “an app may be able to execute arbitrary code with kernel privileges” (iOS and macOS) 🥹.
Write up coming soon. Stay tuned, this is just the beginning — we’ve been busy! 😉
£ulzk¥ retweeted
Rob Pike wrote a complete regular expression matcher in about 30 lines of C
it supports ^, ., *, and $ using only recursion and pointer arithmetic
it's still one of the best introductions to how regex engines actually work
🌖Houston, we have a microphone. 🎙️
Tonight, the #BSidesLV crew is leaving the conference rooms behind and launching straight into poolside karaoke.
Come sing like nobody’s monitoring the logs.
Cheer for your fellow space cadets.
Make questionable musical choices under the Vegas stars.
No vocal certification required. Confidence is optional. Fun is mandatory.
🎤 Poolside Karaoke — tonight
🌴 Bring your crew. Pick your anthem. Prepare for liftoff.
#BSidesLV #PoolsideKaraoke #HackerSummerCamp #Vegas #CybersecurityCommunity




















