Creative partner at Ripple Training. I tweet about Final Cut Pro, Motion, Resolve, Filmmaking, AI, and basically anything I find interesting.
SF Bay Area
Joined March 2007
- Tweets10.9K
- Following1.6K
- Followers5.9K
- Likes20K
Mark Spencer retweeted
Five seasons released yearly without proper marketing made possible purely by love and dedication for the queen
Use your Claude or ChatGPT subscription to help you locate and add b-roll to your Final Cut Pro projects. Link in comments.
Add b-roll to your FCP project with Claude or ChatGPT youtube.com/watch?v=wjKUX8bI…
Mark Spencer retweeted
Apple has some huge updates to Creator Studio, most exciting for me is Motion VFX (thousands of dollars worth of plugins) is now included in Final Cut Pro apple.com/newsroom/2026/10/a…
Mark Spencer retweeted
Tailscale replied on Reddit:
Hi folks, Mike Shaver here, VP of Engineering at Tailscale.
We've seen the concerns about Tailscale SSH and wanted to share what we know so far.
If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.
We've now received the researcher's report and are reviewing it. Our engineering and security teams had already been investigating independently, with help from external security specialists. That work has identified issues we're working to fix. We're still validating the full scope, including which configurations are affected.
A bit of technical context:
Tailscale SSH uses your tailnet's access policies to control who can connect to which machines. Most of the issues we've identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do.
While it’s a serious concern, it isn't the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured. We're still investigating, so we don't want to make blanket claims about what's affected or not.
Again, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.
In the meantime, there are a few precautions you can take:
•Review your SSH access policies. Make sure only the people and devices that need access have it.
•Review SSH forwarding permissions and remove access you don't need.
•Consider enabling SSH check mode for an additional authentication step. This won't fix privilege escalation issues, but it does add another barrier to gaining access.
•Enable automatic updates where supported so you can pick up fixes when they're released.
For particularly sensitive systems, consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect.
We're working on fixes and testing them carefully. We'll publish a security advisory explaining the confirmed findings, affected configurations, recommended actions and available patches. We'll also follow up with a more detailed technical write-up.
If we find anything that changes our assessment or requires immediate customer action, we'll communicate that.
We know it's been a rough week for security teams, and we understand why people are concerned. We'd rather give you the technical context we have than speculate about things we haven't confirmed yet.
We'll share more as we verify the details. If you have any questions about how this relates to your particular environment, please get in touch with our team tailscale.com/contact/suppor…
Mark Spencer retweeted
Looks like Apple did release a support document about compromised eMudhra certificates as well
About the compromised eMudhra intermediate CAs - Apple Support support.apple.com/en-us/1495…
Mark Spencer retweeted
PSA for macOS users:
1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.
2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.
3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.
4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.
4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.
5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:
“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”
Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.
I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
PSA for Codex CLI users:
1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.
2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.
3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.
4. To check your codex version run "codex --version". It should be at least 0.164.0.
5. To patch the vulnerability, run "codex update".
6. Apps that bundle their own Codex copy must also be checked.
Mark Spencer retweeted
Amy Acton was raped by her stepfather when she was 12 years old.
Vivek Ramaswamy, Donald Trump, and J.D. Vance support her rapist.
Mark Spencer retweeted
This is Monica Alba. The reporter from NBC on whom DT lashed out today when she questioned him about defending Vivek Ramaswamy’s ad.
Thank you for not backing down and relentlessly confronting him about this. This is exactly how the media should continue to push him. Thank you for your incredible work.
Mark Spencer retweeted
PSA: This week was kind of a turning point for AI and cybersecurity. Please take this weekend to do some simple cleanup for your family. Some suggestions:
- Set up a password manager like 1Password and give your spouse or partner access to a shared vault. Teach them how to use it.
- Update your passwords for critical stuff - your email account, your bank or financial stuff, etc. Store in your password manager and use the strongest password you can.
- Use two factor auth for everything you can. SMS is not ideal although better than nothing. Google Authenticator or a passkey is better. Hardware key is safest.)
- Add a sim pin to your phone. Makes it harder to sim jack.
- Update your phone and your computer to the newest releases. Turn auto-updates on.
- Freeze your credit - takes 5 minutes.
- Get an IRS Identity Protection PIN.
- If you’re using claude code or have AI agents that browse the web, they’re probably using Node.js. It’s also vulnerable. Update claude code, update node on your machine.
- If you’re building stuff on your computer, ask claude or grokbot (which is connected to twitter and likely has the most current info) to audit any of your repos for vulnerabilities. Ask grok to make it a scheduled task so it can do this daily - things are moving very quickly in the space right now.
- Consider some light resiliency stuff. This probably sounds silly, but it sounded silly at the beginning of covid too. Having printed out copies of important stuff - especially financial accounts. Having some cash on hand. Having some shelf-stable food and clean water or a water filter. Having a map. Having a generator that can at least power your fridge or some devices. Cheap insurance.
Again, I don’t want to alarm people, but I was taught that you should have a Secure plan, a Comfortable plan, and a Wealthy plan. And it seems pretty clear the secure plan needs to now factor cybersecurity risk as a legit threat. Take a weekend and shore yourself up.
Mark Spencer retweeted
messaging my wife a link containing proof of her husband cheating on her from an anonymous instagram account and then when she clicks on it texting her to let her know she failed the family phishing test and she has to retake my cybersecurity course
Good advice
🚨DO THIS RIGHT NOW:
If you only do one thing after reading this, go turn on a passkey for your email before you close the app. Everything else in your digital life unlocks through that inbox.
I want to walk through exactly what I did to my own accounts, because the generic "use strong passwords" advice stopped being useful around the time attackers stopped being human.
I reordered my whole approach once I accepted a simple truth:
“I can't outrun the swarm, but I can make myself expensive enough that the automated systems move on to someone easier.”
That's the entire strategy, and it works.
I started with email, and I'd beg you to do the same. Your inbox is the master key.
Every "forgot password" link on earth ends up there, so if someone owns your email, they own everything downstream of it. I moved mine to a passkey…the kind that lives in your phone or a hardware key and can't be phished, can't be guessed, and can't be tested by an agent running through a leaked password list.
If passkeys feel like too much, at minimum move off SMS codes and onto an authenticator app, because SIM-swapping is still one of the cheapest attacks going.
Then I did the boring, powerful thing I'd put off for years…
I let a password manager generate a unique random password for every account and stopped reusing anything.
This single move defeats the most common attack happening right now.
Credential stuffing works because people recycle one password across forty sites, so one leak opens all forty.
When every password is different and random, a breach at one service stays contained to that service.
I turned on the breach-alert feature too, so I get told the moment any of my credentials show up in a dump.
After that I froze my credit at all three US bureaus. It's free, it takes about ten minutes total, and it blocks the single most profitable thing a stolen identity enables….someone opening accounts in your name.
I keep it frozen and just thaw it for the few hours I actually need it.
I also went through my old accounts and deleted the ones I don't use, because every dormant login is a door I'm not watching.
The last thing I changed was the hardest, and it's a mindset.
I stopped assuming anything urgent is real.
The scary text about a locked account, the email about a failed delivery, the call that sounds like my bank….I treat all of it as hostile by default now and go to the source myself instead of clicking.
AI made these fakes flawless this year.
The typos that used to give scams away are gone.
I can't promise any of this keeps me safe.
I can promise it moved me out of the easy-target pile, and in a month like this one, that's what I'm genuinely aiming for.
And what I'd want for you too.
