J Wolfgang Goerlich

I’m the unflinchingly optimistic graybeard, wandering in this cyber dystopia. InfoSec, cybersecurity, futurist, strategist, chaotic good. The views expressed are my own. Sometimes humorously.
 https://jwgoerlich.com

Public Key

npub14leyfhgzz0q6lmvue96a5r7jws4ayqqtx6hld4gnygu9hsrdm6gqxcdp2p

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs2lujym5pp8sd0akwvjaw6plf8g27jqq9ndtlk65fjywzmcpkaayqpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43q0hsjqf

Publishing to

relay.ditto.pub

Author Public Key

npub14leyfhgzz0q6lmvue96a5r7jws4ayqqtx6hld4gnygu9hsrdm6gqxcdp2p

Show more details

Last Notes

2026-08-17 22:19:18 GMT

Life motto.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/113/168/096/995/367/original/07a048294b1c7efa.png

2026-06-16 01:58:31 GMT

Please. Repeat after me:
AI is not an employee. AI is not a teammate. AI is not a friend.

2026-03-22 19:22:54 GMT

Cyber: Humans are the weakest link!
Also cyber: Human-in-the-loop is the only way to make AI safe!

2025-11-22 06:20:13 GMT

- reply

@nprofile…ppe2 CSRB, the NIST 800 team, CISA, ISACs for multi-state and elections. It’s a mess.
Happy to share how this is impacting local (county) governments, if that’s a route you explore.

2025-09-12 09:36:05 GMT

LOLs per Employee: a vital metric.
Shenanigans are a sign the team has sufficient energy in reserve, signaling readiness for handling emergencies and unplanned work. Play usually reflects underlying trust, cohesion, and resilience.
Encourage it.

2025-09-04 12:22:18 GMT

The velocity for patching Critical vulnerabilities is set by standards and driven by criminal activity. 2000-2010, the acceptable timeframe was 30 days. That dropped to 14 days, from 2010-2020. By 2022, the 7 day standard became the norm.
The criminals, meanwhile? With Netscaler they had exploits within 12 hours of disclosure.

2025-08-10 11:49:03 GMT

- reply

@nprofile…67n0 Appreciate it!

2025-08-09 06:48:54 GMT

- reply

@nprofile…67n0 Gah! That’s one talk I’m sorry to miss.

2025-08-07 17:32:00 GMT

- reply

@nprofile…gqp6 Exactly. My mind immediately went to people with stalkers and in abusive relationships. Someone is going to get hurt over this change.

2025-08-07 17:14:08 GMT

Opened up Instagram to see a number of friends clustered in Las Vegas.
This is a problem. No, not because Sin City. Because Instagram apparently opted in everyone.
Turn it off under chat.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/988/603/383/604/732/original/4d4b1ac97f642e34.png

2025-08-04 19:04:39 GMT

“Industry desperately needs a mechanism to expel bad actors. If we don't make one, it will be imposed on us.”
— Allison Nixon @ #BSidesLV

2025-08-01 21:27:53 GMT

Or, you know, hacker summer camp. Same same.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/955/626/361/575/548/original/0323a80dfa5c9a87.png

2025-07-20 12:25:01 GMT

Did you know, there are posters of my five abilities of good security?
I worked with the designer to have them created for my office, and they have the posters listed on their Etsy store. I make nothing off these, simply find it neat.
https://www.etsy.com/listing/1773894548/five-abilities-of-good-security-cyber?etsrc=sdt

2025-06-26 14:17:20 GMT

- reply

@nprofile…gqp6 is there anything legit or valid on a .top domain these days? It’s wild.

2025-06-25 16:38:39 GMT

Them: "In order to make this change, I need to verify you. I'll do this with a one-time text."
Me: Sure.
Them: "We have no phone number on file."
Me: ...
Them: "Not to worry. I'll update your account. What number would you like to use?"
#CustomerService > #Security

2025-06-17 21:23:59 GMT

Don’t do the thing to do the thing. Do the thing so you can do the next thing.
Consider threat modeling. The goal isn’t a thing, a diagram. The goal is insight and understanding.
Taking short-cuts (cough, AI) short-circuits learning.

2025-06-06 16:58:08 GMT

To become the Director of Shadow IT, these days, you need a Bachelors of the Dark Arts in IT Management. Odd, I know. But HR departments are strictly enforcing this rule.

2025-05-28 14:45:07 GMT

Remember, kids…
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/585/993/251/251/224/original/6e095faa1a663b32.png

2025-05-23 18:06:52 GMT

The original LEGO toy was a wooden duck. Play evolved from wood to plastic, from bespoke to modular. Then after eighty years, LEGO re-released the duck made from their bricks. And if this isn't a metaphor for servers to cloud to containers, I don't know what is.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/558/474/332/152/336/original/d761be6d588f6fc2.png

2025-05-22 22:55:53 GMT

Oh, yes. The classic IT risk management actions: Avoid, mitigate, transfer, denial, anger, bargaining, depression, and acceptance.

2025-05-20 18:45:06 GMT

Common wisdom says, "If you see a problem, fix it!" IT teaches us if you see a problem, there's a reason. Ask why the problem is there. Think about the impact of your solutions. Every fix leads to a new problem, so what will you cause when fixing this one? Think before you fix.

2025-05-17 15:51:12 GMT

Can a cybersecurity expert ever be a Techno-Optimist, after spending our lives cleaning up the unforeseen consequences of IT advances?

2025-05-10 22:07:27 GMT

Stefani Goerlich giving the closing keynote at #BSidesDetroit. “We’re confusing information sharing with intimacy and surveillance with love.” — @nprofile…07h6
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/485/808/911/892/449/original/4beec3bc6e1edd94.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/485/809/610/542/141/original/d17a729269149b71.png

2025-05-02 17:24:05 GMT

Cybersecurity metrics. Data builds credibility. Stories build commitment.

2025-05-01 19:53:28 GMT

“Your battery is running low.”
Me too, lil truck. Me too.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/434/321/960/242/737/original/6e5db3e4c82a3c9c.png

2025-04-08 20:50:23 GMT

- reply

@nprofile…r0kn I usually have a $20 or 20% rule, whichever is more. But this was simply ridiculous.

2025-04-08 15:02:04 GMT

Restaurant. We seat ourselves. We order off a QR code and app. Someone quickly drops off our food. No hellos, no drink refills, no goodbyes. We pay using said QR code and app.
… and the app recommends a 25% tip!?

2025-04-03 04:46:39 GMT

Mid-century modern CISO.

2025-03-27 21:09:37 GMT

Me: Security is nonfunctional
Them: “a nonfunctional requirement.”
Me:
Them: “Security is a nonfunctional requirement, right?”

2025-03-14 23:28:28 GMT

Rideshare apps need a “no Tesla” option. No thanks, I’ll catch the next one.

2024-10-20 15:20:18 GMT

If your first thought is, “maybe they never happened because we worried,” then a career in cybersecurity might be right for you.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/340/419/534/791/007/original/18ea6b18525a26d0.png

2024-09-04 23:04:12 GMT

Occam's Razor: the simplest explanation, with the fewest assumptions, is the correct explanation.
Wolf’s Electric Shaver: the silliest explanation, with the most dramatic dysfunctions, is the correct head-cannon.

2024-07-18 13:43:24 GMT

I saw this hack in a movie once.
https://techcrunch.com/2024/07/18/hackers-could-create-traffic-jams-thanks-to-flaw-in-traffic-light-controller-researcher-says/
A security researcher says he found a flaw in a traffic light controller that would potentially allow malicious hackers to change the lights and create traffic jams.
One of the devices Lemon looked at is the Intelight X-1. According to Lemon, the bug is very simple and basic: There is no authentication on the internet-exposed web interface of the device.

2024-06-30 01:48:27 GMT

I only take my entendres one at a time, thank you.

2024-05-23 19:50:14 GMT

“Dr. Stefani Goerlich reminded us all that behind every data point is a human being whose privacy and security matter deeply” in her BSides312 keynote.
https://blog-gitguardian-com.cdn.ampproject.org/c/s/blog.gitguardian.com/bsides312-2024/amp/

2024-05-04 22:15:22 GMT

- reply

@npub17ht…v005 Like this only wearing black.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/385/121/467/957/979/original/a396035e910d2cd1.png

2024-05-04 20:41:17 GMT

- reply

@npub17ht…v005 I’m wandering the halls.

2024-05-03 21:03:40 GMT

- reply

@npub1lzz…jhl3 It is almost as if these Student journalists are stretching the truth or fabricating their reports. It shouldn’t surprise anyone that kids would tell tales to protect their friends.

2024-04-19 15:22:40 GMT

Slip of the tongue, but I’m pret sure I just taught people that Monty Python simulations was a reasonable way to quantify risk.

2024-03-14 18:28:00 GMT

Shel Silverstein doesn’t get nearly enough credit for predicting ChatGPT.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/095/453/324/493/350/original/d12e511356d51d1f.png

2023-08-27 21:11:59 GMT

- reply

@npub1a5z…hcww Entombed, an original Atari game, has a maze generation algo which no one has ever been able to decipher or reproduce. The original programmer wrote it on acid and, once sober, they couldn’t figure it out. The code remains a mystery to today.