Bob Lord 🔐 :donor:

Personal account where the owls are not what they seem.
🦉🏔️🏔️🪵☕🍩🥧🕵️‍♂️👍
Also:🔐🔑🔒💻

Website: https://www.ilord.com
Twitter: https://twitter.com/boblord

Public Key

npub1d8w5jtxwt6edfp9eg9znl942d337ql63k4536xxcvn37ufep0vwswtpc75

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsxnh2f9n89avk5sju5z3flj64xcclq0agm26garrvxfclwyushk8gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsnuzyj4

Publishing to

nostr.mom

nos.lol

relay.damus.io

Author Public Key

npub1d8w5jtxwt6edfp9eg9znl942d337ql63k4536xxcvn37ufep0vwswtpc75

Show more details

Last Notes

2026-10-16 11:15:08 GMT

- reply

The real tradeoff isn't security vs. usability. It's shortcuts vs. craftsmanship.

2026-10-16 11:15:08 GMT

Myth: "Security breaks usability"
Reality: Most security has no interface to break.
Crumple zones, collapsible steering columns, and safety glass changed nothing a driver touches. Removing a class of coding error is the same: invisible to users, expensive for attackers.
As for the features users do complain about, ask what that development team had. A UX expert? A mandate to refine it on usage data, like every other feature?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/450/296/995/812/355/original/4c1b799d86b2809b.jpeg

2026-10-15 11:15:06 GMT

AI and the Cost Shift:
AI pushes down two costs at once: the cost of writing code, and the cost of finding defects in it. Neither drop is neutral.
Cheaper writing means more code shipped at roughly average security, and average has never been safe (see AI-02). Cheaper finding helps manufacturers and attackers both (see AI-04).
A manufacturer can spend that windfall on margin, on features, or on process discipline. Only the third choice keeps the defects from landing on operators.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/444/634/522/591/425/original/73b7a25a1494d8b8.jpeg

2026-10-04 11:15:07 GMT

Language Matters:
The words we use influence how people think. Shifting language shifts mindsets.
"Vulnerability" sounds like weather: unpredictable, nobody's fault. "Product defect" names something a manufacturer built and could have prevented. Keep it only where it's a term of art, like CVE.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/382/349/221/076/269/original/7f16caad0ab5848d.jpeg

2026-10-03 17:33:53 GMT

RE: https://fed.brid.gy/r/https://bsky.app/profile/did:plc:gvda6fem6r7selm4gzjjww4a/post/3mw7yv72vws2l
Accountability is key.
#note12jd…zmwu

2026-10-02 11:15:15 GMT

In 2007, MITRE published "Unforgivable Vulnerabilities," listing 13 recurring classes of coding error (known as the "Lucky 13") for which effective mitigations had been available.
These are defects (like XSS, SQLi) that keep appearing year after year. Their recurrence is not a technical mystery; it is a business and incentive failure.
The presence of an unforgivable vulnerability signals that customer safety was not treated as a non-negotiable requirement.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/371/025/071/269/341/original/6e2f85a6d4d909b9.jpeg

2026-02-09 14:46:01 GMT

The latest Hacklore newsletter is out. Be sure to subscribe!
Boost for reach! 🙏
https://buttondown.com/hacklore/archive/hacklore-the-valentines-day-edition/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/204/022/784/669/original/22b79b9e6eaafd89.png

2026-01-05 19:42:00 GMT

I’m working on the next hacklore newsletter, and the holiday season delivered a fresh wave of peak hacklore! 🎁 😜
📬 If you want fewer security myths and more reality-based advice for everyday people (including ways for you to help!), subscribe here: https://www.hacklore.org/about

2025-12-25 16:33:27 GMT

- reply

It is!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/781/164/293/064/334/original/14b560f9c7edb1d4.jpeg

2025-12-25 16:22:48 GMT

- reply

If you get the chance to go to The Village, I recommend it. We stayed next to Number 2’s residence. Amazing.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/781/114/560/345/329/original/0dedae57ce874fb8.jpeg

2025-12-09 17:45:58 GMT

- reply

What are the best anti-scam resources I can link to? It's not the focus on Hacklore but I can make sure there is a smoother on ramp to good guidance.

2025-12-09 16:22:37 GMT

- reply

I posted some thoughts here:
https://medium.com/@boblord/methods-of-delivery-vs-intrusion-the-hacklore-edition-b042f51954a6
Feedback welcome!

2025-12-09 16:05:46 GMT

- reply

I made the edits to the references to "URLs". Thank you for that insight that got past all the proofreaders!!!!!
As for the other part about being able to determine the risk level for a site, well, that might be more of a challenge than copy editing. ;-) But fully agree.

2025-12-09 02:02:00 GMT

Does your cybersecurity awareness training contain any hacklore?
I’m collecting examples of hacklore in the wild. Whether it’s training slides, quiz questions, or instructions that focus on rare threats instead of the ones causing the most real-world harm, I want to see it all.
Post some screenshots or notes here, or email them to "info" at hacklore.org. Let’s help organizations replace stale guidance with advice that truly keeps people safe.

2025-12-02 00:53:55 GMT

Looking forward to the family's annual viewing of the two best Christmas movies: Three Days of the Condor, and The Conversation. 🕵️🎄

2025-11-28 15:02:52 GMT

🎅 ✈️ 🚃 🚗 How can friends and family can keep their online accounts secure during the holiday and travel season? This article does an outstanding job of explaining what really keeps accounts safe vs hacklore. 🙏
https://www.thetimes.com/article/cfd5f639-db6b-41f1-a583-d9adbf64bea3?shareToken=39c1ba3cdbc6dd583aa58c3d628751b8
More info: https://www.hacklore.org/ 🔐
📢 Spread the word! 📢

2025-06-14 18:42:14 GMT

"Create an image that summarizes what you know about me."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/683/185/267/987/966/original/a06371060b422036.png

2025-01-11 18:44:44 GMT

𝙏𝙧𝙚𝙖𝙩 𝙖𝙡𝙡 𝙣𝙚𝙩𝙬𝙤𝙧𝙠𝙨 𝙖𝙨 𝙝𝙤𝙨𝙩𝙞𝙡𝙚. This is no longer a paranoid theory, but today's objective reality.
Wired article on phone surveillance:
https://buff.ly/4jcAqEY
My case for encrypting all the things:
https://buff.ly/4iA9i25

2024-12-24 15:56:09 GMT

In light of the Crowdstrike outage over 5 months ago, what specific changes has your organization made to your enterprise security program? What changes to policies, procedures, training, alerting, testing, and your written IRP have you made? Please share!

2024-11-28 19:42:06 GMT

- reply

Why is our plan to train users to avoid the built-in dangers of software and software deployments instead of 𝘀𝗵𝗶𝗳𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗯𝘂𝗿𝗱𝗲𝗻 𝗼𝗳 𝘀𝘁𝗮𝘆𝗶𝗻𝗴 𝗰𝘆𝗯𝗲𝗿 𝘀𝗮𝗳𝗲 to those who can best affect change?

2024-11-28 19:42:06 GMT

- reply

1️⃣ How was the enterprise laptop fleet misconfigured to make this possible?
2️⃣ What products were so dangerous that a single click led to arbitrary code execution? (Think about the specific make/model of browser, mail client, OS, or other software.)
Now, here’s the real question: Why are we training and blaming users for these failures if the true issues lie in 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝘂𝗻𝘀𝗮𝗳𝗲𝘁𝘆 and 𝗽𝗼𝗼𝗿 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲?

2024-11-28 19:42:05 GMT

“𝗔𝗹𝗹 𝗶𝘁 𝘁𝗮𝗸𝗲𝘀 𝗶𝘀 𝗼𝗻𝗲 𝗰𝗹𝗶𝗰𝗸”. How many times have you heard someone say that? How often have 𝙮𝙤𝙪 said it?
Take a step back and ask yourself if this is 𝘳𝘦𝘢𝘭𝘭𝘺 how the hacks happen in 2024. Just one click? Really? If that were true, we'd be asking these questions:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/562/283/178/955/968/original/1d15c9f28967f746.png

2024-11-17 04:31:05 GMT

Some thoughts on the quiet HTTPS revolution:
https://medium.com/@boblord/the-quiet-https-revolution-637a1c40ec6a
🔐
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/496/413/877/454/875/original/3cdfb2a383233404.png

2024-11-01 03:26:20 GMT

💡 Humble suggestion: When giving cybersecurity advice to non-security professionals, skip asking them to "consider" actions. The background knowledge needed to "consider" risks and responses takes years of understanding threats and tech failures.
Make the hard call—either tell them to do it or leave it out. Clear, direct guidance improves the chances that they will implement the advice.