Jake Williams

Breaker of software, investigator of incidents | GSE #150 | Faculty at IANS Research | Stuff: jake at malwarejake dot com | He/him

Public Key

npub1tdhytknt93um3pympngl3jqkd8k9ma7meuj6n4p3clz3amztxyes23m87v

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs9kmj9mf4jc7dcsjdse50ceqtxnmza7ldu7fdf6scu03g7a39nzvcprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntsrvnft

Publishing to

relay.momostr.pink

Author Public Key

npub1tdhytknt93um3pympngl3jqkd8k9ma7meuj6n4p3clz3amztxyes23m87v

Show more details

Last Notes

2026-05-26 19:21:03 GMT

Dear app developers,
I have never had the desire to review an app. Prompting me to leave a review doe not make me want to do it any more. Making me click multiple times to dismiss your "nudge" and get back to using the app just makes me want to uninstall it.
Sincerely,
Every smartphone user ever

2026-04-01 17:16:15 GMT

ICE was checking IDs at the Atlanta airport today. The.guy said "your DL photo is super light, so facial recognition might not work."
I snapped back "that's so you know not to illegally deport me."
His buddy said "we can find a reason" and NOTHING could be more on-brand for an encounter with ICE.

2026-03-06 16:40:57 GMT

That Iranian Navy ship we torpedoed had no ammunition on board because that was a requirement to participate in the MILAN 2026 exercise (organized by the Indian Navy).
The US Navy knew this because IT ALSO PARTICIPATED IN THE EXERCISE. What a national embarrassment.
https://newrepublic.com/post/207429/us-attack-iran-naval-ship

2026-02-28 20:15:00 GMT

RE: https://infosec.exchange/@malwarejake/116149477150967871
It's confirmed that Khamenei is dead. Intentionally killing a country's sitting leader, especially the religious leader in a theocracy, is NOT how you go about regime change.
This will NOT end well.
https://www.reuters.com/world/iran-crisis-live-explosions-tehran-israel-announces-strike-2026-02-28/
#note10jj…wy5n

2026-02-28 17:39:31 GMT

Given reports that Israeli intelligence assesses Khamenei was killed, I assess with high (extreme) confidence that cyber was used to:
1. Confirm his location and direct the attacks.
2. Using collection on Iranian gov officials (e.g., email) reactions of the strike.

2026-02-28 15:07:33 GMT

The administration is getting US service members killed over the fucking Epstein files. I am livid. I hope to live to see Hegseth and every other member of the administration enabling this hanging on a wall.
This is so triggering for my PTSD. Fuck man. This is not okay. I am not okay.

2026-02-20 19:37:18 GMT

Surround yourself with good people. Pay it forward. Hug your friends every chance you get. Purge toxic people from your life.

2026-02-07 19:44:35 GMT

RE: https://infosec.exchange/@malwarejake/116030962813436488
To be vey clear, I do not agree with Snowden's actions.
However, it is now more than a decade later and the whistleblower process is STILL terribly broken. If the whistleblower is a contractor, there are no real protections. It's hard to conclude this isn't by design.
#note17p2…dkyx

2026-02-07 19:19:46 GMT

Regardless of the details of this phone call, there's no question Gabbard broke the law here. Everyone involved in covering this up broke the law.
The whistleblower is killing a career and honestly is risking their safety bringing this forward. It isn't nothing.
https://www.theguardian.com/us-news/2026/feb/07/nsa-foreign-intelligence-trump-whistleblower

2026-02-03 13:03:01 GMT

RE: https://mas.to/@carnage4life/116006745291970990
That, my friends, is the sound of a bubble popping.
#note1kf7…mvdu

2026-01-31 18:44:58 GMT

The hackers had to be "bread in" to the operational details since everything was on a "knead to know" basis.
But they rose to the occasion - it was the yeast they could dough. Things were touch and go until they got on a roll - they'll do butter next time...
https://therecord.media/cyberattack-russian-bread-factory-supply-disruptions

2025-12-05 18:11:06 GMT

Bubble? What bubble?!
https://arstechnica.com/ai/2025/12/microsoft-slashes-ai-sales-growth-targets-as-customers-resist-unproven-agents/

2025-11-26 14:09:12 GMT

The day is rapidly approaching when we're going to learn that one of the big AI companies has been taking money to align their LLMs to recommend certain brands (or criticize their competitors).
It won't be anywhere near as obvious as Grok and Elon. I'd like to see laws prevent this. I know better.

2025-09-11 10:51:45 GMT

Live your life and conduct yourself so that if you're gunned down in public nobody feels the need to tell others that it's inappropriate to celebrate your death.

2025-08-22 14:04:31 GMT

After all the hype, I cannot believe how objectively bad GPT-5 is. In my experience, it is an objective step backwards in most tasks.
It's pretty clear why OpenAI repeatedly delayed shipping it. Calling it now: OpenAI is toast.

2025-07-14 22:58:28 GMT

Don't tie your identity to your job. Jobs are temporary, often ending unpredictably. When your identity is your work, your mental health is impacted horribly when your job security is at risk or you get let go.
I've seen multiple folks in cyber suffer from this, some barely surviving the ordeal.

2025-06-22 14:12:09 GMT

If you're an enterprise worried about your exposure to pro-Iran hacktivists, real talk: you're doing security wrong.
Hacktivists lack sophisticated tools. They employ DDoS and hack-and-leak as their primary techniques. APTs they are not.

2025-06-22 13:27:45 GMT

I'm just glad that as we face increased terrorism risks in retaliation for bombing Iran that there's a steady hand on the wheel for preventing terrorism in the US.
Or mowing my yard. Or running a Model UN club. Or whatever he's actually qualified to do...
https://www.propublica.org/article/trump-dhs-thomas-fugate-cp3-terrorism-prevention

2025-06-06 18:43:40 GMT

I will never understand who at Microsoft thought this was okay. It's a profoundly gross UX pattern.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/637/886/667/060/741/original/3b9d836567ba8c80.png

2025-05-23 19:14:32 GMT

The article doesn't really address the fact that Claude is only mimicking behaviors in its training data set.
Still, it's a great highlight of how quickly dystopian fiction in a training data set can become dystopian reality when AI agents are given too much access.
https://techcrunch.com/2025/05/22/anthropics-new-ai-model-turns-to-blackmail-when-engineers-try-to-take-it-offline/

2025-04-08 10:59:21 GMT

If you're using Ivanti at the perimeter, I have to presume at this point that you enjoy incident repsonse. There's no other rational explanation...

2025-04-03 14:49:55 GMT

Again, Microsoft - unsolicited advertisements for games have NO PLACE in Windows 11 Professional. Please slap whoever decided this was appropriate.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/274/578/765/130/611/original/b08bbf66e58e3b48.png

2025-04-02 14:23:45 GMT

Remember the part of required federal records management training that says "it's okay to use Gmail for work as long as you cc government accounts?"
Yeah, me neither...

2025-04-02 12:56:09 GMT

It's 2025 - please stop using the terms whitelisting and blacklisting. Yes, I know many of these terms were acceptable when you were growing up.
Continuing to use them today shows you're unable to adapt to change, which particularly in high-change environments like cybersecurity, is NOT a good look.

2025-03-29 18:07:21 GMT

I want to find the Microsoft engineer behind this and beat them with dimensional lumber...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/247/049/560/234/685/original/24b6dbc0565761f8.png

2025-03-10 13:58:40 GMT

Fortra doing a victory lap claiming they've cut illicit Cobalt Strike usage by 80% is one thing.
CTI analysts uncritically parroting this ridiculous claim is quite another. Cobalt Strike usage is down because EDRs got better at identifying it specifically. Fortra is AT BEST a minor contributor here.

2025-03-04 19:29:56 GMT

Yet again, I remind you that if you work in cybersecurity, you will never not benefit from learning packet analysis. Yes, there are tools for that. But when they fail (and oh buddy do they fail), your ability to perform independent analysis is critical.

2025-03-02 15:00:50 GMT

I wrote an article outlining why the directive to stop tracking Russian cyber threat actors is impractical and frankly dangerous, outlining some second order effects of the directive. Enjoy.
https://www.linkedin.com/pulse/stop-tracking-russian-cyber-thats-how-anything-works-jacob-williams-ixdkc/

2025-02-26 17:54:29 GMT

Technology is inherently political. Anyone who says otherwise is either being disingenuous or is ignorant of history.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/071/467/063/645/584/original/31fc0de7503ea5bc.png

2025-02-24 13:53:06 GMT

I predict cloud providers run by US companies are going to see some transitioning off their platforms, regardless of where the datacenters are located.
I've talked to several international clients in the last two weeks asking about de-risking, accelerating after Patel was confirmed.

2025-02-15 19:09:20 GMT

"Help help" - I feel you DHS, I feel you...
https://www.linkedin.com/jobs/view/transformation-team-lead-program-manager-at-u-s-department-of-homeland-security-4144567289/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/009/475/859/231/658/original/f605ea0316952b43.png

2025-02-12 16:01:00 GMT

If you're a leader in tech, take this to your stakeholders and explain the implications. Many of the AI-enabled apps your users are integrating into their workflows (or outright relying on) could literally cease to exist with a single court ruling.
https://www.wired.com/story/thomson-reuters-ai-copyright-lawsuit/

2025-02-11 20:42:43 GMT

DOGE is a bigger threat to US federal government information systems than China. If you find this statement controversial, I'm going to question your IT and cybersecurity credentials.

2025-02-11 00:39:10 GMT

Only those wanting to scam consumers are threatened by the existence of the CFPB.
I said what I said.

2025-02-05 20:25:13 GMT

When dealing with aircraft delays (as I am now), I'm always reminded of what an old CW4 pilot told me:
"It's better to be on the ground wishing your were in the air than in the air wishing you were on the ground."

2025-01-16 23:18:49 GMT

There is no generative AI today without flagrant abuse of copyright law.

2024-12-26 14:06:44 GMT

Hot take: the cybersecurity industry wastes an incalculable amount of effort "remediating vulnerabilities" in code because a library used has some "vulnerability" that can't actually be exploited in the way it's used in the application.

2024-12-25 14:40:10 GMT

Find yourself someone who buys you a life size metal Sword of Omens from Thundercats for Christmas.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/713/977/521/693/415/original/12ffcc4cf90bcbd2.jpg

2024-12-17 15:35:30 GMT

Never, EVER, do anything that might create personal legal liability for yourself on behalf of your org.
No matter what anyone says, you are not "family." You are not "in this together." And most importantly they do NOT "have your back."

2024-12-07 14:27:02 GMT

One day I'm going to meet the person who decided the port option in ssh is -p and in scp it's -P.
They will not enjoy this meeting...

2024-12-05 16:12:11 GMT

Hot take: by being actively hostile to end to end encryption apps, FBI and DOJ has created the playing field on which Salt Typhoon now operates.
They're every bit as culpable for texts being intercepted as FCC is for the robocall epidemic.

2024-11-07 17:15:23 GMT

The amount misogyny on display in the cybersecurity field is absolutely wild.
If you're not seeing it, ask "am I part of the problem?"
If you are seeing it, call out the offenders when you see it. Sure, it's uncomfortable. It's WAY more uncomfortable for the victims.

2024-10-25 13:55:58 GMT

Dark web monitoring is a high cost activity that most teams aren't ready for. Most alerts are aggregations from previously identified compromises, and most of those are "employee used their email on some janky site that got popped."
TL;DR: Know how you'll action your alerts.

2024-10-22 16:40:21 GMT

To the random person contacting my employer with vague accusations of domestic violence (while calling me "a GD fscking antisocial psychopath") - thanks for reminding me we need better mental health safety nets in the US.
I just made a donation to NAMI.org in your honor.

2024-09-15 11:20:07 GMT

We have a fundamental breakdown of the social contract in the US.
I don't have the answers for how to fix it. But I've read enough history books to know what happens if we don't - and it's not great.

2024-09-11 16:01:27 GMT

Publicly declaring "I will give you a child" to someone you have no consenting relationship with is a threat of sexual assault, full stop.

2024-08-27 15:57:40 GMT

It will never be a thing that I answer the phone and am willing to "verify my personal information for my security."
If you have legitimate business processes built around this, you're screwing your customers teaching them to be victimized by scams and should feel bad about it.

2024-08-27 13:19:09 GMT

My favorite thing about the Telegram arrest is that "normies" are asking me if this is why I've been refusing to use it for comms and moving them to Signal instead.
Yes. Yes it is...

2024-08-27 13:00:34 GMT

Just a quick reminder that you can't trust what the government tells you.
https://gizmodo.com/donald-trump-homeland-security-report-antifa-portland-1849718673

2024-06-15 11:25:43 GMT

Gen-AI boosters love to claim AI is suitable for all sorts of use cases, but the reality is that if requirements for your use case include "provide consistently correct (or even just consistent) results" then it's not a good use case...

2024-06-06 22:41:22 GMT

This_is_fine.gif
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/572/081/645/540/607/original/834b12aa11e6e7d5.png

2024-05-27 11:31:12 GMT

Broadcom is a cancer.

2024-05-01 11:16:02 GMT

Your AI is only as good as your data.
Most enterprise orgs can't even get asset inventory complete, so let's not talk about the quality of the unstructured data spread across your SharePoint sites...

2024-05-01 10:44:11 GMT

If you feel safer after watching a government unleash violence against its citizenry, you and I obviously have VERY different lived experiences.

2024-04-29 19:40:05 GMT

Nothing in security is easy.
Anyone who tells you otherwise is misinformed, outright delusional, or selling you something.

2024-03-31 23:59:19 GMT

If you're a vendor calling clients telling them to replace their OSS with your software because it's more secure not being open source, I hope you get hit with a ransomware attack that puts you out of business.
You'll deserve it and the industry will be better off without you.