Gerald Benischke
@beny23.github.io
2.9K followers 880 following 940 posts
Maker, breaker and fixer of software. Adventures in #appsec and #agile: beny23.github.io he/him
Posts Media Videos Starter Packs
beny23.github.io
Meh, viewpoints 20 years out of date will just prepare them for the realities in the commercial sector ;-)
beny23.github.io
Great open source supply chain retro. Fondly (erm, not really) remember many of those!
filippo.abyssdomain.expert
To implement robust mitigations across Geomys, I did a survey of open source project compromises in 2024/2025.

Three root causes dominate: phishing, control handoff, and unsafe GitHub Actions triggers. All three can be systematically avoided.

words.filippo.io/compromise-s...
A Retrospective Survey of 2024/2025 Open Source Supply Chain Compromises
Project compromises have common root causes we can mitigate: phishing, control handoff, and unsafe GitHub Actions triggers.
words.filippo.io
beny23.github.io
Just like all the crypto mining infrastructure was reused. Wait what? ;-)
Image of burnt out bitcoin mining farm
Reposted by Gerald Benischke
robbowley.net
Some people are saying the potential overbuild because of AI might not be a bad thing because, like the dotcom era, it could leave behind infrastructure we’ll benefit from for a long time.

1/6
Reposted by Gerald Benischke
junoryleejournalism.com
David Simon, creator of ‘The Wire’, being interviewed by Ari Shapiro (NPR)
SHAPIRO: OK, so you've spent your career creating television without Al, and I could imagine today you thinking, boy, I wish I had had that tool to solve those thorny problems...
SIMON: What?
SHAPIRO: ...Or saying...
SIMON: You imagine that?
SHAPIRO: ...Boy, if that had existed, it would have screwed me over.
SIMON: I don't think Al can remotely challenge what writers do at a fundamentally creative level.
SHAPIRO: But if you're trying to transition from scene five to scene six, and you're stuck with that transition, you could imagine plugging that portion of the script into an Al and say, give me 10 ideas for how to transition this.
SIMON: I'd rather put a gun in my mouth.
Reposted by Gerald Benischke
jjaron.bsky.social
Honestly, when the financial press starts printing diagrams like this, isn't it time for a regulator to step in?
Reposted by Gerald Benischke
estherschindler.bsky.social
I just saw someone use the abbreviation “AI;DR” and I’ll be laughing for a while.
Reposted by Gerald Benischke
lookitup.baby
Seriously? This is ridiculous
carrion.bsky.social
just don’t create a moderation list, bluesky said that’s bad
beny23.github.io
Meanwhile in Redmond:

“Challenge accepted”
abeba.bsky.social
why is msft teams sooooo bad. they couldn’t have built a worse product if they tried
Reposted by Gerald Benischke
meemalee.bsky.social
Author and filmmaker Justine Bateman on generative AI
"They're trying to convince people they can't do the things they've been doing easily for years - to write emails, to write a presentation. Your daughter wants you to make up a bedtime story about puppies - to write that for you." We will get to the point, she says with a grim laugh, "that you will essentially become just a skin bag of organs and bones, nothing else. You won't know anything and you will be told repeatedly that you can't do it, which is the opposite of what life has to offer. Capitulating all kinds of decisions like where to go on vacation, what to wear today, who to date, what to eat.
People are already doing this. You won't have to process grief, because you'll have uploaded photos and voice messages from your mother who just died, and then she can talk to you via AI video call every day. One of the ways it's going to destroy humans, long before there's a nuclear disaster, is going to be the emotional hollowing-out of people." - author and filmmaker Justine Bateman from a piece by Emine Saner for the Guardian
Reposted by Gerald Benischke
jasongorman.bsky.social
4 factors that are reasonably good predictors of which code is likely to break:

1. Complexity (more to go wrong)

2. Coupling (greater risk of breaking changes)

3. Change (the more often code changes, the great the risk)

4. Test Assurance - how thoroughly and how often it's being tested)

(1/3)
Reposted by Gerald Benischke
malwaretech.com
I think the important historic context about Bluesky is while it's seen as a safe space for people who fled Elon-Twitter, it was not designed to be that. It was a misguided side-project created by the previous Twitter CEO (Jack Dorsey) after he learned zero lessons from what happened to Twitter. 1/?
Reposted by Gerald Benischke
beny23.github.io
Schrödinger’s security: Until you look inside you can pretend it might be ok…

Am I doing quantum right?
Reposted by Gerald Benischke
doublepulsar.com
A part of the cause here is operationally - orgs cover up their incidents.

Hire external IR through legal council, don’t tell regulators, put threat intel in TLP wrappers etc.

My entire career has been moving between orgs and knowing all their problems day one. Because they’re all the same.