False Positive or Noise? Smart security teams still get this wrong
Before you report a security finding as a "false positive", make sure you distinguish between FPs and noise. The difference matters, and more people get it wrong than you'd expect
Darren Meyer
The MITRE Thing was a wake-up call
MITRE almost lost funding for a big part of the CWE and CVE programs in 2025. That matters, and we need to act even though it worked out this time.
My Setup (because I'm not cool enough to be on Uses This)
I adore the wonderful Uses This (formerly The Setup) series, which has been "[asking] a random selection of people all about the tools and techniques they're using to get things done" since 2009. I'm never going to be cool enough to actually be interviewed
Espresso milk drinks are starting to all be the same
It's fine, really. Really. But I still have Opinions.
What if you're doing security wrong?
Maybe information security is about more than just protecting information
Starting a blog? In THIS economy?
Why start a blog in 2024? Am I nuts?