A complete Silver Bullet archive (with episodes starting twenty years ago in 2006) can be found on my website.

#swsec #appsec #MLsec

https://www.garymcgraw.com/technology/silver-bullet-podcast/

The Silver Bullet Security Podcast rides again. Our first relaunch episode (episode 154 for those of you counting) can be found on the BIML website.

#MLsec #swsec #appsec #ML #AI

Future episodes are already planned with Giovanni Vigna, Phil Venables, and Nicolas Papernot.

Tune in and subscribe.

https://berryvilleiml.com/podcast/

This is bad security engineering, but it is also a much harder problem to solve than most people realize. #swsec

https://www.theguardian.com/environment/2026/mar/14/nissan-leaf-app-shutdown-nissanconnect-ev-app

#AI is having a big impact on software development. Is this good or bad from #swsec? Nobody knows.

https://www.theguardian.com/technology/2026/mar/12/atlassian-layoffs-software-technology-ai-push-mike-cannon-brookes-asx

It is both rewarding and daunting to be mentioned in this work along with Ken Thompson and Ross Anderson. Lots of ideas expressed in this essay are right on the money.

Have a read. Pass it on.

#MLsec #ML #swsec #appsec #security #infosec

https://medium.com/@maconstantino/trust-me-i-am-compiled-from-ken-thompson-to-the-age-of-poisoned-models-e172c852e408

Maybe the answer is "building security in" instead of "penetrate and patch," huh @gadi ?

#swsec #MLsec #appsec

https://www.wsj.com/tech/ai/send-us-more-anthropics-claude-sniffs-out-bevy-of-bugs-c6822075

#ML and #AI deeply impacting time to exploit. The zero day clock shows this.

This is #security impacted by ML...not #MLsec

Guess we should have learned those lessons from #swsec 25 years ago

https://zerodayclock.com/

@david_chisnall absolutely excellent third paragraph.

Writing software requires great clarity in either requirements or design or (the gods willing) both. AI dev tools appear to work properly only when architecture is clear and built by a human. Formally verified bad design is still bad design.

Security is an emergent system property that is difficult to specify formally without absurd logical contortions

Go

#swsec #appsec #MLsec #security #dev

The Silver Bullet Security Podcast is back! Episode 154 is an interview with Gadi Evron. Have a listen and subscribe to the series.

#MLsec #ML #AI #security #swsec #appsec

https://berryvilleiml.com/2026/03/02/silver-bullet-security-podcast-154-gadi-evron/

@baldur the only answer is to try to be one of the authorities. This is why in 2006 there were three "popes" in #swsec. At least I had my own pope hat.

Proud to have assembled and chaired the Irius Risk Technical Advisory Board. Irius Risk was bought by ThreatModeler in December. The TAB was a particularly potent group of advisors.

#swsec #appsec #threatmodeling

https://theoutpost.ai/news-story/threat-modeler-acquires-irius-risk-for-over-100-million-to-tackle-ai-driven-security-risks-22877/

Just got a briefing on how OpenAI develops and secures code internally using Codex5.1. Also got another briefing on the ONE MLsec-ssg that any of us have ever seen in a major enterprise.

The world is changing.

#MLsec #swsec #appsec #AI #ML

Talking about VIBEguard and the emerging "SLOPopcalypse" in software dev during the LEGIT Technical Advisory Board.

#appsec #swsec

@nuthatch there is also a book in my #swsec series about this https://a.co/d/f5OTVe9

Two things. #AI #ML

1. Not only did Anthropic use seven of my books in their training set, ignoring copyright ownership. Horrors!

2. They did not access the most important books, thus putting together a statistically-incorrect version of my thinking about #swsec Double Horrors!

What happens to #MLsec when training sets are philosophically skewed?

https://berryvilleiml.com/2025/12/05/the-anthropic-copyright-settlement-is-telling/

Satire is always powerful. I wonder how secure microwaves are? #MLsec #swsec #appsec #AI #microwave

https://www.colincornaby.me/2025/08/in-the-future-all-food-will-be-cooked-in-a-microwave-and-if-you-cant-deal-with-that-then-you-need-to-get-out-of-the-kitchen/

Twenty years ago, we published this paper about software security BUGS. Brian Chess and I attempted to introduce a logical taxonomy for vulnerability. Later, mitre fucked it all up by pouring all the bugs into the same huge pot, adding water, and calling it soup. @peisert @Securityandprivacy

https://www.garymcgraw.com/wp-content/uploads/2015/11/bsi11-taxonomy.pdf

#swsec #appsec

Here we go again npm: https://www.koi.ai/incident/live-updates-sha1-hulud-the-second-coming-hundred-npm-packages-compromised. This time the malware will attempt to delete the victim's home directory if unable to obtain credentials.

Don't know many details yet. I guess it's not unfair to assume that the attackers are still utilizing something like the post-scripts aka rce-as-a-service functionality. Mitigate by setting `npm config set ignore-scripts true`. As other actions, freeze updates and get on top of your package tree.

#swsec #infosec #security #npm #cybersecurity

@windsheep this is exactly right on the money. Architectural view and understanding matters very deeply.

Coding a 10,000 line thing "automatically" is amazeballs but it does not reflect (at all) the scale or the architectural complexity of modern software. We are painting ourselves into an enormous maintenance problem corner.

#swsec #MLsec

@nytimes @cademetz BIML has extremely deep expertise in both #ML (Katie did shazam, Harold wrote early birdnet, I wrote my first neural net in 1989 and was a Doug Hofatadter PhD student.) and security engineering (I helped invent #swsec and #appsec, richie published at usenix security as an undergrad).  The combination is all too rare.

The world needs more hard core #MLsec