About

These are the ramblings of a fellow nerd.

Not an analyst firm. Not a vendor with something to sell you. Just someone who has spent a long time in application security, who reads the same firehose you do every morning, and who got tired of not being able to tell the difference between a thing that happened and a thing someone is worried might happen.

So this got built. A machine in a back room reads a few dozen security publications all day and sets aside the ones that look like they matter. Sometimes I write something longer about one of them. That is the whole operation.

If you work in this field

Then you already know the feeling. The vague dread when a new capability ships faster than anyone can reason about what it can be made to do. The specific dread when it turns out to have been reachable from the internet for eight months. The particular exhaustion of explaining, one more time, why "we added guardrails" is not a control.

I feel it too. I am not writing at you from somewhere safe — I am in the same building, looking at the same logs, with the same bad feeling about the thing we shipped last quarter.

Why bother

Because this stuff is genuinely remarkable, and I would like us to get it right. Not slow it down, not pretend it is all terrible — get it right. The people who will decide whether the next decade of this technology is something we are glad about are, somewhat alarmingly, us. People who read security blogs before coffee.

That seems worth paying attention to. So I pay attention, and I write some of it down, and you are welcome to read along.

Following along

The radar updates through the day.Ramblings appear when something is worth the time. There are feeds — one and the other — and nothing else. No email list, no account, no tracking, nothing for sale.

Everything here links to someone else's work. Go read the original — they did the hard part. And please see the terms: this is a fellow practitioner thinking out loud, not advice for your situation.