F15hb0wn Blog Entries

My feed swings between AI worship and AI scorn. After a year of using these tools hard, here is the unromantic version: a language model is a very good guesser. Once you see prediction and measurement as two different jobs, both the hype and the cynicism fall apart.

Two detectives, same case. The one who guesses fast, or the one who shows her work? Why cybersecurity can't run on lucky guesses — and how empathetic processing bridges the two.

The counterpoint to being disoriented in New Zealand has been finding a better balance than I ever had in the US. A fifty-minute walking tour of the city, the rituals that anchor my days, and a love letter to my new home.

In this episode, James talks to Charles Herring about what happens when an IT wizard runs away to join the Navy, works on fighter jets, and then gets thrown into cybersecurity right after 9/11? He shares his unconventional journey from the Wild West days of network defense, complete with fighting worms with worms—to being CISO during the Target breach. Plus: why trauma creates silos, why your SOC is like throwing receipts in garbage bags, and what it takes to build a "good neighborhood" in cybersecurity.

Earlier this week, WitFoo and the University of Canterbury released 100 million labelled cybersecurity records to Hugging Face under Apache 2.0. Here's a three-prompt walk-through for putting it to work in a stack you already own (Grafana, Sentinel, Splunk, Elastic), using Empathetic Processing to translate, detect, and visualise across your own data.

In 2003 at the Naval Postgraduate School, the Blaster worm taught me hard lessons about patch windows, perimeter assumptions, and the laptops that walk in from outside. With Anthropic's release of Mythos, we're about to relive a version of that August, compressed and supercharged. Here's the guidance I gave my team and what I wish I'd known in Monterey.

After publishing The Nuclear Code Fork, smart engineers pushed back with reasonable objections: use mature projects, wait for stable releases, pin your versions, trust the process. Every one of those heuristics was right once. Here's why they're wrong now, with specifics from Log4j, Trivy, LiteLLM, and tj-actions.

We killed all 450 external dependencies in our analytics platform and brought every line of code in house. It took two days, ~305K tokens, and uncovered 14 vulnerabilities that were already sitting in our stack. Here's why we did it, what we found, and what it actually cost.

In November 1998, a terrified young sailor stepped onto the flight deck of the USS Kitty Hawk during night operations and had to make a hard choice under impossible pressure. Twenty-seven years later, the tech industry could use that same lesson.