It's critical that infosec professionals and consumers understand threats and vulnerabilities, but they are being kept in the dark.

Apple expert Thomas Reed learned a lot about Apple's attitude to security at the Objective by the Sea security conference.

Civil Cyber-Fraud Initiative mandates data-breach reporting for gov't contractors.

Public disclosure comes in wake of other grumblings about Apple's bug bounty behavior.

It happens all the time: Organizations get hacked because there isn't an obvious way for security researchers to let them know about security vulnerabilities or data leaks. Or maybe it isn't entirely clear who should get the report when remote…

Apple allegedly pays less for bugs than its competitors do—and pays more slowly.

U.S. anti-hacking laws present a threat to national security, as they are failing to prevent breaches and discouraging white-hat hackers from doing beneficial security research.

Written and performed by Forrest Brazeal (x3)

New tech songs drop first on Twitter: https://twitter.com/forrestbrazeal

Lyrics:
VERSE 1
My day was going great;
Just pushed a code update;
But then the pagers started humming:
Oops, did I just delete
Half the production fleet?
That sinking feeling's coming, from deep within my plumbing

PRECHORUS
Now my life is flashin',
Hope my boss will show compassion
And I really, really need someone to say...

CHORUS
Hey hey hey, it's gonna be okay.
You didn't just set fire to your resume.
This happens to the best,
Try not to get too stressed,
It'll be an awesome story someday.

VERSE 2

I tweaked a small config,
Turns out that it was big
And now my app has been beheaded;
When I do something wrong,
I fear I don't belong,
How can the world forget it, we're trending now on Reddit.

PRECHORUS 2
Oh, mistakes will find you
But you've got a team behind you
So fix the process, yes, but don't dismay:

CHORUS 2
Hey hey hey, it's gonna be okay.
We'll do a full postmortem some other day.
It was a swing and miss,
We're gonna learn from this
And we'll all be better engineers, like,
 
BREAK
Look, here's what you need to know when something gets destroyed
If there's negligence or malice then you shouldn't be employed
But if a human is assumin' then the problem is the system;
It's gut-wrenching, butt-clenching, but you work with 'em.
It can happen to a junior, happen to a senior.
Just because you caused a little pause doesn't mean you're
Incompetent, it means you're doing work with real effect.
It's a scar of battle, baby. That'll earn you some respect.

PRECHORUS 3
And we all have been there
Made a slip or two or ten there;
So we try to do a blameless RCA...

CHORUS 3
Hey hey hey, it's gonna be okay.
You will still be here when this blows away.
We've all screwed something up,
So welcome to the club.
We would love to hear your story someday.

Cybersecurity professionals spend their lives dissecting code and analyzing incident reports to discover how to stop the bad guys.

The decision to block an “expert” level cyberattack has caused controversy inside Google after it emerged that the hackers in question were working for a US ally.

A guide on coordinated vulnerability disclosure for open source projects. Includes templates for security policies (security.md) and disclosure notifications. - oss-vulnerability-guide/guide.md at ...

A zero-knowledge encryption flaw, enabling trivial brute forces of student data when Canvas/Moodle is used.  This is my timeline on a fla...

Slack, the messaging app that boasts at least 12 million daily active users, paid a security researcher $1,750 for finding a critical flaw that could have let attackers hijack a person's computer. Talk about stingy.

Bug Bounty a hack of Grant Howitt’s Honey Heist by horrorcheck You’re an engineer at a startup and it is LAUNCH DAY. Your job: discover and fix mysterious bugs in a complex software system. Good thing you literally eat bugs for breakfast.         (name)       is a/an        (descriptor)        (r...

Dropbox privately paid top hackers to find bugs in software by the videoconferencing company Zoom, then pressed it to fix them.

The promise of crowdsourced cybersecurity, fueled by "millions of hackers," turns out to be a pipe dream, despite high-octane marketing from the bug bounty platforms.

Letting a company know about flaws in their products has gotten easier since 2003—but not by much.

Early disclosure will only happen if both parties agree.