David Adrian

I want to juxtapose two classes of people in the security industry on the defender side of security engineering for products.

Movies and video games make it seem like hacking is simply whoever is smarter at computers breaking into someone else’s system.

The Late Show always felt like adulthood to me.

A couple of days ago, exe.dev raised a lot of money1.

Peter Thiel has a four-quadrant framework for how people think about the future, described both in his 2013 SXSW talk, “You are not a lottery ticket”, as well as in his book, “Zero to One”.

If you have a reason to migrate to post-quantum cryptography (PQC), you should not be inventorying keys for the purpose of migration, and you should stop listening to anyone who suggests that you do so.

Adam Langley wrote about how revocation in the Web PKI doesn’t work over 10 years ago.

Discussions around memory safety often focus on choice of language, and how the language can provide memory safety guarantees.

I recently found myself being repeatedly asked for career advice.

Around the time that Elden Ring came out, I had the thought that it seemed like AAA games were getting worse, especially post-pandemic.

A “distrust” is when a certification authority (CA) that issues HTTPS certificates to websites is removed from a root store because it is no longer trusted to issue certificates.

HTTPS adoption in 2024 is around 95-98%, as measured by page loads in Chrome (it would be better if it was 100%!).

In late March 2024, the open source community discovered a backdoor in XZ Utils, a suite of tools that use the xz compression algorithm.

Inspired by some discussion on Hacker News about whether it was a bad career move to switch from “CTO” to “developer”, I want to talk about CTOs.

Large-scale quantum computers are capable of breaking all of the common forms of asymmetric cryptography used on the Internet today.

This evening, it was announced that Jim Harbaugh was leaving his job as head coach of Michigan football to become the head coach of the Los Angeles Chargers in the NFL.

This post is about HTTPS (X.509) certificates used on the web1.

Certification authorities (CAs) are the entities responsible for validating domain control and issuing the certificates used for HTTPS.

It’s early 2023.

Designing schemas for large-scale data analysis for OLAP (e.g.

The market is in a “downturn”, and this is percolating into the venture-backed startup ecosystem.

Rodents of Unusual Size?

The July 31st, 2021 episode of the Security, Cryptography, Whatever podcast was the great “roll your own crypto”1 debate between Thomas Ptacek and Filippo Valsorda, moderated by Deirdre Connolly, with additional commentary provided by me.

This introduces people familiar with Git to trunk-based development, and vice-versa.

The preorders for the latest generation of game consoles (PS5, Xbox Series X/S) were snapped up, and the restocks are flying off the shelves in minutes.

Paul Graham recently posted Write Simply.

Go uses the net.Conn interface to abstract different types of network connections.

The Big Ten has a bit of a situation on their hands.

Last December, I defended my PhD at the University of Michigan.

In my experience, a lot of the non-academics in the security research community aren’t nearly as familiar with which academic conferences are notable, so here they are.

An article has been going around the Internet recently, arguing that branded vulnerabilities are no longer helping application security and have instead become an instance of the “boy who cried wolf” phenomenon.