Recent content on David Adrian
Movies and video games make it seem like hacking is simply whoever is smarter at computers breaking into someone else’s system. That’s not quite the case. Hacking is the act of exploiting vulnerabilities. And a vulnerability is just a bug. Software has bugs. Some of these bugs are functional bugs where the software does not work correctly. A subset of bugs will have some security…
The Late Show always felt like adulthood to me. Growing up, I heard about David Letterman before I was old enough to stay up late enough to watch The Late Show. One of the local radio stations syndicated Letterman’s Top 10 List bit, and on the days where I didn’t take the bus to school, depending on what time my Dad would drive me into school, we’d hear it in the car on the way…
A couple of days ago, exe.dev raised a lot of money 1 . I decided to poke around with it a little, and signed up. Their trial is 7 days long, so despite having no actual plans, I just started doing stuff. In doing so, I noticed a few interesting things that I thought were worth a quick writeup: I didn’t have to configure an SSH key to be able to ssh exe.dev . I could SSH to my VM despite not…
Peter Thiel has a four-quadrant framework for how people think about the future, described both in his 2013 SXSW talk, “You are not a lottery ticket” , as well as in his book, “Zero to One”. Thiel’s commentary is about society writ large and part of an ideological framework for investing in startups. Instead, let’s use Thiel’s framework to understand security teams, including both teams that…
If you have a reason to migrate to post-quantum cryptography (PQC) , you should not be inventorying keys for the purpose of migration, and you should stop listening to anyone who suggests that you do so. You should not be creating a cryptographic bill of materials. You should not be running cryptographic discovery tools. A key inventory is the wrong place to start a migration, and will result in…
Adam Langley wrote about how revocation in the Web PKI doesn’t work over 10 years ago. Since then, the Web PKI has drastically changed for the better, despite not appearing to “solve” revocation. Unfortunately, many people interpret Adam’s post to mean “we must build a better revocation system for the Web PKI, today”. In reality, revocation does not make sense…
Discussions around memory safety often focus on choice of language, and how the language can provide memory safety guarantees. Unfortunately, choosing a language is a decision made at the start of a project. Migrating an existing C or C++ project to a safer language is much harder than starting a new project in a safe language 1 . I’m not going to say this is impossible, or that you…
I recently found myself being repeatedly asked for career advice. I’m not very good at this, as the best I could offer people in terms of what worked for me is basically “ get overeducated , then make better decisions 10 years ago”. In the context of “cybersecurity”, one piece of advice I can give, that’s applicable to careers, leadership, and getting things…
Around the time that Elden Ring came out, I had the thought that it seemed like AAA games were getting worse, especially post-pandemic. Elden Ring was both open-world and loudly heralded as one of the best games in years; however it seemed like, in general, there were more and more open-world games and more games in large franchises (rather than new IP). Unlike Elden Ring, on average, I felt like…
A “distrust” is when a certification authority (CA) that issues HTTPS certificates to websites is removed from a root store because it is no longer trusted to issue certificates. This means certificates issued by that CA will be treated as invalid, likely causing certificate error interstitials in any browser that distrusted the CA. Distrusts can happen for security reasons, compliance…
HTTPS adoption in 2024 is around 95-98% , as measured by page loads in Chrome (it would be better if it was 100%!). These days, a plaintext HTTP site is a rarity, enough that many users of Chrome’s “Always Use Secure Connections” mode, which presents a full-page interstitial warning the user before accessing an HTTP page, see an average of zero warnings per week. But it…
In late March 2024, the open source community discovered a backdoor in XZ Utils, a suite of tools that use the xz compression algorithm. The xz backdoor was embedded inside liblzma, and took effect when liblzma was used in OpenSSH, a common remote-login tool. You can read about this extensively in many places elsewhere . Since then, many people leveraged the xz backdoor to highlight their favorite…
Inspired by some discussion on Hacker News about whether it was a bad career move to switch from “CTO” to “developer”, I want to talk about CTOs. Specifically, CTO is not a real job and you should likely not aspire to be one 1 especially if you view yourself as primarily someone who sticks to engineering career ladders, either as a manager or as an individual contributor.…
Large-scale quantum computers are capable of breaking all of the common forms of asymmetric cryptography used on the Internet today. Luckily, they don’t exist yet. The Internet-wide transition to post-quantum cryptography began in 2022 when NIST announced their final candidates for key exchange and signatures in the NIST PQC competition . There is plenty written about the various algorithms…
This evening, it was announced that Jim Harbaugh was leaving his job as head coach of Michigan football to become the head coach of the Los Angeles Chargers in the NFL. Destiny is calling him, and it’s wearing a Super Bowl ring. It seems silly to cry about a head coach leaving a college football team, but I did. I cried even though I fully expected this to happen (although I had been…
This post is about HTTPS (X.509) certificates used on the web 1 . It has two parts: Certificates explained without cryptography Certificates explained with cryptography The explanation with cryptography depends on the explanation without cryptography, so you’ll want to either read both, or only read Part 1. Certificates and certification authorities, explained without cryptography Websites…
Certification authorities (CAs) are the entities responsible for validating domain control and issuing the certificates used for HTTPS. The Baseline Requirements (BRs) are technical and policy requirements that govern certification CA behavior, compliance with the BRs is “verified” by external auditors. Root programs are ran by certificate consumers that maintain root stores, such as…
It’s early 2023. All the big tech companies have done at least one round of layoffs 1 . Many midsize tech companies have as well. The rationale for layoffs at smaller startups that aren’t yet revenue positive is simple: cut costs and try to get to profitability faster. But why are big tech companies that make billions of dollars every quarter also laying people off? Revenue for big…
Designing schemas for large-scale data analysis for OLAP (e.g. BigQuery, Snowflake, Avro, JSON Lines, etc.) is different from designing data structures in code or schemas for relational databases. This post focuses on advice for creating schemas for large-scale data analysis. I use X.509 certificates as concrete example of a dataset in need of a schema because I’ve worked with it a lot in…
The market is in a “downturn”, and this is percolating into the venture-backed startup ecosystem. The broad consensus is that the top end of startup valuations are coming back to reality. But what does this mean? What makes a valuation out of this world? And how does this affect employees 1 ? Startup valuations are determined by the amount of money a company raises in exchange for a percentage of…
Rodents of Unusual Size? I don't believe they exist. There’s endless discourse around tech debt. Kellan has some really good categorizations of different types, Will Larson has a great explainer of organization debt in his book , and I also like the idea of product debt . Throughout my career, I’ve been an engineer complaining about tech debt, a manager prioritizing (and deprioritizing) addressing…
The July 31st, 2021 episode of the Security, Cryptography, Whatever podcast was the great “roll your own crypto” 1 debate between Thomas Ptacek and Filippo Valsorda , moderated by Deirdre Connolly , with additional commentary provided by me. Loosely, Filippo was arguing that the mantra of “don’t roll your own crypto” has been ineffective and mostly serves as a form of…
This introduces people familiar with Git to trunk-based development , and vice-versa. I wrote it for work in reference to Github, but it applies to any Git web UI that supports pull requests. I’ve been told it’s a useful reference, so I’m posting a lightly-edited version publicly. tl;dr: One idea is one commit . Implement trunk-based development using the standard Github branch…
The preorders for the latest generation of game consoles (PS5, Xbox Series X/S) were snapped up, and the restocks are flying off the shelves in minutes. Sony and Microsoft say that they’re ramping up production, but to expect supply shortages through June of 2021 . Consoles are snapped up within seconds after online restocks. Why aren’t Sony and Microsoft making this easier for…
Paul Graham recently posted Write Simply . I respect Paul Graham as a founder and an investor. His essays on startups are insightful, but I always felt like something was a little bit off . It turns out that this is because he presents opinions as facts, then disguises this with his writing style . His more recent essays have also strayed away from his original technical and startup-focused…
Go uses the net.Conn interface to abstract different types of network connections. A net.Conn has both Read and Write methods, and is usable as an io.Reader and an io.Writer . Some common implementations of net.Conn are net.TCPConn , which uses TCP to provide reliable streams, and tls.Conn , which wraps an existing net.Conn and uses TLS to provide secure streams. A net.Conn object is usually…
The Big Ten has a bit of a situation on their hands. The Big Ten cancelled the Fall 2020 college football season, and expected to be praised as leaders and legends. Instead, many coaches, players, and athletic directors were upset. Some fans were angry, yet many others had realized months ago that it simply did not make sense to try to play football during an uncontrolled pandemic, especially…
Last December, I defended my PhD at the University of Michigan. At the time, I’d been in grad school for four and a half years, and I’d been working with my research group for another year before that. I also went to Michigan for undergrad, so I’ve been living in Ann Arbor for nearly nine years. Why did I do this? Before I go on, I want to say a few things up front. I went to…
In my experience, a lot of the non-academics in the security research community aren’t nearly as familiar with which academic conferences are notable, so here they are. These conferences are not structured like many “industry” conferences. Instead, these conferences consist of presentations of peer-reviewed academic papers that were submitted to and peer-reviewed by the…
An article has been going around the Internet recently, arguing that branded vulnerabilities are no longer helping application security and have instead become an instance of the “boy who cried wolf” phenomenon. The Badlock bug is a textbook example of over-hyping vulnerabilities for marketing purposes rather than for promoting good security hygiene. The disclosing team’s dubious…
Links to code and stuff
Education University of Michigan , Ann Arbor, MI Ph.D. in Computer Science 2019 Dissertation: Using Large-Scale Empirical Methods to Understand Fragile Cryptographic Ecosystems University of Michigan , Ann Arbor, MI Master of Engineering, Computer Science 2016 University of Michigan , Ann Arbor, MI Bachelor of Engineering, Computer Science 2014 Conference Publications Hop: A Modern Transport and…
Almost nothing is truly required for nearly everything. Don’t do something now if you’re able to put it off and do it better later. Many things are only controversial if you act like they’re controversial. The best prioritization is strong and shared conviction in a direction. It is always good to remove requirements that are bad. Figuring out how to run the thing is building the…
If you will it, dude, it is no dream.