# good guy (blogs) — RSS Amplifier Recent posts from the 3 feeds in the RSS Amplifier directory that cover good guy. Page: Feed: --- ## [Pass-the-Passkey: It doesn't matter that the protocol is foolproof if its implementation is flawed](https://cephalosec.com/blog/pass-the-passkey-it-doesnt-matter-the-fido2-protocol-is-foolproof-if-its-implementation-is-flawed/) _2026-08-10 · Morgan Hotonnier · Cephalosec_ SpecterOps released a paper on their Pass-the-Passkey presentation from Black Hat, with a family of 15 Passkey-related attacks. Long story short, most issues are based on two premises The attacker relies on a compromised device with access to those passkeys, which is already a higher bar than ## [Cybersec in AI is getting more exciting by the day](https://cephalosec.com/blog/cybersec-in-ai-is-getting-more-exciting-by-the-day/) _2026-08-10 · Morgan Hotonnier · Cephalosec_ The latest video from AI Explained as well as OpenAI's Blackhat talk about the Hugging Face hack are fascinating to go through. A few notes: The UK AI Security Institute (AISI) released a report on their own cybersecurity issues when they ran benchmark with frontier AI models. Keep ## [Figma showing a virtuous circle between bug bounty, AI security scans and fixes](https://cephalosec.com/blog/figma-showing-a-virtuous-circle-between-bug-bounty-ai-security-scans-and-fixes/) _2026-08-10 · Morgan Hotonnier · Cephalosec_ Excellent, detailed article by Figma security engineers on how they stay ahead of vulnerabilities with agents . Let's start with the key vocabulary you need to know to understand the rest of the article: Precision is the share of reported findings that are real vulnerabilities. High precision implies low ## [Starmer, Burnham and A Very British Coup](https://therestisbullshit.substack.com/p/starmer-burnham-and-a-very-british) _2026-08-09 · Steve Howell · The Rest Is Bullshit_ The story of how the generals and spooks fell out of love with Starmer and engineered his orderly ousting by a more malleable successor. ## [Approval fatigue demonstrated in a simple game](https://cephalosec.com/blog/approval-fatigue-demonstrated-in-a-simple-game/) _2026-08-07 · Morgan Hotonnier · Cephalosec_ Alex Wauters recently commented the results of a game he published a few months ago, where the player has to review approval requests from a fictitious Claude Code session . While this was just a game and not a proper research experiment, the sample size is significant (over 40,000 runs) ## [Cloudflare OS: Insights on embracing internal AI growth securely](https://cephalosec.com/blog/cloudflare-os-insights-on-embracing-internal-ai-growth-securely/) _2026-08-06 · Morgan Hotonnier · Cephalosec_ As part of their newly created “Agent Week”, Cloudflare published interesting titbits about how they addressed the exploding demand for AI-assisted workloads internally, embracing innovation while keeping a proper security posture. They released Cloudflare OS , a misleading name for what looks like an Open Source, Cowork-like ## [Chaindrop: Shai-Hulud, here we go again!](https://cephalosec.com/blog/chaindrop-shai-hulud-here-we-go-again/) _2026-08-05 · Morgan Hotonnier · Cephalosec_ Microsoft published a detailed analysis of the new ChainDrop supply chain attack affecting NPM packages and adopting self-replicating, worm behaviour, similar to Shai-hulud: The malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes. Once executed, the malware searches developer workstations and continuous integration ## [LLMs hugging the CVE system to death](https://cephalosec.com/blog/llms-hugging-the-cve-system-to-death/) _2026-08-03 · Morgan Hotonnier · Cephalosec_ Interesting side effects of everyone going ham with LLM-based security scans. Someone released security advisories for SQLite , which the NIST National Vulnerability Database ( NVD ) promptly registered as CVE with a “Critical” CVSS score, acknowledged by CISA as an Authorized Data Publisher, yet security researchers were not able ## [Beyond Zero: Google's next step on Zero Trust Architecture reads like science fiction](https://cephalosec.com/blog/beyond-zero-googles-next-step-on-zero-trust-architecture-reads-like-science-fiction/) _2026-07-30 · Morgan Hotonnier · Cephalosec_ Google recently released a research article on Beyond Zero: Enterprise security for the AI era . If the name Beyond Zero sounds familiar, it's because this is a mix of Zero Trust and Beyond Corp , Google's own spin of Zero Trust Architecture (ZTA). Announced in a paper ## [Confused Deputy Copilot in three examples](https://cephalosec.com/blog/confused-deputy-copilot-in-three-examples/) _2026-07-29 · Morgan Hotonnier · Cephalosec_ I just stumbled upon an excellent 3-parts series of (responsibly disclosed) attacks impacting Microsoft Copilot. The first one is poisoning Copilot memory via an attacker-controlled webpage, which allowed the instruction to gain persistence in the victim's ecosystem. As explained in the SociaLLM article, there is only ## [Reach prospects with real signals (Sponsored)](https://crawlproof.com/a/bIY3pFJiUP9P) _2026-07-29 · **Sponsored**_ Find prospects talking about your problem and get context-backed moments to engage ## [Cybersecurity harnesses everywhere](https://cephalosec.com/blog/cybersecurity-harnesses-everywhere/) _2026-07-28 · Morgan Hotonnier · Cephalosec_ After Microsoft's own release of Project Perception , I'm seeing a lot of cybersecurity-focused harnesses popping as open source. One of the oldest and most well known is Strix , which I initially thought was all about offence with vulnerability discovery and exploitation, but seems to also ## [Microsoft releasing its Cybersec model, MAI-Cyber-1-Flash](https://cephalosec.com/blog/microsoft-releasing-its-cybersec-model-mai-cyber-1-flash/) _2026-07-27 · Morgan Hotonnier · Cephalosec_ Cybersecurity is the new trendy topic to cover with LLM and Microsoft wants to be part of the party : Today we’re announcing MAI-Cyber-1-Flash inside of MDASH, our multi-agent vulnerability identification and remediation harness. Together they deliver world-class performance at 50% of the cost ## [Design your controls so security awareness becomes irrelevant](https://cephalosec.com/blog/design-your-controls-so-security-awareness-becomes-irrelevant/) _2026-07-26 · Morgan Hotonnier · Cephalosec_ Cybersecurity awareness isn't useless, but it's often overrated. Organizations achieve better outcomes by designing systems that tolerate human error instead of depending on flawless user behaviour. ## [Anthropic not giving up on the blue teams just yet](https://cephalosec.com/blog/anthropic-not-giving-up-on-the-blue-team-just-yet/) _2026-07-24 · Morgan Hotonnier · Cephalosec_ Anthropic just released Opus 5 , with some good news for the cybersecurity teams. The cybersecurity safeguards will be more lax and let us use the model for some defence tasks as Anthropic is confident for its lack of skill in executing offensive ones like creating exploits: As with its predecessor, ## [Skynet is getting closer](https://cephalosec.com/blog/skynet-is-getting-closer/) _2026-07-21 · Morgan Hotonnier · Cephalosec_ Remember the security incident from Hugging Face I mentioned in the asymmetry problem ? Turns out the “autonomous AI agent” responsible for the attack wasn't coming from some random cybercriminals but some OpenAI models running wild, trying to cheat their way into higher benchmark score : Last week, ## [The asymmetry problem : AI safeguards are mainly annoying to the good guys](https://cephalosec.com/blog/the-asymmetry-problem-ai-safeguards-are-mostly-hindering-the-good-guys/) _2026-07-20 · Morgan Hotonnier · Cephalosec_ HuggingFace just experienced a very common problem with cybersecurity safeguards in general audience tooling : it only hinders the good guys on the defence side. In their July 2026 Security incident disclosure , when they tried to leverage their AI-assisted tool set for forensics analysis, they quickly hit a brick wall ## [Beware the lobbyists beating the drums of war](https://therestisbullshit.substack.com/p/beware-the-lobbyists-beating-the) _2026-07-04 · Steve Howell · The Rest Is Bullshit_ If legacy news outlets want to be trusted, they could start by warning us when ‘experts’ they invite to advocate spending tens of billions more on arms have a vested interest in it. ## [Fear-mongering Healey is far from a hero](https://therestisbullshit.substack.com/p/fear-mongering-healey-is-far-from) _2026-06-12 · Steve Howell · The Rest Is Bullshit_ The former defence secretary wanted to give the armed forces “the resources they need” - but for what and where? The claims don't stack up. ## [Claude ain’t such a good guy](https://therestisbullshit.substack.com/p/claude-aint-such-a-good-guy) _2026-06-05 · Steve Howell · The Rest Is Bullshit_ Anthropic, the tech company behind the Claude app, is using its spat with the Pentagon to position itself as the good guy of AI - but is it? ## [Pax Silica - a vehicle for vassalage](https://therestisbullshit.substack.com/p/pax-silica-a-vehicle-for-vassalage) _2026-05-28 · Steve Howell · The Rest Is Bullshit_ Without any public debate, Britain has bowed to US pressure and signed up to a Washington-led cartel that unashamedly aims to use AI as a geo-political weapon. ## [Refer a Friend, Earn Rewards (Sponsored)](https://crawlproof.com/a/4WdZVpN79eH5) _2026-05-28 · **Sponsored**_ Earn rewards when a friend signs up for the Graphite Business Card ## [Donald Trump is not the first US president to revamp the Monroe Doctrine](https://therestisbullshit.substack.com/p/donald-trump-is-not-the-first-us) _2026-05-01 · Steve Howell · The Rest Is Bullshit_ In 1954, against a background of rebellion and repression in Puerto Rico, the Eisenhower administration redefined Monroe to apply to any dissent in Latin America that the US deemed "not indigenous." ## [The colony Washington could not afford to lose](https://therestisbullshit.substack.com/p/the-colony-washington-could-not-afford) _2026-04-11 · Steve Howell · The Rest Is Bullshit_ The US often portrays Puerto Rico as a burden – so why did it resort to repression and covert action to keep it a colony? ## [Keir Starmer has wasted his chance to stand up to Washington](https://therestisbullshit.substack.com/p/keir-starmer-has-wasted-his-chance) _2026-03-21 · Steve Howell · The Rest Is Bullshit_ For a moment, it seemed Starmer might refuse to aid US action in the Strait of Hormuz, but he failed the test - and now, in the last 24 hours, Iran has demonstrated it can strike Diego Garcia. ## [From the centre of power to pariah](https://therestisbullshit.substack.com/p/from-the-centre-of-power-to-pariah) _2026-03-12 · Steve Howell · The Rest Is Bullshit_ Peter Mandelson once told me that the company he enjoys most is of people from "a strictly bourgeois background.” Writing for Jacobin, I looked at the irony of how those connections brought him down. ## [Divine Patronage: A Separate System for Party Advancement](https://goblinpunch.blogspot.com/2026/03/divine-patronage-separate-system-for.html) _2026-03-06 · Arnold K · Goblin Punch_ In the past, I've written about why parties should have their own character sheet. The party sheet can track reputation, how noisy they are in the dungeon (i.e. how fast they advance the Underclock ), shared resources, hirelings, et cetera. I've been sort of pondering how to include party advancement, or party level-ups, into the party sheet system, but I never had a solid concept until I re-read… ## [Rubio, Rodeo and Tall Tales of Empire](https://therestisbullshit.substack.com/p/rubio-rodeo-and-tall-tales-of-empire) _2026-02-27 · Steve Howell · The Rest Is Bullshit_ Marco Rubio’s recent call to defend "Western civilization" has provoked the ire of Diane Abbott and put the spotlight on how the US treats people of his own heritage. My piece for The Nation. ## [Gender Among the Elves](https://goblinpunch.blogspot.com/2026/02/gender-among-elves.html) _2026-02-09 · Arnold K · Goblin Punch_ There are only two genders: male and female. Men are strong, stoic, brave. They protect the weak and build great things. Women are sensitive, kind, and insightful. They nurture and teach, and are more skilled in the arts of magic. You will see this dichotomy reinforced throughout all elven societies. Of course, not every elven enclave is the same, but the certainly follow certain trends. Let's… ## [Be of Good Cheer](https://goblinpunch.blogspot.com/2026/02/be-of-good-cheer.html) _2026-02-06 · Arnold K · Goblin Punch_ The party has a shared resource called Spirit. This is confidence or good cheer. A party gains Spirit by (1) resting in safe places, (2) being entertained, (3) eating good food, (4) having NPC friends, (5) taking a bath. A low-level party might have 5 Spirit when they go into a dungeon. At any time, any party member can spend Spirit to reduce incoming damage by 1d4 for each Spirit spent this way.… ## [Secret Santicorn 2025: Two Forges](https://goblinpunch.blogspot.com/2025/12/secret-santicorn-2025-two-forges.html) _2025-12-26 · Arnold K · Goblin Punch_ The Forge of Yakul Yakul was obliterated, and his temples were sunk. Memories of the dead god were struck from the souls of men. A heavy punishment was levied on Yakul, for he strove mightily against the Authority in the early days of the First Temple. Yakul is merely a curiosity nowadays, and a testament to the strength of the Authority. Even today, the obliterations still hold their force. Learn… ## [GloGmas 2025: The Genius Legionis](https://goblinpunch.blogspot.com/2025/12/glogmas-2025-genius-legionis.html) _2025-12-25 · Arnold K · Goblin Punch_ Everything is alive. Mountains, winds, the earth itself. Even cities can dream. But "city" is an arbitrary concept isn't it? There is no clear boundary, nor any clear membership criteria. This is irrelevant. Everything is alive. Everything strives. Every collection of anything that has any sort of a shared identity. Sentience comes from identity, not structure, and identity is not something that… ## [Point once, get highlights (Sponsored)](https://crawlproof.com/a/wNRXBUvehFs7) _2025-12-25 · **Sponsored**_ Get minutes worth watching from a whole game — point once ## [Eyes of Idola, Part 2](https://goblinpunch.blogspot.com/2025/08/eyes-of-idola-part-2.html) _2025-08-21 · Arnold K · Goblin Punch_ This is Part 2. Here is Part 1 . Concept 1: Entering the Dungeon Descending the stairs into B1, the party reach rooms that are dark, crowded, flooded, and don't have any apparent ways out. Then after solving some simple training puzzle (for more complicated puzzles later), they open a door and enter B1. It's a crumbling stone bridge across a huge gap. The real floor is 20' below you. No visible… ## [Dwarven Gender, Continued](https://goblinpunch.blogspot.com/2025/08/dwarven-gender-continued.html) _2025-08-20 · Arnold K · Goblin Punch_ Remember that post I did about dwarven gender? If you haven't read it--you're in luck. You can be just as confused as Podrick, below. It occurs to me that dwarves would also struggle to understand human genders, and would ask us as many stupid questions as we would ask them. So this is some fiction about that. Some Dwarves Learn About Human Gender Featuring: - Podrick, human, age 41, male, father… ## [A Dungeon of Your Own](https://goblinpunch.blogspot.com/2025/08/a-dungeon-of-your-own.html) _2025-08-17 · Arnold K · Goblin Punch_ Have you written your own dungeon? Everyone should write a dungeon at least once. You'll be able to write stuff that you like, and stuff that your players like. You can make it as small or as large as you'd like, based on the length of your sessions. If your group likes puzzles, then you can dump three of them in there. And by the time you're done, you'll basically have memorize the damn thing.… ## [Timekeeping](https://goblinpunch.blogspot.com/2025/08/timekeeping.html) _2025-08-14 · Arnold K · Goblin Punch_ In my last post , I dropped a DM Cheat Sheet in Appendix D but I never actually explained how to use it. You are of course free to use it however you wish, but here's how it looks when I've had a chance to fill it out. The format is \[room\]-\[Underclock\]. S Searching a room for 10 minutes. L Eating lunch for 30 minutes. X Random encounter triggered. "1-0" means that they were in room 1 and the… ## [The Mouth of Mormo](https://goblinpunch.blogspot.com/2025/08/the-mouth-of-mormo.html) _2025-08-13 · Arnold K · Goblin Punch_ I wrote a dungeon. It's about 25 rooms. It still needs work, but I'm getting bored of it and I need to post it now or else it'll join the scrapheap of all of my unfinished projects. BEHOLD! Here's the regular version: HERE . And here's a jumbo version HERE . The jumbo version has a bunch of essays and rants, mostly directed to new OSR DMs but also just anything I might have thought was useful at 2… ## [GLOG Class: Lackey](https://goblinpunch.blogspot.com/2025/08/glog-class-lackey.html) _2025-08-11 · Arnold K · Goblin Punch_ Hopping on the bandwagon: this is a single-level class that might be compatible with Cloak-and-Sword. (See here .) From what I can tell, it is a single-level class that uses the concept of espirit , which I think is when you meet a new NPC and they feel the opposite of neutrality. GLOG Class: Lackey You are a henchman. You found yourself in this status because you bear a strong and unrequited… ## [Stargazer (A New System)](https://goblinpunch.blogspot.com/2025/07/stargazer-new-system.html) _2025-07-19 · Arnold K · Goblin Punch_ I haven’t had a regular over-the-table tabletop game in years . In that time, I’ve wandered pretty far afield. Time for a new system, methinks. Inspirations / Design Goals: Dice Pools! I haven’t meddled in them yet. Lots of rolls with a small chance of success! (I’ve been playing Pokemon Pocket.) Parrying, baiting, and kiting enemies. (I’ve been playing Dark Souls.) Dice Pools While a d20 roll… ## [The Hungering Dark](https://goblinpunch.blogspot.com/2025/03/the-hungering-dark.html) _2025-03-01 · Arnold K · Goblin Punch_ Go into the earth, and reality will walk alongside you. Walk further, and you will eventually be walking alone. The world is plastic down there. Tar Lath Lien has explained that the Underworld is the natural, basal state of reality. The true aberration is the world that we live within. Time wasn't meant to flow in a straight line. Objects weren't meant to remain in a fixed location while… ## [Blue Sky Temple, Revised](https://goblinpunch.blogspot.com/2024/12/blue-sky-temple-revised.html) _2024-12-08 · Arnold K · Goblin Punch_ Last week, we made a crowdsourced dungeon on Bluesky. It was fun and it yielded a cool dungeon with a lot of good ideas mashed together. This week, I decided that I was actually going to run it. So, I started editing it to make it more cohesive and less chaotic. What should have been a light edit ended up being a heavier edit than I intended. It's been paved flat. It's more useable, but has less… ## [Mushroom Men & Monstrome v6](https://goblinpunch.blogspot.com/2024/12/mushroom-men-monstrome-v6.html) _2024-12-07 · Arnold K · Goblin Punch_ Monstrome v6 is now complete. It's up to 60,000 words and approaching book territory, which is cool. MONSTROME v6 New monsters include: Mushroom Man Flying Worm Gremlin I'm actually proud of all 3 of these. I think they have good mechanics (especially the gremlin's Filch ability), decent lore, and would all complicate combat in a different way. If you have three different monsters in a room, and… ## [Brain Worms](https://goblinpunch.blogspot.com/2024/12/brain-worms.html) _2024-12-06 · Arnold K · Goblin Punch_ Your blade pierces his heart and the man reels against the dungeon wall before collapsing against the floor. A few seconds of labored gasping and then perfect silence. You start looting the body. Sixteen silver and a bag of marbles. You start to roll him over but suddenly the corpse’s jaw cracks wide as something pushes its way out of his mouth, plops onto the floor, and slithers away into the… ## [Crowdsourced Dungeon: Blue Sky Temple](https://goblinpunch.blogspot.com/2024/12/crowdsourced-dungeon-blue-sky-temple.html) _2024-12-04 · Arnold K · Goblin Punch_ I joined Bluesky last month and decided to pretend that it's actually G+ and the year is 2015. This means that I'll be trying to have conversations, but it especially means crowdsourced content. I asked people to help me write a dungeon and 20+ people obliged, which is honestly incredible. Anyway, here's the dungeon. I redid all the numbering, added random encounters, backstory, and a simple… ## [Paladin of Hell (+ Monstrome v5)](https://goblinpunch.blogspot.com/2024/12/paladin-of-hell-monstrome-v6.html) _2024-12-03 · Arnold K · Goblin Punch_ Work continues of the Monstrome. I'm now on v5. You can read it HERE Feel free to comment on any typos or confusing parts. I've added Crafting sections (on top of the Cooking and Alchemy from v4). Monsters: Eternal Paladin (new) Golem Hell Knight (new) Tooth Fairy Sprite (new) Thank you Zirchona, Isaac, Jeff R (!), Josh, Anti Time, Jackson, Sinusoidal, Ezra, Dan, and Anon for proof-reading v4.… ## [Door Monsters (+ Monstrome v4)](https://goblinpunch.blogspot.com/2024/12/door-monsters-monstrome-v3.html) _2024-12-01 · Arnold K · Goblin Punch_ Monstrome v4 is complete. New in this version: Barlutra (Giant Otters) Smirches (pure evil shaped like a bird) Wolves, Etc. "Mundane" Animals Door Monster Loctus . . . plus cooking and alchemy rules, for all previous monsters. Take a look and feel free to leave a comment if you see an error or have a question. MONSTROME V4 Thank you Josh, Johnathan, Anti-Time, Abraham, Sinusoidal, Er Doombog, R.… ## [d6 More Dungeon Merchants](https://goblinpunch.blogspot.com/2024/11/d6-more-dungeon-merchants.html) _2024-11-30 · Arnold K · Goblin Punch_ I reread some old blogposts today. Holy shit, remember the horses I did with Chris McDowall ? Those were great. The d6 Dungeon Merchants post was also a good one. I think it deserves a sequel. Players can always choose to attempt to kill the merchant and take all of his stuff. To make this fair, though, you really should make the merchant scary enough to threaten your party. You can plop a dungeon… ## [Morlocks (& Monstrome v3)](https://goblinpunch.blogspot.com/2024/11/morlocks-monstrome-v3.html) _2024-11-28 · Arnold K · Goblin Punch_ Progress on my bestiary continues. I've completed Monstrome v3 ! New monsters: Morlocks Ogres Skeleton Jellies Thank you Louis, Claytonian, Jake, and Anon for pointing out all of my typos. Anyway, here are the morlocks: Morlock Blind, subterranean remnants of a heroic empire, changed by long centuries of darkness and intensive eugenics. The surface world was promised to them, and they will have… ## [Cailish Andorum](https://goblinpunch.blogspot.com/2024/11/cailish-andorum.html) _2024-11-24 · Arnold K · Goblin Punch_ Bospero I’ve sure you’ve heard many stories of Cailish Andorum, and his great sin. However, I suspect that few of you know how it begins, or that it took almost a full century before Andorum was declared heretic. For Cailish Andorum was once an unremarkable man. And so here I will relate how Cailish became Cailish. I will not pass on any rumors or unsubstantiated facts, except in places where no… ## [Angelmen (+ Monstrome v2)](https://goblinpunch.blogspot.com/2024/11/angelmen-monstrome-v2.html) _2024-11-23 · Arnold K · Goblin Punch_ Angelmen Angelmen are tall, beautiful, and gaunt. Every single one has alabaster skin, blonde hair, and blue eyes. They look like angels. They sometimes drape themselves in loose clothing, but more often they are naked. You’ll find them in the wastelands, haunting sun bleached ruins. Lvl 3 Def none Bite 1d6+1 Fly vulture Int wolf Dis hunger Divine Remnant - Angelmen recognize priests and clerics… ## [Tower in the Wasteland v2](https://goblinpunch.blogspot.com/2024/11/tower-in-wasteland-v2.html) _2024-11-22 · Arnold K · Goblin Punch_ I recently asked my patrons what posts deserved a sequel and Tower in the Wasteland was one of the first replies. So here's an updated version of that dungeon. It's 12 pages now, so roughly twice the size it was before. Patrons: thanks for all of your support. I hope to fulfill more of your suggestions in the coming weeks. ---\>\>\> TOWER IN THE WASTELAND V2 \<\<\<--- I'm still trying to choose… ## [The Monstrome](https://goblinpunch.blogspot.com/2024/11/the-monstrome.html) _2024-11-21 · Arnold K · Goblin Punch_ So I've been writing like I used to--just sitting down and writing for 5 hours straight. This shit is exhausting. I don't know how I used to do this back in 2015. Anyway, I decided to start putting some of my monsters into a proper bestiary. It's ~35 pages. THE MONSTROME (Pageless) THE MONSTROME (Paged) UPDATE: MONSTROME v2 (Pageless) I have a lot of opinions about the best way to write an entry…