Lea Kissner

The eMudhra "don't trust this trusted cert" vulnerability situation added insult to injury: this is actually a time where connecting to random wifi could be a security issue*. Usually this is terrible security advice! * If your OS and all the apps caching their own trusted you certs aren't fixed.

Why does this airplane keep trying to show me some movie called "Disclosure Day"? We've all seen that enough this week

Lea Kissner reposted

CyLab

@cylab.bsky.social

“People are spending a lot of time trying to automate things, and I need to automate making the problems go away, because the time to exploit is coming down to zero.” @leak.bsky.social, @linkedin.com CISO & VP, talks ground-level #AI attacks & defenses at the @cylab.bsky.social Partners Conference.

Uh oh, Amazon has uncovered my deepest darkest secrets.

Dexerto@dexerto.bsky.social

Amazon users are discovering a bizarre "About You" page that reveals what the company thinks it knows about them One woman found Amazon had determined she "has flat buttocks"

informit.comInformIT: The Trusted Technology Source for IT Pros and DevelopersResources from the authors, creators, innovators, & leaders of technology - home to leading publishers Addison-Wesley Professional, & Sams.

"Building Safer Technology: A Field Guide to Failing Well" is here and you can get it wherever books are sold (35% discount code for you in this thread). I've spent 20 years dealing with terrible things on the Internet and I've learned a lot about how to build things which really *work*.

Discount code SAFERTECH confers a 35% discount off the list price of ISBNs 9780135589328 or 9780135589359 only when purchased on informit.com. Discount does not apply to “Best Value” or “Additional Savings” book + eBook bundles. Offer expires 11:59pm EDT May 31, 2027.

Discount may not be combined with any other offer and is not redeemable for cash. Offer subject to change. (Yes I am required to post that whole schpiel)

Go beyond theory and learn to implement safety practices directly into your workflows and organizational structure. This book provides concrete tools, mental models, and communication strategies for individuals and team leaders to build products that can withstand real-world chaos.

You'll learn how to prevent failures and also how to manage them gracefully when they inevitably occur, preserving trust and turning crises into powerful learning opportunities.

Technology is changing fast. So are humans. Software and AI are woven into everything from power grids to the devices in our homes, failure is no longer a minor inconvenience―it's a critical business risk that can cost lives, paralyze economies, and erode trust.

Building Safer Technology delivers a practical field guide to safety engineering, a practice dedicated to designing systems that are not only innovative but also fundamentally resilient. We teach durable thinking that works even as technology and the ways we interact with it change.

2 Sept

The Pinterest office has a really nifty 📌 giant red pushpin made of Lego📌 They were kind enough to invite me to speak yesterday and had over an hour of great questions, so I'm pretty sure that they liked the talk.

21 Aug

I can't believe that our book, "Building Safer Technology: A Field Guide to Failing Well" is here NOW. Learn how to build safely -- security, privacy, trust&safety, AI safety, etc. We concentrate on the underlying thinking and skills so this is durable knowledge even as technology changes.

informit.comBuilding Safer Technology: A Field Guide to Failing Well | InformITFailure is inevitable. Failing well is a skill. The era of "move fast and break things" is over. In a world where software and AI are woven into everything from power grids to the devices in our homes...

21 Aug

I don't have a copy yet, so you might be able to get one before I do! Get it from the publisher: www.informit.com/store/buildi... Or Amazon: www.amazon.com/Building-Saf...

youtube.comPeople HATE her job 🇧🇷 Ep. 607 🪜YouTube video by Max Klymenko

3 Aug

From watching Career Ladder I've decided my job is like fugu sashimi because if you mess it up, someone will get hurt and many people would never touch it (On Career Ladder, the host tries to guess someone's job in 2 min and often asks what kind of food the job would be) youtube.com/shorts/0cc4V...

20 July

HEY GUESS WHAT YOU CAN ATTACH A GIANT BRIM TO YOUR BIKE HELMET AND MAKE IT INTO A GIANT HAT!

Did I mention that we've been writing a book? Fundamentally, security, privacy, trust&safety, AI safety -- all the fields aimed at dealing with dealing with how technical systems hurt people and how to avoid it -- share a foundation. We cover how to think and achieve *truly* effective practice. 1/

InformIT: www.informit.com/store/buildi... Books A Million: www.booksamillion.com/p/Building-S... Barnes And Noble: www.barnesandnoble.com/w/building-s... Walmart: www.walmart.com/ip/Building-...

I've been asked about how to get a signed copy. In this case, message me, we don't have anything set up.

Thanks also to @stamos.org @lizthegrey.com @jeffdean.bsky.social @lorriecranor.bsky.social Sam Shillace and Mark Russ for taking time out of their extremely busy schedule to look the book over and write us blurbs. /5

pearson.comBuilding Safer Technology: A Field Guide to Failing Well

Pearson: www.pearson.com/en-us/subjec... Amazon: www.amazon.com/Building-Saf... OReilly: www.oreilly.com/library/view... Google Play Books: play.google.com/store/books/...

... like metrics that drive effective action (and not perversity), communication, and team design. I had to learn all of these things the hard way, both on my route to Distinguished Engineer and as a CISO. This is the book I wish I'd had and I hope it helps you, well, build safer technology. 3/

I've been lucky to work with amazing people in my career and on this project. Yonatan Zunger and I have worked together for nearly two decades and have been meaning to write this book for over 10 years. We also have Phillip Misner, JP Hernandez, Harmony Mabrey -- and the inimitable Danielle Cass. 4/

_Building Safer Technology: A Guide to Failing Well_ covers topics all the way from design to incident response to programs all the way to the nitty gritty critical things that no one talks about but are so often the difference between good intentions and effective impact. 2/

1 July

What *does* a hacker look like to you? I probably shouldn't admit how many black hoodies I own, should I? (Spy Museum in NYC, BTW. My kids loved it.)

nytimes.comOne Job That Is Growing in the A.I. Era? Cybersecurity Experts.

9 June

I can't really walk this week for mysterious reasons* and boy is my dog happy with my inability to get into the office. * Literally I don't know why and the doctor doesn't have appointments for weeks. Please feel free to suggest good concierge doctors around Mountain View this is silly.

Do you know what job is incredibly in-demand because of AI? Security. We're always trying to outrun the Internet, but the Internet got faster. The threat landscape has shifted radically at the same time as the attacks have accelerated. I chatted with @kateconger.com: www.nytimes.com/2026/05/24/t...

Holy crow does the security field need people who are willing to say "I don't know, let's figure it out" and understand the systems in enough depth to figure it out. We don't know how to handle security sustainably yet in this shifted threat landscape... let's figure it out.

Note that this means that not every job in security is likely to be in equal demand. The system-oriented, figure-it-out jobs are much more valuable in a world of LLMs than a more structured job. That's not unique to security, but it's still true for us.

nytimes.comOne Job That Is Growing in the A.I. Era? Cybersecurity Experts.

The rate of supply chain attacks is bonkers. Right now we're seeing hundreds in a week when about a month ago 7/week was notable. Coding agents, like humans, are not perfect and don't write perfect code -- they also tend to do wild things and effectively attack your internal systems in the process

The most effective way to deal with most of these things is with really solid engineering-oriented security, making the underlying systems work better as well as more safely. Using LLMs can help us investigate potential incidents and pay down technical debt and build security features but...

I have learned a valuable lesson thanks to a Little Free Library in my neighborhood: the Daily Mail and I do not agree on what makes a good novel.

Companies are much more transparent about security and reliability bugs than privacy bugs. I've wanted solid data on this for a decade, but it's effectively impossible to get. 1/🧵 Obligatory notice: I'm not speaking about or on behalf of my employer. I'm speaking as someone who founded PEPR

Data Bear 🏳️‍🌈@dataandpolitics.net

Tech engineering normalized transparency (status pages, postmortems, bug disclosures) partly to encourage other industries to do the same. Decades later it’s backfired: people hear our issues but not their own industry’s, so they assume engineering is worse rather than more transparent.

For similar reasons it's very, very hard to get data on privacy engineering topics. I really hoped that the European Data Protection Authorities would capture data from incident disclosures with eng info, but given that they're getting free-form data from lawyers this seems unlikely. 6/

usenix.orgPEPR '26The 2026 USENIX Conference on Privacy Engineering Practice and Respect (PEPR '26) will take place on June 1–2, 2026. PEPR is focused on designing and building products and systems with privacy and res...

Right now, pretty much the only way to learn about these topics in practice is to go to PEPR (the Privacy Engineering, Practice, and Respect conference) or to quietly ask someone you know in the field. I'm glad we have a conference (it's June 1!) but ... www.usenix.org/conference/p...

Data Bear 🏳️‍🌈@dataandpolitics.net

Security has built a culture where the expectation is that there is a certain level of discussion. If you disclose an issue competently, I may well end up believing that you're more competent rather than less. 4/

When I worked at Google it was much, much easier to talk publicly about, say, the sophisticated XSS that someone found. It required bouncing it off an XSRF in an entirely different surface. If this is the only XSS you have in ~2014, you were doing pretty well. Everyone got to learn, it was great. 5/

Data Bear 🏳️‍🌈@dataandpolitics.net

Speaking about privacy is much harder. For several years PEPR couldn't find anyone to speak about how to do privacy incident response because it was really only done at large companies who were afraid to admit that there even *were* incidents. Can you imagine this happening in security? 2/

(Eventually I could speak because I was working at a startup and they were happy to advertise that they had serious security/privacy chops wildly out of proportion to their size.) 3/

20 May

Are you a privacy engineer or work with privacy engineers? Would you like to learn more about probably engineering? Boy do I have a conference for you! PEPR, the conference on privacy engineering, practice, and respect, is happening June 1-2 in Santa Clara, CA. www.usenix.org/conference/p...

27 Apr

Spotted in the San Jose airport TSA bins: Delve comparing themselves to the TSA. Given the accusations leveled at Delve, I'm very amused by "AI can't prevent a secondary pat-down but it can find your SOC 2 evidence"

13 Apr

A few of us are (finally!) in the last stages of editing a new book 🎉 and the tentative title is "Creating Safety: How to build with new technologies without shooting yourself (and others) in the foot" Good title? Have a better one?

9 Apr

Security folks: have we considered *not* releasing security patches for the avalanche of bugs we're about to deal with? Hear me out. Given how much faster it's getting to reverse engineer an exploit from a patch and that we're expecting to fix *so* many bugs at once, maybe do a full release.

9 Apr

Add a bunch of chaff in the form of non functional but potentially-interesting changes to slow things down and hopefully people have more time to, say, update iOS or Linux before the exploits are out there. Just a thought.

8 Apr

I don't want to tempt the evil eye or anything, but this paper I'm reviewing for USENIX Security looks amazing. In the good way.