rmhrisk

I’ve made a few updates to unmitigatedrisk.com. I’ve added RSS, and I’ve started bringing my longer-form writing onto the site so it is easier to discover alongside the shorter posts.

There is also a recent piece, The Amnesia Cycle and Why AI Is Turning Developers Back Into Testers, about how AI is shifting software development from producing code toward judging generated output, and bringing some old testing disciplines back into focus.

I’ve made a few updates to unmitigatedrisk.com. I’ve added RSS, and I’ve started bringing my longer-form writing onto the site so it is easier to discover alongside the shorter posts.

Thirty years of digital identity post-mortems and the cryptography was almost never the problem. I went back through the record. Germany put the eID function on 97% of cards and got 22% usage. The UK spent £233 million on Verify and shut it down.

Germany built a technically sound card and got none of the three, and the holder paid, in money and friction, for a credential whose benefits went to somebody else. Enrollment is not adoption.

Thirty years of digital identity post-mortems and the cryptography was almost never the problem. I went back through the record. Germany put the eID function on 97% of cards and got 22% usage. The UK spent £233 million on Verify and shut it down.

Something the credential unlocked that people actually wanted. And a use frequent enough to become a habit, because a credential somebody was issued and a credential somebody carries are different things.

Thirty years of digital identity post-mortems and the cryptography was almost never the problem. I went back through the record. Germany put the eID function on 97% of cards and got 22% usage. The UK spent £233 million on Verify and shut it down.

For as long as my kids can remember, I told them they are students at Hurst University. No campus. No accreditation. Enrollment is automatic when you join the family. Graduation is harder. There is one requirement. By the time you leave the house, you should be able to build a future for yourself.

I was dyslexic and dysgraphic. My parents were told to prepare for the possibility I would never support myself. That prediction did not age well. The schools were not the education. The family was.

Take two systems with the exact same vulnerabilities. One loses its identity keys, the other doesn't. Yet every scanner, compliance checklist, and CVSS score will rate them exactly the same. We learned to scale security answers, but we never learned to scale the reasoning that produced them. 👇

Some of my more popular posts have focused on confidential computing, explaining TPMs, TEEs, secure enclaves, AI, and everything in between. With all the recent discussion about AI agents escaping "sandboxes," I realized there is a similar vocabulary problem here.

We use sandbox as though it describes a security property. But a container, a VM, a confidential VM, and a enclave are very different things. They expose different surfaces, were designed for different adversaries, and make very different promises when something inside is actively trying to get out.

For fifty years, systems became faster, larger, more interconnected, and harder for any one person to understand. Our response was to add audits, frameworks, controls, evidence, reports, certifications, regulators, and penalties.

The Assurance Model Was Built for a World That No Longer Exists rmhrisk.github.io/assurance-mo...

For fifty years, systems became faster, larger, more interconnected, and harder for any one person to understand. Our response was to add audits, frameworks, controls, evidence, reports, certifications, regulators, and penalties.

Yesterday I wrote about the classical WebPKI, the certificate chains, CAs, and governance we’ve used for three decades. Today’s piece is about what ultimately replaces it.

The response is Merkle Tree Certificates. A CA logs certificates into its own Merkle tree and signs the tree head. Each certificate carries a short inclusion proof. One signature covers the batch; the proof is the path.

Yesterday I wrote about the classical WebPKI, the certificate chains, CAs, and governance we’ve used for three decades. Today’s piece is about what ultimately replaces it.

The WebPKI has two core structures that are not the same shape. One is essentially a cryptographic graph of signed delegations. The other is a governance framework of accountability. Almost every major failure in its history sits in the gap between them.

I found myself explaining the WebPKI a lot recently, so I decided to put together a long-form deep dive on what I have been calling the “classical WebPKI”, more on that in the post where I also explore things like...

FIPS 140-3 validations give you a narrow, well-defined assurance boundary. But the real security story often lives in the code and dependencies just outside that boundary - bootloaders, firmware parsers, and the plumbing that actually feeds the crypto.👇

The public record shows recurring patterns and gaps. Procurement and architecture teams should be pressing vendors hard on evidence, not just paper. 👇

FIPS 140-3 validations give you a narrow, well-defined assurance boundary. But the real security story often lives in the code and dependencies just outside that boundary - bootloaders, firmware parsers, and the plumbing that actually feeds the crypto.👇

We built the WebPKI around buildings, cages, ceremonies, HSMs, and audits. Most of the compromises we worry about now don't live in any of those places. 👇

PQ is forcing every CA into a rebuild before 2029. The cheap version swaps the algorithms. The version worth doing fixes what audits and physical controls can't reach. unmitigatedrisk.com?p=1245 👇

One of the developers at Peculiar Ventures needed to debug some smart card APDU traces recently. I have enough trauma from the 90s and 2000s that I felt compelled to build an AI-annotated APDU trace analyzer.

My father learned rocket chemistry on a subsistence farm using stump remover and sugar. No kits. No experts. Just trial, error, and the stubborn belief that if it's broken, you fix it with what you have. He went on to have his name engraved on hardware that flew in orbit.

Then he spent decades in our garage with a green chalkboard and his slide rule, trying to make sure I understood concepts like orbital decay, thrust, specific impulse, the rocket equation, and more, because he was convinced we were forgetting how to go to the moon.