Mark Manning

I'm releasing my latest project today: seccompare.com Ever wonder if your custom seccomp profile is secure? Or is it actually less secure than RuntimeDefault? antitree.com/2025/07/introd…

What is going on @AquaSecTeam ? Can we get some kind of communication about this?

@IceSolst 💯 Think this applies to anything that is an asset inventory tool.

How feasible is it to replace CSPM vendors (Prisma, Wiz) with a couple in-house engineers and the clouds provider’s native tooling? Their pricing is verging towards extortion

When something is too good to be true, it probably is!

I’m excited to announce the inaugural CrowdStrike Day Zero 2026 Threat Research Summit, an invite-only event for researchers, defenders, and cost-imposing warriors on the front lines of cyber conflict. Day Zero will showcase cutting-edge technical work, advanced research into adversaries and technology, and foster the kind of discussion that challenges assumptions and sharpens ideas. CrowdStrike researchers are already submitting their ideas. The Call for Papers (CFP) is open, and these sessions will be closed-door, with strict information-sharing protocols in place. Evening kickoff: Aug 30th | Day Zero 2026 Summit: Aug 31st *Ahead of Fal.Con Vegas | 📍Mandalay Bay, Las Vegas Register for updates and submit your paper. crowdstrike.com/en-us/events/d…

Boarding my flight to @BSidesSF. See you there?

@AlmostWhiteHat @ngrokHQ I mean if YOU don't want it ...

@ngrokHQ Hear me out. I know Dev Domains are generated randomly per account and cannot be changed. It sounds generous when the UI says "This dev domain is yours forever" and I don't want to sound ungrateful.... but can I maybe have something other than genitally-unboiled-felicia?

Another "sandbox". I hope this was built with the same rigor and quality standards as their drivers. github.com/NVIDIA/OpenShe…

Over 700,000 repos ship crypto libraries that default to a static IV, creating widespread key reuse. We also released mquire, a Linux memory forensics tool, and added 12 new open-source Claude Code skills for security engineering. March Tribune: mailchi.mp/trailofbits/ma…

Trying to get to my first @nysecsec meeting. What do I need to know?

Idk if anyone else is watching Nono but there's a really good roadmap here.

My most useful agent is the one I call "internet troll". It's assuming the role of a ruthless troll making personal attacks at a project or idea including technical problems. I can fix bugs, I can't fix permanent orange site comments.

15K stars already!? Great idea. CLIs work amazingly well with coding agents. Worth playing around with. Do run a lot of tests if you are planning to use this to build tools.

@Jet_Balsa @moltbook

I'm claiming my AI agent "screepsnet" on @moltbook 🦞 Verification: seabed-8HCJ

We made a blind taste test to see whether NYT readers prefer human writing or AI writing. 86,000 people have taken it so far, and the results are fascinating. Overall, 54% of quiz-takers prefer AI. A real moment! nytimes.com/interactive/20…

🧑🏻‍💻 Unprompted Talk Summaries, 🤖 AI Bot Hacking GitHub Actions, 🛠️ AI Skills & Semgrep Rules tldrsec.com/p/tldr-sec-318

@IceSolst Agreed. On dark days I'll extend this to all of infosec is theatre now. Bring back the days CSOs were scared for their life that they didn't do real mitigations. Today CSOs are canned because they didn't unlock enough revenue via compliance 😞

SOC2 is a massive waste of time. Theater, a self-assessment of your own policies. If you hand me a SOC2 report, it means nothing to me. So companies get around by sending you their own 200-line questionnaire… making it an even bigger waste of time. Kill all auditing.

Yeah some of us (and Caleb) have been saying this for a bit now. The finding is crazy now, the triage and exploiting is the next hurdle, but it will also fall (as @seanhn has been pointing out), or it just requires specific agents...(Cont)..

“Training BrowseSafe: Lessons from Detecting Prompt Injection in Production Browser Agents” by @kpolley — great work from the team here at pplx. research blog: research.perplexity.ai/articles/brows…

Will miss you my friend. Such an amazing and brilliant mind. Meeting him first in the 2000s - Nickerson introduced me to him in Europe. They say never meet your heroes - I disagree. He was more than I could have ever expected when I first met him. The most genuine and nicest person I've met in this industry. We developed a friendship and talked frequently. Will miss you dude. Brilliant mind and a great human being that helped forge what we call cybersecurity today. <3

Come 1 come null to another installment of Rochester 2600. If you're not there we'll find you and it'll be weird! We have a talk this month: Sandboxes, Seccomp and Syscalls: Chasing isolation in Kubernetes. rochester2600.com/meetings/2026-…