Picking a pentest firm (completely biased but maybe not wrong pov) Look for companies with public contributions. Bug bounty, cve, open source tools, talks, content, etc. Can all be indicators of a solid team. A team that gives back and shares their time with the community. Ask to talk to the pentester(s) who will be doing the work. Ask about their methodology and how they do things. Ask for a sample report. Ask questions about specific findings to see the level of depth/expertise the testers may have.

mcps are changing turns out designing mcps to load every tool definition into the model prompt was a bad idea anthropic’s nov 4 blog post suggests a new pattern treat each mcp server like a normal code library, e.g. typescript modules or files, and let the agent write and run small programs that do two things: discover only what is needed, list a servers directory to see what exists, open just the specific tool files, import only those functions process data locally, call mcp tools from code, then filter, join, and aggregate inside a sandboxed runner so only the small final bits go back to the model doing this dramatically cuts tokens anthropic shows a typical case dropping from 150k tokens down to ~2k (98.7% savings) below a viz showing before/after

I don't mind leveraging AI to help with some reversing tasks, to be honest. What would take me 10 weeks, now takes me 10 days, I have MCP hooked to x64dbg now, so we are balling.

Kubernetes migration almost killed our startup. Where we were: - 8 EC2 instances - Ansible for deploys - Boring but working - $1200/month AWS bill Why we migrated: - New investor wanted 'cloud-native' - Engineers wanted K8s experience - Competitors were using it - Seemed like the future 6 months later: - 3 engineers spending full-time on K8s - AWS bill at $4500/month - Deploys took longer than before - More outages, not fewer - Product development stalled We rolled back: - Moved to ECS Fargate - 2 week migration - Back to $1800/month - Engineers back on features K8s is amazing for scale. We weren't at scale. Technology should solve problems you actually have.

Dark Reading | AI Agents Are Going Rogue: Here's How to Rein Them In darkreading.com/cyber-risk/a…

Great news for browser security (and not just because it cites my XSLT research :)). A lot of younger folks don't even know this feature exists, yet is/was the default attack surface in all major web browsers with a history of exploitation. developer.chrome.com/docs/we…

ChatGPT just helped researchers crack XLoader malware in hours — work that used to take days. AI unpacked the code, found keys, and exposed C2 domains. Big shift for malware analysis. Check this story ↓ thehackernews.com/2025/11/th…

Multi-Turn Attacks Expose Weaknesses in Open-Weight LLM Models infosecurity-magazine.com/ne… #cybersecurity #infosec #hacking

2009: FireEye took down the Mega-D botnet by disabling its C&C infrastructure. Unfortunately, within 2 weeks the botnet was operational again at pre-takedown levels. Were botnets sold in bottles in the long, long ago? Nobody knows.

Dark Reading | SonicWall Firewall Backups Stolen by Nation-State Actor darkreading.com/cyberattacks…

Today’s AI Adventure: 🤖 Today I went through all my READMEs a bunch of times asking Q to find inconsistencies and errors. I have a number of coordinated projects and I wondered if any inconsistencies could be causing problems. The main question I asked after getting the READMEs coordinated and in sync was to ask if anything would prevent me from starting a new project and telling q to implement an application that processes logs with my log router. Doing that uncovered a potential concurrency problem between projects in different threads. Q alerted me to a potential initialization issue. My efforts did not entirely resolve all problems. I still had projects which didn’t follow all the rules in the readmes and that prevented other projects from compiling. I still had projects trying to subvert my rules designed to make sure no errors are ever hidden. I tried to overcome this by asking Q to check the projects over and over until no more issues got reported. I worked on multiple projects at the same time to discover integration issues. When I discovered projects failing to implement things incorrectly or trying to hide errors I added common tests to check for those things and report them. I also added clarification in readmes to be very explicit about certain aspects of the implementation. Because I use traits with rules for implementation I was able to pretty quickly obtain consistency across projects. I do think it sped up development. The odd thing though, is when a bunch of projects implement the same trait according to the exact same instructions and ONE will just go completely off the rails. This time it was my screen logger project, of all things. The screen logger should be the simplest of all loggers. Take a message. Pass it to a formatter. Print it. For some super annoying reason it kept failing to follow the pattern none of the other loggers had problems implementing.😩😩😩😩 The biggest problem was trying to subvert error handling rules. It was as if the screen logger was a rogue employee. An insider threat was trying to implement convoluted code that would not show every error ok the screen. Out of like 30 projects it was nearly the first one I started fixing today (besides the one it was blocking) and was the second to last one I finally got working to unblock the one I started with. The end result is pretty cool though. I asked Q if there were any circular dependencies and it said no and mapped out the flow of the architecture nicely showing a beautifully satisfying hierarchy of dependencies that play nicely together. It’s that same kind of satisfying feeling I’d have when finishing an oil painting as an art major. You just have this feeling when you get it right and it’s beautiful. Everything feels harmonious. Now Q says now I can implement a project and just tell it to use the log router and it will all just work. I need to deploy a few AWS resources and then we’ll find out how try that is tomorrow.🤞