Adding value @googlechrome security. Host @scwpod, cofounder of @censysio, cryptography, startups. “Ruthlessly practical". DJB says I’m an NSA plant. Go blue!

Joined February 2009
1,063 Photos and videos
Pinned Tweet
23 Mar 2024
With Real World Cryptography coming up next week, I wanted to take an opportunity to point out that our current post-quantum cryptographic primitives are not suitable for the web dadrian.io/blog/posts/pqc-si…
3
15
52
14,532
I am willing to join whatever party arrests and imprisons JJ Abrams for the sequels.
117
Sprawl 0x5 is happening tonight. Who's hyped?
2
8
1,122
David Adrian retweeted
Replying to @tunahorse21
Treat the model with the same disdain that Golang treats the junior engineers
2
14
976
Founders Fund
If you think you’re willing to do anything for your startup’s success, think again. This is me making out with a guy for investor money.
1
2
495
Wow, it only took Steve Yegge 21 years to realize Google is not good at interviewing. What an amazing insight from Steve Yegge, something completely novel. Truly the power of Steve Yegge.
1
56
5,333
David Adrian retweeted
Just talked to @lcamtuf for @SCWpod and was tOdAy YeArS oLd when I learned that I could buy and download his new book, which looks amazing, right now. Which is what I'm doing. nostarch.com/secret-life-of-…
3
21
4,084
But it turns out there's a 1:1 and onto relationship between "people I already thought were useless" and "people who use AI for writing"
3
166
David Adrian retweeted
Replying to @mitchellh
That sounds right, looking at all the broken products I see announced. Which suggests agents are just multipliers: the copy-paste crowd can paste faster, the loves-computers crowd gets to do more with computers. Good coworkers matter more than ever.
4
7
124
4,727
🇺🇸🇺🇸🇺🇸
113
But what if there was one more?
There's about 80 products in the agent sandboxing space right now. By YC Summer '26 we could hit 100
238
David Adrian retweeted
I love AI. I use it all the time. I code with it. I brainstorm with it. I use it for research. I use it to learn. But I never write with it.
117
54
1,063
78,721
David Adrian retweeted
Bucco’s guide to making $400k : So, your dumb ass has been lucky enough to stumble into making a 1% salary. Congratulations, you’re at the doorstop of generational wealth (or early retirement). Here’s how to not fuck it up 1. Assume this isn’t permanent: The first thing you need to recognize is most people don’t keep their 1% salaries. There’s a lot of luck, and variable comp, that usually goes into that kind of paycheck. So have some humility and live like it ain’t permanent, because it usually ain’t. Which brings me to point #2 2. Live below your means: Most people who start making fat paychecks start racking up fat credit card bills. But if you follow my first rule you won’t do that. At least for the first 3 years you will live like you aren’t making a lot of money. You will save. A lot. This is a gift to future you 3. Take care of yourself: If you are making this much you are usually working very hard. So take care of yourself. Invest in your brain and your body and your health. It is a marathon, not a sprint, as they say. And one of the reasons people don’t maintain their high paychecks is because they burn out 4. Pay it forward: Fate has smiled on you. You are not only obligated to pay it forward, but it is the right thing to do. One day you may experience something bad, unlucky, and catastrophic. People will remember that you did not neglect others while it was your moment in the sun and they will come to your support. Be kind, especially when you don’t need to 5. Maintain perspective: You are not better than anyone because you make a lot of money. There are many ways to be rich. Be sure that you stay humble, and continue to invest in your friends, families, relationships and health. Or you might one day find yourself with a full bank account and an empty life Follow these rules and I assure you that the odds of living a prosperous life will tip heavily in your favor
This might be a hot take but I know someone at meta who makes $400k a year and is quite literally capped at that number for life - likely will never get a promotion strong enough to change that. 9-5 until they’re what, 50? This is not living. No matter the salary.
48
120
3,010
853,767
document.addEventListener('DOMContentLoaded', () => { // attacker code here });
Tomorrow, I will drop Chrome exploit code showing how an attacker can execute arbitrary Javascript within the context of a domain they control.
8
5
140
28,033
1
532
Tomorrow, I will drop Chrome exploit code showing how an attacker can execute arbitrary Javascript within the context of a domain they control.
15
28
406
74,419
The only thing more useless than a pentest is an AI agent doing the pentest.
4
12
1,924
The only thing worse than people writing prose with AI is people writing about people writing prose with AI on LinkedIn.
1
2
384
All photos taken with 100ft of a two-lane road.
If you want any to hate America, watch the news. If you want to love it, drive through it.
1
365
I strongly believe there are entire companies right now under heavy AI psychosis and its impossible to have rational conversations about it with them. I can't name any specific people because they include personal friends I deeply respect, but I worry about how this plays out. I lived through the great MTBF vs MTTR (mean-time-between-failure vs. mean-time-to-recovery) reckoning of infrastructure during the transition to cloud and cloud automation. All those arguments are rearing their ugly heads again but now its... the whole software development industry (maybe the whole world, really). It's frightening, because the psychosis folks operate under an almost absolute "MTTR is all you need" mentality: "its fine to ship bugs because the agents will fix them so quickly and at a scale humans can't do!" We learned in infrastructure that MTTR is great but you can't yeet resilient systems entirely. The main issue is I don't even know how to bring this up to people I know personally, because bringing this topic up leads to immediately dismissals like "no no, it has full test coverage" or "bug reports are going down" or something, which just don't paint the whole picture. We already learned this lesson once in infrastructure: you can automate yourself into a very resilient catastrophe machine. Systems can appear healthy by local metrics while globally becoming incomprehensible. Bug reports can go down while latent risk explodes. Test coverage can rise while semantic understanding falls. Changes happens so fast that nobody notices the underlying architecture decaying. I worry.
1
303