Chris Herdt

@[email protected]
291 Followers
280 Following
380 Posts

Infosec operations manager and cybersecurity instructor. Cyclist. Saint Paul, Minnesota.

Past life: sysadmin, web app developer, web monkey, help desk. Philly, Cincinnati, Birmingham, Portland, Detroit, Ann Arbor, Utrecht

Since all that is boring, ask me about the time I bought a school bus on Ebay.

he/him/his

Webhttps://osric.com/chris/
Chris HerdtJun 2

Maybe people need to load keywords on their resumes to pass human and/or automated gatekeepers

But personally I wouldn't include YAML on my resume unless I co-authored the specification

Chris HerdtMay 18
Given enough AIs, all bugs are shallow?
Chris HerdtMay 6

My thoughts on Mythos have started to coalesce:

- 90% of the vulnerabilities it will find will be vulnerabilities you could already find with existing tools. But orgs aren't using those tools consistently or well. Get ahead of this by using existing tools.

- A lot of exploits are going to be chained, so addressing known vulnerabilities and implementing security controls now can help break links in the anticipated exploit chains.

- Organizations should be prepared for expedited patching for vendor and open source software, and prepared to put resources into detecting and remediating vulnerabilities in internal tools.

Chris HerdtMay 5

Alma Linux had updated kernel packages to address Copy Fail (CVE-2026-31431) before RedHat did:

https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/

https://access.redhat.com/security/cve/cve-2026-31431

Copy Fail (CVE-2026-31431) Patches Released

Update: Patched kernels are now in production2026-05-01 21:07 UTC — The patched kernels are now rolling out to production repositories/mirrors. You no longer need to enable the testing repo to get them. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo reboot Most mirrors have a sync frequency of 3 hours. If the updates are not available to you yet we recommend trying again in about an hour.

AlmaLinux OS
Chris HerdtMar 23

One of my colleagues is currently trolling co-workers with CVE-2025-71263 (a vulnerability found in the recently rediscovered UNIX V4 source)

I kind of want to let people in on the joke, but quite not enough

Chris HerdtMar 20
I know it's easy to mispronounce a word or name you've never heard aloud before, but if you're making a YouTube video about Jean Giraud, maybe figure out how to pronounce his name first?
Chris HerdtMar 17
All the resumes with "CISSP in progress." I can say a lot of things are in progress! That's a red flag. I suppose it matches the pattern for "CISSP" for automated filters, but humans are unimpressed.
Chris HerdtMar 16

Search tools now try to second-guess what I'm searching for. I'm searching for "tree" and it's returning results "three" and "true"

I mean if Levenshtein distance is considered relevance, "trash" is right there

Chris HerdtMar 4

I received an email inviting me to a webinar/talk by Chrys Heard and I thought it was a joke or an AI hallucination based on my name, but there really is someone by that name in infosec

Howdy, Chrys!

Chris HerdtFeb 11

Glad to see Flickr has their priorities straight, sending out their "happy birthday to us!" message before notifying me of their data security incident

(I get it, they need to fully understand the scope of the incident before sending out notifications, and the marketing message has probably been in the queue for a month already)