Chris Merkel 🐀👨🏼‍🍳

@chrismerkel@infosec.exchange
670 Followers
1.2K Following
986 Posts

Dad, beautiful nerd, storyteller.

AppSec, CloudSec, DevOps, DFIR, rainbow teaming, recreational hacking and dubious career advice.

By day, I lead teams comprised of the most talented people working in this industry.

Beyond that, I lead and volunteer my time doing career development work across many different venues.

Nerdy stuff I do for fun:
- Malware analysis
- Shodan safari
- Photo and video restoration

Pronounshe/him/his
Threadshttps://www.threads.net/@chris__merkel__cyber
CheetosFlamin' Hot
I just dowhat the rat tells me
The claude "thinking" animation is a great reminder that you can improve your brainstorming process with kegels.

Sometimes your job is literally keeping the secrets of how the sausage is made.

Too many companies focus on easy things like PII and don't do the hard work of classifying and protecting intellectual property.

Hormel Foods, Inc. accuses Johnsonville, its Sheboygan Falls-based rival, of using two former Hormel employees to steal "trade secrets.”

https://www.jsonline.com/story/news/crime/2025/06/20/hormel-says-johnsonville-stole-recipes-trade-secrets-in-lawsuit/84288763007/

Minnesota-based Hormel sues Wisconsin's Johnsonville, says Johnsonville stole 'trade secrets'

Hormel Foods, Inc. accuses Johnsonville, its Sheboygan Falls-based rival, of using two former Hormel employees to steal "trade secrets.”

Journal Sentinel
My second favorite thing is when your org is a customer of an enterprise SaaS product, but you are not, and get sales and marketing emails anyways specifically identifying you as a customer.

My favorite part of having to use enterprise SaaS products is getting signed up for marketing emails without consent.

I think every procurement org should put in a line deep inside the contract that identifies this as a material breach of contract, giving organizations an instant and universal exit clause.

Don't use Smart TVs as Smart TVs.

If you buy a Smart TV, keep it off the internet and use your choice on streaming box or local media player instead. Apple TV generally comes out on top in terms of respecting viewer privacy.

https://www.zdnet.com/home-and-office/home-entertainment/how-to-disable-acr-on-your-tv-and-why-doing-so-makes-such-a-big-difference/

How to disable ACR on your TV (and why doing so makes such a big difference)

Smarter TV operating systems bring more convenience - but they also raise new privacy concerns, especially when it comes to automatic content recognition (ACR).

ZDNET

Every person I've talked to who works in the food industry tells me the same thing - there's little investment in cyber.

https://techcrunch.com/2025/06/16/food-distributor-unfi-says-its-recovering-from-cyberattack-as-grocery-shortages-persist/

As grocery shortages persist, UNFI says it's recovering from cyberattack | TechCrunch

Whole Foods and other grocery stores reported shortages following the cyberattack

TechCrunch
Part of GCPs control plane lacks memory safety protections. The outage on Thursday was caused by a null pointer.
https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1SsW
Google Cloud Service Health

"what if we made a whole social network for people who are into shrimp jesus"

That's the pipe-hitting idea that embodies the Meta AI public feed.

If you're into that, I guess good for you but wow

Yes, Pixel had call screening like seven years ago, but Samsung never implemented it, and their version was Bixby which is trash and nobody used it.

That means a whopping 10% of the (US) Android market was using call screen. That's 10% of a 40% market share.

Now because of Apple, 60% of the market finally has this feature. If you're a scammer or a telemarketer, your odds of getting AI call screened go from 2% to 70%, assuming Apple turns this on by default, and I hope they do.

If that doesn't decimate junk calling, IDK what will.

This two hours of UI changes could have been a blog post.