@coffeetocode

Software engineer to security consultant, now security partner at @Netflix. Infosec pragmatist.

 SF Bay Area
coffeetocode.net
Joined February 2010
  • Tweets2.7K
  • Following884
  • Followers1.9K
213Media
"Penetration Test" is a crazy overloaded term. Important to start w/ discussion of goals and tradeoffs between testers and client team.
22
675
51
926
Thanks for the #BSidesSF Semgrep workshop @enncoded @LewisArdern @onefiftyman . You packed a *ton* into 2 hours. Really appreciate the work that went into it.
1
3
12
1,050
What can we say, twitter-driven development sometimes works :) netflix.com/.well-known/secu… Ya'll are good folks. Keep it going!
security.txt (RFC 9116)@securitytxt1 Feb 2023
Exciting news! @Apple joins the list of companies with a security.txt file. Now, we only need @netflix to complete the FAANG list. 🙌
2
6
1
58
12,243
I love formal forecasting exercises (esp those run by @Magoo) because they really force you to slow down consider all the potentially relevant facts, and introspect your biases. FWIW I was 80% here, but I think I was undervaluing the "autopilot" nature of modern CI/CD.
Ryan McGeehan@Magoo21 Nov 2022
Replying to @Magoo
That's what myself and 26 others sought to gather over the weekend. The panel we put together forecasted a 72.8% belief it would happen. Here's the spread of forecasts magoo.github.io/risk-measure…
1
1
Expanded a bit on this over at infosec.exchange/@coffeetoco…

coffeetocode (@[email protected])

Attached: 1 image xposting this of interest from @magoo , https://twitter.com/Magoo/status/1594728894867066881 , and unpacking it a bit more here. A panel forecast on essentially "Will twitter have...

infosec.exchange
Of the ~950 people I follow on twitter, some hacky profile scraping says that about 60 of those currently have a Mastodon link. So for me that's basically from ~0% to 15% exodus (or at least strongly hedging) in a *week*.
2
3
Hah, this makes me feel so much better about my small pile of aborted "I think I should write something about..." drafts.
Troy Hunt
@troyhunt29 Aug 2022
Know how many blog posts I start writing but never finish? *HEAPS*! Sometimes the story just doesn't work out as expected, sometimes I calm down and change my mind, other times... I'm a busy guy 🤷‍♂️ Are there any here I really should finish?
1
2
I don’t think there’s a SOC2 rule against banking 50 pre-approved empty PRs for future use.
4
3
1
73
Someone asked today "Is that list of 'goals' *really* a list of goals, or just a some themes of work?" I *love* that question & the insight behind it. True "goals" help prioritize among possible work, themes really don't. 1/2
1
2
When looking at a big backlog of known work we want to drive, it's *so easy* to just group into themes and call it good. I can think of times I've done that which really, really would have benefitted from asking if the framing leads to an ability to confidently prioritize. 2/2
Chrome was delivered without any sprints at all. The team came in at 9 and left at 5 (figuratively, people actually kept their own ~8h schedules) every workday for a couple years like clockwork. No drama. No broken marriages, no broken families. – at Tustin, CA
Hadi Partovi
@hadip14 Aug 2021
Replying to @hadip
Sadly, there were divorces and broken families and bad things that came out of that. But I also learned that even at a 20,000-person company, you can get a team of 100 people to work like their lives depend on it.
66
1,814
346
10,804
Congrats to @Resourcely! Clear, exciting product vision at that critical touchpoint of developer velocity, security, and cloud resources. Very pleased to have joined this round, and looking forward to seeing where @travismcpeak and @0xshellrider take this idea.
Resourcely@Resourcely26 Jul 2022
Hello world! We're on a mission to make cloud security easier for users. See our funding announcement (techcrunch.com/2022/07/26/re…) and blog post (resourcely.io/post/introduci…) for more details. We're #Hiring!

Resourcely helps automate security, so developers can concentrate on coding | TechCrunch

When Resourcely co-founder and CEO Travis McPeak was working at Netflix, he recognized a significant tension that existed between security and speed. If

techcrunch.com
1
8
Strong recommend for anyone thinking about sustainability, culture, and ultimately the humans in a security organization. @astha_singhal knows what she's talking about and delivers it so well. 🙌
Astha Singhal@astha_singhal11 Jul 2022
This year I got the amazing opportunity to deliver the keynote at one of my favorite security conferences, @BSidesSF. You can now check out my talk on "Building Sustainable Security Programs" here: youtube.com/watch?v=-hWp_CDc…
4
Web timing attacks: super cool in principle, still super janky in practice. Seems like TimeTrial (github.com/dmayer/time_trial) and Nanown (code.blindspotsecurity.com/t…) still best tools, but really janky to get running & require a known-good case. Anyone got suggestions? Banging my head.
1
Strong recommend. Some great examples that improve both risk and user experience, and also give metrics that make the wins feel real.
Leif Dreizler
@leifdreizler8 Jul 2022
Replying to @workingrach
@workingrach and my @BSidesSF preso is uploaded to Youtube! youtube.com/watch?v=Ru9i7Ne_…

BSidesSF 2022 - An Unlikely Friendship: Why Security Engineers ......

Leif Dreizler • Rachel Landers - An Unlikely Friendship: Why Securi...

youtube.com
1
4
Brilliant talk from @coffeetocode on bonding security to developer productivity.
1
6
1
20
Slides from my #LocoMocoSec talk on "Productizing Security" docs.google.com/presentation…
6
13
58
#locomocosec
Jim Manico from Manicode Security
@manicode30 Jun 2022
When it literally rains on your parade at @LocoMocoSec with @ropnop @SammyHep @ndm @h4ck3rky13 and @coffeetocode #stillHavingFun
5
When it literally rains on your parade at @LocoMocoSec with @ropnop @SammyHep @ndm @h4ck3rky13 and @coffeetocode #stillHavingFun
4
1
15
Woo! @LocoMocoSec has been on my list since it started; I'm finally here and so excited! Looking forward to meeting folks. Just hanging out today/tomorrow if anyone else in early wants to meet up!
Ronnie Flathers@ropnop27 Jun 2022
Aloha @LocoMocoSec 😎 so excited to be here - have wanted to attend this con for a long time! Really looking forward to learning a lot, talking prodsec and meeting new friends. Anyone else gonna be here? And can’t wait to catch up @coffeetocode been too long!
3
1
13
Woot! Let's do this! I'm really looking forward to sharing this.
LocoMocoSec: Hawaiʻi Security Conference
@LocoMocoSec23 Jun 2022
Patrick Thomas, Senior Security Partner @netflix, is speaking @LocoMocoSec next week! Register now to see his talk 'Productizing Security For Leverage and Scale' on June 30th🤙 ⛵ Waikīkī Marriott Resort 🏝️ O'ahu, Hawai'i ☀️ June 27-30th 🌟 @coffeetocode
1
2
1
16
Load more