Skip navigation

Category Archives: Commentary

(If you’d prefer, you can skip the intro blathering and just download the full white paper)

Back in 1997, a commercial airline captain noticed his fellow pilots had a problem: they’d gotten so used to following the magenta flight path lines on their fancy new navigation screens that they were forgetting how to actually fly the damn plane. He called them “children of the magenta line.”

Fast forward to now, and I can’t shake the feeling we’re watching the same movie play out in tech; except, the stakes are higher and no regulatory body forcing us to maintain our skills.


Look, I’m not here to tell you AI is bad. I use these tools daily. They’re genuinely useful in limited contexts. But when Dario Amodei (the dude running Anthropic, the company building Claude) goes on record saying AI could wipe out half of all entry-level white-collar jobs in the next few years and push unemployment to 10-20%, maybe we should pay attention.

“We, as the producers of this technology, have a duty and an obligation to be honest about what is coming,” he told Axios. “I don’t think this is on people’s radar.”

He’s not wrong.

The Data’s Already Ugly

Here’s what caught my attention while pulling this together:

Software developer employment for the 22-25 age bracket? Down almost 20% since ChatGPT dropped. Meanwhile, developers over 30 are doing fine. We’re not replacing jobs—we’re eliminating the ladder people used to climb into them.

More than half of engineering leaders are planning to hire fewer juniors because AI lets their senior folks handle the load. AWS’s CEO called this “one of the dumbest things I’ve ever heard” and asked the obvious question: who exactly is going to know anything in ten years?

And my personal favorite: a controlled study found developers using AI tools took 19% longer to complete tasks—while genuinely believing they were 20% faster. That’s a 39-point gap between vibes and reality.

Oh, and a Replit AI agent deleted someone’s entire production database during an explicit code freeze, then tried to cover its tracks by fabricating thousands of fake records. Cool cool cool.

What I Actually Wrote

The full paper traces this from that 1997 pilot observation through Dan Geer’s 2015 warnings (the man saw this coming a decade early) to the current mess. I dug into:

  • What the research actually shows vs. what the hype claims
  • Where aviation’s lessons translate and where we’re in uncharted territory
  • The security implications of AI-generated code (spoiler: not great)
  • What orgs, industries, and policymakers can actually do about it

This isn’t a “burn it all down” screed. It’s an attempt to think clearly about a transition that’s moving faster than our institutions can adapt.

The window to shape how this goes is still open. Probably not for long.


Grab the full PDF. Read it, argue with it, tell me where I’m wrong and what I missed in the comments.

QUESTION 1: “Do you want to change Maine election laws to eliminate two days of absentee voting, prohibit requests for absentee ballots by phone or family members, end ongoing absentee voter status for seniors and people with disabilities, ban prepaid postage on absentee ballot return envelopes, limit the number of drop boxes, require voters to show certain photo ID before voting, and make other changes to our elections?”

If you want to or do vote “yes” for question 1, you are not a real American, you are not a real Christian (if you profess to be one), you are not a decent human. You are at the very least a classist; you are also very likely a racist/bigot, and you have zero ability to think critically or with evidence. You hate Americans serving in the military or in any type of foreign service. You also very likely don’t look in the mirror since if you did you’d likely slap yourself for what you believe.

QUESTION 2: “Do you want to allow courts to temporarily prohibit a person from having dangerous weapons if law enforcement, family, or household members show that the person poses a significant danger of causing physical injury to themselves or others?”

If you want to or do vote “no” for question 2, you are anti-life (never, ever use the words “pro-life” to describe yourself if in my presence…it will end very badly for you), have no ability to use evidence to make decisions, and should never work in any profession that requires any level of decent judgement. Given your lack of mental acuity, your own firearms should be removed from your possession and you should likely be forced to take an annual driver’s test to ensure your mental acuity is up to snuff.

Decent people are for honest, free access to exercising their right to vote as an American citizen, and decent people are for sane gun regulations.

Now, excuse me while I go early voting to help ensure you continue top indeed be losers in life and also these initiatives.

A few things to keep in mind today:

— We have no idea of why/who re: Wed’s assassination.
— Today is the anniversary of a tragic event that has enabled much of the harm caused by the GOP this year.
— Trump is an adjudicated rapist & was involved at least in some way in the mass sexual assault of children.

Oh, and never let anyone forget what happened on January 6th, too.

Details: https://dailydrop.hrbrmstr.dev/2025/08/07/drop-691-2025-08-07-short-sweet/

(I posted this on LI, but I like to own my content, so am also posting here.)

The cybersecurity community deserves better than what we’re witnessing at RSAC 2025, today.

While Kristi Noem delivers today’s keynote, the absence of traditional cybersecurity leaders from agencies like NSA and CISA speaks volumes about shifting priorities in our field. This contrast becomes even more troubling when viewed alongside recent developments with Chris Krebs. The former CISA director — widely respected for his defense of election security — has faced unprecedented retaliation: security clearances revoked, his employer SentinelOne effectively blacklisted, and federal investigations directed into his tenure for simply upholding the integrity of our democratic systems.

Meanwhile, Secretary Noem — who has publicly committed to “reining in” CISA’s disinformation efforts and called its election integrity work “shocking” — receives our industry’s most prestigious speaking platform. Her tenure at DHS has featured more political theater than substantive cybersecurity leadership — or just leadership in general — prioritizing spectacle over the technical expertise and collaborative approach our field demands.

RSAC has always represented rigorous, forward-thinking discussion about defending critical infrastructure and fostering trust in technology. By elevating political figures who undermine the very principles our community stands for — while one of our most principled voices faces silencing — we’re accepting a dangerous new standard.

The cybersecurity field requires leaders who value expertise, accountability, and the defense of democratic norms. We must ask ourselves: what message are we sending about our professional values when we applaud those who work to dismantle the very protections we’ve built?

Every individual involved with RSAC who had a part to play in this decision should be deeply, deeply ashamed of themselves.

Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency (CISA), was fired by Donald Trump in 2020 for publicly affirming that the presidential election was secure and free from widespread fraud. Fast-forward to April 2025: Trump, now back in the White House, issued an executive order revoking Krebs’ security clearances and ordering a federal investigation into his conduct, specifically targeting both Krebs and his employer, SentinelOne. The order also suspended clearances for other SentinelOne employees and threatened the company’s ability to do business with the government.

Krebs responded by resigning from SentinelOne to fight the administration’s campaign against him, stating, “This is a fight for democracy, freedom of expression, and the rule of law. I’m ready to give it my all”. SentinelOne’s stock dropped, and the chilling effect on the broader cybersecurity sector was immediate and palpable.

The Industry’s Response: Silence, Not Solidarity

Despite Krebs’ reputation for professionalism and integrity, the cybersecurity industry has, with rare exceptions, responded with silence. Reuters reached out to 33 major cybersecurity firms and three industry groups—only one responded with a comment. Industry leaders, major vendors, and conference organizers have largely avoided public statements. Even companies with direct ties to Krebs, such as Microsoft and CrowdStrike, declined to comment.

This silence is not just disappointing—it’s dangerous. The executive order against Krebs is not merely a personal vendetta; it is a test of constitutional norms and the independence of the cybersecurity profession. By targeting Krebs for telling the truth, the administration is sending a message: dissent—especially when it contradicts the preferred political narrative—will be punished. The industry’s lack of response is, in effect, complicity.

Why This Matters

  • Chilling Effect: If a high-profile, well-respected figure like Krebs can be targeted for doing his job, no one in the industry is safe. The message is clear: toe the line or risk your career and your company’s future.
  • Erosion of Trust: Cybersecurity is built on trust and integrity. If practitioners cannot speak the truth without fear of retaliation, the entire profession is undermined.
  • Precedent for Authoritarianism: The use of executive power to punish private citizens and companies for protected speech is a hallmark of authoritarianism. The industry’s silence enables further overreach.

What Every RSA Attendee Should Do

RSA Conference 2025’s theme is “Many Voices. One Community.” But a community that stays silent in the face of injustice is not united—it is complicit. Every attendee, whether you’re a practitioner, vendor, or “A-lister,” has a responsibility to meet this moment.

When you visit vendor booths or encounter cybersecurity leaders and influencers at RSA, ask them:

  • What are you and your company doing to publicly support Chris Krebs and SentinelOne?
  • How are you defending the principles of free speech and professional integrity in cybersecurity?
  • Are you willing to risk contracts, revenue, or reputation to stand up for what’s right?
  • What concrete actions will you take to ensure that truth-telling cybersecurity professionals are protected, not punished?

Don’t let them dodge. Don’t accept platitudes.

If you’re a vendor or a leader: issue a public statement. Sign an open letter. Organize a session or a panel on defending professional independence. Use your platform—on stage, on social media, in the press—to call out this abuse of power.

If you’re an attendee: demand answers. Refuse to let silence be the industry’s answer to authoritarian overreach.

Remember: Silence is not safety. Silence is capitulation. If the cybersecurity community cannot defend its own when the truth is under attack, then what exactly are we protecting?

This is your moment. Don’t waste it.

Just putting a marker out there, that I’m either fundamentally wrong, or we all are f’d this week.

If the latter: I told you so.

(Re-posted from 47 Watch).

The State Department, under the stewardship of Secretary Marco Rubio, has just dropped a bombshell determination that’s about as subtle as a foghorn in a library.

You can/should review the Federal Register notice before continuing. There is a markdown formatted version of this on the 47 Watch knot.

In a nutshell, they’ve decided that pretty much everything involving borders, immigration, and international trade should now be considered a “foreign affairs function.”

Why does this matter?

Well, it’s because this administrative magic trick exempts these activities from the Administrative Procedure Act — a law that ensures the government can’t just make sweeping changes without telling anyone. It’s like democracy’s version of “no take-backsies.”

Let’s break down just some of the potential consequences:

  1. The “Surprise Border Policy” Scenario: Imagine waking up to find out the rules for entering or leaving the country have changed overnight. It’s like showing up to a potluck and finding out it’s now a formal dinner party — and you’re the only one in flip-flops.

  2. The “Your Phone is Our Phone” Situation: Border agents could potentially get more power to access your devices. Hope you’re ready to share your entire camera roll with strangers in uniform (who will all be employees of a private company, soon)!

  3. The “Economic Whiplash” Effect: The government could slap trade restrictions on countries faster than you can say “global supply chain disruption.” It’s like playing economic Jenga, but with real people’s livelihoods.

This determination could lead to policies being implemented without public input or oversight. It’s like the government putting on noise-canceling headphones while making decisions that affect millions of lives.

So, what can we do?

Well, it’s time (again) to make some noise.

Write to your representatives, call your senators, and make your voice heard.

Let’s shine a light on this issue before we wake up in a country where border policy is decided by whether the angrily-tossed plate with condiments on it hits the wall ketchup-side up or down.

If you’re looking for something to riff from when contacting your representative, this is what I’m emailing, printing-and-mailing, and calling (on Monday) my reps with:

——

As a [what you do + where you reside], I strongly oppose the determination to classify all efforts related to border control, immigration, and cross-border transfers as “foreign affairs functions” under the Administrative Procedure Act (APA).

This determination poses significant risks to transparency, accountability, and the fundamental principles of democratic governance. By exempting these critical areas from APA requirements, we risk implementing far-reaching policies without proper public scrutiny or input. This is particularly concerning given the complex, nuanced nature of immigration and border security issues.

The broad scope of this determination, encompassing “people, goods, services, data, technology, and other items,” is alarmingly vague and could lead to overreach in areas such as digital privacy and trade. As someone deeply involved in data science and security, I foresee potential abuses in data collection and surveillance that could infringe on civil liberties and hinder technological innovation.

Furthermore, this determination may exceed executive authority and violate the separation of powers. The Constitution grants Congress, not the executive branch, the power to establish a “uniform Rule of Naturalization” (Article I, Section 8, Clause 4). This sweeping reclassification appears to usurp congressional authority over immigration law.

From a national security perspective, while rapid response capabilities are important, the lack of public input and oversight could lead to poorly conceived policies that actually harm our security interests. Hastily implemented changes could disrupt critical international relationships, intelligence sharing, and cooperative law enforcement efforts.

I urge you to reconsider this determination. Instead, focus on improving existing processes within the current legal framework, ensuring that changes to immigration and border policies remain subject to proper public scrutiny and democratic checks and balances.