BrianKrebs

BrianKrebs's avatar
BrianKrebs
npub1vc39...axsh
Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Signal: briankrebs.07 krebsonsecurity @ gmail .com Linkedin: https://www.linkedin.com/in/bkrebs website: https://krebsonsecurity.com
The Extorter in Chief is at it again. Per the NYT: "The Trump administration has sought to pressure Senator Chuck Schumer, Democrat of New York and the minority leader, to help name New York’s Penn Station and Washington Dulles International Airport after President Trump in exchange for releasing billions of dollars he has frozen for a rail tunnel under the Hudson River." Top administration officials have told Mr. Schumer in recent weeks that the money would be released if he agreed to name the facilities in Mr. Trump’s honor, according to four people familiar with the private conversations. The people spoke on the condition of anonymity because they were not authorized to reveal the private discussions."
As much as I bash on the stupid ways that companies are trying to shove AI down everyone's throats, it does seem to be remarkably good at finding vulnerabilities. I'm a little concerned that our over-reliance on racing to patch everything 24/7 isn't going to scale well for much longer (if indeed it ever has). As this blog post from Anthropic points out, this is becoming a frequent refrain from people advocating that companies invest more in AI. I'm not necessarily saying they're wrong in this respect. But I am generally wary of any industry that claims you need more of what it is selling just so you can offset the negative externalities caused by the unbridled use of its technology. "Claude Opus 4.6, released today, continues a trajectory of meaningful improvements in AI models’ cybersecurity capabilities. Last fall, we wrote that we believed we were at an inflection point for AI's impact on cybersecurity—that progress could become quite fast, and now was the moment to accelerate defensive use of AI. The evidence since then has only reinforced that view. AI models can now find high-severity vulnerabilities at scale. Our view is this is a moment to move quickly—to empower defenders and secure as much code as possible while the window exists."
Must-read: How ‘Pink Slime’ Publishers Are Weaponizing FOIA From the Mirada Green and the Tow Center for Digital Journalism: "Metric Media filed more than nine thousand public records requests last year. It used the data to target Democratic politicians and private citizens." If you're unfamiliar with Metric Media, they own thousands of local "news" sites that mostly republish drivel until election time rolls around they're all partisan conservative publications masquerading as local news. "Founded in 2019, Metric has been criticized for jury tampering and tied to pay-for-play political schemes and fake newspapers that land in mailboxes ahead of key elections. Recently, it has focused on obtaining troves of public records. In the past year, an investigation by the Tow Center for Digital Journalism has found Metric filed more than nine thousand Freedom of Information Act requests across all fifty states." "Many of the requests are for data at the forefront of America’s culture-wars, from allegedly rigged elections to banned books to transgender inmates. With public records in hand, Metric has targeted liberal politicians with negative reporting, criticized the funding of nonprofit organizations, and published personally identifying details about small-town residents who spoke up at school board hearings. Unlike traditional journalism, Metric’s stories do not air dueling perspectives or offer targets a chance to comment."
I've really been enjoying Dana Milbank's dispatches from the Va. countryside lately. This one is about how the effort to "save the honeybees" -- which has been on the whole enormously beneficial -- has largely helped the honeybees massively crowd out native species, particularly the bumblebees. We have several people keeping honeybees near where we live, and we've absolutely noticed the honeybees crowding out other native species (of which there ~4,000). Milbank writes of the bumblebees: "Once widespread throughout eastern North America, it has disappeared from 87 percent of its historic range. Now it exists only in pockets, such as in the Upper Midwest and in the mountains between Virginia and West Virginia." "If you are in it for the pollinators, try some of the better (and easier) suggestions I’ve listed below from the experts. The bumblebees, sweat bees, mason bees, miner bees, leafcutters and other native bees, most of them solitary, ground-nesting and docile, need your help. Honeybees do not." https://www.washingtonpost.com/climate-environment/2026/02/06/how-to-save-the-bees-honeybees-dying/ https://archive.ph/GyeS5
When I saw the other journalists that were nominated, I didn't think there was a chance (e.g. ProPublica was nominated for their excellent investigative reporting uncovering the Pentagon's reliance on Chinese contractors for cloud work). I'm very flattered to be in such great company. Thank you to the Institute for Security and Technology (IST) for this award. Last night's IST gala at the National Press Club was a stroll down memory lane in many ways. Ran into people I haven't seen in person for ages, and most of them have been involved in shaping cybersecurity policy for 25+ years. It was also bittersweet because I spent a lot of time at the Press Club as a reporter at The Washington Post, and I'm still livid about the insanity of the 300 or so WaPo journalists who lots their jobs this week. I'm particularly mystified by the decimation of the Post's Metro staff; despite its stature as a top source of national and international news, The Washington Post has always maintained a strong focus on what's going on in the DC area. When they merged washingtonpost.com with the dead tree edition in 2009 and eliminated my job, the mantra of the company was they wanted to be THE source of news about what's happening in the Nation's Capital, and how policy being made in DC affects the rest of the world. Here's part of what I told the audience last night: "I horrified this week to see The Washington Post lay off 300 of its 800 remaining journalists -- the third major staff reduction in as many years. A lot of the cuts are deeply affecting the foreign and local metro staff; it's easy to forget the Watergate scandal started as a metro story. Probably we need several hundred more reporters digging into what this administration is doing, because Watergate frankly can't hold a candle to it all." "I'm hoping all of the post-Posties will land in a better place soon, but I also hope they can keep doing their important work regardless of where it comes from. And I will continue to advocate for, support and encourage anyone who wants to go the independent route. I think journalism is going to be just fine for now, but I'm not sure I share the same view about many traditional news organizations. I hear from a lot of reporters considering the going out on their own worry about not having a big publication name to automatically open doors for them, or watch their backs legally, and those are certainly big adjustments of going solo. But you know what makes all that worth it? When you're breaking news that forces important people to answer hard questions, and the gatekeepers go, wait, who are you with again?" image
This made me lol, from a LinkedIn post on the proposed "strategic bitcoin reserve," and how holding crypto is actually hard and super risky, and how maybe we shouldn't be thinking about doing more holding of it on purpose. image
This makes me sad (been there). From Joe Menn at WaPo: "Most of the Washington Post’s tech reporters were laid off today, including me. I have loved my time at the paper, which is where I wanted to work from age 15. I take some consolation in not being among the survivors who will have to work harder with less for fewer readers. On to better things."