<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:admin="http://webns.net/mvcb/"
	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
	xmlns:content="http://purl.org/rss/1.0/modules/content/">

	<channel>

	<title>&#45; CircleID</title>
	<link>https://www.circleid.com/blogs/</link>
	<description>Postings from  on CircleID</description>
	<dc:language>en</dc:language>
	<dc:rights>Copyright 2026, unless where otherwise noted.</dc:rights>
	<dc:date>2026-03-31T21:29:00+00:00</dc:date>

	
	<item>
		<title> In Memoriam: Frederick P. Brooks, Jr. – a Personal Recollection (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20221119-in-memoriam-frederick-p-brooks-jr-a-personal-recollection</guid>
		<link>https://circleid.com/posts20221119-in-memoriam-frederick-p-brooks-jr-a-personal-recollection</link>
		<description><![CDATA[Brooks is famous for many things. Many people know him best as the author of <em>The Mythical Man-Month</em>, his musings on software engineering and why it's so very hard. Some of his prescriptions seem quaint today -- no one these days would print out documentation on microfiche every night to distribute to developers -- but his observations about the problems of development remain spot-on. But he did so much more. <a href="https://circleid.com/posts20221119-in-memoriam-frederick-p-brooks-jr-a-personal-recollection">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> The Importance of Understanding Attacker Target Selection (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20210705-importance-of-understanding-attacker-target-selection</guid>
		<link>https://circleid.com/posts20210705-importance-of-understanding-attacker-target-selection</link>
		<description><![CDATA[There's a bit of a debate going on about whether the Kaseya attack exploited a 0-day vulnerability. While that's an interesting question when discussing, say, patch management strategies, I think it's less important to understand attackers' thinking than understand their target selection. In a nutshell, the attackers have outmaneuvered defenders for almost 30 years when it comes to target selection. <a href="https://circleid.com/posts20210705-importance-of-understanding-attacker-target-selection">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Where Did "Data Shadow" Come From? (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20210629-where-did-data-shadow-come-from</guid>
		<link>https://circleid.com/posts20210629-where-did-data-shadow-come-from</link>
		<description><![CDATA[Anyone who works in privacy is familiar with the term "data shadow": the digital record created by our transactions, our travels, our online activities. But where did the phrase come from? Who used it first? A number of authors have attributed it to Alan Westin, whose seminal book Privacy and Freedom (largely a report on the work of the Committee on Science and Law of the Association of the Bar of the City of New York) set the stage for most modern discussions of privacy.  <a href="https://circleid.com/posts20210629-where-did-data-shadow-come-from">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> An Inquiry Into an Organization's Security Priorities (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20210301-an-inquiry-into-an-organizations-security-priorities</guid>
		<link>https://circleid.com/posts20210301-an-inquiry-into-an-organizations-security-priorities</link>
		<description><![CDATA[In the wake of recent high-profile security incidents, I started wondering: what, generally speaking, should an organization's security priorities be? That is, given a finite budget - and everyone's budget is finite - what should you do first? More precisely, what security practices or features will give you the most protection per zorkmid? I suggested two of my own, and then asked my infosec-heavy Twitter feed for suggestions. <a href="https://circleid.com/posts20210301-an-inquiry-into-an-organizations-security-priorities">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Hot Take on the Twitter Hack (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20200720-hot-take-on-the-twitter-hack</guid>
		<link>https://circleid.com/posts20200720-hot-take-on-the-twitter-hack</link>
		<description><![CDATA[If you read this blog, you've probably heard by now about the massive Twitter hack. Briefly, many high-profile accounts were taken over and used to tweet scam requests to send Bitcoins to a particular wallet, with the promise of double your money back. Because some of the parties hit are sophisticated and security-aware, it seems unlikely that the attack was a straightforward one directly on these accounts. <a href="https://circleid.com/posts20200720-hot-take-on-the-twitter-hack">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Trust Binding (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20200615-trust-binding</guid>
		<link>https://circleid.com/posts20200615-trust-binding</link>
		<description><![CDATA[A few months ago, there was a lot of discussion that despite its claims, Zoom did not actually offer end-to-end encryption. They're in the process of fixing that, which is good, but that raises a deeper question: why trust their code? (To get ahead of myself, this blog post is not about Zoom.) If Zoom has the key but doesn't abuse it, there isn't a problem, right? Let's fast-forward to when they deploy true end-to-end encryption. Why do we trust their code not to leak the secret key? <a href="https://circleid.com/posts20200615-trust-binding">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> The Price of Lack of Clarity (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20200429-the-price-of-lack-of-clarity</guid>
		<link>https://circleid.com/posts20200429-the-price-of-lack-of-clarity</link>
		<description><![CDATA[As anyone reading this blog, assuredly knows, the world is in the grip of a deadly pandemic. One way to contain it is contact-tracing: finding those who have been near infected people and getting them to self-quarantine. Some experts think that because of how rapidly newly infected individuals themselves become contagious, we need some sort of automated scheme. That is, traditional contact tracing is labor-intensive and time-consuming - a time we don't have. <a href="https://circleid.com/posts20200429-the-price-of-lack-of-clarity">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Is Zoom's Server Security Just as Vulnerable as the Client Side? (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20200415-is-zooms-server-security-just-as-vulnerable-as-the-client-side</guid>
		<link>https://circleid.com/posts20200415-is-zooms-server-security-just-as-vulnerable-as-the-client-side</link>
		<description><![CDATA[Zoom programmers made elementary security errors when coding, and did not use protective measures that compiler toolchains make available. It's not a great stretch to assume that similar flaws afflict their server implementations. While Mudge noted that Zoom's Windows and Mac clients are (possibly accidentally) somewhat safer than the Linux client, I suspect that their servers run on Linux.Were they written with similar lack of attention to security? <a href="https://circleid.com/posts20200415-is-zooms-server-security-just-as-vulnerable-as-the-client-side">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Trusting Zoom? (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20200406-rusting-zoom</guid>
		<link>https://circleid.com/posts20200406-rusting-zoom</link>
		<description><![CDATA[Since the world went virtual, often by using Zoom, several people have asked me if I use it, and if so, do I use their app or their web interface. If I do use it, isn't this odd, given that I've been doing security and privacy work for more than 30 years, and "everyone" knows that Zoom is a security disaster? To give too short an answer to a very complicated question: I do use it, via both Mac and iOS apps. Some of my reasons are specific to me and may not apply to you... <a href="https://circleid.com/posts20200406-rusting-zoom">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Zoom Cryptography and Authentication Problems (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20200405-zoom-cryptography-and-authentication-problems</guid>
		<link>https://circleid.com/posts20200405-zoom-cryptography-and-authentication-problems</link>
		<description><![CDATA[In my last blog post about Zoom, I noted that the company says "that critics have misunderstood how they do encryption." New research from Citizen Lab show that not only were the critics correct, Zoom's design shows that they're completely ignorant about encryption. When companies roll their own crypto, I expect it to have flaws. I don't expect those flaws to be errors I'd find unacceptable in an introductory undergraduate class, but that's what happened here. <a href="https://circleid.com/posts20200405-zoom-cryptography-and-authentication-problems">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Zoom Security: The Good, the Bad, and the Business Model (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20200403-zoom-security-the-good-the-bad-and-the-business-model</guid>
		<link>https://circleid.com/posts20200403-zoom-security-the-good-the-bad-and-the-business-model</link>
		<description><![CDATA[Zoom - one of the hottest companies on the planet right now, as businesses, schools, and individuals switch to various forms of teleconferencing due to the pandemic - has come in for much criticism due to assorted security and privacy flaws. Some of the problems are real but easily fixable, some are due to a mismatch between what Zoom was intended for and how it's being used now - and some are worrisome. <a href="https://circleid.com/posts20200403-zoom-security-the-good-the-bad-and-the-business-model">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Y2038: It's a Threat (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20200120_y2038_its_a_threat</guid>
		<link>https://circleid.com/posts20200120_y2038_its_a_threat</link>
		<description><![CDATA[Last month, for the 20th anniversary of Y2K, I was asked about my experiences. (Short answer: there really was a serious potential problem, but disaster was averted by a lot of hard work by a lot of unsung programmers.) I joked that, per this T-shirt I got from a friend, the real problem would be on January 19, 2038, and 03:14:08 GMT. Why might that date be such a problem? On Unix-derived systems, including Linux and MacOS, time is stored internally as the number of seconds since... <a href="https://circleid.com/posts20200120_y2038_its_a_threat">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> The Early History of Usenet, Part IX: Retrospective Thoughts (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20200109_the_early_history_of_usenet_part_ix_retrospective_thoughts</guid>
		<link>https://circleid.com/posts20200109_the_early_history_of_usenet_part_ix_retrospective_thoughts</link>
		<description><![CDATA[Usenet is 40 years old. Did we get it right, way back when? What could/should we have done differently, with the technology of the time and with what we should have known or could feasibly have learned? And what are the lessons for today? A few things were obviously right, even in retrospect. For the expected volume of communications and expected connectivity, a flooding algorithm was the only real choice. <a href="https://circleid.com/posts20200109_the_early_history_of_usenet_part_ix_retrospective_thoughts">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> The Early History of Usenet, Part VIII: The Great Renaming (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20191227_the_early_history_of_usenet_part_viii_the_great_renaming</guid>
		<link>https://circleid.com/posts20191227_the_early_history_of_usenet_part_viii_the_great_renaming</link>
		<description><![CDATA[The Great Renaming was a significant event in Usenet history since it involved issues of technology, money, and governance. From a personal perspective -- and remember that this series of blog posts is purely my recollections &ndash; it also marked the end of my "official" involvement in "running" Usenet. I put "running" in quotation marks in the previous sentence because of the difficulty of actually controlling a non-hierarchical, distributed system with no built-in, authenticated control mechanisms. <a href="https://circleid.com/posts20191227_the_early_history_of_usenet_part_viii_the_great_renaming">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	
	<item>
		<title> The Early History of Usenet, Part VII: Usenet Growth and B-News (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20191202_the_early_history_of_usenet_part_vii_usenet_growth_and_b_news</guid>
		<link>https://circleid.com/posts20191202_the_early_history_of_usenet_part_vii_usenet_growth_and_b_news</link>
		<description><![CDATA[For quite a while, it looked like my prediction &ndash; one to two articles per day &ndash; was overly optimistic. By summer, there were only four new sites: Reed College, University of Oklahoma (at least, I think that that's what uucp node uok is), vax135, another Bell Labs machine &ndash; and, cruciallyy, U.C. Berkeley, which had a uucp connection to Bell Labs Research and was on the ARPANET. <a href="https://circleid.com/posts20191202_the_early_history_of_usenet_part_vii_usenet_growth_and_b_news">More...</a>]]></description>
		<dc:date>2026-03-31T14:29:00-07:00</dc:date>
	</item>
	

	</channel>
</rss>