Review: TajMo: Room On The Porch Tour

On Thursday I was fortunate to be able to attend the Taj Mahal and Keb' Mo's Room On The Porch Tour. The two legendary Blues musicians, collectively known as TajMo, played at the Paramount Theatre in Denver. For two guys that have toured for almost 60 years (Taj) and the other for 50 years (Keb), they both bring serious energy and stage presence to this day.

jericho.blog

Lazy Movie Headlines Are Lazy

At some point this year, while occasionally scrolling my Google-based news feed on my phone, I noticed that more and more articles about movies had the duration of the film in the headline. 95 minutes.. 95 minutes.. 105 minutes.. 116 minutes.. 132 minutes. Uh, why? What normal human reads that and thinks "oh 116 minutes is perfect!" or "that's only 1.93333 hours!" This kind of lazy writing was a flashback to when I pointed out how…

jericho.blog

Odds Are You Are Responsible for that Traffic Slowdown

I know, potentially insulting readers in the headline is not a good way to keep people interested, but it's statistically true. Until recently, when stuck in bad traffic I daydreamed about having a drone or helicopter view to see where the problem is. On occasion I am close enough to the front of the jam to see the cause; absolutely nothing.

jericho.blog

How Much Lipstick Can That CVE Pig Wear?

Preface When I started writing this, I was still on the CVE editorial board, which I was removed from in 2018. That means I have been taking notes and working on this blog for over eight years. It's a case of more and more evidence piling up and me not having time to pick a time to dedicate to completing and publishing.

jericho.blog

Q&A: Modernizing the National Vulnerability Database in the Age of Artificial Intelligence

The last two years of the National Vulnerability Database (NVD) has been tenuous, perfidious, and an outright disaster for organizations world-wide. That isn't hyperbole unfortunately, as the program has continued to go downhill for more than two years. NVD is no longer a place to get usable vulnerability intelligence. It started back in 2024 at VulnCon, when Tanya Brewer shared an update during a talk on the state of NVD.

jericho.blog

Apparently Turkeys Obtained Personhood According to AI

Introduction Each morning I do a quick skim of recorded events from my security system. Living in the mountains I get to enjoy clips of a wide variety of animals that visit for the last three years. That's typically bears, deer, foxes, turkeys, and a skunk. On rare occasions that includes mountain lions, coyotes, and raccoons. The security system is pretty simple with Google Nest cameras that tie into…

jericho.blog

Meta – The No Child Left Behind of LLMs?

Intro Last month, headlines told us about a novel incident where OpenAI's agents "went rogue, escaped, and hacked" a company during testing. Some are calling it a "watershed moment" for computer security. Details quickly emerged that led some to conclude it was "remarkably easy". From there it just got more interesting, weirder, and more serious though.

jericho.blog

A Word on Microsoft and Vulnerability Exploitation

Intro Microsoft Security Response Center (MSRC) is the group responsible for triage when researchers report new vulnerabilities. They handle a wide variety of other tasks, but my focus is on their analysis of vulnerabilities in one context or another. That could be the researcher's disclosure or investigating an actively exploited vulnerability in a customer environment. At some point in the past, MSRC's security advisories started adding metadata around exploitation.

jericho.blog

Drowning in EULA, T&S, and Privacy Policy Updates

Introduction If you use a computer in almost any capacity, you have been exposed to an End-User License Agreement (EULA) before. As far as Internet lore goes they have a special place in infamy and contempt. Even before the Internet as well as the early days it was worse in some ways. When you went to a store and purchased software that came in a box you found yourself facing a…

jericho.blog

Research: Hacking-adjacent Incident from 1966

At this point I don't even remember where I obtained a really poor resolution image of a newspaper page. It's been on my computer for at least six years, likely much longer. Due to the poor resolution no matter how much you zoom and try to find a sweet spot of readability, the details were too fuzzy. Today, I decided to take another stab at it and try to search it out.

jericho.blog

Review: A Natural History of Empty Lots by Christopher Brown

Earlier this year a good friend gave me a book, "A Natural History of Empty Lots: Field Notes from Urban Edgelands, Back Alleys, and Other Wild Places" by Christopher Brown. The book follows Brown primarily, occasionally including members of family, after he moved to Austin, Texas and purchased an empty lot in an industrial section of town. From there he learns to better appreciate the nature that springs up around us.

jericho.blog

Random Movie/TV Thoughts and Reviews (July 2026)

Spartacus: House of Ashur (2025) is a continuation of the original Spartacus series from 2010 in which Ashur is given an alternate fate than received in the original. This allows a reimagined story ending and launch into the new that finds himself dominus of the very ludus that had previously owned him. Rather than just a repeat with new characters, this series stays local and branches out offering 'unseen spectacles' in the arena.

jericho.blog

CISA KEV’s Revolving Door

Some time ago, perhaps last year or two years ago during VulnCon, I made an offhand comment about Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerability (KEV) catalog and how there were more than one vulnerability that had appeared in it and were subsequently removed. I received doubt from someone (Tod Beardsley?) that didn't think it had happened at all.

jericho.blog

VDBs: Pedantic Nuances on Version Tracking

I am all about the pedantic nature of running a vulnerability database (VDB). It's the backbone of running one well as "simply aggregating vulnerability information" is anything but simple. I've been outspoken on the issue of perceived simplicity for at least two decades and brought it up in various presentations and blogs. This blog is not new in that I have…

jericho.blog

Nature Finds a Way

After moving into the mountains a few years ago I found myself being more aware of nature's diversity. I would imagine a lot of people, especially in Colorado, think they are aware and in tune with nature and I am sure many are. But going from city life to mountain life will open your eyes to a lot more of it.

jericho.blog

YouTube’s Thumbnail Generation Fraud

In what I can only assume is part of the ever-growing world of AI enshitification, I began noticing an odd thing when watching videos on YouTube. When viewing content there is the primary screen with the video you are watching and on the right is a column with additional recommended videos as determined by their algorithm. At some point in the past year, maybe more, those thumbnails stopped being a random screen capture from the video itself.

jericho.blog

F5 Contributes to KEV Confusion

F5 is a technology vendor that sells a variety of networking technology including security products. With a considerable security portfolio and long tenure in the industry they are well positioned to observe known exploited vulnerabilities (KEV). Their staff frequently write blogs about threat actor activity, exploit campaigns, and associated topics. Unfortunately, while they have great insight into this activity, their ability to convey that information in a clear manner is seriously lacking.

jericho.blog

We’re Losing the “Cyber” War to Ourselves

It's hard to pinpoint where the concept of cyberwar originated. In roundabout ways it likely goes back many decades in fiction. As far as citations go, some believe a seminal work is titled Unrestricted Warfare by Qiao Liang and Wang Xiangsui, two colonels in the People's Liberation Army (PLA). Regardless of when the premise started, the computer-based cold war has been going full steam for two decades or more.

jericho.blog

And AI Tech Bros Still Want to Gamble…

If you follow even the headlines for so-called "AI" developments, you may have caught a few that talked about how some AI insiders say there is a chance that the technology they are developing will "destroy humanity". Of course, that term is subjective and could vary considerably from person to person. Does it mean it will destroy what makes us human, the creativity and drive?

jericho.blog

Save the Earth One Napkin at a Time

Over the years I have certainly thought about the concept "healing by a thousand bandaids", as a counter idiom to "death by a thousand cuts", while not writing as much about it. I have blog notes for various things in the spirit of this and have used it consistently at work to describe the idea of using small bits of automation for a greater impact.

jericho.blog

The Loquacious Introvert

This is my 1,000th post on this blog! Not counting this post, that is 893,353 words written here over 38 years. Of course, this blog hasn't been around that long but I made an effort the last few years to consolidate all of my writing in one place and date it accordingly. That means the first "post" of this blog is…

jericho.blog

2026 East Coast Drive (Part 8: Random Notes)

The final post in my series on the recent East coast drive through five states has broader observations and thoughts. With over two thousand miles of driving it gives you plenty of time to think and observe. In no particular order… Professional Driver Responsibility I think that all 18-wheel trucks should be required by federal law to have a phone number you can call to report dangerous driving or other issues.

jericho.blog

Captain Obvious Audits the NVD

During my recent trip to the East Coast several people linked an article from Recorded Future to me since it was on a topic I have written extensively about. The article covered a May 26 report from the Office of the Inspector General (OIG) at the Department of Commerce that was summarized as "mistakes have been made" in the operation of National Vulnerability Database (NVD).

jericho.blog

2026 East Coast Drive (Part 3: VA / DC)

June 5 (Friday) From Richland, Virginia it was time to head North toward Washington D.C. The day was primarily stopping at a few towns to check out stores and drive through the areas to get a feel for them. I had driven through this area in 2022 as part of another cross country trip but this time headed in a different direction with time to check out more of the area.

jericho.blog

2026 East Coast Drive (Part 2: North Carolina / Virginia)

June 3 (Wednesday) After the convention I drove back to Wilmington, North Carolina to check out a few shops and grab lunch along the river. The old downtown area is nice to walk and has a lot to see including art and a battleship. Being back in the South also gave a bit of nostalgia seeing Waffle House again, especially with all the…

jericho.blog

2026 East Coast Drive (Part 1: NaClCON)

Pre-game For the first half of June I attended NaClCON and then drove through five states and the District of Columbia. The trip began with a rare flight that required a layover as Wilmington, North Carolina is a small regional airport. That put me through O'Hare which I despise due to past trips that left me stranded there overnight. Fortunately the flight was uneventful other than having to wake up at 4:30am to catch an early flight.

jericho.blog

My Quest for the White Squirrel!

I recently attended NaClCON in Carolina Beach, North Carolina. After the con concluded I took a drive through North Carolina, Virginia, Washington D.C., West Virginia, Kentucky, Tennessee, and back through North Carolina to fly out. Between June 3rd and June 12th I drove around two thousand miles to see a couple states I had never been to as well as areas of other states I had not.

jericho.blog

Colorado Voting System Irregularities & Continued Rigging

Earlier this year I wrote about how the Colorado voting system is effectively "rigged" to enforce a two-party system. In that I said "In Colorado, if you are not registered with political affiliation, you are given two ballots; one Democrat and one Republican. This forces you to vote along party lines even if you do not fully support either party.

jericho.blog

Weekly Threat Bulletin – June 17th, 2026

These are the top threats you should know about this week.

f5.com