Andy Ellis Profile picture
Advisory CISO: @OrcaSec. Operating Partner: @YLVentures. CEO: @DuhaInc. Fan: @Patriots.
Dec 3, 2021 14 tweets 14 min read
Dear @MayorLungoKoehn (cc @Morell4Medford @zacbears):
This will be a bit long, but it’ll be a series of tweets, not just a picture, so it’s accessible to more humans.

I think I can see your effort here, but this semi-apology is highly problematic. 1/ #MedfordAntiSemitism @MayorLungoKoehn @Morell4Medford @zacbears Let’s start with your language. An apology should always start with “I,” not “We.” “I” owns. “We” deflects. Who is “We”? There are some exceptions, but “I” is more powerful, and, actually, helpful as you write the rest of the apology. 2/ #MedfordAntiSemitism
Apr 25, 2021 11 tweets 5 min read
The first time I crossed paths with @dakami, let’s just say I wasn’t pleased. But it’s a little bit of a long story, and we did share a laugh at the end of it, so bear with me. #InMemoryOfDakami The story starts in 2007, maybe. One of my biggest worries at Akamai was hardening our DNS infrastructure. If you take out a CDN’s top level DNS, that’s … pretty much it. 2/ #InMemoryOfDakami
Feb 4, 2020 5 tweets 1 min read
I see a variant of this almost weekly. If you ever find yourself denigrating humanity’s risk management, recognize that we got this far, and consider how your model could use updating. 1/ Humans take risk in everything we do. It’s really important to *not* be paralyzed by known risks. So you internalize the risks you live with, and generally ignore them. 2/
Jul 3, 2019 30 tweets 6 min read
First: kudos to @Cloudflare for transparency here and throughout their incident.
Next: some thoughts on safety in distributed systems like this. (I don’t know how CF does it, so don’t take this as criticism of their practices, merely some musings from similar experiences) 1/ While test and QA is important, massive distributed systems with unconstrained user inputs are hard to simulate, so deployment to production is *always* risky. Call it “operational field testing,” but there is always the chance you’re going to find new failure modes there. 2/
Jun 27, 2019 6 tweets 1 min read
Dear $VENDOR,
Starting your pitch – especially in a social setting – with “What are you doing about problem X?” is a pretty clear setup. You’re putting your target on the defensive even before they open their mouth. 1/ Yes, you’re trying to get your target to commit to doing something that isn’t as “good” as your solution. And of course, that sets you up to close an improvement deal, right?

Wrong. 2/
Dec 5, 2018 27 tweets 9 min read
Inspired by PechaKucha, here is my attempt at telling a story -- The Villain's Quest in Harry Potter -- via Twitter. 20 "slides", one every 20 seconds. For good or ill, it'll be over soon. 0/20 We often tell stories from the point of view of the hero. But heroes don't notice everything; examining a story from the point of view of the villain can be informative. Let's look at Harry Potter. 1/20 Image