Brian Greenberg

Resources · maintained, not linked-and-forgotten

A working library for students & practitioners

These are the ten guides I keep current for my students and for peers building security and technology programs. Each is a curated, opinionated list — if it's here, I'd stake a recommendation on it. External links open in a new tab.

96 entries

Tools

Secure Operating Systems & VMs

  • TailsThe Amnesic Incognito Live System: a portable OS you boot from a USB stick that protects against surveillance and censorship. All traffic routes through Tor, and it leaves no trace when you shut down—every session starts clean.
  • QubesOSA “reasonably secure operating system” built on security through compartmentalization: everything runs in isolated virtual machines, so a compromise of one—your browser, an email attachment—can’t reach the rest of your digital life.
  • WhonixAn anonymous operating system that runs like an app and routes all Internet traffic through the Tor anonymity network. Available for all major operating systems.
  • Oracle VM VirtualBoxA free, open-source platform that lets users run multiple operating systems on a single device. Supports Windows, Linux, Solaris, and macOS guests; free for personal, educational, or evaluation use.
  • VMware Workstation Pro & FusionDesktop hypervisors used by millions to run virtual machines on Windows, Linux, and Mac — now free for personal use.
  • Proxmox VEThe open-source server hypervisor: KVM virtual machines and Linux containers under one web console, with clustering, live migration, and built-in backup. What to run on the hardware in the closet when VirtualBox is too small and VMware is too expensive.

Encryption

  • OpenPGPA non-proprietary format for authenticating or encrypting data using public key cryptography, based on the original PGP software. The standard for nearly all of the world’s signed or encrypted email.
  • VeraCryptFree, open-source disk encryption for Windows, macOS, and Linux. The successor to TrueCrypt: whole disks, partitions, or portable containers, with hidden volumes for plausible deniability.
  • CryptsetupAn open-source utility that conveniently sets up disk encryption based on the dm-crypt kernel module.
  • LUKS (Linux Unified Key Setup)The standard on-disk format for Linux disk encryption, managed through cryptsetup — what LUKS is and how to implement full-disk encryption with it.
  • ageModern file encryption with no configuration, no key rings, and no options to get wrong — one small tool, a public key that fits on a line. The honest answer when PGP is more machinery than the job needs.

PGP & Email Encryption

OpenPGP is the standard; these are the programs that implement it, the keyserver that distributes your key, and the guide that walks a beginner through it. Start with the OpenPGP entry above for what the format is, then pick the tool for your platform.

  • GnuPG (GPG)The free, GPL-licensed reference implementation of OpenPGP and the engine nearly every other PGP tool wraps. If you sign a release, encrypt a file, or verify a package signature on Linux or macOS, this is what actually does it.
  • GPG SuiteThe macOS on-ramp: GnuPG plus a key manager, Keychain integration, and an Apple Mail plugin, in one installer. The shortest path from “I should use PGP” to actually having a working key on a Mac.
  • Gpg4winThe Windows equivalent — GnuPG bundled with the Kleopatra certificate manager and Outlook integration. Free, open-source, and funded in part by the German federal information-security office.
  • MailvelopeOpenPGP inside webmail: a browser extension that encrypts and decrypts in Gmail, Outlook.com, and most providers, so you can use PGP without moving to a desktop mail client. Often the only realistic path for someone on a managed machine.
  • keys.openpgp.orgThe modern public keyserver, and the one to use. The old SKS network was effectively destroyed by certificate-flooding attacks and had no way to remove a key; this one verifies the address before publishing it and lets you delete your own.
  • Email Self-Defense (FSF)The Free Software Foundation’s illustrated, step-by-step PGP walkthrough — install, generate a key, exchange one, send your first encrypted message, in about half an hour. The guide to hand someone who has never done this.
  • RFC 9580 — OpenPGPThe 2024 refresh of the OpenPGP specification, superseding the long-frozen RFC 4880: modern AEAD encryption, v6 keys, and updated algorithm guidance. The normative citation when you need one.

Password Managers

  • KeePassXCA free, open-source password manager that keeps your vault as a file you control — no account, no cloud, no subscription, no vendor to breach. Cross-platform, audited, and the answer when the requirement is “nobody else holds this.”
  • BitwardenOpen-source password management with sync that actually works across every device and browser, a genuinely usable free tier, and the option to self-host the server. The one to recommend to family and to a small business.
  • Apple PasswordsThe Passwords app Apple split out of Settings — free, already on every Apple device, syncing through iCloud Keychain, and handling passkeys and verification codes. If the choice is between this and reusing the same password everywhere, this wins; the cross-platform managers above win once Windows or Android enters the picture.
  • Google Password ManagerBuilt into Chrome and Android and free with any Google account, with passkey support and a Password Checkup that flags reused and breached credentials. The same trade-off as Apple’s: excellent inside its ecosystem, limiting the moment you want your passwords in a different browser.
  • 1PasswordThe paid, proprietary option — and the one I actually run. Two-secret key derivation means a stolen vault is useless without the Secret Key that never leaves your devices, and the developer tooling is the real differentiator: a CLI that injects secrets into scripts so they are never hardcoded, and an SSH agent that holds your keys and signs your git commits.

Two-Factor Authentication & Passkeys

One caveat first, because it is easy to miss: several password managers — 1Password and Apple Passwords among them — will happily store your one-time codes alongside the password. It is genuinely convenient, and it also means a single compromised vault hands over both factors at once. Keeping codes in a separate app preserves the second factor as an actually separate thing; decide deliberately rather than by default. Better still, use a passkey or a hardware key where one is offered — unlike a typed code, neither can be phished or relayed.

  • Ente AuthA free, open-source authenticator that works on every platform including the desktop and web, with end-to-end encrypted backup so losing your phone is not a catastrophe. The easiest recommendation for someone who wants codes kept separate without the recovery anxiety.
  • Aegis AuthenticatorThe open-source Android authenticator worth switching to: an encrypted vault, biometric unlock, and — critically — exports that actually let you move your codes somewhere else. Android only.
  • 2FASOpen-source authenticator for iOS and Android with a browser extension for desktop approvals and optional encrypted cloud backup. No account required to start.
  • YubiKeyA hardware security key that proves your presence with a physical touch. Because the key checks which site is asking, it cannot be tricked into authenticating to a convincing fake — the failure mode that defeats every code you can read and retype. Buy two and register both, so a lost key is an inconvenience rather than a lockout.
  • passkeys.devThe practical reference for passkeys — the FIDO-based credentials that replace the password and the one-time code together, sync through your platform or password manager, and are phishing-resistant by design. Where authentication is heading; worth understanding before you are asked to deploy it.

Backup & Recovery

A backup you have never restored is a hope, not a backup. Whatever you choose, schedule a restore test — the drill is the control, not the copy. For the strategy behind the tools — why the restore test matters, and how backup systems themselves get compromised — see my essay on backup security.

  • resticA fast, open-source backup program with encryption, deduplication, and snapshots built in, targeting local disks, SFTP, and every major object store. One static binary, verifiable repositories, and a restore path simple enough that you will actually test it.
  • BorgBackupDeduplicating, compressing, authenticated-encryption backup for Linux and macOS — the long-standing open-source workhorse. Excellent when you are backing up many similar systems and want the storage bill to reflect it.
  • SyncthingContinuous open-source file synchronization directly between your own devices — no cloud account in the middle. Worth knowing precisely because it is not a backup: sync replicates your mistakes, so pair it with one of the tools above.

DNS & Public Resolvers

Email Authentication Toolkits

Email was designed without a way to prove who sent a message — exactly what phishing exploits. These four DNS standards close the gap; if you own a domain, publish all four.

DKIM cryptographically signs each message, proving the domain owner sent it and nothing was altered in transit.

DKIMmxToolbox EasyDmarc DNS Checker

SPF lists the servers authorized to send mail for your domain — the oldest of the standards; a domain without one is trivially spoofable.

SPFmxToolbox Kitterman SPF Tools EasyDmarc SPF Check Online

DMARC is the enforcement layer: it ties SPF + DKIM together, tells receivers to reject failures, and reports abuse of your domain back to you.

DMARCmxToolbox DMARC Tags Dmarcian Fortra (Agari) DMARC tools DMARC XML Analyzer

BIMI displays your logo in the inbox — but only for domains that already enforce SPF, DKIM, and DMARC, so it doubles as visible proof of good email hygiene.

BIMIRed Sift DNS Checker

Network Analysis & Defense

  • WiresharkThe world’s standard network protocol analyzer, free and open source: capture live traffic and read it frame by frame, decoded across hundreds of protocols. When you need to know what actually crossed the wire rather than what a log claims, this is the tool.
  • NmapThe network mapper: discover hosts, enumerate open ports and services, fingerprint operating systems, and script deeper checks with NSE. Three decades old, still the first command run on an unfamiliar network. (Source-available under the Nmap Public Source License — GPL-derived, not OSI-approved.)
  • Pi-holeA DNS sinkhole for your whole network: block ads, trackers, and known-malicious domains for every device at once, including the ones that cannot run an extension. Runs happily on a Raspberry Pi and gives you a real picture of what your devices are talking to.
  • OPNsenseAn open-source firewall and routing platform built on FreeBSD — stateful filtering, VPN, IDS/IPS, and reporting, on your own hardware with no licensing tier. The FOSS answer to a small-business perimeter appliance.

Notes, Writing & Research

The tools I actually run to think and write. All three keep your work in files or an open database you can export — a durability requirement, not a preference.

  • ObsidianNotes as a folder of plain Markdown files on your own disk, linked into a graph you can actually navigate. Free for personal use, works offline, and because the files are just text there is no lock-in — every word on this site is written in it before it ever reaches the repository.
  • ZoteroThe free, open-source reference manager: a browser button that captures a source with its metadata and PDF, and a word-processor plugin that formats the citations and bibliography in any style. Built by a non-profit research center, not a publisher.
  • OmniFocusA serious Getting Things Done task manager for Apple platforms — projects, contexts, deferred dates, and review cycles, with enough structure to hold everything a leadership role throws at you. Paid and Apple-only; the depth is the point.

Utilities

  • Service StatusMy own live board: 49 cloud and SaaS services polled every 15 minutes, each read from that vendor’s own status page rather than a third-party aggregator. A failed check reads Unknown rather than green, because a check that didn’t happen isn’t good news.
  • CyberChefGCHQ’s open-source “cyber swiss army knife”: decode, decrypt, deobfuscate, and convert data by dragging operations into a recipe, entirely in your browser. The fastest way to unpick a suspicious string without writing a script — or sending it to a third party.
  • PodmanA daemonless, rootless container engine that speaks the same commands as Docker — a meaningful security improvement, since containers run as your user instead of through a root daemon. Drop-in enough that aliasing docker to podman usually just works.
  • PuTTYAn SSH and telnet client developed originally by Simon Tatham for the Windows platform. Open-source, with source code available, developed and supported by a group of volunteers.
  • Google Admin ToolboxGoogle’s free diagnostic suite: Dig for DNS lookups, HAR analyzer for browser traffic, MX checks, message-header analysis, and more. Useful well beyond Workspace administration.
  • ShodanThe IoT Search Engine for the Internet of Everything — the world’s first search engine for Internet-connected devices.
  • Microsoft PowerToysA set of utilities for power users to tune and streamline their Windows experience for greater productivity.
  • chezmoiManage your dotfiles and app settings across machines with git as the source of truth — templates for per-machine differences, password-manager integration for secrets. Replaced Mackup in my toolkit.
  • have i been pwned?Troy Hunt’s free service aggregating billions of breached records so victims can learn of account compromises. Check every address you own and subscribe to notifications.
  • Cloud Latency Map by KentikA free public tool exploring measured latencies between 100+ cloud regions worldwide — spot recent changes between clouds, cities, or continents.
  • DLP TestA free testing site for Data Loss Prevention deployments: safe sample PII/PCI data plus HTTP, HTTPS, and FTP endpoints — prove your DLP controls actually block sensitive data in motion.
  • File ExamplesFree dummy files in every common format and size — video, audio, documents, images, archives — for exercising upload limits, MIME handling, and file parsers without hunting for a real file to throw at them.
  • Wayback MachineThe Internet Archive’s time machine for the web: 900+ billion captures since 1996. Indispensable for investigations (what did that page say before it changed?), dead-link rescue, and institutional memory.

Security References & Investigation

  • MITRE ATT&CKThe knowledge base of adversary tactics and techniques from real-world observations — the common language of modern defense. If you learn one framework taxonomy, learn this one.
  • ANY.RUN Threat IntelligenceThreat-intel lookup built on ANY.RUN’s interactive malware sandbox: search hashes, IPs, and domains across millions of live analysis sessions.
  • Decent Security: Investigation GuideA practical, step-by-step guide to investigating suspicious files, links, and emails with free tools — written for working admins, not just researchers.
  • Knock-KnockA live honeypot dashboard of real break-in attempts against SSH, RDP, Telnet, and FTP — where the bots come from and what credentials they try, with free blocklists.
  • MITRE D3FENDThe defensive counterpart to ATT&CK: a knowledge graph of countermeasures, mapped to the attacker techniques they actually address. Use it to answer “we know they do this — what specifically do we deploy against it?”
  • CISA Known Exploited Vulnerabilities (KEV)The authoritative list of vulnerabilities being exploited in the wild right now — a few thousand entries out of the hundreds of thousands published. The single best free filter for “patch this first,” and binding on U.S. federal agencies.
  • CVE ProgramThe system of record that assigns every publicly disclosed vulnerability its identifier — the common name that lets a scanner, a vendor advisory, and a news story refer to the same flaw.
  • NIST National Vulnerability DatabaseThe U.S. government’s enriched feed of CVE records: severity scores, affected-product data, and references, in a form tools can consume. The reference source behind most vulnerability management.
  • FIRST CVSSThe Common Vulnerability Scoring System — the open standard behind every “critical, 9.8” you have read. Learn what the vector string actually encodes; the base score is a property of the flaw, not of your risk.
  • FIRST EPSSThe Exploit Prediction Scoring System: a data-driven probability that a given vulnerability will be exploited in the next 30 days. The correction to severity-only triage — pair it with KEV and patch what will actually be used against you.
  • YARAThe pattern-matching language malware researchers use to describe and hunt families of files by their contents. Open source, embedded in most analysis tooling, and the standard way to share a detection with someone else.
  • SigmaA vendor-neutral, open format for writing detection rules against log data, converted to your SIEM’s native query language. Write the detection once, keep it when you change platforms — the YARA idea applied to logs.
  • VelociraptorOpen-source endpoint visibility and digital forensics at scale: query thousands of machines for artifacts, collect evidence, and hunt across a fleet during an incident. Serious DFIR capability without a per-endpoint licence.
  • The Shadowserver FoundationA nonprofit that scans the internet daily and reports what it finds — exposed services, compromised hosts, botnet activity — free to the network owners and national CERTs responsible for them. Subscribe for your own ranges; the report is free and specific.
  • SANS Internet Storm CenterA free daily handler’s diary of what is actually happening on the internet, written by practitioners since 2001, plus the StormCast podcast in five-minute installments. The most reliable low-noise way to keep a pulse.
  • Zero Day ClockA data visualization of how the disclosure-to-exploitation window has collapsed — from years to days, and with AI, heading toward minutes.

Live Threat Maps — cyber weather

SpamHausLive view of spam and botnet activity from the Spamhaus feeds. KasperskyThe classic spinning-globe cyberthreat map. BitDefenderReal-time attack, spam, and infection tracker. CheckpointThreatCloud live cyber attack map. RadwareLive DDoS and web-attack telemetry. FortinetFortiGuard real-time threat intelligence map. NetScoutHorizon — global DDoS attack visibility. SonicWallLive worldwide attack telemetry from SonicWall sensors. Digital Attack MapTop daily DDoS attacks worldwide (Google + Arbor). TalosCisco Talos email & spam reputation world view.

↑ Back to top

37 entries

Standards & Controls

Cybersecurity Frameworks

  • NIST Cybersecurity Framework 2.0The most widely adopted security framework in the world and where most organizations should start: six functions — Govern, Identify, Protect, Detect, Respond, Recover — free, outcome-based, and mapped to nearly everything else on this page.
  • CISThe Center for Internet Security — the community-driven nonprofit behind the CIS Controls® and CIS Benchmarks™, globally recognized best practices for securing IT systems and data.
  • CIS Controls v8 → SOC 2 MappingMapping between AICPA Trust Services Criteria (SOC 2) and the CIS Critical Security Controls v8.
  • NIST ITLThe Information Technology Laboratory — NIST’s globally trusted source of independent research, measurements, and standards for IT.
  • NIST CybersecurityNIST’s cybersecurity standards, guidelines, and best practices for U.S. industry, federal agencies, and the public.
  • NIST SP 800-53The exhaustive security & privacy control catalog behind U.S. federal systems (and FedRAMP) — the authoritative, granular definition of every control.
  • NIST SP 800-61 (Incident Response)Incident-response recommendations aligned with CSF 2.0 — build the capability to detect, respond, and recover before you need it.
  • NIST AI Risk Management FrameworkAI RMF 1.0: the voluntary framework for identifying, measuring, and governing AI risk — the emerging baseline for AI governance programs.
  • The Secure Controls Framework (SCF)A comprehensive internal-controls catalog spanning cybersecurity and data privacy — a long-term tool for compliance efforts across People, Processes, Technology, and Data.
  • Cyber EssentialsThe UK standard organizations can be assessed and certified against to protect against the most common cyber attacks.
  • OWASPThe Open Worldwide Application Security Project: open community, 250+ chapters, and the definitive free resources for building software that can be trusted.
  • CSA Cloud Controls MatrixThe Cloud Security Alliance’s control framework purpose-built for cloud: ~200 controls across 17 domains, mapped to ISO 27001, NIST, and PCI-DSS. The de facto standard for assessing cloud providers.
  • CIS BenchmarksConsensus-built hardening guides for specific systems — Windows, Linux distributions, cloud accounts, browsers, databases — free to download. Where the CIS Controls tell you to harden, these tell you exactly which setting.
  • DISA STIGsThe U.S. Defense Department’s Security Technical Implementation Guides: prescriptive, auditable configuration standards for hundreds of products, published free. Stricter than most organizations need, and useful precisely for that.

Secure Software & Supply Chain

Framework guidance aimed at how software gets built and shipped, rather than at the organization running it. If you write or buy software, this is the layer your assurance actually rests on.

  • NIST Secure Software Development Framework (SSDF)NIST SP 800-218: the practices for building software securely, organized so you can map your existing pipeline to them. The framework U.S. federal software attestations are written against, and a sound checklist regardless.
  • SLSASupply-chain Levels for Software Artifacts: a graded set of requirements for build integrity and provenance, so a consumer can verify how an artifact was produced. Gives you a named level to claim and a concrete next one to reach.
  • OpenSSF ScorecardAutomated health and security scoring for any open-source repository — branch protection, signed releases, dependency hygiene, maintenance activity. Run it on a dependency before you adopt it, and on your own project before someone else does.
  • OWASP GenAI Security ProjectOWASP’s home for the Top 10 for LLM Applications and the agentic-AI security work: prompt injection, insecure output handling, excessive agency, and the rest. The reference to hand a team shipping anything with a model in it.

Industry Standards

  • IEC 62443The leading standard for industrial cybersecurity, covering all kinds of facilities and systems across myriad industries.
  • ISO 27000 familyThe family of information-security standards providing end-to-end security guidance for an organization.
  • ISO 27001The certifiable core of the family: implement and operate an Information Security Management System (ISMS). The certification most often requested in vendor due diligence worldwide.
  • ISO 27002The companion code of practice to 27001 — detailed implementation guidance for each ISMS control.
  • ISO 27032Guidelines for Internet security (2023 revision): managing the Internet-facing threats — phishing, malware, cross-organization attacks — that fall between cybersecurity, network security, and information security.
  • ISO 27701The privacy extension to 27001: a Privacy Information Management System (PIMS) for personal data, mapped to GDPR obligations — the bridge between your security and privacy programs.
  • ISO 22301The international standard for Business Continuity Management Systems: plan for, survive, and recover from disruption. Security keeps the bad guys out; 22301 keeps the business running when something gets through.
  • ISO 31000The umbrella risk-management standard — principles and process for treating risk of any kind, in the language the rest of the enterprise uses.
  • ITILThe Information Technology Infrastructure Library — the framework for standardizing the selection, planning, delivery, and lifecycle of IT services.
  • COBITISACA’s framework for governance and management of enterprise IT — the board-level answer to whether IT is delivering value, managing risk, and staying aligned with the business.
  • SOC 2The AICPA’s compliance framework for service organizations handling customer data: reports evaluate security, availability, processing integrity, confidentiality, and privacy against the Trust Services Criteria.
  • CMMCThe U.S. DoD’s Cybersecurity Maturity Model Certification — the tiered certification (built largely on NIST SP 800-171) required of defense contractors handling controlled unclassified information.

Reference Architectures

  • Microsoft Cybersecurity Reference Architectures (MCRA)Microsoft’s freely published architecture diagrams showing how identity, endpoint, network, SecOps, and zero-trust capabilities fit together across a modern enterprise — an excellent way to see the whole security estate on one canvas.
  • Google Cloud Enterprise Foundations BlueprintGoogle’s answer to the MCRA: an opinionated reference for a secure GCP landing zone — org policy, identity, network segmentation, logging, and detective controls, with companion Terraform so the diagram is also deployable. Read it next to the Microsoft one to see how the same problems are solved on a different cloud.
  • AWS Security Reference Architecture (AWS SRA)AWS’s holistic guide to which security services to deploy where across a multi-account organization — the third vendor view, and the one to consult before designing an AWS estate rather than after.
  • NIST SP 800-207: Zero Trust ArchitectureThe vendor-neutral canon. Every vendor zero-trust model above cites this document — the definitions, the logical components, and the deployment patterns. Start here so you can tell a genuine zero-trust architecture from a product relabeled as one.
  • CISA Zero Trust Maturity ModelThe practical companion to 800-207: a maturity grid across five pillars (identity, devices, networks, applications, data) that turns the theory into “where are we now, and what is the next step.” Free, and a genuinely useful self-assessment.
  • Open Security Architecture (OSA)The vendor-neutral, openly licensed one: a library of reusable security-control patterns drawn as diagrams you can lift into your own designs. The open-source complement to the cloud vendors’ blueprints — no platform assumed.
  • SABSANot a set of diagrams but the method for producing your own: a business-driven framework that traces every security control back to a business requirement, so the architecture is defensible to the board rather than assembled from best-practice by habit. The discipline behind the artifacts above.

↑ Back to top

56 entries

Software Development

Version Control

  • GitThe free, open-source distributed version control system — fast, tiny footprint, cheap local branching. It outclasses SCM tools like Subversion, CVS, Perforce, and ClearCase.
  • GitHubThe developer platform on top of Git: access control, issues, pull requests, CI, and wikis for every project.
  • GitLabThe other major Git platform — a complete single-application DevSecOps platform, hosted or self-managed, with a generous open-source tier.
  • ForgejoA lightweight, fully free software forge you can self-host on modest hardware — issues, pull requests, packages, and CI. The realistic exit path if you ever need your code hosting to not be someone else’s platform decision.
  • CodebergA free, donation-funded code host run by a German non-profit and built on Forgejo. Worth knowing as the community-governed alternative when a project wants no commercial owner at all.

Development Environments

  • Visual Studio CodeThe free, open-source code editor supporting most languages, for macOS, Linux, and Windows.
  • HomeBrewThe Missing Package Manager for macOS (or Linux) — install and manage developer tools from the command line, reproducibly.
  • Oh My Zsh!A delightful, community-driven framework for your Zsh configuration, bundled with thousands of functions, plugins, and themes.
  • iTerm2The free, open-source terminal that replaces Terminal.app: split panes, searchable scrollback, per-host profiles, and a shell integration that makes long SSH sessions genuinely comfortable. The window most of this site was built in.
  • OrbStackDocker containers and Linux VMs on macOS that start in a couple of seconds and stay out of your battery and memory — the drop-in replacement for Docker Desktop. Free for personal use, paid for commercial.
  • VimThe ubiquitous modal editor — charityware, on essentially every Unix machine you will ever log into, and unchanged enough that the keystrokes you learn now still work in thirty years. Start with vimtutor at a shell prompt: it ships with Vim and takes about half an hour.
  • Vim Cheat SheetThe one-page reference worth bookmarking: movement, editing, registers, macros, search-and-replace, and window management, grouped so you can find a command by what you are trying to do. Open source and translated into dozens of languages.
  • Open VimAn interactive tutorial that puts a live Vim in the browser and walks you through the motions one at a time, correcting you as you go. The gentlest possible introduction if a blinking terminal cursor feels hostile.
  • Vim Help FilesVim’s own manual — the complete :help documentation, rendered as searchable, linkable web pages. Once past the basics, this is the authoritative answer to nearly every “can Vim do…” question.
  • NeovimThe modern, community-driven continuation of Vim: built-in language-server support, Lua configuration, and a fast plugin ecosystem. Still the editor that works identically over SSH on a machine you have never seen before.
  • OpenTofuThe open-source infrastructure-as-code tool forked from Terraform after its licence change, now under the Linux Foundation. Same language and workflow, MPL-licensed and community-governed — a live case study in why licence terms belong in your architecture review.
  • AnsibleAgentless automation over plain SSH: describe the desired state of your machines in YAML and apply it repeatably. The lowest-ceremony way to stop configuring servers by hand and start reviewing configuration as code.
  • PostmanThe API platform most teams standardize on: send and inspect requests, save them as shareable collections, script tests that run in CI, mock a server, and document the contract — the fastest way to understand an unfamiliar API.

Build & Deploy

The pipeline behind this site, start to finish: a static site generator, a CI runner that gates every commit, and an edge platform that serves the result.

  • Eleventy (11ty)A simpler static site generator: no client-side framework, no runtime, just your content compiled to plain HTML that loads instantly and will still work in a decade. This site is built with it.
  • GitHub ActionsCI/CD wired directly into the repository — run your tests, linters, and security gates on every push and block the merge when one fails. Generous free tier, and you can point it at your own hardware with a self-hosted runner.
  • Cloudflare WorkersServerless code running at the edge, close to your users, with a free tier that comfortably covers a personal site and a generous jump to paid. The contact form on this site is a Worker.

AI-Assisted Development

  • Claude CodeAnthropic’s agentic coding tool: Claude working in your terminal, editor, or CI — reading the codebase, writing and testing changes, opening pull requests. The tool this site is built and maintained with.
  • Google AntigravityGoogle’s agent-first development platform (public preview, free for individuals): a full IDE plus a manager surface for supervising multiple coding agents working asynchronously.
  • OpenAI CodexOpenAI’s coding agent and the closest counterpart to Claude Code: works in the terminal, the IDE, and ChatGPT itself, and delegates longer jobs to a cloud sandbox that opens a pull request when it finishes. The CLI is open source under Apache-2.0.
  • GitHub CopilotThe most widely deployed AI pair programmer — inline completions, chat, and code review across the GitHub platform and major editors.

Practices & Documentation

  • Keep a ChangelogThe simple, sane convention for CHANGELOGs humans can read: what changed, for whom, and when. If your project ships versions, keep one.
  • Conventional CommitsA lightweight commit-message convention (feat:, fix:, docs:…) that makes history readable and lets tooling automate versioning and release notes.
  • MermaidDiagrams as code: flowcharts, sequence and ER diagrams from plain text that lives in the repository and renders on GitHub — reviewable, diffable, and current.
  • Semantic VersioningThe MAJOR.MINOR.PATCH contract, in one page: what each number promises a consumer, and when you are obliged to bump which. The third leg of the stool with Conventional Commits and Keep a Changelog — together they let release tooling do the work.
  • DiátaxisA framework that splits documentation into four distinct kinds — tutorials, how-to guides, reference, explanation — because they serve different needs and fail when blended. The clearest answer to “our docs exist but nobody can use them.”
  • The Twelve-Factor AppTwelve principles for building services that deploy and scale cleanly — config in the environment, stateless processes, disposability, parity between dev and production. Written for the cloud era and still the fastest way to spot why a deployment hurts.
  • Choose a LicensePlain-language help picking an open-source licence, from GitHub. Publishing code without one does not make it free — it leaves it under default copyright, which is the opposite of what most people intend.
  • SPDX License ListThe canonical list of licence identifiers — the standardized short strings (Apache-2.0, MIT, GPL-3.0-only) that SBOMs, scanners, and package manifests all speak. Use the identifier, not the prose name.
  • Google FontsGoogle’s open-source font library: 1,500+ typefaces, free to use and self-host — the default first stop for web typography.

Code Quality & Testing

The everyday gates. Each one is cheap to add, runs in seconds, and should fail the build rather than print a warning nobody reads.

  • RuffAn extremely fast Python linter and formatter that replaces flake8, black, and isort in one tool — fast enough to run on every save without noticing. The default choice for new Python projects.
  • uvThe Python package and project manager from the same team, orders of magnitude faster than pip, with a real lockfile and managed interpreter versions. It replaces pip, venv, and pyenv with one command.
  • pytestThe Python testing framework worth learning properly: plain assert statements, fixtures that compose, and parametrization that turns one test into fifty. Its plugin ecosystem covers nearly everything else you will want.
  • mypyStatic type checking for Python. Type hints you never check are just comments — this is the tool that makes them binding, and running it in strict mode on new code catches a whole category of bug before it runs.
  • BATSThe Bash Automated Testing System: real unit tests for shell scripts, in TAP-compliant output CI can read. Shell scripts run your infrastructure — they deserve tests as much as anything else does.

Security in Development

  • Source Code Security AnalyzersNIST’s guide to analyzers that examine source code for weaknesses leading to vulnerabilities — one of the last lines of defense during development.
  • Source Code Analysis ToolsOWASP on Static Application Security Testing (SAST) tools: analyze source or compiled code for security flaws, in your IDE, before they get expensive.
  • SemgrepFast, open-source static analysis where the rules look like the code they match — no query language to learn. Curated security rulesets across most languages, and quick enough to run as a merge-blocking check rather than a nightly report.
  • OWASP ZAPThe leading free, open-source web application scanner and intercepting proxy — dynamic testing against a running site, which is exactly the class of flaw static analysis cannot see. The complement to SAST, not a substitute for it.
  • TrivyOne open-source scanner for container images, filesystems, repositories, and infrastructure-as-code — vulnerabilities, misconfigurations, and exposed secrets. The pragmatic first scanner to wire into a pipeline.
  • gitleaksOpen-source secret scanning across your working tree and full git history. The history part matters: a key committed and “removed” two years ago is still in the repository, and still valid until someone rotates it.
  • BanditA security linter for Python that walks the syntax tree looking for the common dangerous patterns — shell injection, hardcoded passwords, unsafe deserialization, weak cryptography. The Python-specific complement to a general SAST tool.
  • pip-auditAudits your Python dependencies against known vulnerabilities, straight from your requirements file or pyproject.toml. It exits non-zero on a finding, which is what makes it a real gate rather than a report.
  • OSV.devAn open, precise vulnerability database for open-source dependencies, with osv-scanner reading lockfiles across ecosystems. The polyglot answer when one repository holds Python, Node, Go, and a container.
  • ShellCheckA static analyzer for shell scripts that catches the quoting and expansion mistakes behind a remarkable share of production incidents. Paste a script into the web version; then put it in CI, where zero warnings is the standard.
  • SigstoreKeyless signing for software artifacts, backed by a public transparency log — sign a release without owning and protecting a long-lived private key. The practical way to produce verifiable provenance for what you ship.
  • pre-commitA framework for running your linters, formatters, and secret scanners automatically before each commit. The cheapest possible place to catch a problem — the developer’s own machine, seconds after they made it.

Open-Source Projects Worth Knowing

  • senior-engineering-partnerMy own open-source Claude Code skill — a strict senior engineer that reviews your code, insists on tests, blocks hardcoded secrets, and enforces a security-and-backup floor across the whole build, from throwaway prototype to production. Apache-2.0.
  • CodeBurnA free, open-source tracker for AI-coding spend: reads the session files on your machine across 36 AI tools and agents and breaks the cost down by model, project, task, and tool — so you can see where the budget actually goes.
  • release-pleaseGoogle’s release automation: it reads your Conventional Commits, bumps the semver, updates the CHANGELOG, tags, and opens a GitHub Release — the tool that cuts releases so you never hand-tag one that drifts from its notes.
  • OWASP Secure Agent PlaybookOWASP’s open collection of structured security “plays” that let AI agents run security-engineering tasks systematically — evidence-based findings across code, APIs, AI apps, and infrastructure, mapped to industry standards.
  • ScubaGoggles (CISA)CISA’s tool to check a Google Workspace tenant against the SCuBA Secure Configuration Baselines — automated posture assessment with compliance reports. (Its Microsoft 365 sibling is ScubaGear.)

↑ Back to top

27 entries

AI

The AI landscape, curated: the labs that matter, the products they ship, and where to build. This section changes more often than any other — the field moves that fast.

The Major Labs

  • AnthropicThe AI safety company behind the Claude model family. Research-first culture; notable for Constitutional AI, interpretability research, and the strongest models for agentic and coding work.
  • OpenAIThe company that brought generative AI mainstream with ChatGPT: the GPT model family plus image, video (Sora), and voice models, and the largest consumer AI product in the world.
  • Google DeepMindGoogle’s consolidated AI lab: the Gemini family, AlphaFold, and the deepest research bench in the industry, distributed through Google’s consumer and cloud products.
  • PerplexityThe AI-native answer engine: conversational search with inline citations — the clearest glimpse of what search looks like after ten blue links.
  • Meta AI / LlamaMeta’s Llama family made open-weight frontier-class models a reality and seeded much of today’s open-model ecosystem.
  • MistralThe leading European lab: efficient open and commercial models and the Le Chat assistant — significant technically and for European AI sovereignty.
  • xAIElon Musk’s lab behind the Grok models, integrated with X.
  • Hugging FaceNot a lab but the town square of open AI: the hub where models, datasets, and demos are shared. If a model has open weights, it lives here.

Assistants & Products

  • ClaudeAnthropic’s assistant: chat with projects, artifacts, file analysis, and connected tools. (What I use daily.)
  • Claude CodeClaude as an agentic software engineer — in your terminal, editor, and CI. Also on the Software Development guide.
  • Claude CoworkClaude Code’s agentic architecture pointed at knowledge work: reads and writes real files, works across connected apps, and carries multi-step office tasks through to finished deliverables.
  • ChatGPTOpenAI’s assistant and the most-used AI product on earth: chat, voice, vision, custom GPTs, and agent modes.
  • GeminiGoogle’s assistant, woven through Search, Workspace, and Android, with industry-leading long-context and multimodal abilities.
  • NotebookLMGoogle’s research notebook: ground the model in YOUR sources and get answers, study guides, and generated audio overviews — strictly from what you gave it. Superb for students.
  • OllamaRun open models locally with one command — private, offline, free. The easiest on-ramp to local AI on a laptop.
  • LM StudioA polished desktop app for discovering, downloading, and chatting with local open models — the GUI counterpart to Ollama.
  • Open WebUIThe leading self-hosted AI interface: a full ChatGPT-style web UI you run yourself, on your own hardware, entirely offline if you like — front-ending Ollama or any OpenAI-compatible API, with users, RAG, and tools built in.

Developer Platforms

  • Anthropic API / ConsoleBuild with the Claude models: developer console, workbench, and usage management. Documentation at docs.claude.com.
  • OpenAI PlatformAPI access to the GPT, image, video, and voice model families, with playground and evals tooling.
  • Google AI StudioFree playground and API keys for the Gemini models; graduate to Vertex AI for enterprise deployment.
  • Hugging FaceHost, fine-tune, and serve open models; the transformers library is the lingua franca of applied ML.
  • Model Context Protocol (MCP)The open standard for connecting AI assistants to tools and data — one protocol instead of a bespoke integration per model and per system. Introduced by Anthropic, now implemented broadly; the plumbing behind most agents that do real work.
  • llama.cppThe MIT-licensed C/C++ inference engine that made running capable models on ordinary hardware — including a laptop CPU — genuinely practical. The foundation under a great deal of local AI tooling, Ollama included.
  • vLLMThe open-source, high-throughput inference and serving engine most self-hosted deployments settle on when one user on a laptop becomes many users on a GPU. Apache-2.0, with an OpenAI-compatible API.

Open Models & Accountability

  • Allen Institute for AI (AI2)A non-profit research institute releasing genuinely open models — OLMo ships the weights, the training data, and the code, not just a downloadable file. The reference point for what “open” ought to mean in this field.
  • AI Incident DatabaseAn open, searchable record of documented AI harms and failures in the real world. Aviation got safer by studying crashes systematically; this is the equivalent effort, and it is the antidote to purely hypothetical risk discussions.
  • arXivThe open-access preprint server where essentially every significant AI result appears first, months before formal publication. Free to read, and the reason the field moves at the pace it does.

↑ Back to top

22 entries

Training

Email Security & Phishing Awareness

  • PhishingUses email to trick victims into sharing personal information via deceptive emails and websites. Never click unsolicited links or attachments.
  • SmishingPhishing over text messages. Never respond to requests for personal information and never click the links — go to the company’s website yourself.
  • VishingFraud over phone calls, voicemail, or VoIP. Don’t answer unknown callers; send them to voicemail and call back. Be wary of AI voice impersonation — silencing instructions for Apple (linked) and Android.
  • Jigsaw Phishing QuizGoogle’s free phishing test: can you spot when you’re being phished? Harder than you think.
  • More Free Phishing ResourcesA roundup of additional free phishing-awareness tools.

Cybersecurity Platforms

  • SANS TrainingThe SANS Institute specializes in comprehensive cyber security education, resources, and training programs for individual practitioners and cyber teams worldwide.
  • Hack The BoxA leading gamified cybersecurity upskilling, certification, and talent assessment platform for individuals, businesses, governments, and universities.
  • TryHackMeA gamified, hands-on cyber security training platform in your browser, with blue, red, and purple team content for all skill levels.
  • WarGamesOffered by the OverTheWire community — learn and practice security concepts through fun-filled games.

AI Training — free from the labs

  • Anthropic AcademyAnthropic’s free course catalog with completion certificates: AI fluency for non-technical learners, Claude product training, and developer deep-dives on the API, MCP, and Claude Code.
  • OpenAI AcademyOpenAI’s free learning hub: live and on-demand courses on ChatGPT and the OpenAI platform, from beginner AI literacy to building with the API.
  • Google AI EssentialsGoogle’s self-paced AI fundamentals course (part of Grow with Google): practical instruction in using generative AI effectively and responsibly at work.
  • Google Cloud Skills BoostGoogle’s official training hub for Google Cloud: hands-on labs, learning paths, and skill badges across GCP, data, security, and the Gemini/AI stack — many paths free.

Learn to Code — free and open

Full curricula that cost nothing and ask for no credit card. If you are starting out, one of these plus a finished project beats any paid course you do not complete.

  • freeCodeCampA donor-supported non-profit offering thousands of hours of coding curriculum and free certifications, entirely in the browser. Genuinely free — not a trial, not a funnel — and it has taken a great many people from zero to employed.
  • The Odin ProjectAn open-source, project-based full-stack curriculum that deliberately makes you set up a real environment and build real things rather than filling in blanks in a sandbox. Harder than the alternatives, which is the point.
  • ExercismFree practice exercises in 70+ programming languages with mentoring from volunteers who review your solution and tell you how to make it idiomatic. The feedback loop is what makes it different.
  • roadmap.shCommunity-maintained, open-source learning paths for developer roles — frontend, backend, DevOps, cybersecurity — showing what to learn and in what order. The map most self-taught people wish they had at the start.
  • MIT OpenCourseWareVirtually every MIT course, published free: lectures, problem sets, and exams. No enrollment, no certificate — just the actual material, which for computer science fundamentals is hard to beat.
  • Developing Secure Software (LFD121)The OpenSSF and Linux Foundation’s free secure-development course, with a certificate on completion. The rare offering that teaches the security practices this site keeps recommending, at no cost.

Capture the Flag

  • picoCTFCarnegie Mellon’s free beginner capture-the-flag platform, built for students, with year-round practice challenges. The gentlest real on-ramp into hands-on security, and it stays open after the annual competition.
  • CTFtimeThe calendar and scoreboard for capture-the-flag competitions worldwide, plus archived write-ups explaining how teams solved each challenge. The write-ups are the real curriculum.

Professional Development

  • Your Public LibraryThe most underused training benefit in America: most public library cards unlock LinkedIn Learning and other course platforms completely free. Linked here: Chicago Public Library’s online learning portal — check your own library’s ‘online resources’ page.
  • LinkedIn LearningVideo courses taught by industry experts across Business, Creative, Technology, and Certification tracks.

Computing History

  • ARPANET InteractiveAn interactive recreation of the ARPANET, the 1969 research network the Internet grew out of — explore the historical map and log in to simulated hosts of the era. History you can telnet into.

↑ Back to top

39 entries

Publications & Podcasts

Publications

  • TechTargetData-driven publisher network of 140+ technology sites — including the Storage channel and the channels below.
  • Software QualityTechTarget’s software quality & testing channel.
  • SecurityTechTarget’s enterprise security channel.
  • IoTTechTarget’s Internet of Things channel.
  • ArsTechnicaTechnology news for “alpha geeks”: technically savvy, up-to-date coverage of tech news, policy, science, and hardware.
  • IDCThe premier global market intelligence provider for IT, telecom, and consumer technology — 1,300+ analysts across 110 countries.
  • GartnerResearch and consulting on technology strategy: planning, architecture, product evaluation, and market analysis.
  • ForbesSelf-promotional plug for my articles. 😉
  • Informa TechTargetThe combined Informa Tech + TechTarget company: B2B technology media, research, and intelligence across 220+ digital properties.
  • OMDIAA global analyst and advisory leader connecting the dots across the technology ecosystem.
  • AI BusinessInforma’s news site on enterprise AI adoption.
  • SecurityWeekCybersecurity news, analysis, and insight for information security professionals, plus well-run virtual events and the ICS Cybersecurity Conference. One of the feeds I actually read daily.
  • Dark ReadingCybersecurity news and a trusted online community for security professionals — CISOs, technology specialists, and researchers.
  • The New StackContext and explanation of at-scale technologies — modern architectures, the software development life cycle, and operations culture.
  • The RegisterThe leading and trusted global online enterprise technology news publication, reaching roughly 40 million readers worldwide.
  • CSOServes enterprise security decision-makers with critical information across risk management, network defense, fraud, and data loss prevention.
  • The EU Artificial Intelligence Act🇪🇺 Up-to-date developments and analyses of the EU AI Act, maintained by the Future of Life Institute.
  • The InterceptInvestigative journalism with strong surveillance and privacy coverage.
  • CyberCrime MagazineCybersecurity Ventures — cyber economic market data, insights, and predictions; Page ONE for the global cyber economy.
  • SemaforSmart, distilled news with journalistic transparency and competing perspectives across borders.
  • The VergeTechnology and how it makes us feel — breaking news, reviews, and award-winning features since 2011.
  • tl;dr secKeep up with cybersecurity in 7 min/week — the best tools, talks, and resources, free, for 50,000+ security professionals.

Independent Voices & Research

Individual writers and research teams rather than publications — the sources the publications quote.

  • Krebs on SecurityBrian Krebs’s independent investigative reporting, in depth and frequently ahead of everyone else — he has broken a remarkable number of the breaches you have heard of. Follow the cybercrime economy through the people who run it.
  • Schneier on SecurityBruce Schneier on security as a system of technology, economics, psychology, and policy — the writing that taught a generation to think about threat models rather than products. Essential for anyone whose job includes explaining risk to executives.
  • Google Project ZeroDeep technical write-ups from Google’s zero-day research team, published after a fixed disclosure deadline. Demanding reading, and the clearest window into how serious vulnerabilities are actually found and exploited.
  • ACM QueueACM’s magazine written by practicing engineers for practicing engineers — long-form, durable pieces on systems, reliability, and software design. The antidote to a news feed.

Podcasts

  • IT Ops QueryDistills the signal from the noise on enterprise IT transformation and operations, hosted by TechTarget’s Beth Pariseau.
  • DarkNet DiariesHackers, breaches, shadow government activity, hacktivism, and cybercrime — the things that dwell on the hidden parts of the network.
  • The Backup Wrap-upTurns unappreciated backup admins into cyber recovery heroes — each episode dives deep into protecting your organization from data loss and ransomware. The tools it talks about are under Tools → Backup & Recovery.
  • CISO SeriesA media network delivering the most fun in cybersecurity: 9-10 weekly episodes across five programs, plus live events.
  • CyberCrime Magazine PodcastsPage ONE for cybersecurity podcasts.
  • The ChangelogLong-running conversations with the people who actually maintain the open-source software everyone else depends on — including the parts that are unglamorous, unfunded, and load-bearing.
  • Oxide and FriendsBryan Cantrill, Adam Leventhal, and guests on building hardware and systems software — engineering culture, hard debugging stories, and industry history told by people who were there.

Articles & Reports

↑ Back to top

9 entries

Movies & Videos

Educational & Informative Films

  • The Company Man: Protecting America’s SecretsFrom the FBI 🇺🇸: based on an actual case, this short film shows how one company was targeted by foreign actors for economic espionage — and what the FBI did to help.
  • Game of PawnsFBI/ONCIX film educating American academia on how foreign intelligence services target and attempt to recruit American students studying abroad.
  • Made in Beijing: The Plan for Global Market DominationThe FBI’s 30-minute film on the PRC’s sustained industrial-espionage campaign — helping private-sector partners protect their crown jewels.
  • MindwalkThe systems-thinking film (1990, free on YouTube): a physicist, a politician, and a poet spend a day at Mont Saint-Michel arguing about why the mechanistic worldview fails — and what a systems view offers. Based on Fritjof Capra’s The Turning Point; it shaped how I think about technology and organizations.
  • Coded BiasInvestigates algorithmic bias after MIT Media Lab researcher Joy Buolamwini uncovered flaws in facial recognition technology.
  • The Social DilemmaDocumentary-drama on the dangerous human impact of social networking, with tech experts sounding the alarm on their own creations.
  • The Tinder SwindlerPosing as a wealthy diamond mogul, he wooed women online and conned them out of millions via romance scams. Some victims plan payback.

Cybersecurity Media

↑ Back to top

28 entries

Privacy

Anonymity Tools

  • The Tor ProjectThe US nonprofit advancing human rights and privacy online through free software and open networks. The Tor Browser routes and encrypts web traffic through three layers of international nodes (onion routing).
  • TailsA complete anonymous operating system on a USB stick: boot any computer, work through Tor, shut down — nothing is written to the machine. What journalists and sources use when the computer itself can’t be trusted.
  • WhonixAn anonymous operating system that runs like an app and routes all Internet traffic through the Tor anonymity network. Available for all major operating systems.
  • QubesOSThe compartmentalized OS: everything runs in isolated virtual machines, so no single compromise exposes your whole digital life. Runs Whonix built-in.
  • GrapheneOSA hardened, open-source Android built for privacy and security, with per-app network and sensor permissions and no Google services unless you choose to sandbox them in. The most credible option if the phone itself is part of your threat model.

Where to Start

  • Privacy GuidesA non-profit, community-run, and refreshingly non-commercial set of recommendations for privacy tools — with the criteria for each choice written out. The one link to send someone who asks “where do I even begin?”
  • Terms of Service; Didn’t ReadCrowd-reviewed, graded summaries of the terms and privacy policies nobody reads, service by service. It will not make the agreements better, but it will tell you in under a minute what you are agreeing to.

Network Privacy

  • TailscaleA private, encrypted mesh network (built on WireGuard) connecting your own devices wherever they are — zero open ports, no traffic through anyone else’s servers. Not an anonymity tool: it’s how you reach your own machines privately instead of exposing them to the internet. Free personal tier.
  • Cloudflare 1.1.1.1 + WARPCloudflare’s free app: private DNS (1.1.1.1) plus WARP, a WireGuard-based tunnel that encrypts your device’s traffic so your ISP and the coffee-shop Wi-Fi can’t see it. Not anonymity (Cloudflare can see the traffic) — but a huge privacy upgrade on untrusted networks.
  • Cloudflare OneThe enterprise sibling: Cloudflare’s SASE / zero-trust platform — the same WARP agent plus identity-aware access, secure web gateway, and network firewall for organizations replacing VPNs.
  • Mullvad VPNA VPN that takes “we don’t know who you are” seriously: no email address required, a random account number instead of a login, cash accepted, open-source apps, and published third-party audits. The rare one whose no-logs claim has survived a police search.

Browser & Inbox

  • uBlock OriginThe free, open-source, no-business-model content blocker — no “acceptable ads” programme, no data collection, low resource use. Blocking third-party trackers remains the single highest-value privacy change most people can make in a minute.
  • Privacy BadgerThe EFF’s tracker blocker, and it works differently from the others: instead of a blocklist, it watches which third parties follow you across sites and learns to block them. That makes it a genuine complement to a blocklist blocker rather than a duplicate of one.
  • GhosteryA long-running, open-source tracker and ad blocker with a useful habit: it shows you exactly which trackers were on the page and who owns them. Worth running once on a news site you read daily just to see the number.
  • Proton MailEnd-to-end encrypted email from a Swiss provider, with open-source clients and a usable free tier. Encryption is automatic between Proton users and available to outsiders via password-protected messages or your own PGP keys.

Privacy Advocacy

  • EFF PrivacyEFF fights in the courts and Congress to maintain your privacy rights in the digital world, and works with partners around the globe to support privacy-protecting technologies.

Secure Messaging

  • SignalEnd-to-end encrypted messaging and calls; the reference standard. Open-source, nonprofit-run, and collects essentially no metadata.
  • TelegramCloud messaging with optional end-to-end “secret chats.” Note the default: ordinary chats are encrypted to Telegram’s servers, not end-to-end.
  • ElementMatrix-protocol client for decentralized, federated encrypted chat — run your own server or pick one you trust.

Credit Freeze & Identity Lock-Down

For students and readers: the complete identity lock-down. Freezing your credit is free, takes about half an hour, and closes the door most identity theft walks through. Do all of it — the secondary agencies are the gaps thieves actually use. Background: my identity-theft essay.

  • EquifaxBig-three bureau #1 — freeze and unfreeze online, free.
  • ExperianBig-three bureau #2 — decline the paid “lock” upsell; the free freeze is the legal protection.
  • TransUnionBig-three bureau #3 — free freeze, ignore the paid monitoring offers.
  • ChexSystemsThe agency banks use when opening checking/savings accounts — freezing it blocks fraudulent bank accounts in your name.
  • NCTUEThe telecom & utilities exchange, used for phone/cable/utility applications — a favorite bypass when the big three are frozen. Online or 1-866-349-5355.
  • InnovisThe “fourth bureau.” Less used, still worth closing off.
  • Social Security: block electronic accessCall the SSA at 1-800-772-1213 (or visit a local office) to block electronic and phone access to your record, so no one can hijack or redirect benefits online.
  • Create your mySSA accountClaim your own account before someone else does; review your earnings record yearly.
  • myE-Verify Self LockLocks your SSN in E-Verify so it can’t pass employment-eligibility checks — blocking employment fraud with your number.
  • OptOutPrescreenThe official bureau-run opt-out from pre-screened credit offers — removes the “pre-approved” mail that makes mailbox theft profitable. Choose the permanent option.

↑ Back to top

57 entries

Organizations & Conferences

Professional Associations

  • CompTIAThe Computing Technology Industry Association — the non-profit trade association behind the IT industry’s best-known professional certifications.
  • AITPThe Association of Information Technology Professionals — founded in Chicago in 1949, focused on education for business professionals in IT, with 62 local and 286 student chapters.
  • EFFThe Electronic Frontier Foundation — the leading nonprofit defending civil liberties in the digital world since 1990: user privacy, free expression, and innovation through litigation, policy, and technology.
  • DAMAData Management Association International — a vendor-independent global association advancing information and data management practice.
  • ASISASIS International — a global community of security practitioners protecting assets: people, property, and information.
  • ACMThe Association for Computing Machinery — the world’s largest educational and scientific computing society, with the field’s premier Digital Library, publications, and conferences.
  • InfraGard🇺🇸 The FBI/private-sector partnership protecting U.S. critical infrastructure: education, information sharing, networking, and workshops on emerging threats.
  • InfraGard: become a memberMembership is free, vetted by the FBI, and open to U.S. persons working in or with critical infrastructure.
  • SNIAThe Storage Networking Industry Association — vendor-neutral standards, education, and certification for data infrastructure.
  • IAPPThe International Association of Privacy Professionals — the largest global information privacy community, defining and improving the privacy profession.
  • ISAThe International Society of Automation — the globally trusted provider of foundational standards-based resources for industrial automation.

Open-Source Foundations

The institutions that hold the licences, the trademarks, and the neutral ground under the software almost everything else runs on. Worth knowing who they are before you need them.

  • The Linux FoundationThe neutral home for Linux and several hundred critical projects — Kubernetes, Node.js, OpenTofu, and the OpenSSF among them. Where competing vendors fund shared infrastructure without any one of them owning it.
  • Open Source InitiativeStewards of the Open Source Definition and the body that reviews which licences actually qualify. The reason “open source” means something specific rather than whatever a press release says it does.
  • Free Software FoundationThe organization behind the GNU project and the GPL, arguing since 1985 that software freedom is an ethical question and not merely a development model. You need not adopt the philosophy to owe it the licences you rely on.
  • The Apache Software FoundationAn all-volunteer foundation shepherding hundreds of projects under the permissive Apache-2.0 licence, with a governance model — the “Apache Way” — that many other communities copied outright.
  • OpenSSFThe Open Source Security Foundation: cross-industry work on securing the open-source supply chain, and the home of Scorecard and the supply-chain frameworks, Sigstore, and the free secure-development coursework. The organized response to Log4Shell and its relatives.
  • FIRSTThe global Forum of Incident Response and Security Teams — the association connecting CSIRTs across nearly every country, and the steward of CVSS, EPSS, and the Traffic Light Protocol.
  • IETFThe Internet Engineering Task Force: the open, membership-free standards body that produces the RFCs defining how the internet actually works. Anyone may participate, and rough consensus plus running code still decides.
  • Internet SocietyThe non-profit advocating for an open, globally connected, and secure internet, and the organizational home supporting the IETF. Its policy and encryption work is where the technical standards meet the political fights.

Industry & Business Networks

  • ACGThe Association for Corporate Growth — since 1954, serving 90,000 investors, executives, lenders, and advisers to growing middle-market companies.
  • TMAThe Turnaround Management Association — the most professionally diverse organization in corporate restructuring, renewal, and corporate health; ~10,000 members in 54 chapters.
  • CampITSince 1984, CAMP IT Conferences help IT leaders make critical strategic decisions — over 50,000 enterprise IT executives have attended.

Government Agencies

Conferences & Events

  • DEF CONThe world’s largest and longest-running hacker conference (Las Vegas, every August since 1993): villages, CTFs, lockpicking, and the talks everyone else quotes for the rest of the year. If you attend one security conference, make it this one.
  • Black HatThe most technical information-security research event series, held annually in the US, Europe, and Asia — DEF CON’s corporate sibling, run the same week in Las Vegas.
  • RSA ConferenceThe security industry’s biggest business gathering (San Francisco each spring) — where vendors, CISOs, and policymakers meet.
  • THOTCONChicago’s own hacking conference: non-profit, low-cost, no-frills, genuinely excellent talks. Tickets sell out fast.
  • Security BSidesThe global framework for community-organized security conferences — hundreds of volunteer-run, low-cost events where first-time speakers and local communities get their stage.
  • BSides ChicagoChicago’s BSides.
  • BSides312The Loop’s newer BSides, named for the area code.
  • HOPEHackers On Planet Earth — the biennial New York conference from the 2600 community: hacking in its broadest civic sense.
  • Chaos Communication CongressThe Chaos Computer Club’s legendary end-of-year congress — Europe’s largest hacker gathering, deeply technical and deeply political (streamed and archived free).
  • Enterprise ConnectThe leading conference for enterprise communications and collaboration technology.
  • FOSDEMTwo days in Brussels every February, thousands of developers, hundreds of talks — and completely free, with no registration and no sponsor keynotes. The largest gathering of open-source developers in the world, funded almost entirely by volunteers.
  • All Things OpenRaleigh’s large, deliberately accessible open-source conference — technology, community, and business tracks aimed as much at newcomers and organizations adopting open source as at maintainers.
  • SCaLEThe Southern California Linux Expo: North America’s largest community-run open-source conference, volunteer-organized since 2002, with an inexpensive ticket and a genuine hobbyist-to-professional range.
  • Open Source SummitThe Linux Foundation’s umbrella event — Linux kernel, cloud, embedded, and supply-chain security tracks under one roof. Where the maintainers of the infrastructure you depend on are in the same building.
  • USENIXThe advanced computing systems association: USENIX Security, OSDI, NSDI, SOUPS, and LISA. Rigorous, peer-reviewed research — and the proceedings are open access, so you can read the papers whether or not you attend.
  • Infosec Conferences DirectoryA maintained directory of upcoming security conferences worldwide — the answer to “what’s happening near me?”

Chicago InfoSec Community

The community I’m part of. Chicago has one of the strongest regional security scenes in the country — here’s where to plug in:

  • Chicago InfoSec Events CalendarThe community-maintained calendar of every security meetup, conference, and gathering in Chicagoland. Start here.
  • BurbsecThe long-running suburban Chicago security meetup family — multiple monthly gatherings, no membership, just show up.
  • Chicago Code & CoffeeCasual weekend co-working and networking for developers and technologists of all levels.
  • Chi Hack NightChicago’s weekly civic-technology night — volunteers using data and code for the public good, and the best on-ramp into Chicago’s tech community.

Community chat — the Discord servers and Slack workspaces where these communities live day to day:

DiscordBurbsec Hack The Box TryHackMe Google Labs WiCyS DePaul Proton Secure Controls Framework DePaul Security Daemons (signup) DePaul CS Society /r/sysadmin
SlackMac Admins Chicago Tech

↑ Back to top

Something missing?

These lists improve when readers argue with them. If a tool or course belongs here — or has rotted — tell me.

Suggest a resource →