The Letter — Stop Hacklore!
We are a group of current and former Chief Information Security Officers (CISOs), security leaders, and practitioners who have seen how compromises unfold in the real world across industry, academia, and government. We write to correct a set of persistent myths about digital risk to everyday people and small businesses (as opposed to high-risk individuals) that continue to circulate widely online and in public advice columns. Specifically, we aim to retire the following outdated pieces of advice: Avoid public WiFi: Large-scale compromises via public WiFi are exceedingly rare today. Modern products use encryption technologies to protect your traffic even on open networks, and operating systems and browsers now warn users about untrusted connections. Personal VPN services offer little additional security or privacy benefit for most people and don’t stop the most common attacks. Never scan QR codes: There is no evidence of widespread crime originating from QR-code scanning itself. The tru
An Open Letter Released Nov-24-2025 To the public, employers, journalists, and policymakers: We are a group of current and former Chief Information Security Officers (CISOs), security leaders, and practitioners who have seen how compromises unfold in the real world across industry, academia, and government. We write to correct a set of persistent myths about digital risk to everyday people and small businesses (as opposed to high-risk individuals) that continue to circulate widely online and in public advice columns. The outdated advice Specifically, we aim to retire the following outdated pie
saved by
related reading
- Digital hygiene – karpathykarpathy.bearblog.dev
- Easy improvements to personal opseckliu.io
- Andrej Karpathy on X: "I wrote a quick new post on "Digital Hygiene". Basically there are some no-brainer decisions you can make in your life to dramatically improve the privacy and security of your computing and this post goes over some of them. Blog post link in the reply, but copy pasting below https://t.co/gRyeVouko5" / Xx.com
- Awareness and Developer Training That Actually Works | Anagram Securityanagramsecurity.com
- OPINION: stop studying cybersecurity because of memaia.crimew.gay
- Product Security Bad Practicescisa.gov
- Building practitioner-focused cybersecurity: nine principles for founders and product leadersventureinsecurity.net
- Defining A Software Supply Chain Security Platform & Exploring New Techniques, Part 2softwareanalyst.substack.com
- Themes from Real World Crypto 2022 - The Trail of Bits Blogblog.trailofbits.com
- Most of the security teams’ work has nothing to do with chasing advanced adversariesventureinsecurity.net
- Practical Advice to Avoid Getting Pwned by AIchoosingvictory.com
- Securing the Future: The Next Wave of Cybersecuritycasber.substack.com