Vern McCandlish

@malanalysis

A #DFIR, #infosec, #dadjokes, #scifi, #books, #rpg, #ttx, #malware, elder #genx, and #gaming nerd. AKA an elder geek. Retired #leo. Retired from #infosec in #OT now too. Kindness first is useful but telling off toxic folks is on my response spectrum too.

4,458 Following4,016 Followers1,793 Posts

YouTube Bluesky

Is this your profile?Claim it and malanalysis.dirty.social is yours.Claim profile

Vern McCandlish@malanalysis· Jun 25

Felt like posting this section of the War Powers Act: 50 U.S. Code § 1544c Disclaimer: Yes, I know it requires Congress to demonstrate a spine if it is ignored.

Text of 50 U.S. Code § 1544c "Concurrent resolution for removal by President of United States Armed Forces
Notwithstanding subsection (b), at any time that United States Armed Forces are engaged in hostilities outside the territory of the United States, its possessions and territories without a declaration of war or specific statutory authorization, such forces shall be removed by the President if the Congress so directs by concurrent resolution."

Vern McCandlish@malanalysis· Jun 18

Name a TV show no one remembers but you. Far Out Space Nuts

Promo shot of the TV show Far Out Space Nuts starring Bob Denver as Junior and Chuck McCann as Barney, along with their fuzzy alien friend Honk.

Vern McCandlish@malanalysis· Jun 17

So they are going to make movies sourced from AI generated stories.

Woody and Buzz Lightyear from the movie Toy Story where Buzz is speaking and waving his hand out broadly while Woody looks worried. Captioned with "AI Stories on Reddit, They're Everywhere."

Vern McCandlish@malanalysis· Jun 16

The "We're gonna need a bigger boat" scene from the movie Jaws, with the caption "We're gonna need more H2O2"

Vern McCandlish@malanalysis· Jun 16

They should have taken Abe Lincoln's advice and verified everything they find on the internet before relying on it.

Picture of Abraham Lincoln with the false quote "Don't believe everything you read on the internet just because there's a picture with a quote next to it."

Vern McCandlish@malanalysis· Jun 6

I would like to nominated this skeet for most underrated skeet of the day:

Screen shot of a series of skeets where the first person asks, "How many people know what kerning is, do you think? Lol.". That is quoted with the text "On Bluesky? All of us" to which Gwen Snyder replied "Oh you mean keming"

Vern McCandlish@malanalysis· Jun 6

Captain Kirk in the movie The Rath of Khan yelling into a communicator, captioned with BCC!

Vern McCandlish@malanalysis· Jun 4

Skin color meme from Family Guy with a color palette going from white to black with a variety of colors, the lighter color group is labeled "Honest Mistake" and the darker colors are labeled "Outrageous Criminal Act"

Vern McCandlish@malanalysis· Jun 4

#DFIR

Epic handshake meme with one arm labeled "Historians", the other arm labeled "Digital Forensics Examiners" and the handshake labeled "Time Pedantry"

Vern McCandlish@malanalysis· May 24

Repost with the Russian agent that spies on your posts

Natasha Fatale, one of the villains from the Rocky and Bullwinkle cartoon.

Vern McCandlish@malanalysis· Feb 22

All the discussion from folks criticizing athletes on team USA for representing the USA reminded me of a quote by Mark Twain.

Mark Twain quote "Patriotism is supporting your country all the time, and your government when it deserves it." Written in white text over an image of open water.

Vern McCandlish@malanalysis· Feb 20

Man on the floor pulling up a couch cushion in the act of the looking for something. The image is captioned "Hun, have you seen my critical thinking?"

Vern McCandlish@malanalysis· Feb 18

The political discourse today reminded me of this wonderful scene from season 2 of Fallout:

The main character in the Fallout series, Lucy, is in frame with a kitchen counter behind her. There are two frames. In the top frame she is quoted as "One side is murdering people, enslaving them, crucifying them," and in the second frame she is quotes as "and the other side is vaguely problematic."

Vern McCandlish@malanalysis· Jan 3

I am a horrible Bill's Fan. Wegman's now has a reusable grocery bag with Josh Allen's picture on it. I saw it while shopping today and my brain instantly created images of the cashier always dropping the last item they try to put into it. I may have an idea for a TT skit now too.

Picture of a reusable grocery bag for sale at Wegman's featuring Josh Allen in a Bills Uniform, carrying a football while running and looking to pass.

Vern McCandlish@malanalysis· Jan 1

Reminder for the younger folks: "The bottom of the hour" indicates where the big hand is on you grand parents' old analog clock, and it is pointing to the bottom of the clock face. "Bottom of the hour" can also be described as "Half past" by the older folks in casual conversation.

Analog clock showing the little hand between the 10 and the 11 and the big hand pointing down at the 6 (aka the bottom of the hour or half past the hour)

Vern McCandlish@malanalysis· Jan 1

By hex code I got this for this year. I guess if I went with ISO 8601 it would have shaded more yellow.

A visual display of the color code chart with the color selected as #012026 which is a dark blue-teal.

Vern McCandlish@malanalysis· Jan 1

I am going to keep putting in the effort, but this was already the plan:

Screen shot of Merriam-Webster's post "Take a screen shot of this GIF, and whichever new work you land on is YOUR word for 2026." with the GIF having landed on "Kind-Hearted"

Vern McCandlish@malanalysis· Dec 26

I don't make many predictions, but I think here is a slow pitch directly over the plate... As more companies turn to using AI generated code, criminal hackers and digital incident responders will be overwhelmed with work. #infosecmemes #dfirmemes

Epic handshake meme with the joined trait being "AI Code making career opportunities" and the two arms being labeled "DFIR Professional" and "Criminal Hackers"

Vern McCandlish@malanalysis· Dec 21

#infosecmemes

The Decision meme with two buttons. One labeled: "It doesn't" and one labeled "Wall of Text" with the bottom panel showing a cartoon man sweating anxiously with the caption "When asked to explain how DNS works"

Vern McCandlish@malanalysis· Dec 7

This story reminded me I need to reread Andy Greenberg's @agreenberg.bsky.social excellent book "Tracers in the Dark". andygreenberg.net

Photo of the book cover for Tracers in the dark: The global hunt for crime lords of cryptocurrency by Andy Greenberg.

Vern McCandlish@malanalysis· Dec 7

Reminder that when building your own VPN server, the following diagram applies: #infosecmemes

Image caption at top "Limit: Pick no more than two"
Image is of a black and white triangle with the center labeled "Building a personal VPN Server" and the three corners being labeled "Works as designed" "Easy" and "Safe"

Vern McCandlish@malanalysis· Nov 27

It's a holiday, time to break out the new shoes.

Vern McCandlish@malanalysis· Nov 21

A takeaway from reading @doublepulsar.com write up on the Capita Ransomware Incident is that SOCs need to engage internal counsel when setting response SLAs. Re: £14m (~$18m) Fine imposed by governing body. #infosec #dfir doublepulsar.com/what-organis...

Screenshot from blog entry with the text:
Capita challenged this element of the fine, saying its internal SOC SLA targets are not within the ICOs remit to judge. It said it had set the targets high to encourage teams to meet them. The ICO disagreed it isn’t in their remit, and it marks the primary finding by the ICO regarding the fine.

Vern McCandlish@malanalysis· Nov 19

Time to break this one out again:

Robin with a whiteboard meme (stranger things) with a woman holding a whiteboard with the words "At its worst, Excel is the second best tool for any data analysis job"

Vern McCandlish@malanalysis· Nov 18

They way I roll my eyes and sometimes even sigh out loud when I hear someone start a question with "This is more of a comment than a question..." but I have yet to see a host shut it down.

Runaway balloon meme with the character labeled Host reaching for the balloon labeled Q&A in the first frame, but in the second frame you see the host being hugged by a blob with a face labeled "More of a comment than a question.

Vern McCandlish@malanalysis· Nov 10

I had a mentee tell me that they got a job that they didn't hit all the bullet points on so they had not intended to apply, but they remembered my mantra of "Apply anyway, let them say no" So please, if you have doubts about whether you hit all the bullet points in a job posting, apply anyway.

Yoda looking to some to his right giving the advice "Apply always, "No" let them say"

Vern McCandlish@malanalysis· Nov 9

Yeah, I likely should have done this a while ago, but better late than never.

Screen shot of the mute words and tags page of Bluesky with the word Axios being added with the radio buttons for "Forever" and "Text & tags" checked, indicating the term Axios is being muted in a user's Bluesky feeds forever.

Vern McCandlish@malanalysis· Nov 8

I saw it again this morning, but the most preventable form of professional immaturity has to be hiring an expert in a field you know little about and then arguing with them when their advice isn't want you wanted to hear.

Dale Gribble character from King of the Hill holding a lit cigarette standing in front of a fence with a house and trees in background captioned: I know I hired you for expertise, but...

Vern McCandlish@malanalysis· Nov 6

Every time I get amazed at the skill of the red team and/or pen testers, I am also reminded that this is way more common that anyone really wants to think about. #Infosec

Since the heist, information has resurfaced showing that gaps in security appear to have been known for years – including a 2014 warning that alleged one of the museum’s key passwords was simply “LOUVRE.” The new report only adds to a number of security failings exposed by the heist.

Vern McCandlish@malanalysis· Oct 17

My employer sent me an exit survey as I enter retirement that had the question: "If you have already decided and are comfortable disclosing, which organization will you be joining in the future?" I truly wish I could have seen their reaction when they read "AARP" as my response.