Toufi Saliba

MCP stands for Model Context Protocol. (The joke is the S in MCP stands for security, but that’s another post.) They say to think of it like “like a USB-C port for AI applications” because it allows interoperability between AI chatbots and other tools. Here’s some of the MCP stuff happening across the Automattic solar system: Core WordPress now has an MCP Adapter that uses a new Abilities API to do CRUD

109

10 Comments

Every breach starts with access, and most enterprises lack visibility into who has access to what, and why. AI’s compounding that problem – legacy identity tools weren’t built for the scale, complexity, or speed of modern AI adoption.  That’s why we’re delighted to be supporters of Veza from the Series A through the current $108M Series D. Veza redefines what identity security looks like in a GenAI world. With this round, we’re also happy to welcome New Enterprise Associates (NEA), Atlassian Ventures, Workday Ventures, and Snowflake Ventures to the Veza team.  It sounds simple: Know who has access to what, and why. But delivering that clarity, especially at Fortune 500 scale, is anything but easy. More from Veza CEO and co-founder Tarun Thakur on what he’s hearing from customers and why this problem matters: 

53

Just published a short guide to run your own GPU-powered LLM, fully locally, with XCP-ng/Xen Orchestra. Using Ollama and OpenWebUI (two fantastic open source tools), you can get a private, fast, self-hosted AI assistant in just a few commands. The article walks you through everything step by step, from VM creation with GPU passthrough, Nvidia driver installation, to model interaction. It's surprisingly easy, and very satisfying to see it all run on your own hardware. https://lnkd.in/df4vE98Y Bonus: I’ll drop a comment with an article on why doing this matters (even if it feels obvious lately).

94

5 Comments

Exciting news from Ultralytics! The latest Ultralytics YOLO 8.3.114 update introduces robust Tracker Re-identification (#ReID). This enhancement to the BoT-SORT algorithm significantly enhances object tracking by minimizing ID switches and efficiently extracting key features. This update promises improved performance in various scenarios and is ideal for surveillance, sports analytics, and robotics applications. A big shoutout to our incredible community and contributors for making this possible! For more information, check out the details at https://lnkd.in/dwssFBbs. #AI #MachineLearning #ComputerVision #YOLO

104

3 Comments

Rant: Interview‑only "cryptographic inventories" are a waste of money. Cryptographic inventory is step one for quantum readiness. It’s recommended or required by every relevant regulation or framework. But doing it well is hard. Very hard. I recently worked with a CNI regulator designing future approaches to evaluate quantum-readiness progress. I got to review cryptographic inventories voluntarily submitted by some of their advanced orgs. I’m allowed to share the headline: nearly 3 out of 4 crypto inventories were purely manual - based entirely on stakeholder interviews - and were quickly shown to be unfit for any serious purpose, including compliance, risk assessment, or PQC migration planning. Many were delivered by big-name consulting firms that sold the idea that a few interviews conducted by junior consultants could produce a comprehensive, useful, and compliant crypto inventory. This is fundamentally flawed. I call them “Potemkin inventories.” In many cases, you’re better off not doing one at all than relying on a false sense of completeness. Even if very competent engineers are interviewed, such inventories are inherently shallow: • They miss machine‑to‑machine flows, headless services, and shadow IT. • They overlook embedded and legacy cryptography in firmware, appliances, and field devices. • They ignore code paths, build pipelines, and third‑party components where cryptography is pulled in transitively. • They undercount keys, certificates, and usages distributed across KMS, HSMs, vaults, clouds, and SaaS. • They produce little verifiable evidence or coverage metrics. What a real cryptographic inventory requires: • Multi-modal automated discovery across networks (active/passive), endpoints, containers, cloud APIs, and configuration stores. • Repository & pipeline mining (code/config/IaC) to identify libraries, algorithms, modes, key sizes, and certificates. • External & internal service scanning (TLS, SSH, IPsec, MQTT, etc.) with evidence capture. • PKI/KMS/HSM & vault introspection; key lifecycle and usage mapping. • SBOM/dependency analysis to find transitive cryptographic libraries; supplier attestations for third-party/SaaS coverage. • Traffic sampling, where appropriate, to validate declarations without breaking privacy. • Traceability, coverage metrics, repeatability - so you can re‑run and prove change. Interviews are still valuable - they provide context, owner mapping, and business-risk insight; but they must be one input among many. I don’t blame clients who bought these services; they tried to hire "experts" to help them navigate the complexity. But I do have a problem with consultancies that fail to educate their clients, and that charge seven figures to deliver something they should know is inadequate. If your "cryptographic inventory" came in a PowerPoint and was based only on several stakeholder interviews… you don’t have an inventory. You have a hypothesis. #PQC #QuantumReadiness #CryptographicInventory #CBOM

115

30 Comments

Quantum computers won't ask permission before breaking RSA. State actors aren't waiting either - they're harvesting your encrypted data right now for tomorrow's decrypt. At Hawcx, we're not building for "someday." We're shipping quantum-resistant, zero-trust authentication today. Read why the clock is already ticking: https://lnkd.in/g_pjg3Nw #QuantumResistant #PostQuantumCryptography #ZeroTrust #CyberSecurity #PQC #Passwordless #FutureProof

19