Thomas Ptacek
Security engineer; founder of Matasano Security and Latacora.
Thomas Ptacek did not write this page. ppll compiled it from their own words, each linked to the source. Is this you? · Report a mistake
Latest x.com
What they believe
-
Upzoning can result in high value for owners and low prices for buyers.
The irony is that upzoning can actually get you high value for owners and low prices for buyers.
x.comSaid 14 Oct 2026This on korrents
-
Taking writing feedback from an LLM does not bleach out a writer's personal style.
The most common pushback I'm getting to this post is that taking this kind of feedback from an LLM is going to bleach out your style just like having the model generate the text, because models can't be trusted with "style". No.
x.comSaid 18 Sept 2026This on korrents
The bold line is korrents’ wording; the quote is theirs. These 2: what they wrote before what they said aloud, one per source, newest first.
Feed
As its own page →Hiding
15 October
14 October
-
Their words
The irony is that upzoning can actually get you high value for owners and low prices for buyers.
13 October
12 October
11 October
10 October
9 October
8 October
5 October
Nothing matches.
Beliefs
Korrents What they believe 19 beliefs — each backed by an exact quote.
Each is a — compiled by korrents.com, not by them: the one-line wordings are korrents', the quotes are theirs.
Recent
Upzoning can result in high value for owners and low prices for buyers.
The irony is that upzoning can actually get you high value for owners and low prices for buyers.
@tqbf on X Said 14 Oct 2026
Taking writing feedback from an LLM does not bleach out a writer's personal style.
The most common pushback I'm getting to this post is that taking this kind of feedback from an LLM is going to bleach out your style just like having the model generate the text, because models can't be trusted with "style". No.
@tqbf on X Said 18 Sept 2026
Readers detect LLM-selected words in writing at extremely high sensitivity
you can't use a single word the LLM selects for you, even if it's better than your own; users detect LLM words in the parts per trillion.
@tqbf on X Said 16 Sept 2026
Show 16 more
Increased reliance on CFAA prosecutions to pursue public policy goals could backfire like a cursed monkey's paw, as practitioners would recognize.
Increased reliance on CFAA prosecutions for public policy goals couldn't possibly be a cursed monkey's paw situation, said no practitioner in this space ever.
@tqbf on X Said 15 Sept 2026
The answer to every significant programming challenge in 2026 is a Python library people overlook for not being in Rust, though that no longer matters.
The answer to every significant programming challenge in 2026 is a Python library you didn't think to go looking for because it's in Python and not Rust, as if that mattered anymore.
@tqbf on X Said 9 Sept 2026
Building a command-line interface is almost always a good idea; building a terminal UI almost never is
CLIs have purposes for which they’re irreplaceable. Building a CLI is almost always a good idea. Building a TUI almost never is.
Stop Making TUIs Said 20 Aug 2026
Terminal interfaces exist out of necessity, not because they are the right design
We build terminal interfaces because we have to, not because we should.
Stop Making TUIs Said 20 Aug 2026
Production systems need a command-line interface, not a user interface running on the server
The problem with this argument is that you probably don’t need a user interface on prod. You need a command line interface on prod that a user interface on your Macbook can drive.
Stop Making TUIs Said 20 Aug 2026
Coding agents make every plugin interface you ever blew off trivially usable, which is a large productivity win.
I can't say enough how excellent a coding agent is at customizing Chrome with extensions. A huge productivity win. Every plugin interface you've ever blown off is now trivially usable.
@tqbf on X Said 19 Aug 2026
Data centre opposition only pushes construction to the parts of America that regulate energy and pollution least.
It seems pretty clear that the only thing data center opposition is doing is pushing data center construction to the (many) places in America that won't regulate energy or pollution. Weird thing to pat oneself on the back for.
@tqbf on X Said 10 Aug 2026
The "private equity is buying up all the houses" argument is both wrong and an excuse for deferring zoning reform.
Progressive slopulism really fucked us with this "Private equity is buying up all the houses" argument. It's a fractally stupid concern AND an excuse for deferring zoning reform.
@tqbf on X Said 6 Aug 2026
An open weights model from 2025 with a pentest harness could already escape a sandbox and hack most networks; the surprise says more about the sandbox than the model.
I genuinely believe that if you took an open weights model from 2025 and built a pentest harness for it, it could do this kind of sandbox escape and scan/hack in most networks. This is only surprising because you assume OpenAI has sounder sandboxes.
@tqbf on X Said 22 Jul 2026
Even if all progress on LLMs stopped today, LLMs would remain the second most important development in a software career spanning the mid-1990s to now.
All progress on LLMs could halt today, and LLMs would remain the 2nd most important thing to happen over the course of my career.
My AI Skeptic Friends Are All Nuts Said 2 Jun 2025
LLMs can write a large fraction of the tedious code a developer will ever need to write, and most code on most projects is tedious.
LLMs can write a large fraction of all the tedious code you’ll ever need to write. And most code on most projects is tedious. LLMs drastically reduce the number of things you’ll ever need to Google.
My AI Skeptic Friends Are All Nuts Said 2 Jun 2025
The part of a coding agent that actually acts on code is not AI at all — it is simple systems code wired to ground truth, the way a Makefile is.
The code in an agent that actually “does stuff” with code is not, itself, AI. This should reassure you. It’s surprisingly simple systems code, wired to ground truth about programming in the same way a Makefile is.
My AI Skeptic Friends Are All Nuts Said 2 Jun 2025
Job interviews are incredibly hostile experiences for candidates.
Because here is the thing about interviews: they are incredibly hostile experiences for candidates.
The Hiring Post Said 6 Mar 2015
Judging a candidate on confidence selects for people who are good at interviewing.
Confidence bias selects for candidates who are good at interviewing.
The Hiring Post Said 6 Mar 2015
Software engineers may be the professionals least qualified to judge a candidate's "passion" and "confidence".
there may be no cohort of professionals less qualified to assess barely-tangible socio-psychological attributes like “passion” and “confidence” than the modern software nerd.
The Hiring Post Said 6 Mar 2015
Even the flimsiest work-sample test outperforms interviews.
But even the flimsiest work-sample outperforms interviews, so the effort pays dividends immediately.
The Hiring Post Said 6 Mar 2015
Beliefs others hold too
Terminal interfaces exist out of necessity, not because they are the right design 2 hold this
We build terminal interfaces because we have to, not because we should.
Stop Making TUIs Said 20 Aug 2026
The "private equity is buying up all the houses" argument is both wrong and an excuse for deferring zoning reform. 2 hold this
Progressive slopulism really fucked us with this "Private equity is buying up all the houses" argument. It's a fractally stupid concern AND an excuse for deferring zoning reform.
@tqbf on X Said 6 Aug 2026
What is a korrent?
A korrent is a belief a person has stated in their own words: one sentence stating the claim, backed by a quote and a source, kept at korrents.com.
Under a name here, the quoted block is what they actually said. The korrent beneath it is the claim those words support, in korrents' wording — tap it to see the record, its source, and who else holds it.
Nobody here wrote their own korrents. They are compiled from public statements, and a person can change their mind, which is recorded too.
Recommends rcmnd
rcmnd What they recommend 7 things — each backed by an exact quote.
Compiled by rcmnd.app, not by them: the quotes are theirs, and each links to the post it was copied from.
Recent
Loved TUI frameworks
I love this so much. The one truly legitimate use of TUI frameworks.
x.com 27 Sept 2026
Recommends tmux
I use a similar process to build TUI apps (tell your agent to use tmux to test the TUI, it works a treat).
sockpuppet.org 20 Aug 2026
Liked Lazygit
I want to see a native UI built to capture everything that’s great about Magit or Lazygit (without having to build it myself).
sockpuppet.org 20 Aug 2026
Show 4 more
Liked Math Academy
I like Math Academy a lot and have a bunch to say about it
sockpuppet.org 20 Aug 2026
Liked Claude
But Claude isn’t just a replacement-level SwiftUI developer. Claude is actually good.
sockpuppet.org 12 May 2026
Disliked Electron
Electron isn’t good. But it’s always been good enough.
sockpuppet.org 12 May 2026
Loved Magit
Magit is still the best thing going. For now.
sockpuppet.org 12 May 2026
Where they publish
Site sockpuppet.org Their own site, shared with Erin Ptacek.
The personal site — a small, long-running blog on security, cryptography and the trade, quite separate from the company writing.
Link verified 1 Sept 2026.
Blog The Fly Blog Their employer's blog, where their long technical posts appear.
A company blog with several writers; their own posts are bylined and are where the longer arguments land. No feed is attached here, because one feed carries every author's posts and this page must not attribute anyone else's words to them.
Link verified 1 Sept 2026.
x.com @tqbf Where the arguments about security and software happen.
The highest-volume channel: long threads and sharp replies on security, cryptography, hiring and infrastructure. Most of the positions on this site were said here or on the Fly blog.
Recent
- As always I've forgotten to remind anybody that ChiSec is tonight (Kaiser Tiger on Ogden in West Loop, 7PM) until like 45 minutes before I head out. 15 Oct 2026
- Bloodborne remaster when? 15 Oct 2026 popcar.bearblog.dev
- I am happy to report that you can still have 12-hour experiences like this working with agents. 15 Oct 2026
Show 17 more
- The irony is that upzoning can actually get you high value for owners and low prices for buyers. 14 Oct 2026
- I'm embarrassed for the authors of this piece, who are left attributing the 20+ year market failure of DNSSEC to a blog post I wrote in 2015. I'm not kidding: that's the argument. 14 Oct 2026 circleid.com
- This is going just great! 13 Oct 2026 heise.de
- You wouldn't be familiar with our immediate influences. They're mostly German. 13 Oct 2026
- A sleeper thing here I think we'll be talking about more next year: high-end native user interfaces that have TUI/nerd affordances, like deeply-integrated vi key bindings or absurdly dense information displays. 12 Oct 2026
- I hereby formally and solemnly coin the term "Post Public Cryptography" and its acronym "PPC", which must henceforth be attributed to me. 11 Oct 2026
- Why even HAVE a Chicago Pope? 11 Oct 2026
- I'm like 5 months late hyping this but Wyman's lists are my favorite rock writing (Queen's entry on the Hall of Fame list is maybe the best bit of rock writing ever) and I hadn't ever seen the Nirvana list before. 10 Oct 2026
- In 2026 I think new specialized text editors are less interesting than new specialized code exploration tools. I read \infty more lines of code now than I write; being stuck in my editor (or worse, the Github PR viewer) is silly. 9 Oct 2026
- I have the same friend and this is real. 8 Oct 2026
- I'm not super complaining or whatever, just sort of commenting, but I got in 2 hours later than expected and Turo cancelled my car as a no-show, which makes me wonder how airport Turo ever works. 5 Oct 2026
- I am in San Francisco in a hotel room with a functioning wood-burning fireplace. That is all. 5 Oct 2026
- In SFBA (mostly SF, but have a car) tomorrow thru Thursday, happy to get coffee or whatever with people. 4 Oct 2026
- Are we doing this I guess we're doing this I feel victimized by these trends because I can't not fill them out see also: cruciferous vegetables tier list 3 Oct 2026
- We did a "Day In Our Data" event, a civic hackathon where neighbors got together to build stuff with all the open data Oak Park and Illinois make available. Capacity crowd. Highly recommend doing this in your hood! You probably already have a civic nerd commission. 3 Oct 2026
- I complained a couple weeks ago about what I saw as a lack of engagement from Abundant Housing Illinois in Oak Park, where we're on the verge of being the first muni in the state to end single family zoning. But they are killing it lately. 30 Sept 2026
- This is a great dunk and I don't know anything about Instinct but mostly all that's happening here is it's hard to come up with good examples for things. 30 Sept 2026
Link verified 1 Sept 2026. Recent items update automatically from the channel.
About the English under a post
Some people here publish in a language other than English. Where they do, this site shows a machine translation beneath the post, in this typeface — the site's own, not theirs.
The post itself is never changed, moved or hidden: what is set in the serif above is exactly what the person published, and it is what to quote them on. A translation can be wrong in ways that matter, especially about tone.
Only the post's own words are translated. A quoted post, a linked article and a belief on korrents.com are left in their original language.