Simson Garfinkel
Somerville, Massachusetts, United States
6K followers
500+ connections
About
Simson Garfinkel is the Chief Scientist of BasisTech, LLC., a technology accelerator in…
Articles by Simson
-
Why I ask AI coders to ask me questions.
Why I ask AI coders to ask me questions.
I’ve been using a whole host of AI program to write code over the past two years, but I’ve developed a style that is…
11 Comments -
A clever PayPal Scam
A clever PayPal Scam
Someone just sent me ₱0.01 PHP to my PayPal account, causing PayPal to send me an email message that is the start of a…
10 Comments -
AI Hackers are coming for my C++ Code
AI Hackers are coming for my C++ Code
(From Simson's Substack) Last night I got this email at 9:12 PM: This message was automatically sent to me by GitHub…
1 Comment -
Why Rust Matters
Why Rust Matters
Rust is an exciting computer language that has made huge strides in popularity and importance over the past year. In…
12 Comments -
“Our Dollar, Your Problem: An Insider’s View of Seven Turbulent Decades of Global Finance, and the Road Ahead”, by Kenneth Rogoff
“Our Dollar, Your Problem: An Insider’s View of Seven Turbulent Decades of Global Finance, and the Road Ahead”, by Kenneth Rogoff
What I'm reading, and why I'm recommending it to others. My recommend reading this fall to practically everyone I know…
3 Comments -
Data management is hard (WHOOP!)
Data management is hard (WHOOP!)
I'm a big fan of WHOOP but I noticed that it has a data management problem when it syncs my high-resolution heartbeat…
2 Comments -
Vibe Coding, Human Design, and Data Management
Vibe Coding, Human Design, and Data Management
Last night I spent three hours trying to find a bug in my program—a bug I ultimately traced to a misunderstanding…
14 Comments -
A Modest Proposal, or the Sound of Inevitability
A Modest Proposal, or the Sound of Inevitability
For preventing the end of journalism, ending the dependence of AI systems on data “scraped” from the Internet, and…
13 Comments -
Noisy Outtakes
Noisy Outtakes
My book Differential Privacy will be published March 25 by MIT Press. The book is part of the “Essential Knowledge…
3 Comments -
Spooky Data at a Distance
Spooky Data at a Distance
As Halloween fast approaches, I thought it would be fun to recount a dinner talk that I gave several years ago on a…
6 Comments
Activity
6K followers
-
Simson Garfinkel posted thisI am so tired of reading posts that start "Someone..."
-
Simson Garfinkel shared thisIt’s an amazing institutionSimson Garfinkel shared thisJob opportunity: The Computer History Museum is hiring a Founding Director of its new AI Initiative. It could be especially appealing to the alt-ac crowd. <grin> https://lnkd.in/eqPDr9aJ
-
Simson Garfinkel shared thisRichard A. Tapia (1939-2026) was first in his family to attend college, the first U.S.-born Hispanic person elected to the National Academy of Engineering (1992), and the first mathematician to hold the title of University Professor at Rice (and the sixth person in the university’s then-94-year history to do so), and the first recipient of the Computing Research Association’s A. Nico Habermann Award (1994). He and his twin brother Bobby were drag racers from age 15; in 1968, the brothers set a world record in elapsed time for fuel dragster racing, traveling a quarter mile in 6.54 seconds. He joined his two passions in a lecture, “Math at Top Speed: Exploring and Breaking Myths in the Drag Racing Folklore,” delivered at universities and mathematics-awareness events for decades. https://lnkd.in/epFbczXj
-
Simson Garfinkel shared thisPerhaps the most important book that Thomas Levenson has ever written!Simson Garfinkel shared thisHey, everyone...but especially Boston-area peeps. As you probably know, I have a new book coming out--A Pox on Fools, a polemical history of opposition to vaccines. (Lots more details here: https://lnkd.in/e9YchWgk ) Pub. date is June 9, and the launch event comes two days later on June 11. Harvard Books--one of the great cultural institutions around here--is sponsoring and I'll be in conversation with my science-and-medicine writing colleague, the anthropologist Jason Bryan Silverstein, who hangs his hat at the Harvard Medical School. The event is free but requires an RSVP. I'd love to see you all there! https://lnkd.in/eReWiyaP ETA: If you can come and perhaps even more if you can't, pre-ordering is the best thing you can do to support any book, and especially one like A Pox..., which hopes to make a contribution to an urgent current issue. If you do plan to be at the Cambridge PL, the RSVP link in the Harvard Bookstore announcement gives you an option to reserve a copy to receive at the event. And if you can't, pre-ordering it from your favorite bookseller does double duty: boosting both this one title and the bookstore that serves your community, all at the same time. And thanks!
-
Simson Garfinkel shared thisI would say this is quite troubling, but I’ve had similar problems with federal express, and the inability to file claims as a person receiving the packageSimson Garfinkel shared thisFedEx allowed a MacBook Pro to be stolen in transit. The box was shipped from NYC yesterday and weighed 5.8lbs. It showed up at my doorstep weighing 2.4lbs. I opened the box and no computer. Spent more than 10 minutes asking FedEx's phone screener to talk to a human. Deeply frustrating experience. There's no prompt tree for "the contents of a package was stolen in transit". After getting to an incredibly unresponsive human, she told me that the sender had to file a claim and that FedEx would do nothing until the sender filed the claim. If you had a company where employees were stealing $4K computers, wouldn't you care about maybe finding who is doing the theft. This feels to me like something systemic rather than a one-off.
-
Simson Garfinkel reposted thisSimson Garfinkel reposted thisNot so long ago I was at a medical appointment getting some stitches. Either because stitching is so routine, or simply he wanted to distract me from the fact that I was getting sewn back together, the doc asked me what I did for a living. I’m a book editor, I said. And that prompted the inevitable question: “Oh, so does that mean you correct people’s grammar?” Generally speaking, it does not, not any more than being a hair stylist means combing hair. But the conversation got me trying to explain what it is I do, in fact, do, all in five minutes’ time. Maybe it was the penicillin, but I think I figured it out. It’s this: I help people write the books their ideas deserve. Now, of course, getting great ideas into a great book does sometimes involve grammar. But writing the book your ideas deserve is a process with many, bigger challenges before a final read for clarity. In nonfiction land, where I live, the biggest challenge may be the first: how does someone take a great idea–perhaps something that can be jotted down in a journal in twenty-five words–or a life’s sprawling work, and begin to sketch the outlines of a 1,000-word overview? There are more challenges to come: How does that become a proposal, one that’s a good enough read that an agent or acquisition editor doesn’t want to put it down? How does it become a piece of writing that delivers powerful insight, so that a publicist knows they’ll have something to run with? How does it become a proposal that doesn’t just serve up some pro-forma market analysis, but instead says to the jaundiced, jaded, or simply overworked book-publishing professional that, yes, this is a project you should risk time, treasure, and heartache on? And then, how does it become a provocative, gripping, and even entertaining book? How, indeed? If you’ve stopped short at any of those stages, I don’t think anyone can blame you. Expecting a scientist, an historian, or a top-flight journalist to have also mastered the art of writing a great book proposal or a great book is about as reasonable as expecting someone to come out of graduate school both a mathematician and a master gardener. I’m sure some do. But it’s not very likely. That’s where I come in. Yes, I can help you with your grammar. But I can also be your coach, your mentor, your guide. I can dive into the primary research and secondary literature alongside you, to help push your ideas to the limits and make your arguments as ironclad as can be. And I can shine your book, chapter by chapter, paragraph by paragraph, line by line–even with pencil on paper, if that’s how you’d like to do it (I have very neat copy-editor’s handwriting, earned the hard way, but I never use red ink). If you want to write a book that doesn’t simply inform people of what you think, but which transforms how they think, get in touch, at thomas@landleditorial.com or via https://lnkd.in/gVubWuHB. Write the book your ideas deserve. I’m ready to help you do it!
-
Simson Garfinkel shared thisYay formal verification!A blueprint for formal verification of Apple corecrypto - Apple Security ResearchA blueprint for formal verification of Apple corecrypto - Apple Security Research
-
Simson Garfinkel shared thisI am your expert for introductions.Simson Garfinkel shared thisLinkedIn needs an "make an intro" feature to facilitate helping other people network. E.g. I know Bob is applying to job at BigCo, I know Alice works there, and I should be able to click a "make an intro" button that let's me tell Alice she should connect with Bob b/c he's a great dude.
-
Simson Garfinkel shared thisThere is now a "kudoboard" to Celebrate the life and work of Peter G. Neumann (PGN): https://lnkd.in/e2wTTsZP
-
Simson Garfinkel liked thisMicrosoft – if you're listening, stop this. I'd very much like to know who made the decision to deviate from a practice which supports security vulnerability research and responsible disclosure. You appear to have breached a public trust. Here's what you risk burning down due to a misguided response: Access to thousands of creative minds continuously testing systems. Only paying a reward when a verified vulnerability is successfully found and reported. Independent researchers who bring unique tools, backgrounds, and real-world attack simulations. Providing a paid, legal path to report bugs incentivizes hackers to act as responsible citizens instead of exploiting systems criminally. Brand Protection.Simson Garfinkel liked thisMicrosoft didn't get 6 zero-days dumped on them because a researcher was reckless. They got 6 zero-days dumped on them because they deleted someone's MSRC account after that person did exactly what the industry spent thirty years begging researchers to do, report privately first. You want to know why full disclosure still exists as a concept in 2026? This is why. This is a live demonstration. You cannot build a vulnerability disclosure program on the implicit threat that the vendor will act in good faith and then be surprised when researchers stop acting in good faith in return. I've been in rooms, actual rooms, not Slack channels, where we debated this exact dynamic in the late 90s. The argument was simple then and it's simple now: researchers hold the leverage exactly once, at the moment of discovery. The second they hand that over to a vendor with no patch commitment, no timeline, no accountability, they have nothing. Microsoft knows this. They've known it for decades. Deleting someone's account isn't an accident or an oversight, it's a message. Eclipse sent one back. I'm not going to pretend to be shocked. Now Microsoft's Digital Crimes Unit is rattling sabers about legal action and coordinating with law enforcement. Classic. When you can't defend the product, attack the researcher. This playbook is older than infosec itself and it has never once made software more secure. What it does do is remind every researcher sitting on a bug right now exactly how much their good faith is worth. The chilling effect is the point. A scared research community is a quiet research community, and a quiet research community is very convenient if you're shipping 120 vulnerabilities worth of Patch Tuesday every month. July 14th is going to be interesting. I don't know what Eclipse has, but I know that whoever is making the call at Microsoft to escalate this legally rather than just fix the bugs has badly miscalculated the temperature of this community right now. You don't get to offshore your QA to unpaid security researchers, refuse to compensate them, nuke their accounts, threaten them with prosecution, and then appeal to responsible disclosure as a moral principle. Pick one. You don't get both.
-
Simson Garfinkel liked thisSimson Garfinkel liked thisMicrosoft didn't get 6 zero-days dumped on them because a researcher was reckless. They got 6 zero-days dumped on them because they deleted someone's MSRC account after that person did exactly what the industry spent thirty years begging researchers to do, report privately first. You want to know why full disclosure still exists as a concept in 2026? This is why. This is a live demonstration. You cannot build a vulnerability disclosure program on the implicit threat that the vendor will act in good faith and then be surprised when researchers stop acting in good faith in return. I've been in rooms, actual rooms, not Slack channels, where we debated this exact dynamic in the late 90s. The argument was simple then and it's simple now: researchers hold the leverage exactly once, at the moment of discovery. The second they hand that over to a vendor with no patch commitment, no timeline, no accountability, they have nothing. Microsoft knows this. They've known it for decades. Deleting someone's account isn't an accident or an oversight, it's a message. Eclipse sent one back. I'm not going to pretend to be shocked. Now Microsoft's Digital Crimes Unit is rattling sabers about legal action and coordinating with law enforcement. Classic. When you can't defend the product, attack the researcher. This playbook is older than infosec itself and it has never once made software more secure. What it does do is remind every researcher sitting on a bug right now exactly how much their good faith is worth. The chilling effect is the point. A scared research community is a quiet research community, and a quiet research community is very convenient if you're shipping 120 vulnerabilities worth of Patch Tuesday every month. July 14th is going to be interesting. I don't know what Eclipse has, but I know that whoever is making the call at Microsoft to escalate this legally rather than just fix the bugs has badly miscalculated the temperature of this community right now. You don't get to offshore your QA to unpaid security researchers, refuse to compensate them, nuke their accounts, threaten them with prosecution, and then appeal to responsible disclosure as a moral principle. Pick one. You don't get both.
-
Simson Garfinkel liked thisSimson Garfinkel liked thisFour months into serving as Branch Chief, and I continue to be inspired by my team's sheer resilience and collaboration. Good leadership isn't about having all the answers; it's about having a team that actively collaborates, shares fresh perspectives, and speaks up with great ideas. Successfully navigating changes while transitioning projects requires incredible agility and focus, which my team delivers. Watching them adapt, collaborate, and push our goals past the finish line motivates me to be a better leader every day.
-
Simson Garfinkel liked thisSimson Garfinkel liked thisI presented our age-verification research at the Privacy Engineering Practice and Respect conference earlier this week (And yes, I sewed the pepper dress)
-
Simson Garfinkel liked thisSimson Garfinkel liked thisIn 1999, I wrote my first paper on threat modeling, Breaking Up Is Hard To Do: Modeling Security Threats for Smartcards. Bruce and I talked on the phone a lot, and our analysis methodology was to think carefully about the problems. Threat modeling was something done by smart professionals with lots of experience and time available. At the same time, Loren Kohnfelder and Praerit Garg wrote their paper on the S.T.R.I.D.E. Model of Threats, but it wasn’t mentioned in public until later. I mention both of these because they’re useful anchor points for understanding change. Seven years later, on June 5, 2006 I started working for Steve Lipner and Eric Bidstrup at Microsoft. On my first day, Eric said something like “This threat modeling thing isn’t working. Fix it.” I asked something like “what does success look like?” and he said “that’s a good question. Figure it out and convince people you have it right.” There are days when I feel like I’m still doing that, but more seriously, I want to look back on some of the new things that have emerged in that time. Full post in the links, with shout outs to Michael Howard, David LeBlanc and Window Snyder, all of whom made threat modeling work great.
Experience
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Education
-
Massachusetts Institute of Technology
-
-
Activities and Societies: Student Information Processing Board; Student Newspaper (The Tech); Lecture Series Committee; Independent Building Hacker.
-
-
-
-
-
-
-
-
-
Licenses & Certifications
Publications
-
The Computer Book
Sterling
Part of Sterling’s extremely popular Milestones series, this illustrated exploration of computer science ranges from the ancient abacus to superintelligence and social media.
With 250 illustrated landmark inventions, publications, and events—encompassing everything from ancient record-keeping devices to the latest computing technologies—this highly topical addition to the Sterling Milestones series takes a chronological journey through the history and future of computer science. Two…Part of Sterling’s extremely popular Milestones series, this illustrated exploration of computer science ranges from the ancient abacus to superintelligence and social media.
With 250 illustrated landmark inventions, publications, and events—encompassing everything from ancient record-keeping devices to the latest computing technologies—this highly topical addition to the Sterling Milestones series takes a chronological journey through the history and future of computer science. Two expert authors, with decades’ of experience working in computer research and innovation, explore topics including the Sumerian abacus, the first spam message, Morse code, cryptography, early computers, Isaac Asimov’s laws of robotics, UNIX and early programming languages, movies, video games, mainframes, minis and micros, hacking, virtual reality, and more.Other authors -
-
Database Nation
O'Reilly
See publicationDatabase Nation: The Death of Privacy in the 21st Century shows how, in these early years of the 21st century, advances in technology endanger our privacy in ways never before imagined. Direct marketers and retailers track our every purchase; surveillance cameras observe our movements; mobile phones will soon report our location to those who want to track us; government eavesdroppers listen in on private communications; misused medical records turn our bodies and our histories against us; and…
Database Nation: The Death of Privacy in the 21st Century shows how, in these early years of the 21st century, advances in technology endanger our privacy in ways never before imagined. Direct marketers and retailers track our every purchase; surveillance cameras observe our movements; mobile phones will soon report our location to those who want to track us; government eavesdroppers listen in on private communications; misused medical records turn our bodies and our histories against us; and linked databases assemble detailed consumer profiles used to predict and influence our behavior. Privacy--the most basic of our civil rights--is in grave peril.
Patents
-
Method for Determining Hard Drive Contents through Statistical Drive Sampling
Issued US 8433959
Other inventors -
Projects
-
bulk_extractor
- Present
See project'''bulk_extractor''' is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results can be easily inspected, parsed, or processed with automated tools. '''bulk_extractor''' also created a histograms of features that it finds, as features that are more common tend to be more important. The program can be used for law enforcement, defense, intelligence, and cyber-investigation…
'''bulk_extractor''' is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results can be easily inspected, parsed, or processed with automated tools. '''bulk_extractor''' also created a histograms of features that it finds, as features that are more common tend to be more important. The program can be used for law enforcement, defense, intelligence, and cyber-investigation applications.
-
tcpflow
-
See projecttcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like tcpdump(4) shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. tcpflow understands TCP sequence numbers and will correctly…
tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like tcpdump(4) shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. tcpflow understands TCP sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery.
-
SBook
-
SBook was an award-winning AI-based personal information management system. It pioneered many techniques that are commonplace today, including instant search and named entity extraction.
Other creators -
Honors & Awards
-
Fellow
Association for Computing Machinery
-
DOD Value Engineering Award
Department of Defense
Awarded for the development and deployment of novel algorithms and software that significantly enhanced "big data" operations on stored data at multiple Law Enforcement, Defense and Intelligence facilities.
Languages
-
C / C++ / Objective-C
Native or bilingual proficiency
-
Python
Native or bilingual proficiency
-
Java
Native or bilingual proficiency
Recommendations received
6 people have recommended Simson
Join now to viewOther similar profiles
Explore more posts
-
Jongkil J.
I’m looking forward to sharing some of my latest research on the human-centric side of #cybersecurity with the Signal Not Noise (formerly LAST Conferences) community this week. In my work at TNK and across the research landscape, it’s become clear that cybersecurity is seeing a critical shift: the true front line of cybersecurity is no longer technical - it’s #human Join me this Thursday, 16th of February at 12:30pm as I break down a method for characterizing and quantifying human risk by drawing on #psychology and #behavioralscience. Free Registration Here: https://lnkd.in/gG-cdwXe #InfoSec #CyberRisk #HumanCentric #TNK
-
Robert Mahari
As more U.S. states consider rolling out AI laws, Europe’s landmark AI Act is a natural reference point. In a new piece for the Federal Sentencing Reporter, Gabriele Mazzini (the Act’s chief architect) and I examine how well the European omnibus framework fits the high-stakes, domain-specific context of criminal sentencing. Three practical takeaways for U.S. policymakers and courts: 🧩 One-size-fits-all has limits. The AIA’s prohibited vs. high-risk split turns murky in sentencing (e.g., what counts as "solely" profiling in a criminal risk tool?). Sector-specific rules that target concrete harms paired with tailored guardrails may better enable responsible innovation. 🎯 Regulate effects, not internals. Don’t fixate on technical nuances or hypothetical processes inside black box systems. Instead, focus on real-world outcomes through validation on realistic data, measurable error and calibration across groups, due-process safeguards, documentation, and continuous monitoring. 🧠 Keep AI assistive—with real oversight. Human oversight risks becoming a rubber stamp when a key benefit of AI is to unburden overworked human systems. Regulations must be pragmatic when requiring human oversight and account for the necessity of effective training, sufficient time to review, the ability to deviate from AI, audit trails, and remedies. While our analysis centers on sentencing, the broader point is that non-European jurisdictions should be cautious about importing the AI Act wholesale. Horizontal frameworks are useful references but durable governance in high-stakes domains often requires domain-specific guardrails. Link in comments.
2 Comments -
Peng Wu
Saw this write-up about a Claude security issue demonstrating prompt injection + file exfiltration risks for Cowork that"a worth reading: https://lnkd.in/dzvWpbuS My thoughts: 1.) Claude Code and Cowork are amazing tools. If we're serious about the future of agents, this requires giving these systems actual agency, e.g. the ability to act outside their sandbox. 2.) But that comes with enhanced risks. Prompt injection was mostly theoretical a year ago. With Cowork automating across your work environment, it's not theoretical anymore. And the attack demoed in the article can happen with zero user approval. 3.) What really surprised me: Anthropic knew about this specific file exfiltration vulnerability before releasing Cowork (it was disclosed months ago in Claude.ai chat). They acknowledged it but didn't fix it; they just added a warning for users to watch for "suspicious actions." That's a buyer-beware approach I didn't expect from them. The experiments I've done with Cowork have been really cool. But using these tools well needs a clear-eyed view of the risks. We all want autonomous agents, but we can't ignore the cracks in the foundation. For folks who are experimenting right now with Cowork, how are you balancing the excitement of the tool with the reality of these risks? #genAI #Anthropic #Claude #promptinjection #AIsafety #cybersecurity #buyerbeware
1 Comment -
Steve Atwal
🌩️ NOAA is rolling out AI‑based global forecasting models to speed up and sharpen weather predictions, including the tracking of tropical storms. Similar AI forecasting systems from ECMWF and Google DeepMind show that meteorology is rapidly becoming a flagship real‑world domain for applied AI. More accurate, faster forecasts could transform disaster preparedness, insurance, agriculture, and supply chains, while also raising questions about model transparency and long‑term robustness. #AI #Climate #Weather #Science #DisasterPreparedness #Research #EarthObservation #AIFreakyFacts
1 Comment -
Michael Asquith
🔥We filed a U.S. provisional patent for Agentic Enrichment Architecture (AEA). In midst of processing the same in Europe! 🔸AEA is a human-at-the-control enrichment layer that fuses cultural, linguistic, and brand context directly into your content ops. 🔸Why now? LLM-only workflows miss nuance, burn cycles, and inflate costs across markets. AEA cross pollinates w/ your stack—no rip-and-replace: Enrichment API • Locale Profiles • Policy/Style Overlay • Agent Handoffs • Readiness Signals. 🌊 Outcomes: native resonance, fewer review loops, brand integrity, lower risk—with transparency, auditability, and separation of duties built in. 🔸We’ve been solidifying and onboarding strategic partners and we are so proud enriching Legacy models to build future ready right now! 🏗️ Where others choose labels, we architect layers and levels across100+ Geo-markets! Granular Cultural #CX Vibrancy! NO MORE BOX ♒ performative outcomes AEA augments the tech you already have with enterprise security —and so much more. ✔️Check out #CreativeStudioX. 🔸Consult Manta → https://lnkd.in/g8gwvTZi #GlobalizeWe #AEA #AgenticAI #GWAgenticAIInteroperability #Localization #HumanAtTheControl #ChicagoTech #GEO #AEO #SEO #ContentStrategy #BrandAgents #1871Tech #ChicagoTech Betsy Ziegler Lawrence Johnson Krishna Mula GlobalizeWe
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content