Meet Denver Brady, avowed serial killer and author of a book with the same title as this novel. His work forms the book-within-a-book, more of a step-by-step instruction on how to off someone and escape to do it again and again. The book is found in the novel’s primary murder victim’s hands at the start of the novel, which begins the manhunt by inspector Samantha Hansen, who is coming off compassionate leave and back on the force. Sam, as she likes to be called, is beset with loads of problems, both emotional and physical, and has trouble concentrating on clues that should be obvious to her (maybe not for all readers however) as she tries to solve the novel’s murder. She reads along the how-to book and tries to align the clues in the book with the ones she uncovers during the course of her investigation. The novel mostly takes place in and around London, and has loads of plot twists and turns, right up to its very end. I won’t give away any of these because they are deliciously put together. Many murder mysteries run out of gas towards the end but this book — or should I say the combined books — holds your attention until nearly the last page. I highly recommend this novel by Rebecca Philipson.
At least Clippy was cute
I was not a fan of Microsoft’s Clippy. But I was waxing somewhat nostalgic about the little paper clip reading all the negative reviews of Microsoft’s latest foray into helpful assistants, its AI-based Copilot. David Linthicum wrote today on LinkedIn about the enterprise backlash, saying, “The company’s decision to introduce new licensing models, charge premium prices for AI features, and encourage hardware upgrades created deep skepticism.” He cited its intrusive design, general unhelpfulness and AI hallucinations, and evidence that just a small percentage of adoption by Office users as major obstacles and says it is a cautionary tale: Microsoft needs to listen more and impose less on its users.
Some wags (including Marc Benioff) have called Copilot Clippy 2.0. I don’t think that is a fair fight. We should at least bump up the version to 10.0. In many respects, Clippy was ahead of its time (read this historical look back to see why this author called it cutting-edge AI for 1996.)
I haven’t spent much time with Copilot, because I would rather do my internet lookups when I need them, not be distracted by some automated nag. True, Copilot can generate a lot of text with just a simple request. But a lot of AI slop, as it is called. Does it do a better job than Clippy in understanding context? Yes, but it still interrupts the creative flow, or at least my creative flow.
Over the many decades that I have become a not-so-famous writer I have learned how do my searches for the data and links in my stories. Now I type in complete sentences, rather than find three unique words that will drive better results. (That reminds me of What3words.com, which is a fascinating site, but I digress. See how annoying interrupting things can be? Sorry.)
So at least Clippy was cute. It had its detractors too, but also fans such as this short video that showed its future that is surprisingly fresh for something done a decade ago.
And for those of you who want to reanimate Clippy, here is some code that will bring it back to your desktop.
I will leave you with some words of wisdom from a colleague, Theresa Szczurek, who talks about finding joy and fear in AI in her latest newsletter: “You choose when to use AI. You decide where it adds value. You define ethical boundaries. You determine how it supports — not supplants — your strengths. AI is one tool among many. You are still the strategist. The leader. The creator.”
The Hacker News: My Day Getting My Hands Dirty with an NDR System
As someone relatively inexperienced with network threat hunting, I wanted to get some hands-on experience using a network detection and response (NDR) system. My goal was to understand how NDR is used in hunting and incident response, and how it fits into the daily workflow of a Security Operations Center (SOC). Corelight asked me to write a sponsored piece for The Hacker News about my experience using their Investigator threat hunting software (screenshot below).
While I’m new to threat hunting, I do have experience looking at network traffic flows. I was even an early user of one of the first network traffic analyzers from Network General called Sniffer. Sniffers were specialized PCs equipped with network adapters designed to capture traffic and packets. These computers were the foundation on which more advanced network monitoring platforms were built. That Wikipedia link shows you how far we have come with designing useful control interfaces.

My day getting down and dirty with Corelight’s Investigator taught me valuable lessons on how to create threat hypotheses, understand how threats move about a network, and, more importantly, gave me an opportunity to learn more about how networks operate and how they can be defended in the modern era.
The future generation of news looks very different from today
A new research report from a combined effort of Financial Times Strategies and the Knight Journalism Lab at Northwestern University is now out. Entitled “Next Gen News” it describes a very different future for the way news is gathered, packaged, and consumed. And if I haven’t grabbed you in the seconds it took to read my lede, then too bad and so sad for me.
The report is the second such effort from this collaboration and uses online surveys of 1,000 subjects in each of five countries: Brazil, India, Nigeria, the UK and the US. They also took more in-depth interviews of 84 random subjects aged 18-28, and 19 news producers across the world drawn from both solo creators and larger news sites. The 80-page report is well worth your time, and shows what is happening in the world of news. Some of it is obvious, but a lot of it isn’t, and the insights will surprise you.
If you have never heard of Lisa Remillard, The Pudding, Morning Brew or Climate Adam, then you need to pay a lot more attention to this report and the market that they represent. News sites are embracing novel ways to attract, orient and engage readers. Sites are tailoring their content to produce a mix of sources, notifications, story types and ways to adjust their algorithms to provide the best engagement. That much you probably know, but there are many tips and tricks on how to get from the old news world to the modern era.
To that end, they identify seven different modes of engagement, as shown in the diagram below.

For example, the sifters can scroll through a list of news items. They have about two seconds for video and maybe 15 or so seconds for reviewing the text to select the stories or topics that breakthrough. Seekers use overall websites to guide their discovery process. Each of the seven modes is explored in detail, with numerous examples from sample websites from the five countries.
One of the interesting things is how different the news environment is across the world. Nigeria, for example, is the most digitally engaged country, for example. The study’s authors explain why they picked the places they did, and document who they did additional interviews at length.
The challenge for modern news producers is that there is a broader definition of what news is for modern readers. It can contain civic info, but it also has a personal impact on the reader and is both entertaining and non-fiction. The researchers found that the best producers have turned the trad journalism model on its head: they start from being distributors, master the language and style of their platforms and design their content so it can travel across their own news ecosystem. Being distribution first means that engagement isn’t just a by-product of solid journalism but built-in up front. Publishing is the start of a conversation between the site creators and readers, not the endpoint of what was once the legacy process. The old news style began with an idea and then worked through research and writing the story and ended with distribution. The modern workflow starts with distribution and then tests several ideas before moving into editing and publication, all in the service of community engagement.
No longer are news producers trying to shoehorn content into a distribution platform (like TikTok or YouTube), with results measured in page views or likes. Instead, the content is designed to be native to a platform in terms of style, focus, and news content. And forget about the inverted pyramid scheme for writing stories: there are numerous examples of what next-gen news uses, such as building recurring inside jokes to make complex topics more approachable.
This means that the modern newsroom is filled with what the researchers call “full stack creators.” This doesn’t mean that they know everything from HTML to Cursor, but that they have a mix of skills including on-camera presence, visual storytelling, script writing, being able to package the product with descriptions and thumbnails, and understanding the basic analytics that will be used in their stories. That is a tall order. But wait, there is more: the modern newsroom needs to be a working, cross-functional pod that can cover multiple platforms too.
Back when Twitter was still a trusted breaking news source, we had to learn the ins and outs of socializing our content. And to some extent, this is still the case, just now the socializers are just one of the seven modes mentioned earlier. But now the producer has to start with the assumption that they have to build content that people actually want to share with their peers, and understand how different platforms distribute their shared content. To be effective, this content has to resonate emotionally, be simple to grasp, and easy to report. Seems obvious, right?
Not mentioned in the report is that content creators have to navigate the dangerous waters of AI and understand that traditional SEO and being an “influencer” are both dead concepts. Cybersecurity expert Daniel Miessler recently posted that “The main viable path for knowledge worker professionals is to start seeing themselves as free agents. And to start behaving that way in terms of how they present to the world. It’s about to be essential that you’re visible, that you have a portfolio of work you can show/talk about, that you have a domain. A website.” Everyone will be an influencer, and its our job as scribes to find, target, and feed our particular audiences.
Book Review: The Bolden Cylinder by Norman Woolworth
An old wax cylinder was discovered in a New Orleans attic containing a recording of a an century-old jazz pioneer. The cylinder ends up missing at the same time as an arsonist burns down the home it was last seen. The mystery widens to some unsavory characters and some interesting plot twists that weave various real locations around town, so those readers familiar with the city might enjoy the travel scenes. The double murder/arson investigation — a dead body is discovered in the burnt-out home that has been there for decades — proceeds in fits and starts, and with just the right mix of action, dialogue and suspense. I thought some of the plot points could have been described more sharply, but would recommend this mystery nonetheless. Buy the book on Amazon here.FIR B2B #159: A tale of two newspapers
Paul Gillin and I are back with this episode after the recent events of the massive layoffs at the Washington Post and the LA Times, the shuttering of the Pittsburgh Post Gazette and funding cuts at NPR. We describe the continuing train wreck of daily news there and contrast the Post’s approach with what has been going on at the New York Times digital property. The Times diversified its revenue stream beyond its core newsgathering with purchasing gaming, cooking, and sports-related content. Post’s owner Jeff Bezos didn’t diversify or even keep the news core. Part of the digital newspaper problem is that its ad revenue model is gone, as search traffic has dried up thanks to AI chatbots. Compounding this is that overall monthly visits to the Post’s website is down from 60M (in 2022) to 40M visits last year, and subscriptions are dropping too. We contrast the Post and the Times business models.
On our latest 17 min. podcast, we talk about some signs of success with subscriptions for smaller, more targeted sites, such as 404Media, which shows that a small group of independent journalists can keep quality high and report on significant stories. Also, individual creators (such as Mr. Beast and Mark Rober) can build a brand and attract significant audiences (Rober has more than 70M subscribers, for example) on YouTube and TikTok.
If you want to also listen to Marty Baron, former editorial director of the Post, here he is talking to Tim Miller about his thoughts on the decline of his former employer.
Book review: The Jills by Karen Parkman
The title characters of The Jills are members of the cheer squad supporting the Buffalo Bills football team, and what happens when trouble envelops several of them. It is loosely based on the reality and challenges faced by these women — low pay, ridiculous work requirements that dictate every moment of their lives: how they look, what they eat, and so forth. One of the Jills is missing, and foul play is suspected. Two sisters are at the heart of the plot: one a Jill, and one who is in and out of various addiction 12-step programs. Lurking on the sidelines is a Buffalo crime family that who is dating the missing Jill. The novel’s verisimilitude is spot-on, and the scrapes that the two sisters get into drives the plot forward and provides for a fast-paced read. Highly recommended.
Book review: Spies, Lies and Cybercrime by Eric O’Neill
Eric O’Neill has had an interesting career hunting down some of the worst spies and cybercriminals (he was one of the principals behind the takedown of Robert Hanssen). His book is a part travelogue, part instruction and best-practices manual, and part a detailed narrative of how cyber attackers ply their trade. If you haven’t heard of a few of the exploits (Colonial Pipeline, Solar Winds, WannaCry, and many others), this book is useful in describing the back story of these and others that have receded from the headlines. He draws on his own experiences at fighting these attackers from real life IT workers that are trying to keep their networks secure and protected, and “another grim reminder that once your data is out there, it’s out there for good— and the dark web has no return policy,” as he writes. The dark web – where criminals operate – has a gross cybercrime haul greater than Germany and Japan’s GDP combined.
We have already reached the place where we can’t trust everyday sites such as texts, FaceTime, Teams and other social sharing platforms. “Trust has become an uncommon commodity.”
O’Neill has spent years as a national security lawyer, corporate investigator and part of the threat response teams for cybersecurity vendors, so he knows the landscape very well. He wrote this book for a laudable purpose: “If enough of us become covert agents and learn to safeguard our personal data, we can also make the world safe from cyberattacks. This is how we start. One data point at a time.” His philosophy is that we must do better and start thinking like our adversaries if we are to repel their digital advances. “There are no hackers, there are only spies.” His years in law enforcement “left me with a simple axiom: Criminals are lazy. If they weren’t, they’d get day jobs.” So true. And being patient in understanding how your business has been compromised will pay off in finding where the breach took place and how to shore up your defenses.
The end of the book is worthy of clipping as a ready reference, what he calls the Spy Hunter Tool Kit. It is a list of dozens of valuable suggestions, such as never respond to a phishing text (such as the one I got while I was writing this review, asking me to change my PayPal password. (I no longer have a PayPal account, having gotten tired of all the scams and come-ons such as this one.)
His book was written while AI blossomed (I guess that is one way to describe it) and audio and video deepfakes became more common. One way to suss out if they are fake is to move your hands wildly at the beginning of a video conference call, although eventually AI will figure out a solution to this too.
If you are an experienced cybersecurity professional and want a book to give your friends, family, and co-workers, this is a good place to start with their education. If you are new to the cybercriminal world, this book will show you its depths and darkest corners, and hopefully motivate you to use better and unique passwords and other protective techniques.
This is a great introduction to cybercriminals and how to protect yourself from being their next victim.
Book review: Good Intentions by Marisa Walz
This book takes on several tough subjects as part of its winding plot involving two terrible accidents on Valentine’s Day: one twin sister and one child are killed in two separate auto accidents. The surviving twin and the boy’s mother are brought together in grief, as their worlds fall apart. The twin runs her own event management business, and her husband has his own business too. The psycho drama of these three adults is woven expertly by the author as we watch their conflicts over loss and adjusting to various circumstances that I don’t want to reveal to spoil the plot. As someone who has lost an adult child, their grief journeys aren’t sugar-coated and seem very realistic and raw. And the strong ending is somewhat surprising but brings the novel to an appropriate close. Highly recommended.
Beware of OpenClaw, a new AI tool and potential threat
When I began writing about the potential dangers and benefits of AI a few years ago, I quickly came to the conclusion that the two are very closely tied and both directions present new challenges for enterprise IT managers. The latest development of Clawdbot (AKA Molt.bot or now called OpenClaw) are a very instructive case study. So what does it do, and what is the threat?
Basically, it is a powerful way to automate your digital life using a variety of AI agents. It is an AI-based assistant, and its use is spreading like wildfire. The top line is that OpenClaw is taking over — Token Security has found it has collected more than 60,000 Github reviews and nearly a quarter of its enterprise customers are using it and running it mostly from their personal accounts. They say “It is also a security nightmare, with exposed control servers that can lead to credential theft and remote execution over the internet.” This is no Chicken Little deal — “This rapid adoption signals a significant shadow AI trend that security teams need to address immediately.”
Here are two places that provide a deeper dive: First is security blogger Samuel Gregory, who has an excellent 15 minute demo video where he says “If you don’t know what you are doing, you can cause a lot of damage.” He shows you some of the guardrails you need to install, explains a bit of the bot’s history, and is well worth watching. But many of his suggestions mean you have to do a lot more work to isolate the bot from your online life — which shows quite starkly the tradeoff of security with ease of use.
Shelly Palmer, who actually uses the tech he writes about has this post where he documents what it took to get it up and running across his digital life. The bot connects his Slack, iMessage, WeChat, and Discord accounts. He has spent several hundred dollars in tokens to fine-tune it, and says it costs him anywhere from $10-$25 a day — “the bot just eats tokens.”
Part of OpenClaw’s problem is that you can run it on your local hard drive, but that it sends its feelers deep into your corporate SaaS infrastructure. For this to work, the bot needs access to your accounts and credentials. The bot’s website (mentioned above) is proud of this connectivity, saying up front that it “Clears your inbox, sends emails, manages your calendar, checks you in for flights. All from WhatsApp, Telegram, or any chat app you already use.” A story in El Reg goes into further details about the security implications. Not surprisingly, as they mention, “Users are handing over the keys to their encrypted messenger apps, phone numbers, and bank accounts to this agentic system.” Gulp.
The bot has its own package registry where you can download various “skills” as they are called to do various tasks for you. This sounds great until you realize — as this one researcher describes (sorry it is a Tweet, forgive me), there is absolutely no vetting, and 100% chance that something you have downloaded has evil intent. Daniel Miessler Tweeted this warning shown below on how to harden any Clawdbot implementation. But many of the fixes depend on personal choices deeply rooted in the realm of Shadow IT. The issue is that it is easy to install, but difficult to install securely, something that many users might not realize in their joy of having a clean inbox and automatically delegating their mundane tasks.
SOCPrime used its own tool to find users who have jumped on the Clawdbot bandwagon, and I am sure other threat intel tools will soon have similar posts.
“Yes, there are real issues: plain-text secret storage, misconfigured admin UIs on the open internet, and a skills ecosystem where people blindly install untrusted code,” says Matt Johansen. So keep your eyes open, scan your networks for the appropriate indicators, and educate yourself and your end users on what they are doing and how they do it more securely.
When spreadsheets first entered businesses, I recall how hard IT had to work to stay ahead of our users who were enamored with the new tech. But that was a single piece of software. With OpenClaw, we have an entirely new layer of digital infrastructure, and one that is complex and could be costly as well as open up multiple security sinkholes. Proceed with caution.