Neil note: I’ve published this with the hope that others familiar with what this could entail will give feedback. As such, what you read now might not be the final version. If I make material changes, I’ll indicate them.
Quick and easy guide for securing macOS systems, for both laymen and security enthusiasts. Last updated for Golden Gate.
The goal of this blog is to share write-ups about bugs i have found in Facebook and reported to them under the Facebook bug bounty program.
Posts and writings by Lennart Poettering
A new version of Firefox Multi-Account Containers requires permission to “Exchange messages with programs other than Firefox.”
This table is based on research at Nash for work expanding our MPC protocol to secure wallets on new blockchains. We took a snapshot of rankings by market cap in early February 2021. In summary, 74 coins use ECDSA and the secp256k1 curve, including Bitcoin, Ethereum, and 48 ERC20 tokens. 10 coins use EdDSA and…
How to turn 256 bits of entropy into a beautiful, avatar-friendly circular SVG: the Hashvatar.
Years ago, OpenBSD gained two new security system calls, pledge(2) (originally tame(2) ) and unveil . In both, an application surrenders capabilities at run-time. The idea is to perform initialization like usual, then drop capabilities before handling untrusted input, limiting unwanted side effects. This feature is…
Last December, I was invited to a private bug bounty program to test a beta version of GitHub Actions. GitHub Actions is a workflow automation tool integrated with GitHub. One common use case of GitHub Actions is for CI builds – a project can fairly easily start up a Docker container every time they push a commit…
How I built a click farm to “bypass” Cloudflare’s CAPTCHA killer with some cheap USB security keys, an Arduino, and a bit of python.
Justin Sherman for Wired points out the farce that is anonymized data: Data on hundreds of millions of Americans’ races, genders, ethnicities, religions, sexual orientations, political beliefs, int…
I’ll be taking some time in the next months to talk about the newly hostile-by-default nature of technology, and how I deal with it.
Backups are critical. If you are lucky and organised you have a set of useful backup primitives, such as Point in Time snapshots on your Infrastructure As A Service (IaaS), your disk array controller, or volume manager. However there always seems to be some critical machine in my life that does not fall into these…
My list of “Probably Are Gonna Need It” security features for your web app – things that you should build up-front, not wait until you need them (when it’s already too late).
Cybersecurity is hard enough. Doing it across federal agencies is a mammoth task.
Sometimes, you don’t necessarily need to hack a system to exploit it.
“Sunburst” was the most sophisticated hack the world has ever seen. One of the most urgent lessons so far learned from the attack: we need…
Every year or so, something compels me to start over with a fresh OS image. Most recently, that something was an unfortunate water bottle incident. Once again, I need to pull down my digital life from the internet. The code and assets for this blog currently live in a 500 MB Git repository, which was hosted on…
Rewriting programs in Rust has become a bit of a meme and one program that has been discussed a lot is cURL .
Honestly, I love the design of this thing. It reminds me of something from the good old sci-fi.
Ribosome inverts Microsoft PhotoDNA hashes using machine learning.
Mistral Contrastin's thought bubble, blog, and personal revelations.
Previously on Deep Space Nine, we discussed (read: I complained about) the short life and quick death of DLNA. On the way, I mentioned DLNA's dependence on UPnP as an underlying autoconfiguration protocol. Let's talk a bit more about UPnP, because it's 1) an interesting protocol, 2) widely misunderstood, and 3)…
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that led to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.
telegra.ph/why-isnt-telegram-end-to-end-encrypted-by-default-08-142021127 points145 commentscited by 11Security & Privacy details
I've been getting this question more often this year. It's based on the wrong assumption that some other popular messaging apps such as WhatsApp are "end-to-end encrypted by default", while Telegram is not. This post is intended to disprove this myth that has been so carefully crafted by Facebook/WhatsApp marketing…
