This is a follow-up to my blog post macOS Sonoma silently enabled iCloud Keychain despite my precautions from five months ago. The TL;DR of that blog post is that when you have iCloud enabled but not iCloud Keychain, updating from Ventura to Sonoma causes iCloud Keychain to be silently enabled. (I don't know yet…
Large-scale quantum computers are capable of breaking all of the common forms of asymmetric cryptography used on the Internet today. Luckily, they don’t exist yet. The Internet-wide transition to post-quantum cryptography began in 2022 when NIST announced their final candidates for key exchange and signatures in the…
A few years ago, I have blogged about my approach to sandboxing less-trusted applications that I have to or want to run on my main machine. The approach has changed since then, so it is tim...
A few days ago, Anthropic released Claude Computer Use, which is a model + code that allows Claude to control a computer. It takes screenshots to make …
Things this developer thinks might be interesting to you.
Recall is a new feature in Windows 11 which takes a screenshot every few seconds, runs local device OCR on it and stores the resulting text in a SQLite database. …
Regulation-induced monocultures meet unfortunate but explicable engineering decisions.
Culture is increasingly mediated through algorithms. These algorithms have splintered the organization of culture, a result of states and tech companies vying for influence over mass audiences. One byproduct of this splintering is a shift from imperfect but broad cultural narratives to a proliferation of niche groups…
Based on a new proposal by the Belgian Minister of the Interior, EU governments could endorse the much-criticised child sexual abuse regulation (CSAR or chat control) as early as June after all. This is what internal information leaked to Pirate Party MEP and shadow rapporteur Patrick Breyer reveals
Defending Mastodon from Donald Trump's social media
Illegal drug transactions facilitated through Georgia's employee portal
Spam on GitHub is getting out of control and affecting 10,000's of users daily. GitHub is seemly doing nothing about it, here is the proof.
A simple XSS in Google application
While reading Real-World Cryptography , I came across the "million message attack" . This is an attack that Daniel Bleichenbacher demonstrated in 1998, which effectively broke RSA with a particular encoding function called PKCS #1 . It was only mentioned briefly, so I dug in and decided to try to understand the…
It feels like not a week goes by without someone sending me yet another credential stuffing list. It's usually something to the effect of "hey, have you seen the Spotify breach", to which I politely reply with a link to my old No, Spotify Wasn't Hacked blog post
How to extract raw source protobuf definitions from compiled binaries, regardless of the target architecture
A bunch of malicious extensions in Chrome Web Store have hidden affiliate fraud functionality, collect users’ browsing profiles, or both. These extensions appear to be connected to the Karma shopping assistant, developed by Karma Shopping Ltd. which is not a small company.
An updated version of the methodology to be used in the Child Sexual Abuse Regulation, leaked by the news portal Contexte, reveals more details on the approach pursued by the Belgian Council Presidency: The text doubles-down on services that allow people to protect themselves. If services are used t
In this blog post, you will learn different methods to harden your OpenBSD system, and in which situation they are useful
Silently sends up to 255 bytes of the client's heap to the server . The server must support NPN , and the heap data is encrypted in transit.
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
Last week, the United States joined the U.K. and Australia in sanctioning and charging a Russian man named Dmitry Yuryevich Khoroshev as the leader of the infamous LockBit ransomware group. LockBit’s leader “ LockBitSupp ” claims the feds named the wrong guy, saying the charges don’t explain how they connected him to…
There are indications that U.S. healthcare giant Change Healthcare has made a $22 million extortion payment to the infamous BlackCat ransomware group (a.k.a. “ ALPHV “) as the company struggles to bring services back online amid a cyberattack that has disrupted prescription drug services nationwide for weeks. However…
XNU kernel buffer overflow, introduced in macOS 14.0 and fixed in macOS 14.5.
Don't trust. Verify. I could not resist making a fake book cover Here follows a brief description on how you can detect if the curl package would ever make an xz. xz (and its library liblzma) was presumably selected as a target because it is an often used component and by extension via systemd it … Continue reading…
Scope. To talk about C++’s current safety problems and solutions well, I need to include the context of the broad landscape of security and safety threats facing all software. I chair the ISO C++ s…
While looking for ways to activate the developer menus left over in Animal Crossing, including the NES emulator game selection menu, I found an interesting feature that exists in the original game that was always active, but never used by Nintendo. In addition to the NES/Famicom games that can be obtained in-game, it…
I think turning everyday gadgets into bombs is a bad idea. However, recent news coverage has been framing the weaponization of pagers and radios in the Middle East as something we do not need to concern ourselves with because “we” are safe.
