271
Windows 10 spies on your use of System Settings (2021)
Windows 10 spies on your use of System Settings
272
Shifting Cyber Norms: Microsoft security POST-ing to you
tl;dr: Microsoft and other email security scanners will visit the links in email you transmit, and run the JavaScript in those links, including calls that lead to POSTs going out. This used to be unacceptable, since POSTs have side effects. Yet here we are. This breaks even somewhat sophisticated single-use sign-on /…
273
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
274
Why not use DNS over HTTPS (DoH)?
DoH is not about protecting your DNS queries from peepers. That is a big lie. It is about making sure only one peeper can see all of your queries.
275
What, if anything, should I do about using Mozilla's Firefox
I have used it for a long time - 20 years now, including for a while the IceWeasel variant - and I like it as a browser.
276
When root meets immutable: OpenBSD chflags vs. log tampering
Rafael Sadowski
277
Xcode Constantly Phones Home
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
278
How much EU is in DNS4EU?
This is another post that started after several toots on mastodon. Most of the things presented here were already tooted by other people, but I think this is a good chance to write a mini tutorial about what to look at. We’ll use DNS, whois, BGP and your favourite search engine. What is DNS4EU? To quote the web page…
279
Susctl CVE-2024-54507: A particularly 'sus' sysctl in the XNU kernel
A very sus sysctl in the XNU kernel.
280
Decompiling 2024: A Year of Resurgance in Decompilation Research
The year 2024 was a resurgent year for decompilation. Academic publications from that year made up nearly 30% of all top publications ever made in decompilation. In this post, I do a summarization and retrospective of both the academic and ideological progress of decompilation in 2024. Hint: decompilation research is…
281
Acronis True Image costs performance when not used
Over two years ago I installed Acronis True Image for Crucial in order to migrate my data to a new SSD I had just purchased. It worked. I then left True Image installed “just in case”, and what har…
282
A modern approach to preventing CSRF in Go
My new book guides you through the start-to-finish build of a real world web application in Go — covering topics like how to structure your code, manage dependencies, create dynamic database-driven pages, and how to authenticate and authorize users securely .
283
Acme, a brief history of one of the protocols which has changed the Internet
ACME, a brief history of one of the protocols which has changed the Internet Security Changelog 03 December 2025: article announced on Mastodon, LinkedIn and X. 03 December 2025: J.C. Jones published his reflections about 10 years of Let’s Encrypt. A must read! 03 December 2025: J.C. has also been kind enough to…
284
Most parked domains now serving malicious content
Direct navigation — the act of visiting a website by manually typing a domain name in a web browser — has never been riskier: A new study finds the vast majority of “parked” domains — mostly expired or dormant domain names, or common misspellings of popular websites — are now configured to redirect visitors to sites…
285
A valid HTML zip bomb
<h1 id="a-valid-html-zip-bomb"><a tabindex="0" class="anchor" href="/notes/html_zip_bomb">A valid HTML zip bomb</a></h1><p><img src="/notes/res/zip_bomb_file.svg" alt="Illustration d'une bombe zip" height="150" width="150"> Many sites have been affected by the aggressiveness of web crawlers designed to improve…
286
Internet Access Providers Aren't Bound by DMCA Unmasking Subpoenas–In Re Cox
The DMCA online safe harbor is a notice-and-takedown scheme. Web hosts aren’t liable for copyright-infringing third-party uploads unless and until the copyright owner submits a proper takedown notice to the host, at which point the web host can remain legally...
287
AI cheats: Why you didn't notice your teammate was cheating
For the past few years, cheats have evolved rapidly. First came memory reading aimbots, then colorbots, and now AI aim assist. Cheats have escaped the host PC. How does it affect the players and anti-cheats?
288
289
A quiet change to RSA
Over the course of years, RSA implementations gradually replaced Euler's totient function with Carmichael's totient function.
290
Setting up a trusted, self-signed SSL/TLS certificate authority in Linux
With OpenSSL, it’s pretty easy to generate a simple self-signed TLS certificate . Just run the following command:
291
292
Digital ID – The New Chains of Capitalist Surveillance
From The world is entering an era where identity is no longer a matter of personal relationships, lived experience, or even paperwork. Increasingly, it is reduced to biometric scans, algorithmic ve…
293
DOGE Denizen Marko Elez Leaked API Key for xAI
Marko Elez , a 25-year-old employee at Elon Musk’s Department of Government Efficiency (DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security. So it should fill all Americans with a deep sense of…
294
Yes, the Book of PF, fourth edition is coming soon
© 2025 Peter N. M. Hansteen Long rumored and eagerly anticipated by some, the fourth edition of The Book of PF is now available for ...
295
Unfortunately, the ICEBlock app is activism theater
At this summer's HOPE conference, Joshua Aaron spoke about ICEBlock, his iPhone app that allows users to anonymously report ICE sightings within a 5 mile radius, and to get notifications when others report ICE sightings near them. You can see the full talk, and the lively/infuriating Q&A,
296
Encrypting files with passkeys and age
Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
297
Why the Sanitizer API is just `setHTML()`
Why the Sanitizer API is just <code>setHTML()</code>
298
Firefox Forcing LLM Features
Mozilla forcing llm features and providing no gui for users to disable them
299
How did Facebook intercept competitor's encrypted mobile app traffic? (2024)
A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.
300
Reverse Engineering US Airline's PNR System and Accessing All Reservations
Timeline & Responsible Disclosure