391
The FIPS 140-3 Go Cryptographic Module
Go now has a built-in, native FIPS 140-3 compliant mode.
392
Introduction to reverse-engineering vintage synth firmware
A gentle introduction to reverse-engineering vintage synthesiser ROMs using the Ghidra disassembler.
393
A thought on JavaScript "proof of work" anti-scraper systems
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
394
395
LLMs and coding agents are a security nightmare
Things are about to get wild
396
Yep, Passkeys Still Have Problems
Firstyear's blog
397
Trusting clients is probably a security flaw
If your service needs to trust the clients, hold my Big Mac
398
We got hit by an alarmingly well-prepared phish spammer
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
399
When you deleted /lib on Linux while still connected via SSH (2022)
Let's first not talk about why this can happen, but deleting /lib, /usr/lib, or some other essential runtime files happens quite a lot (as you can see: here, here, here, and here). In this post, I will only discuss what happens when you delete /lib on Linux and how to recover from that. The easy
400
Windows BitLocker – Screwed Without a Screwdriver
Breaking up-to-date Windows 11 BitLocker encryption -- on-device but software-only
401
Did Semgrep Just Get a Lot More Interesting?
Documentation and guides from the team at Fly.io.
402
How I protect my Forgejo instance from AI web crawlers
This article describes my nginx configuration and strategy on how to prevent web crawlers from putting down my instance while still serving most people with minimal amount of friction.
403
JTAG 'Hacking' the Original Xbox in 2023
Released in November 2001, the original Xbox was Microsoft’s first venture into the game console industry. With its hardware closely resembling a cheap but v...
404
Signal – An Ethical Replacement for WhatsApp
Moving from WhatsApp to Signal is an important action, right now. WhatsApp’s parent company, Meta, has been involved in several cases of election interference: America in 2016, Trinidad and Tobago …
405
Passkeys and Modern Authentication
Some thoughts in support of simple solutions.
406
Fake VS Code Extension on NPM Spreads Multi-Stage Malware
The Mend research team uncovered a fake VS-code extension—truffelvscode—typosquatting the popular truffle for VS-code extension. Read the post for more details.
407
Gmail E2E is as terrible as expected
Recently, Google introduced E2E encryption in Gmail. It went bad.
408
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack campaigns were highly targeted and carried out in a variety of ways. The majority of these attacks originated via…
409
Remote Code Execution in Marvel Rivals Game
Reverse Engineering: I discovered a serious Remote Code Execution (RCE) vulnerability in a popular game that could let attackers run code on your PC. Watch how I found it, reported it, and what you can do to stay safe.
410
Hardening the Firefox Front End with Content Security Policies
Most of the Firefox User Interface (UI), including the address bar and the tab strip, are implemented using standard web technologies like HTML, CSS and JavaScript plus some additional custom components like XUL. One of the advantages of using web technologies for the front end is that it allows rendering the frontend…
411
Xcode constantly phones home
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
412
Three ways formally verified code can go wrong in practice
"Correct" doesn't mean "correct" when correctly using "correct"
413
Certificate Transparency in Firefox
Certificate Transparency (CT) has been one of the biggest advancements in web security, keeping users safe from threats such as certificate fraud and…
414
How we reduced the impact of zombie clients
Every night, right around midnight (mainly UTC), a horde of zombies wakes up and clamors for … digital certificates! The zombies in question are abandoned or misconfigured Internet servers and ACME clients that have been set to request certificates from Let’s Encrypt. As our certificates last for at most 90 days…
415
Removing XSLT for a more secure browser
Prepare for Chrome deprecating and removing XSLT from the browser.
416
An attacker’s blunder gave us a look into their operations
An attacker installed Huntress onto their operating machine, giving us a detailed look at how they’re using AI to build workflows, searching for tools like Evilginx, and researching targets like software development companies.
417
Hidden risk in Notion 3.0 AI agents: Web search tool abuse for data exfiltration
CodeIntegrity research on Notion AI security, Notion 3.0 AI Agents, lethal trifecta risk, indirect prompt injection, web search tool abuse, and data exfiltration.
418
Code highlighting extension for Cursor AI used for $500k theft
Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer.
419
Guarding My Git Forge Against AI Scrapers
A summary of the techniques in place to protect my git forge
420
DDoS Botnet Aisuru Blankets US ISPs in Record DDoS
The world’s largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers like AT&T , Comcast and Verizon , new evidence suggests. Experts say the heavy concentration of infected devices at U.S. providers is…