In past years, the Rustls project has been happy to receive substantial investments from the ISRG. One of our goals has been to improve performance without compromising on safety. We last posted about our performance improvements in October of 2024, and we're back to talk about another round of improvements. What is…
A subtle G++ bug from 2012, C++20’s new comparison rules, and legacy Boost code can collide to crash Solidity’s compiler on valid code. We unpack the surprising chain reaction and how to fix it.
Privacy is only dead if we let it die. Be careful about the all-or-nothing mindset in data privacy, it can do more damage than good to the cause. While striving for improvements, do not forget to cheer and celebrate each small win.
Lessons learned from becoming the unexpected face of a npm supply-chain attack.
During a one hour period today, my computer contacted 63 different Apple domains while i was not logged on and using it. I have been trying to minimize to the extent possible the reach of big tech into my life. A full 25% of the DNS queries from one of my computers (M2 MBA with macOS 15.4) are to Apple owned domains …
A comparison of how well Rust and Ada prevent the most common memory-related software errors.
Trump is quietly building a surveillance state, and almost no one is paying attention.
Each time you see a targeted ad, your personal information is exposed to thousands of advertisers and data brokers through a process called “real-time bidding” (RTB). This process does more than deliver ads—it fuels government surveillance, poses national security risks, and gives data brokers easy access to your…
The vulnerabilities we found in Cloudflare's CIRCL FourQ implementation: invalid-point attacks, Edwards-curve edge cases, and the disclosure that fixed them.
We uncovered 1,100+ exposed Ollama LLM servers—20% with open models—revealing critical security gaps and the need for better LLM threat monitoring.
First and foremost: If you’ve got any documentation on this hardware, please contact me! I would love to read the actual specs for this protocol.
Clearview AI is known for scraping billions of photos of people around the world on the internet – and selling its facial recognition system to law enforcement and state actors
Teammate App had a publicly exposed database and told me to stop harassing them after I emailed them about it.
On July 22, 2025, the European police agency Europol said a long-running investigation led by the French Police resulted in the arrest of a 38-year-old administrator of XSS, a Russian-language cybercrime forum with more than 50,000 members. The action has triggered an ongoing frenzy of speculation and panic among XSS…
Why are developers so hesitant to bring anti-cheat solutions to Linux?
libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license .
Alright, I’ve got another conspiracy theory misconception to dispel. :) After reading through the Chrome Terms of Service, some people are worried that Google is trying to assert rights on ev…
This article dives into my full methodology for reverse engineering the tool mentioned in this article. It's a bit longer but is intended to be accessible to folks who aren't necessarily advanced reverse-engineers.
Last week, I wrote about how Joshua Aaron's ICEBlock app, which allows people to anonymously report ICE sightings within a 5-mile radius, is – unfortunately, and despite apparent good intentions – activism theater. This was based on Joshua's talk at HOPE where he made it clear that he isn'
Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers. As outlined a year ago, defenders face the daunting t…
The key question is: Can you detect AI agent traffic on your application today? We tested multiple AI agent toolkits across high-traffic consumer sites, and the results were clear—legacy detection techniques (CAPTCHAs, IP blocking, user-agent filtering) are largely ineffective. Here’s what we found.
Local LLMs prioritize privacy over security. Our research reveals a 95% backdoor injection success rate.
Maybe you, yes you, should run a Certificate Transparency log. It’s cheaper, easier, and more important than ever.
The shutdown of the facial recognition cameras at the Václav Havel Airport in Prague came after years of criticism from EDRi member IuRe.
We published our video on zero-knowledge proofs! Surprisingly, making this video took a lot of work. Zero-knowledge proofs for coloring are one of those algorithms that, in hindsight, seem beautifu…
[A Federal Air Marshal (FAM) tasked with surveillance of an airline passenger targeted by Quiet Skies lists and/or rules followed the traveler out to the curb and recorded the license plate number of the vehicle in which she left the airport, so that her airline reservations could be integrated with license plate…
