571
The need for memory safety standards
For decades, memory safety vulnerabilities have been at the center of various security incidents across the industry, eroding trust in technology and costing billions. T…
572
Apple software update “bug” enables Apple Intelligence
Some people who had previously disabled Apple Intelligence in macOS 15.3 and iOS 18.3 saw it re-enabled after updating to macOS 15.3.1 and iOS 18.3.1 today. In fact I personally have two different Apple silicon Macs running macOS Sequoia, and after I updated both Macs to 15.3.1, Apple Intelligence was re-enabled on my…
573
Benchmarking leading AI agents against Google reCAPTCHA v2
We evaluate three leading AI models—Claude Sonnet 4.5, Gemini 2.5 Pro, and GPT-5—on their ability to solve Google reCAPTCHA v2 challenges and find significant performance differences, with success rates ranging from 28% to 60%.
574
Mozilla says it's finally done with Onerep
In March 2024, Mozilla said it was winding down its collaboration with Onerep — an identity protection service offered with the Firefox web browser that promises to remove users from hundreds of people-search sites — after KrebsOnSecurity revealed Onerep’s founder had created dozens of people-search services and was…
575
Anticheat Update Tracking
A few years ago when I was into reverse engineering and binary analysis (and game modding), I did a lot of research into anticheats work. I was curious about tracking their updates, since that would allow me to:
576
Europe's Digital Sovereignty Paradox – "Chat Control" Update
Can you build tech independence while breaking encryption?
577
NSPM-7 labels common beliefs as terrorism 'indicators'
New directive targets “anti-Christian,” “anti-American,” and “anti-capitalism” opinions
578
Tor Browser 15.0
Tor Browser 15.0 is now available, featuring an update to Firefox ESR 140, improvements to tab management and the address bar on desktop, and screen lock for Android.
579
Stopping bad guys from using my open source project (feedback wanted)
I maintain a sorta-popular open source package, and I want to prevent big corporations and "bad guys" from using it. I want feedback on how to do this.
580
Platforms systematically removed a user because he made "most wanted CEO" cards
On December 14, James Harr, the owner of an online store called ComradeWorkwear, announced on social media that he planned to sell a deck of “Most Wanted CEO” playing cards, satirizing the infamous “Most-wanted Iraqi playing cards” introduced by the U.S. Defense Intelligence Agency in 2003. Per the...
581
Can you use GDPR to circumvent BlueSky's adult content blocks?
In the battle between the Online Safety Act and GDPR, who will win? FIGHT! I'll start by saying that I'm moderately positive on Online Safety. If services don't want to provide moderation then they shouldn't let their younger users be exposed to harm. The social network BlueSky has taken a pragmatic approach to this…
582
The double standard of webhook security and API security
Explore the surprisingly different security standards we apply to webhooks versus traditional API requests.
583
A Reverse Engineer's Anatomy of the macOS Boot Chain and Security Architecture
1.0 The Silicon Root of Trust: Pre-Boot & Hardware Primitives The security of the macOS platform on Apple Silicon is not defined by the kernel; it is d...
584
Leeks and Leaks
On the completely impossible situation of blocking the Tor .onion TLD to avoid leaks, but at the same time not block it to make users able to do what they want. dot-onion leaks The onion TLD is a Tor specific domain that does not mean much to the world outside of Tor. If you try … Continue reading Leeks and leaks →
585
Critical vulnerability in AI coding platform Base44 allowing unauthorized access
New discovery underscores security implications of AI-powered development and the rise of Vibe Coding Platforms.
586
587
Could the XZ backdoor been detected with better Git/Deb packaging practices?
The discovery of a backdoor in XZ Utils in the spring of 2024 shocked the open source community, raising critical questions about software supply chain security. This post explores whether better Debian packaging practices could have detected this threat, offering a guide to auditing packages and suggesting future…
588
A Sneaky Phish Just Grabbed My Mailchimp Mailing List
You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported
589
Why cryptography is not based on NP-complete problems
Cryptographic schemes are based on the computational difficulty of solving some ‘hard’ problem. For example, RSA (specifically, RSA-2048) is based on the difficulty of a problem like this:
590
Mullvad VPN present And Then? (Chat Control is back on the menu)
Chat Control is back on the menu. To highlight the corruption behind the proposal, Mullvad VPN now presents "And Then?"
591
Take It Down Act: A Flawed Attempt to Protect Victims That'll Lead to Censorship
Congress has begun debating the TAKE IT DOWN Act (S. 146), a bill that seeks to speed up the removal of a troubling type of online content: non-consensual intimate imagery, or NCII. In recent years, concerns have also grown about the use of digital tools to alter or create such images, sometimes...
592
Self-Signed JWTs
An auth scheme where you let yourself in.
593
Demonstrably Secure Software Supply Chains with Nix
Discover how Nix can revolutionize your software supply chain security, enabling verifiable integrity and offline rebuilds from source.
594
Mac app launches slowed by malware scan (2024)
I've always attributed slow Xcode launches to Xcode simply sucking, but I've noticed that the FileMerge app frequently launches slowly too. When this happens, the app can take a dozen bounces in the Dock before finally opening. FileMerge resides in the folder Xcode.app/Contents/Applications/ within the Xcode bundle…
595
I fear for the unauthenticated web
LLM and AI companies seem to all be in a race to breathe the last breath of air in every room they stumble into. This practice started with larger websites, ones that already had protection from ma...
596
Another Conflict Between Privacy Laws and Age Authentication–Murphy v Confirm ID
This opinion is a routine ruling over TOS formation and whether disputes must go to arbitration. However, before I dig into that question, I need to note the case’s chilling implications. * * * This case involves the Adult Friend...
597
598
You cannot have our user's data
sourcehut is a network of useful open source tools for software project maintainers and collaborators, including git repos, bug tracking, continuous integration, and mailing lists.
599
TeleMessage Explorer: a new open source research tool
I've spent the last week or two writing code to make sense of the massive hack of data from TeleMessage, the comically insecure company that makes a modified Signal app that Trump's former national security advisor Mike Waltz was caught using. I've decided to publish my code
600
Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Fingerprinting
In an attempt to combat user tracking, both privacy-aware browsers (e.g., Tor) and email applications usually disable JavaScript. This effectively closes a major angle for user fingerprinting. However, recent findings hint at the potential for privacy leakage through selected Cascading Style Sheets (CSS) features…