Hasty Briefsbeta

All tags

#security

34 stories total

Bilingual

A peek into Reddit's anti-spam internals
23 days ago
- An unusual bug exposed internal Reddit spam removal reasons to a moderator in 2021.
- Spam removal systems include 'spamurai' (rules-based), 'spammit' (percentage scoring), and shadowbans.
- Domain bans and keyword filters (e.g., 'torenteu') are used to block spam links.
- Reddit uses the Perspective API to detect spam, but this API is being shut down in 2026.
- Spamurai logs extensive data: account age, karma, reports, ISP, user agent, TLS fingerprints, and more.
- URL inspection can follow redirects to detect banned patterns, leading to account bans.
- Anti-spam systems have evolved from CRM114 to REV1, Snooron, and REV2, likely using Lua rules.
- The author withheld details for years to avoid aiding spammers, but now sees the information as less critical due to API deprecation and LLMs.
Reddit will require you to log in to use old.reddit.com
20 days ago
- Reddit will require users to log in to access old.reddit.com starting next month.
- The change aims to reduce abusive scraping and automated traffic on the platform.
- Logged-out old.reddit.com is a significant source of abusive activity, but also important for long-time users.
- Logging in provides Reddit with more signals to detect rule-breaking accounts and block traffic.
- Some users may be upset as they prefer old.reddit.com for its familiar interface and privacy without logging in.
- Reddit claims old.reddit.com lacks modern security, making it more vulnerable to malicious traffic.
Tor’s Arti 2.5.0 Released: Stable Counter Galois Onion
20 days ago
- Arti 2.5.0 released with Counter Galois Onion marked as a stable feature.
- Congestion Control is now enabled in default builds to increase speed.
- Includes fixes for two medium-severity DoS security issues.
- Ongoing development for using Arti as a relay and directory authority.
- Minimum supported Rust version increased to Rust 1.91.
- Contains bugfixes, cleanups, and improvements across the codebase.
A Special Wireless-Free Nikon Camera Is Publicly Available for the First Time
a month ago
- Nikon Z6 III (No Wireless Connectivity) is now publicly available through retailers.
- Camera lacks Wi-Fi and Bluetooth chips due to security needs for government and industrial clients.
- Priced higher ($3,079.95 MSRP) than standard Z6 III despite fewer features.
- Higher cost due to specialized, limited manufacturing and assembly modifications.
- Nikon offers it to evaluate market demand for similar future products.
The pandemic of incomplete OpenSSL error handling
16 days ago
- A bug report for APT highlighted TLS failures on FIPS systems due to MD5 errors, suggesting use of ERR_clear_error() around TLS operations.
- The author opposes this as a bad practice, arguing that discarding unrelated errors is unsafe and that the root cause should be fixed instead.
- ERR_clear_error() is widely used as a best practice in many codebases, but it leads to a systemic issue of incomplete error handling.
- Another anti-pattern involves checking top-level errors after OpenSSL operations and discarding them if deemed not severe, which also silences unrelated errors.
- Developers are encouraged to inspect code for ERR_clear_error() calls and consider using ERR_set_mark() for safer error stack management.
- A call is made to OpenSSL authors to avoid promoting practices that compromise security and trust in software.
Be a Hikikomori for Science
16 days ago
- Nvidia introduces a datacenter financing scheme to generate revenue from multiple streams.
- Companies are increasing both AI implementation and hiring, but this may not align with business objectives.
- SoftBank enters the GPU rental market to utilize its extensive US server farm for AI training.
- The UN emphasizes the need for global governance to prevent risks from rapidly advancing AI capabilities.
- Oracle outlines potential risks in its heavy investment in AI, highlighting numerous risk factors.
- Russian actors are impersonating Signal support for phishing attacks; the US disrupts Iranian propaganda sites.
- Microsoft's patches fail to fix vulnerabilities in on-prem SharePoint, now targeted in zero-day attacks.
- DEF CON expands efforts to include hackers in hardening critical infrastructure through the Franklin project.
- EQT acquires a majority stake in Acronis at a valuation exceeding $3.5 billion, though specifics are unclear.
- Ten years after the first corporate ransomware, Mikko Hyppönen predicts continued threats, noting cybersecurity as a stable career.
- Collabora releases CODE 26.04 with new features like Markdown support and optional AI integration.
- GIMP 0.54 is revived in Flatpak form, offering a retro-computing experience with the original Motif interface.
- Bcachefs exits experimental status with performance improvements and increased Rust usage, but faces AI-related issues.
- France's digital sovereignty efforts struggle to reduce reliance on Microsoft, as seen in Nextcloud and Office challenges.
- The history of CentOS traces its evolution from a hobby project to a default enterprise OS after community collaboration.
- A Netflix developer open-sources Project Headroom, an app designed to significantly reduce AI-related costs.
Guix substitute and guix pull vulnerabilities
16 days ago
- Guix substitute utility has vulnerabilities enabling remote privilege escalation, store corruption, and file disclosure, affecting all systems regardless of root privileges.
- Exploitation requires downloading a binary substitute; any substitute server or MITM can attack, even with HTTPS, and local exploitation requires socket access.
- Guix pull and guix time-machine have a vulnerability allowing channel file control to create or overwrite files, mainly causing denial-of-service risks.
- Four specific vulnerabilities are detailed: restore-file not hardened, fetch-narinfos not verifying URLs, file:// URI issues, and cache-key misuse.
- Mitigation includes disabling substitutes with --no-substitutes, avoiding untrusted channels files, and updating to fixed commits via guix pull and daemon restart.
- Fixes involve hardening restore-file, verifying narinfos, restricting file:// URIs, and modifying cache-key derivation to prevent directory traversal.
- Upgrading instructions vary for Guix System and other distributions, emphasizing immediate updates and cautious substitute use during the process.
- Timeline shows discovery from May to June 2026, with coordinated disclosure and fixes via pull request #9665.
- A test script is provided to check vulnerability status, with code included for validation.
Secure Unix ancestor KSOS did type safety before Rust made it cool
14 days ago
- Nvidia introduces a datacenter financing scheme aimed at maximizing revenue through dual payment models.
- Research shows that companies integrating more AI technologies are also increasing their human workforce, though this does not always align with business objectives.
- SoftBank enters the GPU rental market to support AI training, leveraging its large US server farm infrastructure.
- The UN emphasizes the urgent need for global governance to prevent potential AI-related catastrophes, as technological advancements outpace regulatory frameworks.
- Oracle discloses various risk factors that could jeopardize its significant investments in AI.
- Russian actors are impersonating Signal support to conduct phishing attacks, while the US shuts down Iranian propaganda sites.
- Microsoft's recent patches failed to secure on-premises SharePoint, leaving it vulnerable to zero-day attacks, amid other security updates.
- DEF CON's Franklin project recruits hackers to enhance critical infrastructure security, expanding its scope to include the entire conference.
- EQT acquires a majority stake in Acronis, valuing the cybersecurity firm at over $3.5 billion.
- A decade after the first corporate ransomware attack, security expert Mikko Hyppönen predicts continued threats, highlighting infosec as a stable career choice.
- Collabora launches CODE 26.04 with new features like Markdown support and integrated AI, intensifying competition among FOSS office suites.
- GIMP 0.54 is revived via Flatpak, offering a nostalgic retro-computing experience with its original Motif interface.
- Bcachefs moves out of experimental status in a performance-focused release, incorporating more Rust but facing challenges with AI-generated content.
- France's push for digital sovereignty struggles to reduce reliance on Microsoft, as seen in efforts to transition from Office to alternatives like Nextcloud.
- The history of CentOS traces its evolution from a personal Linux project to a widely used enterprise OS, driven by community collaboration after Red Hat's shift.
- A Netflix developer creates and open-sources Project Headroom, an app designed to significantly reduce AI-related expenses.
NSA and IETF: Fairness
14 days ago
- NSA historically weakened cryptographic standards, including DES, RC4, and RSA-512, and sabotaged random number generators to enable exploitation.
- The IETF TLS working group is voting on an NSA-driven RFC for solo ML-KEM in TLS, risking widespread deployment despite security concerns.
- Opposition to solo ML-KEM is growing, with over 60 objections citing security risks, while proponents push for adoption with flawed arguments.
- IETF procedures show a pro-endorsement bias: repeated 'last calls' allow document advancement even with unresolved objections, favoring entities like NSA and defense contractors.
- Voting against the spec or staying silent has asymmetric consequences: opposition encourages discussion and delays potential security sabotage, while support risks immediate harm to millions of users.
GitHub cuts short offer to burn repos on CD after mockery ensues
14 days ago
- AI: Quantum computers and AI are being explored to solve fusion fuel issues, with simulations by the Department of Energy, Cleveland Clinic, and IBM.
- AI and ML: Software engineers can earn high salaries at fast-growing companies, despite AI's complex impact on the tech business.
- Software: Microsoft is restructuring commercial and Xbox teams, citing rapid global changes and the need to avoid complacency.
- AI and ML: AMD's Ryzen AI Halo facilitates local AI but is expensive, priced at $4K with 128 GB of memory.
- AI and ML: Nvidia introduces a double-dipping financing scheme for datacenters to maximize payments.
- Security: Russian phishing attacks impersonate Signal support, while the US targets Iranian propaganda and a marketing company raises data privacy concerns.
- Security: Microsoft patches fail to protect on-prem SharePoint from zero-day attacks, amid other security updates from China and Ring.
- Black Hat and DEF CON: DEF CON expands its Franklin project to include hackers in hardening critical infrastructure, with voting village successes.
- Security: EQT acquires a majority stake in Acronis at a $3.5B+ valuation, strengthening cybersecurity investments.
- Malware Month: Ten years after the first corporate ransomware, Mikko Hyppönen predicts ongoing threats but notes infosec as a stable career.
- FOSS: Collabora releases CODE 26.04 with Markdown support and AI integration, intensifying competition among open-source office suites.
- FOSS: GIMP 0.54 is revived via Flatpak for retro-computing, using the original Motif interface instead of GTK.
- FOSS: Bcachefs exits experimental status in a performance release, but faces challenges with AI-related issues.
- FOSS: France's digital sovereignty push struggles to move away from Microsoft, as shown by Nextcloud's rollout challenges.
- FOSS: The history of CentOS traces its evolution from a hobby project to a default enterprise OS after community efforts post-Red Hat.
- FOSS: Netflix creates and open-sources Project Headroom to reduce AI costs, offering potential savings for users.
Brit supermarket giant triples down on facial recog to nab shoplifters
14 days ago
- The Department of Energy, Cleveland Clinic, and IBM are simulating molten salts to address the fusion fuel dilemma, focusing on tritium production.
- Software engineers can earn high salaries at fast-growing companies, but AI's impact on the tech business is complex and varied.
- Microsoft is restructuring its commercial and Xbox teams, acknowledging rapid global changes and the need to avoid complacency.
- AMD's Ryzen AI Halo offers local AI capabilities but comes at a high cost of $4K, featuring 128 GB of memory.
- Nvidia has introduced a datacenter financing scheme that allows for double payments, enhancing revenue streams.
- Russian actors are conducting phishing attacks by impersonating Signal support, alongside US actions against Iranian propaganda and data security issues.
- Microsoft's patches failed to fix on-prem SharePoint, leaving it vulnerable to zero-day attacks, with additional updates on China's surveillance and Ring's policies.
- The DEF CON Franklin project engages hackers to strengthen critical infrastructure, expanding efforts based on successful voting village reports.
- EQT acquired a majority stake in Acronis at a valuation over $3.5 billion, though the exact portion sold is unspecified.
- Mikko Hyppönen notes that corporate ransomware persists after ten years, but cybersecurity remains a stable career choice.
- Collabora released CODE 26.04 with Markdown support, improved formula handling, and optional AI integration amid competition in FOSS office suites.
- GIMP 0.54 has been revived as a Flatpak, offering retro-computing nostalgia with its original Motif interface.
- Bcachefs has exited experimental status in a performance release, incorporating more Rust but facing challenges with AI-related issues.
- France's digital sovereignty efforts struggle to reduce Microsoft dependency, as seen in Nextcloud's rollout challenges with Office migration.
- The history of CentOS traces its evolution from a biochemist's hobby to an enterprise default, driven by community response to Red Hat's changes.
- A Netflix expert created and open-sourced Project Headroom, an app designed to significantly reduce AI-related costs.
Kernels: Major Updates
14 days ago
- Introduction of a new 'kernel' repository type on the Hugging Face Hub to cater to compute-specific needs, allowing users to browse accelerators, operating systems, and backend versions.
- Enhanced security measures including trusted kernel publishers, code signing with Sigstore's cosign for ephemeral keys, and reproducibility via Nix builds to prevent malicious kernel execution.
- Revamped CLI tools with better separation between kernels and kernel-builder, focusing on library functions versus building processes, and improved support for agentic kernel development workflows.
- Extended framework and backend coverage, such as Torch Stable ABI support and Apache TVM FFI integration, enabling cross-framework kernel interoperability.
- Foundation for agentic kernel development with tools for scaffolding, building, benchmarking, and optimizing kernels via HF Jobs integration for performance testing across hardware configurations.
- Miscellaneous updates including an easier environment setup script, system cards for kernels, compatibility checks via has_kernel() and get_kernel_variants(), and improved manylinux_2_28 support to resolve libstdc++ linking issues.
You shouldn't trust Trusted Publishing
13 days ago
- Trusted Publishing is an authentication scheme for machine-to-machine trust, not for human trust in package safety.
- It uses OIDC to link CI/CD machine identities to package indexes, issuing short-lived, scoped publishing credentials.
- PyPI avoids displaying Trusted Publishing status prominently to prevent misuse as a trust signal for package quality.
- Trusted Publishing reduces long-lived credentials but can still be compromised if CI/CD workflows are attacked.
- The scheme is optional and does not guarantee package safety; anyone can use it, including for malicious uploads.
- Attestations on PyPI are separate from Trusted Publishing and also do not imply end-user trust without independent verification.
Zombie 'who owns Unix?' lawsuit comes alive again
13 days ago
- South Korean chip startup FuriosaAI expands into European datacenters with Equinix in Lisbon.
- Enterprise AI faces security issues, with most reporting incidents or vulnerabilities.
- Quantum computers and AI being explored for fusion fuel solutions by Department of Energy, Cleveland Clinic, and IBM.
- Software engineers earn high salaries in fast-growing companies despite AI's complex impact.
- Microsoft restructures commercial and Xbox teams, citing rapid change and challenges.
- Russian phishing attacks impersonate Signal support, while US targets Iranian propaganda.
- Microsoft patches fail to fix on-prem SharePoint zero-day attacks, and China enhances surveillance.
- DEF CON's Franklin project involves hackers in critical infrastructure protection, expanding scope.
- EQT acquires majority stake in Acronis at over $3.5 billion valuation.
- Ransomware persists after a decade, but infosec offers stable career opportunities.
- Collabora releases CODE 26.04 with Markdown and AI features, competing in FOSS office suites.
- GIMP 0.54 revived in Flatpak for retro-computing, using Motif instead of GTK.
- Bcachefs exits experimental status with performance improvements and Rust integration.
- France's digital sovereignty push struggles against Microsoft's dominance, as seen in Nextcloud rollout.
- CentOS history: From a hobby project to enterprise default, aided by community after Red Hat's shift.
- Netflix engineer creates open-source app Project Headroom to reduce AI costs.
Windows is watching: Anti-piracy tool fingers Scattered Spider suspect
13 days ago
- South Korean chip startup FuriosaAI is expanding into European datacenters with its RNGD accelerators at Equinix's Lisbon facilities.
- Enterprise AI adoption is facing security challenges, with a majority reporting incidents or vulnerabilities.
- Researchers are using quantum computers and AI to tackle fusion fuel issues, with institutions like the DOE and IBM simulating molten salts for tritium production.
- Software engineers can earn high salaries at fast-growing companies, though AI's impact on the tech business is complex.
- Microsoft is restructuring its commercial and Xbox teams, acknowledging rapid global changes and the need to avoid complacency.
- Phishing attacks involving Russians posing as Signal support are occurring, alongside US takedowns of Iranian propaganda sites.
- Microsoft's patches for on-prem SharePoint failed, leaving it vulnerable to zero-day attacks, amid other security updates.
- DEF CON's Franklin project is engaging hackers to strengthen critical infrastructure, with the event now fully incorporating these efforts.
- EQT has acquired a majority stake in Acronis, valuing the cybersecurity company at over $3.5 billion.
- Despite a decade of corporate ransomware, there's no end in sight, but cybersecurity remains a stable career option.
- Collabora's CODE 26.04 release enhances FOSS office suites with Markdown support and AI integration, though AI is off by default.
- GIMP 0.54 has been revived as a Flatpak for retro-computing enthusiasts, using Motif instead of GTK.
- Bcachefs has left experimental status with a performance-focused release, incorporating more Rust but facing AI-related issues.
- France's push for digital sovereignty struggles to move users away from Microsoft products, as shown by Nextcloud rollouts.
- CentOS evolved from a biochemist's hobby into a default enterprise OS after community efforts post-Red Hat's shift.
- Netflix engineer open-sourced Project Headroom, an app designed to significantly reduce AI-related costs.
China tells devs to ditch Claude Code over 'backdoor code' fears
12 days ago
- AI models are becoming more affordable, but luxury frontier models still stand out.
- Inference is becoming a commodity in AI, except for advanced frontier models.
- FuriosaAI, a South Korean chip startup, expands into European datacenters in Lisbon.
- Many enterprises report AI-related security incidents due to rushed adoption.
- Researchers use quantum computers and AI to tackle fusion fuel challenges, like tritium production.
- Software engineers can earn high salaries at fast-growing companies despite AI's complex impact.
- Russian attackers pose as Signal support for phishing, while US targets Iranian propaganda sites.
- Microsoft patches fail to fix SharePoint zero-day vulnerabilities, with other security updates mentioned.
- DEF CON's Franklin project engages hackers to strengthen critical infrastructure, expanding its scope.
- EQT acquires a majority stake in Acronis at a valuation over $3.5 billion.
- Ransomware persists after a decade, but cybersecurity offers stable career prospects.
- Collabora's CODE 26.04 enhances FOSS office suites with Markdown and AI features, default-off.
- GIMP 0.54 is revived via Flatpak, appealing to retro-computing enthusiasts with Motif.
- Bcachefs exits experimental phase with performance improvements but faces AI-related issues.
- France's digital sovereignty push struggles against Microsoft dominance in office software.
- CentOS evolved from a hobby project to a default enterprise OS after community support.
- Netflix engineer open sources Headroom app to reduce AI costs for users.
Is It Safe to Host HTML That Runs Its Own JavaScript?
11 days ago
- ShareMyPage hosts arbitrary HTML and JavaScript without sanitization.
- Pages run in a sandboxed iframe with a null origin, blocking cookie and storage access.
- Content is served from a separate, cookieless origin with no session data.
- Multiple security layers ensure no single point of failure.
- Isolation protects users and the platform from malicious code, but does not address content moderation.
Orbital datacenter gold rush needs an environmental review, FCC told
10 days ago
- Microsoft's emissions rise due to AI-driven datacenter expansions.
- OpenAI's GPT-Live improves real-time conversational AI capabilities.
- SpaceXAI rebrands to offer legal and Excel-related AI services.
- SambaNova's heterogeneous compute platform boosts AI performance with Nvidia GPUs.
- Former GitHub CEO launches a new coding platform for AI era.
What xAI's Grok Build CLI Actually Sends to xAI
9 days ago
- Grok Build CLI transmits the contents of files it reads, including secrets in .env files, unredacted to xAI via POST /v1/responses and POST /v1/storage.
- Grok uploads the entire repository, including unread files and git history, to Google Cloud Storage bucket 'grok-code-session-traces' at multi-GB scale, independent of model usage quotas.
- The upload mechanism is active by default, not disabled by the 'Improve the model' toggle, and not explicitly documented in the CLI's setup materials.
Theo de Raadt: "You've been smoking something mind altering" (2007)
8 days ago
- Virtualization adds another kernel layer with potential new bugs.
- It relies on x86 architecture that has poor page protection.
- Claims that virtualization provides security benefits are misguided.
- Software engineers struggle with secure OS and application development.
- Expecting flawless virtualization layers is unrealistic.

firstprev0next

About|Login

#security

A peek into Reddit's anti-spam internals

Reddit will require you to log in to use old.reddit.com

Tor’s Arti 2.5.0 Released: Stable Counter Galois Onion

A Special Wireless-Free Nikon Camera Is Publicly Available for the First Time

The pandemic of incomplete OpenSSL error handling

Be a Hikikomori for Science

Guix substitute and guix pull vulnerabilities

Secure Unix ancestor KSOS did type safety before Rust made it cool

NSA and IETF: Fairness

GitHub cuts short offer to burn repos on CD after mockery ensues

Brit supermarket giant triples down on facial recog to nab shoplifters

Kernels: Major Updates

You shouldn't trust Trusted Publishing

Zombie 'who owns Unix?' lawsuit comes alive again

Windows is watching: Anti-piracy tool fingers Scattered Spider suspect

China tells devs to ditch Claude Code over 'backdoor code' fears

Is It Safe to Host HTML That Runs Its Own JavaScript?

Orbital datacenter gold rush needs an environmental review, FCC told

What xAI's Grok Build CLI Actually Sends to xAI

Theo de Raadt: "You've been smoking something mind altering" (2007)