software security

Bilingual

How to Generate Secure License Keys in 2026
2 months ago
- Software licensing faces two main attack vectors: cracking (direct code modification) and keygens (generating valid keys by reverse-engineering algorithms).
- Partial Key Verification (PKV) is a legacy algorithm that eventually leaks all subkey parameters, making it insecure by design.
- Modern cryptographic algorithms like Ed25519 (elliptic-curve) and RSA-2048 provide asymmetric signing, preventing key forgery.
- Cryptographic license keys embed data (e.g., email) and a signature, verified using a public key embedded in the application.
- RSA keys are larger but widely supported; Ed25519 offers smaller keys but may have less language support.
- Even with modern cryptography, applications remain vulnerable to cracking, but key generation cannot be compromised without breaking the crypto.
- A licensing server can extend cryptographic keys to support complex models like entitlements, node-locking, and device trials.
Cull your dependencies
2 months ago
- - The Log4J vulnerability serves as a cautionary tale, demonstrating how a widely used logging library (168,000 lines of code) can introduce critical security risks.
- - Dependencies accumulate enormous amounts of code (often >1M lines) with an estimated 15–50 bugs per 1,000 lines, leading to thousands of potential issues in imported code.
- - Developers often import full libraries to avoid writing small utility functions, adding unnecessary bloat and unknown code quality.
- - There is a false assumption that packages from official package managers are inherently high quality and secure, despite being maintained by volunteers with no required checks.
- - Dependencies become entrenched and proliferate due to assumed best practices, making removal difficult and causing vulnerabilities to silently accumulate.
- - Poor tooling for detecting unused dependencies leads to stale packages persisting as bloat.
- - Proposed rules: avoid adding dependencies, require explicit justification and logging for each addition, and standardize on a single utility package.
A 2024 Plea for Lean Software (with running code) - Bert Hubert's writings
2 months ago
- Software today is excessively bloated, with 350MB packages and 1,600 dependencies, leading to serious security risks.
- Security is dire due to vast attack surfaces, poor code quality, and logic bugs; even top companies like Apple and Google make critical mistakes.
- Economic incentives favor speed over security, but legislation like the EU's Cyber Resilience Act may force vendors to prioritize software quality.
- The author created Trifecta, a minimal image-sharing tool with 1,600 lines of code and few dependencies, proving that lean, modern software is still possible.
- Reducing the amount of code shipped, inspecting dependencies, and prioritizing simplicity over complexity are key to improving software security.
Interstitial risk: when two secure systems make one vulnerable one
2 months ago
- Interstitial vulnerabilities exist in the spaces between software components, which traditional scanning methods (SAST/DAST) and even LLMs often miss.
- These vulnerabilities arise when assumptions between components become misaligned, such as during rewrites or system splits, without any changes to the API on paper.
- Examples include type mismatches after a language rewrite (e.g., Python to Rust) and auth checks that vanish when a monolith is split, both leading to security gaps.
- Common patterns include timeout/retry drift, serialization mismatches, error-code remapping, and message-ordering assumptions, all locally correct but insecure in combination.
- Root causes include product evolution, lost tribal knowledge, team changes, and polyglot type system mismatches, exacerbated by organizational inertia and past approvals.
- Existing solutions like contract testing, threat modeling, CSPM, and pentests are insufficient as they don't continuously fuzz live contracts at seams.
- Mitigation involves explicit interface specs, adversarial contract testing for rewrites, boundary fuzzing, and clear ownership of contracts via RACI.
- AI-assisted rewrites worsen interstitial risks by increasing the speed and frequency of context-lost changes, making contract vigilance more critical.
- The author is developing a tool to detect these issues, highlighting the need for systematic, continuous monitoring of interstitial spaces.
North Korean Hackers Compromise Go and PHP Packages
2 months ago
- PolinRider is a DPRK-linked supply-chain campaign that takes over legitimate GitHub accounts and injects obfuscated JavaScript loaders into repositories.
- Initially confined to GitHub, the campaign expanded to multiple package ecosystems including Packagist, Go modules, npm, and PyPI without evolving its malware.
- Ecosystems like Go and Packagist are particularly vulnerable because they resolve packages directly from Git repos, making GitHub account takeovers equivalent to publishing access.
- The malware uses methods such as appending JavaScript to config files, fake .woff2 font files, .vscode/tasks.json triggers, and typosquatted npm dependencies.
- Payloads are distributed via blockchain dead-drops (e.g., TRON, Aptos) and lead to Lazarus toolkit implants like Beavertail and InvisibleFerret for credential theft and C2.
- Git history is rewritten using scripts like temp_auto_push.bat to hide tampering, preserving original timestamps through force-pushed commits.
- Defenders should audit registry publication history against repo modifications, enforce strong GitHub security (e.g., MFA), and scan for IOCs like hidden JavaScript and malicious tasks.json.
- While npm and PyPI are less susceptible due to separate publishing credentials, PolinRider still publishes malicious packages from scratch in those ecosystems.
Lean Software Scaling Laws
3 months ago
- Proposal to measure how coding LLM perplexity scales with codebase context size, using Lean as a test case for formal languages.
- Aim to estimate scaling laws of 'predictability' by programming language, translating to security and safety improvements in software.
- Lean may have worse baseline performance but better scaling exponents, suggesting long-term benefits for program correctness and cybersecurity.
- Methodology involves empirical measurement via frozen LLMs, corpus construction, loss measurement, and scaling law fitting per language.
- Prediction: 'Weak' languages like Python excel at small scales but have worse scaling exponents, while 'strong' languages like Lean cross over at larger scales.
- Bias controls needed for programmer and domain differences; context learning and failure modes like ecosystem maturity effects are considered.

software security

How to Generate Secure License Keys in 2026

Cull your dependencies

A 2024 Plea for Lean Software (with running code) - Bert Hubert's writings

Interstitial risk: when two secure systems make one vulnerable one

North Korean Hackers Compromise Go and PHP Packages

Lean Software Scaling Laws