Hasty Briefsbeta

All tags

#security

683 stories total

Bilingual

FAA closes airspace around El Paso, Texas, for 10 days, grounding all flights
3 months ago
- FAA closes airspace around El Paso International Airport for 10 days due to 'special security reasons'.
- All flights (commercial, cargo, general aviation) grounded from late Tuesday through Feb. 20.
- Travelers advised to contact airlines for updated flight information.
- Closure expected to cause significant disruptions in the El Paso metro area (population ~700,000).
- El Paso is a key cross-border commerce hub with Ciudad Juarez, Mexico.
- Airport serves as a gateway to west Texas, southern New Mexico, and northern Mexico.
- Major airlines like Southwest, United, American, and Delta operate at the airport.
Show HN: Solnix – an early-stage experimental programming language
3 months ago
- Solnix is a verifier-safe programming language designed for Linux kernel security, specifically for writing eBPF security policies.
- It prioritizes safety, auditability, and predictable behavior under the Linux kernel verifier.
- Solnix supports Linux Security Modules (LSM), XDP, TC, and tracing policies with a clean high-level syntax.
- Key features include native eBPF performance, kernel verifier compliance, structured high-level syntax, and concurrency-safe operations.
- Example use case: Block execution of forbidden binaries using LSM with a deny list.
- Design principles focus on compile-time guard checks, bounded memory access, and security-focused abstractions.
I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)
3 months ago
- OpenClaw gained popularity as a personal AI assistant but faced security issues due to default public internet exposure.
- Security concerns with OpenClaw included accidental exposure of shell, browser automation tools, and API keys.
- The author built a secure personal AI agent using Blink (agent platform) and Tailscale (security layer) on a Mac Mini.
- Blink provides isolated containers for each agent, ensuring separation of tasks and credentials.
- Tailscale ensures the system is invisible to the public internet, requiring cryptographic authentication for access.
- The setup includes specialized agents for business and personal tasks, improving response quality and security.
- Blink supports multi-channel messaging (Telegram, SMS, WhatsApp) with lightweight adapters for each platform.
- Cost-effective with minimal ongoing expenses: ~$19/month for Mac Mini, ~$1.50 for electricity, and $5-15 for AI model usage.
- Key security features: no public internet exposure, isolated containers, cryptographic authentication, and granular permissions.
- The entire system was built in two weeks using open-source tools, emphasizing security from the start.
Inspecting the Source of Go Modules
3 months ago
- Go's Checksum Database ensures package integrity by storing cryptographic hashes of module versions.
- The decentralized nature of Go modules allows fetching directly from origin, but the Checksum Database prevents tampering.
- GitHub's web interface can display incorrect code due to mutable tags, unlike the Go tooling which verifies checksums.
- A typosquatting attack exploited GitHub's mutable tags to hide malicious code behind innocent-looking commits.
- Solutions include using `go mod download` to fetch correct source and upcoming `go mod verify -tag` for local verification.
- Alternative services like pkg.geomys.dev provide verified source viewing with additional features.
- Future plans include optional proof checking for module zip files once CORS issues are resolved.
- Geomys, supported by companies like Ava Labs and Teleport, funds sustainable open-source Go maintenance.
- Recommendation against `GOPROXY=direct` to reduce attack surface from direct git clones.
Case 5-2026: An 18-Year-Old Woman with Headache and Hypertension - PubMed
3 months ago
- Official U.S. government websites use .gov or .mil domains.
- Ensure the site is secure (https://) before sharing sensitive information.
- Secure sites encrypt and transmit data safely.
What Your Bluetooth Devices Reveal About You
3 months ago
- Bluehood is a Bluetooth scanner built to analyze and track nearby devices, revealing personal information leaked via Bluetooth signals.
- Bluetooth devices constantly broadcast presence, allowing tracking of daily patterns, device correlations, and exact times people are home or away.
- Many devices, including medical implants and vehicles, don't allow users to disable Bluetooth, leading to involuntary data exposure.
- Privacy-focused tools like Briar and BitChat require Bluetooth, creating a tension between privacy protection and data exposure.
- Bluetooth metadata can reveal behavioral patterns, such as house occupancy, delivery schedules, and shift work, posing privacy risks.
- Bluehood features passive scanning, device classification, pattern analysis, and a web dashboard, running on any device with Bluetooth.
- The tool is educational, demonstrating how easily personal data can be collected with basic hardware and minimal effort.
- Awareness of Bluetooth exposure helps users make informed decisions about enabling or disabling it based on necessity versus convenience.
CURL's Daniel Stenberg: AI slop is DDoSing open source
3 months ago
- Daniel Stenberg, creator of cURL, discusses AI's dual impact on open source: enabling bogus security reports and uncovering deep bugs.
- cURL's bug bounty program was overwhelmed by AI-generated 'slop' reports, leading to its shutdown to remove financial incentives for low-quality submissions.
- AI tools have helped cURL find and fix over 100 bugs, reasoning across protocols and specs in ways traditional tools couldn't.
- Stenberg uses AI review bots for pull requests but remains skeptical of AI-generated production code, likening AI suggestions to an 'eager junior'.
- AI-generated contributions don't change cURL's legal risk model, as the project has always trusted contributors' rights to submit code.
- Stenberg highlights the broader open source challenge: large companies using AI to find bugs but not providing patches or funding for fixes.
- He urges projects to experiment with defenses against spammy AI reports and scrapers, suggesting vetted-reporter 'secret clubs'.
- Stenberg's message emphasizes human choice in using AI for good (improving security) or bad (flooding projects with low-quality reports).
Running NanoClaw in a Docker Shell Sandbox
3 months ago
- Docker Sandboxes introduces a new shell sandbox type for running personal AI assistants like NanoClaw securely.
- The shell sandbox provides an isolated Ubuntu environment with Node.js, Python, git, and common dev tools.
- Running NanoClaw in a Docker sandbox adds layers of security: filesystem isolation, credential management, clean environment, and disposability.
- Prerequisites include Docker Desktop, Docker Sandboxes CLI, and an Anthropic API key.
- Steps to set up include creating a sandbox, connecting to it, installing Claude Code, configuring the API key, and setting up NanoClaw.
- The shell sandbox can also run other AI-powered bots, automation scripts, and experimental tools securely.
- Management commands include listing, stopping, starting, and removing sandboxes.
Password managers' promise that they can't see your vaults isn't always true
3 months ago
- Password managers have become widely adopted, with 36% of US adults using them.
- Top password managers use 'zero knowledge' encryption to protect user data.
- Claims of unbreakable security by Bitwarden, Dashlane, and LastPass are challenged by new research.
- Research shows vulnerabilities in password managers, especially during account recovery or shared vault scenarios.
- Cloud-based vaults offer convenience, but some users prefer memorizing passwords or DIY solutions.
- Security measures can be bypassed with physical attacks, like the '$5 wrench attack'.
Cryptographic Issues in Matrix's Rust Library Vodozemac
3 months ago
- Matrix's Olm library had multiple side-channel vulnerabilities, which were not fixed despite disclosure.
- Matrix.org's security team failed to notify alternative clients about vulnerabilities and mishandled the disclosure process.
- Vodozemac, Matrix's Rust library, contains cryptographic vulnerabilities, including accepting the identity element in Diffie-Hellman, leading to zero security.
- Downgrade attacks from V2 to V1 in Vodozemac reduce security by truncating HMAC outputs to 64 bits.
- Miscellaneous issues in Vodozemac include weak ECIES CheckCode, silent dropping of message keys, deterministic IV in pickle format, and disabled security checks under fuzzing.
- Matrix's cryptography lacks expertise, with repeated vulnerabilities found in both libolm and Vodozemac.
- Matrix's leadership has not shown humility or willingness to learn from past security issues.
- Audits of Matrix's cryptography have not led to sufficient improvements, with known issues remaining unaddressed.
- Matrix's security flaws make it a risky choice for secure communication, comparable to other poorly secured platforms like Twitter's X Chat.
NUZOLVENCE (zoliflodacin) - PubMed
3 months ago
- The .gov domain indicates an official United States government website.
- Federal government websites typically end in .gov or .mil.
- Always verify the site is federal before sharing sensitive information.
- A secure connection (https://) ensures encryption and secure data transmission.
One Pivotal Trial, the New Default Option for FDA Approval - Ending the Two-Trial Dogma - PubMed
3 months ago
- Official U.S. government websites use .gov or .mil domains.
- Verify the site is federal before sharing sensitive information.
- Secure sites use https:// to encrypt and protect data transmission.
Biting the Tail of CAR-T for Relapsed Multiple Myeloma - PubMed
3 months ago
- The .gov domain indicates an official United States government website.
- Federal government websites typically end in .gov or .mil.
- Always ensure you're on a federal government site before sharing sensitive information.
- A secure connection (https://) confirms the site's authenticity and encrypts transmitted data.
Lessons learned from `oapi-codegen`'s time in the GitHub Secure Open Source Fund
3 months ago
- oapi-codegen participated in GitHub's Secure Open Source Fund to enhance project security.
- The project generates Go code from OpenAPI specs, handling sensitive data, making security crucial.
- Maintaining oapi-codegen alone has been challenging, prompting efforts to expand the maintainer pool.
- Security measures were prioritized to ensure safe collaboration with new maintainers.
- Identified security gaps and implemented improvements like security policies and GitHub Advanced Security checks.
- Engaged with a community of maintainers for shared learning and support.
- GitHub's program provided valuable resources and expertise to improve project security.
- Future plans include sharing more learnings and continuing to enhance security and maintenance.
Escaping Misconfigured VSCode Extensions (2023)
2 months ago
- Disclosure of vulnerabilities in VSCode extensions and VSCode itself, including CVE-2022-41042 with a $7,500 bounty.
- Exploration of VSCode Webviews and their security model, including sandboxing and communication mechanisms.
- Three vulnerabilities identified: HTML/JavaScript injection in SARIF viewer, HTML/JavaScript injection in Live Preview, and path traversal in Live Preview's local HTTP server.
- Exploitation techniques include DNS prefetching for file exfiltration, srcdoc iframes for JavaScript execution, and DNS rebinding for remote attacks.
- Recommendations for securing VSCode Webviews, emphasizing CSP restrictions, localResourceRoots configuration, and secure postMessage handlers.
Carelessness versus Craftsmanship in Cryptography
3 months ago
- Two AES libraries, aes-js and pyaes, provide a default IV in their AES-CTR API, leading to key/IV reuse bugs affecting thousands of projects.
- Reusing key/IV pairs in AES-CTR or GCM mode can lead to serious security issues, including plaintext recovery and brittle encryption.
- aes-js and pyaes lack modern cipher modes like AES-GCM and AES-GCM-SIV, making them vulnerable to attacks.
- Both libraries are vulnerable to side-channel attacks and have not been updated since 2017-2018.
- The maintainer of aes-js dismissed a serious security concern with a casual response, highlighting carelessness.
- strongSwan's strongMan VPN Manager was found to be vulnerable due to pyaes's default IV, but the maintainer responded with a model security fix.
- The fix for strongMan included replacing pyaes with a modern library, using GCM-SIV, and adding per-entry key derivation.
- The difference between carelessness and craftsmanship lies in how developers respond to mistakes, with strongMan exemplifying the latter.
Lexega Turns SQL into Signals
2 months ago
- Lexega transforms SQL into deterministic signals for policy enforcement.
- It tokenizes, parses SQL, extracts semantic facts, and emits signals.
- Signals describe actions like unbounded writes or policy changes.
- Rules match signals to assign severity and messaging.
- Policies decide enforcement actions like block, warn, or allow.
- Lexega handles semantic diffing to catch high-risk SQL changes.
- Supports Jinja/dbt-templated SQL with context-aware rendering.
- Custom rules can be defined in YAML for org-specific risks.
- Deterministic analysis ensures repeatability and auditability.
- CI-friendly decisions with machine-readable outputs.
The History of a Security Hole
2 months ago
- A user process on 32-bit i386 OpenBSD 6.3 could crash the OS due to a security hole allowing access to I/O ports.
- The issue traces back to the Intel 80386's I/O permission bit map (IOPB) design, added late in the 386's development.
- The IOPB was intended to allow per-task I/O port access permissions but was poorly documented and implemented.
- OpenBSD and NetBSD had bugs in their Task State Segment (TSS) handling, leading to unintended I/O port access.
- OpenBSD's fix in 2000 inadvertently expanded the IOPB size, allowing access to more ports than intended.
- In 2016, OpenBSD removed IOPB-related APIs but left a critical bug, allowing user processes to access many I/O ports.
- The bug was fixed in OpenBSD 6.2 and 6.3 by correctly setting the TSS limit to exclude the IOPB.
- Other OSes like Windows and OS/2 handle the IOPB differently, often setting the IOPB offset past the TSS limit.
- The saga highlights the dangers of incomplete documentation, complex hardware design, and subtle programming errors.
Antigenic Drift and Antivaccine Shift in the 2025-2026 Influenza Season - PubMed
2 months ago
- Official U.S. government websites use .gov or .mil domains.
- Verify the site is a federal government site before sharing sensitive information.
- Secure sites use https:// to encrypt and protect transmitted data.
Unicode's confusables.txt and NFKC normalization disagree on 31 characters
2 months ago
- Homoglyph attacks exploit visually identical characters from different scripts, like Cyrillic 'а' vs. Latin 'a'.
- Unicode's confusables.txt provides a defense by mapping ~6,565 characters to their visual equivalents.
- NFKC normalization collapses compatibility variants (e.g., fullwidth letters → ASCII) and is recommended for slug validation.
- 31 characters in confusables.txt conflict with NFKC normalization, mapping to different Latin letters/digits.
- Example: Long S (��) is mapped to 'f' by confusables.txt (visual) but to 's' by NFKC (semantic).
- Capital I variants (16) are mapped to 'l' by confusables.txt but normalize to 'i' via NFKC.
- Digit 0 variants (7) are mapped to 'o' by confusables.txt but normalize to '0' via NFKC.
- Digit 1 variants (7) are mapped to 'l' by confusables.txt but normalize to '1' via NFKC.
- The conflict arises because confusables.txt focuses on visual resemblance, while NFKC focuses on semantic meaning.
- A naive pipeline combining both may have dead code (31 entries) or incorrect results if stages are reversed.
- Solution: Filter confusables.txt to exclude NFKC-handled characters, reducing entries from ~6,565 to ~613.
- Recommended pipeline: NFKC → NFKC-aware confusable map → mixed-script rejection.
- Documentation gap: Unicode standards don't address the interaction between confusables.txt and NFKC.
- A generator script automates creating an NFKC-aware confusable map, ensuring reproducibility across Unicode versions.

first prev29next

About|Login

#security

FAA closes airspace around El Paso, Texas, for 10 days, grounding all flights

Show HN: Solnix – an early-stage experimental programming language

I ditched OpenClaw and built a more secure AI agent (Blink and Mac Mini)

Inspecting the Source of Go Modules

Case 5-2026: An 18-Year-Old Woman with Headache and Hypertension - PubMed

What Your Bluetooth Devices Reveal About You

CURL's Daniel Stenberg: AI slop is DDoSing open source

Running NanoClaw in a Docker Shell Sandbox

Password managers' promise that they can't see your vaults isn't always true

Cryptographic Issues in Matrix's Rust Library Vodozemac

NUZOLVENCE (zoliflodacin) - PubMed

One Pivotal Trial, the New Default Option for FDA Approval - Ending the Two-Trial Dogma - PubMed

Biting the Tail of CAR-T for Relapsed Multiple Myeloma - PubMed

Lessons learned from `oapi-codegen`'s time in the GitHub Secure Open Source Fund

Escaping Misconfigured VSCode Extensions (2023)

Carelessness versus Craftsmanship in Cryptography

Lexega Turns SQL into Signals

The History of a Security Hole

Antigenic Drift and Antivaccine Shift in the 2025-2026 Influenza Season - PubMed

Unicode's confusables.txt and NFKC normalization disagree on 31 characters