From the notebook
24 notes on this topic.
A reverse engineering enthusiast spent four years breaking open the PlayStation 2's Mechacon chip, the hardware guardian that controlled everything from disc authentication to region locking.
A fintech with 50 million users fell for spoofed government data requests. The weak link was not the encryption.
A government Rails site was compromised hours after the CVE-2024-28103 patch dropped. The attackers were watching the release notes.
The Pixel 11 drops hardware memory tagging that was standard on the Pixel 8 and 9. GrapheneOS called it out on Twitter.
Zapscape is a guest-to-host escape for KVM on x86. It lets a compromised VM run code on the host machine, which is the nightmare scenario for cloud providers.
Someone is flooding the National Vulnerability Database with fake SQLite vulnerabilities written by language models, and it is breaking actual security work.
Why my intrusion detection capstone needed an Isolation Forest, a Random Forest and an autoencoder to reach 0.95 F1 on real attack traffic.
A security firm ran Claude through GlobaLeaks' codebase and found medium-severity bugs for seventy-six dollars per finding. The question is whether a human would have caught the same issues faster.
OpenAI open-sourced the internal security guidelines they used when building Codex. Turns out threat modelling an AI code generator is different from threat modelling a database.
OrchidFiles reported a flaw that let anyone read private repo secrets. GitHub marked it duplicate, did not patch it, then banned the researcher.
Law enforcement claimed strong encryption would end investigations. A new paper tracks what actually happened: encryption went mainstream, crime still gets solved.
A Chinese LLM patched critical security bugs in a codebase where OpenAI's models and Anthropic's Claude refused to engage. The refusal problem is real.
Fifteen years of a compartmentalised desktop OS, zero remote code execution bugs. The paper tracking every public Qubes vulnerability is out.
Gwern argues personalised LLM assistants could filter spam, draft replies, and catch your mistakes before you send them. The privacy trade-off is obvious.
Anthropic's Model Context Protocol promised to standardise how AI agents talk to tools. A new audit shows most implementations ship with auth disabled by default.
A firmware update silently killed Transparent Memory Encryption on consumer chips. The engineers stopped replying when users asked why.
Someone found 10,000 GitHub repositories distributing malware disguised as cracked software and game cheats. The scale is wild.
The Arch Linux team spent the weekend cleaning up more than 1,500 malware-laden packages from the AUR. The scale is what surprised me.
The Arch User Repository just had 400 packages backdoored. The attack vector was not clever. It was obvious, predictable, and it worked anyway.
YAML, TOML, and JSON parsers can run arbitrary code during deserialization. Most dependency scanners miss them entirely.
Someone finally built a home security camera system that encrypts on-device and costs nothing per month.
PHP's dependency manager is rolling out cryptographic signatures. The timing matters more than the tech.
Linus Torvalds says automated vulnerability scanners have turned the kernel security mailing list into noise. The tools work, the signal-to-noise ratio does not.
Mythos, an autonomous security agent, caught a buffer overflow in curl that human auditors missed. The tooling works.