Gonçalo Valério @dethos@s.ovalerio.net

"Internet Archive Infrastructure"

https://archive.org/details/jonah-edwards-presentation

Super interesting 👍

#infrastructure

"Are Xiaomi browsers spyware? Yes, they are…"

https://palant.info/2020/05/04/are-xiaomi-browsers-spyware-yes-they-are.../

#privacy #security

"An Exploration of JSON Interoperability Vulnerabilities"

https://labs.bishopfox.com/tech-blog/an-exploration-of-json-interoperability-vulnerabilities

👍

#security #json #programming #webdev #softwaredevelopment

"Avoiding npm substitution attacks"

https://github.blog/2021-02-12-avoiding-npm-substitution-attacks/

#security #nodejs #npm

"Common Nginx misconfigurations"

https://blog.detectify.com/2020/11/10/common-nginx-misconfigurations/

#security #nginx

"Total Cookie Protection, works by maintaining a separate “cookie jar” for each website you visit."

https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/

#privacy #web #firefox

"Traitor packages up a bunch of methods to exploit local misconfigurations and vulnerabilities (including most of GTFOBins) in order to pop a root shell."

https://github.com/liamg/traitor

#security #testing

"... ByteDance's censorship machine"

https://www.protocol.com/china/i-built-bytedance-censorship-machine

#censorship

"Malware in open-source web extensions"

https://lwn.net/SubscriberLink/846272/37d25507fa3e9cd3/

#security #infosec #browserextensions

"The "P" in Telegram stands for Privacy"

https://www.inputzero.io/2020/12/telegram-privacy-fails-again.html

And like others have said, the "s" stands for security.

#security #infosec #privacy #bugs

"What happens if malicious code is uploaded to npm under these names? Is it possible that some of PayPal’s internal projects will start defaulting to the new public packages instead of the private ones?"

"For instance, the main culprit of Python dependency confusion appears to be the incorrect usage of an “insecure by design” command line argument called --extra-index-url."

https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

#security #infosec #programming

"Intercept SSM Agent Communications"

https://frichetten.com/blog/ssm-agent-tomfoolery/

#aws #security #ssm #ec2

"Supercookie uses favicons to assign a unique identifier to website visitors."

https://github.com/jonasstrehle/supercookie

#privacy

"Why npm lockfiles can be a security blindspot for injecting malicious modules"

https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/

I would say this also applies to other languages and package managers.

#security #infosec

"As an interim solution to help people in Iran get connected again, we’ve added support in Signal for a simple TLS proxy that is easy to set up, can be used to bypass the network block, and will securely route traffic to the Signal service."

https://signal.org/blog/help-iran-reconnect/

#signal

"Growth, where it no longer serves a purpose beyond the accumulation of more growth — in the form of investors’ returns, company coffers and the personal wealth of founders — is worshipped. And the cost is astronomical."

https://joanwestenberg.medium.com/dont-grow-d7f87faeaf56

"Heap-based buffer overflow in Sudo (CVE-2021-3156)"

https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt

#security #infosec

"...opinionated
actionable guide to using AWS securely in 2021"

https://summitroute.com/downloads/aws_security_maturity_roadmap-Summit_Route.pdf

#security #infosec #netsec #cloud #aws