Gonçalo Valério @dethos@s.ovalerio.net

"In Safari 15 on macOS, and in all browsers on iOS and iPadOS 15, the IndexedDB API is violating the same-origin policy. Every time a website interacts with a database, a new (empty) database with the same name is created in all other active frames, tabs, and windows within the same browser session."

https://fingerprintjs.com/blog/indexeddb-api-browser-vulnerability-safari-15/

#security #infosec #privacy #apple

https://www.youtube.com/watch?v=aXQ2lO3ieBA

Sounds familiar, doesn't it? 😂

"Memory location matters for performance"

https://pythonspeed.com/articles/performance-memory-locality/

Well written reminder of important CS concepts.

"A story of IP takeovers and open-source intelligence at scale"

https://caniphish.com/phishing-resources/blog/compromising-australian-supply-chains-at-scale

#security #infosec #netsec

New node.js security release:

https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/

#security #nodejs

"Who wrote this shit?"

https://www.heltweg.org/posts/who-wrote-this-shit/

#programming #softwaredevelopment

"NPM might be executing malicious code in your CI without your knowledge"

https://medium.com/cider-sec/npm-might-be-executing-malicious-code-in-your-ci-without-your-knowledge-e5e45bab2fed

#security #npm #javascript #nodejs

"Is your Python code vulnerable to log injection?"

https://dev.arie.bovenberg.net/blog/is-your-python-code-vulnerable-to-log-injection/

#python #logging #security

"How eBPF will solve Service Mesh - Goodbye Sidecars"

https://isovalent.com/blog/post/2021-12-08-ebpf-servicemesh

🤔

#cloud #servicemesh #security

Related: https://palant.info/2021/12/29/how-did-lastpass-master-passwords-get-compromised/

"Cloud Security Breaches and Vulnerabilities: 2021 in Review"

https://blog.christophetd.fr/cloud-security-breaches-and-vulnerabilities-2021-in-review/

#security #cloud

"LastPass users warned their master passwords are compromised"

https://www.bleepingcomputer.com/news/security/lastpass-users-warned-their-master-passwords-are-compromised/

#security #passwordmanager #lastpass #infosec

"If You’re Not Doing Continuous Asset Management You’re Not Doing Security"

https://danielmiessler.com/blog/continuous-asset-management-security/

#security #infosec

"Building Trust in the Software Supply Chain"

https://binary.transparency.dev/

#security

"Understanding the Impact of Apache Log4j Vulnerability"

https://security.googleblog.com/2021/12/understanding-impact-of-apache-log4j.html

#security #infosec #log4shell