Gonçalo Valério @dethos@s.ovalerio.net

"The Justice Department Will No Longer Charge Security Researchers with Criminal Hacking"

https://www.schneier.com/blog/archives/2022/05/the-justice-department-will-no-longer-charge-security-researchers-with-criminal-hacking.html

#security

"BPFDoor — an active Chinese global surveillance tool"

https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

🤔

#security #netsec #infosec

"How to Disable Ad ID Tracking on iOS and Android, and Why You Should Do It Now"

https://www.eff.org/deeplinks/2022/05/how-disable-ad-id-tracking-ios-and-android-and-why-you-should-do-it-now

#privacy #android #ios

"Some top 100,000 websites collect everything you type—before you hit submit"

https://arstechnica.com/information-technology/2022/05/some-top-100000-websites-collect-everything-you-type-before-you-hit-submit/

Not cool 🤨

#privacy #web

"Linux Accessibility..."

https://scribe.rip/@r.d.t.prater/linux-accessibility-an-unmaintained-mess-8fbf9decaf8a

#linux #gnome #kde #a11y

"Faster, more memory-efficient Python JSON parsing with msgspec"

https://pythonspeed.com/articles/faster-python-json-parsing/

#python

"... An attacker having permission to create non-temp objects in at least one schema could execute arbitrary SQL functions under a superuser identity."

https://www.postgresql.org/support/security/CVE-2022-1552/

#security #infosec #postgresql

"Along this journey, we found a few things. Command injection, container escapes, our Github tokens, Cloudflare’s Github tokens, Cloudflare API Keys to Cloudflare Organisation, and Cloudflare’s Azure API tokens amongst other things."

https://blog.assetnote.io/2022/05/06/cloudflare-pages-pt1/

#security #cloudflare #infosec

"RSS Feed Best Practises"

https://kevincox.ca/2022/05/06/rss-feed-best-practices/

#rss #atom #blogs

"Due to a bug in the yank action, it was possible for any RubyGems.org user to remove and replace certain gems even if that user was not authorized to do so."

https://github.com/rubygems/rubygems.org/security/advisories/GHSA-hccv-rwq6-vh79

#security #ruby #infosec #supplychain

"Themes from Real World Crypto 2022"

https://blog.trailofbits.com/2022/05/03/themes-from-real-world-crypto-2022/

Those side channels ... crazy stuff...

#security #infosec #cryptography

"CVE-2022-21449: Psychic Signatures in Java"

https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/

#security #java #infosec

Heroku's "breach" looks to be even worse than what was previously shared.

First Github integration, now passwords... whats next?

https://news.ycombinator.com/item?id=31255450

#security #heroku #infosec

"Increasing the surface area of blogging"

https://tomcritchlow.com/2022/04/21/new-rss/

Some nice ideas. Perhaps I should implement some of them in https://github.com/dethos/worker-planet

#blogs #rss

"RFC 9116
A File Format to Aid in Security Vulnerability Disclosure"

https://www.rfc-editor.org/rfc/rfc9116

Seems it's official, the RFC for "securiy.txt" got published.

#security #infosec #netsec #appsec

"Let's talk about supply chain attacks and backdoored dependencies"

https://kerkour.com/supply-chain-attacks-and-backdoored-dependencies

#security #supplychain #dependencies

"I'm a security engineer and I still almost got scammed"

https://robertheaton.com/almost-scammed/

#security