How trustworthy are the extensions you get in your editor or IDE? I'd expect most marketplaces to not be well harmed against such attacks.

The more releases out there the more vulnerabilities are (and could be) discovered. Some actions are necessary to get things under control properly.

The words we use indeed matter. This is definitely a domain where we should avoid ambiguities...

Or why you should let domain simply expire, there's plenty of work to do before that.

This is completely nuts... they really want to unleash a security and privacy nightmare. The irony is that it does respect DRM content on the other hand, we can see where the priorities are.

Ever wondered about the state of the art in password cracking? This is not an easy read but a good reference.

An alternative to the venerable sudo coming with systemd. Looks like it has interesting properties.

Maybe a bit dry, but gives a good idea of how a fuzz testing harness works. And also how it can be tweaked.

Interesting study on the brute force attacks against SSH. It gives plenty of insights and leads to a potential approach to detect most of them.

The title says it all. This article is a nice introduction to certificates, how they work, how the trust model is setup, etc.

Interesting article, shows quite well the complexities of D-Bus and Polkit. Unsurprisingly such complexity easily leads to mistakes which can compromise security. This then hints to interesting things to keep in mind when you have to deal with D-Bus and Polkit.

Definitely a good idea, we'd need several such institutes across the world. Would governments be willing to try this?

You think the xz vulnerability was a one time event? Think again, this kind of bullying with ulterior motives happen regularly to critical projects.

Excellent post showing unhealthy consumer/maintainer dynamics in FOSS projects. This particular example was instrumental in getting the xz backdoor in place.

You should be mindful of the dependencies you add. Even more so when the name of the dependency has been proposed by a coding assistant.

Good analysis of the backdoor recently discovered in xz. Really a bad situation. Luckily it was probably detected before it could do any real damage. What's especially striking is the amount of patience it required, it's really been put in place over a long stretch of time to reduce chances of detection.

Those were nasty, good they've been patched already.

This is bad. Unlocking many doors is just a couple of taps a way if you're already a guest.

A trip down memory lane when such attacks were indeed common. Nowadays, we know better though.

Interesting explanation of the guarantees such a system must provide and their consequences.