An attack which doesn't want to die. Time to retire RSA use with TLS, this is really overdue.

Really a bad summer for Microsoft security wise. Trust should be low among Azure customers now. Who was paying attention though?

Totally missed this over the summer... this is a huge breach. It will have a long lasting impact. The scope might be larger than we expect.

Interesting new side-channel attack. A bit mind boggling to be honest. Only one browser seems affected so far (since it's Chrome probably most of its variants are affected as well).

Interesting and unfortunate security issue... This is admittedly a somewhat unusual setup though, but to be kept in mind I think.

What a bad idea. From the information at hand I don't see how this can go well.

Nicely explain how to secure your webhooks step by step.

Good explanations, the parallel and history perspective on Palladium is right. It's the same fight than 20 years ago, it shows up its ugly head regularly. Time to collectively say no once more.

This is a good list, should be seen as a starting point there are more things to do after this. I'm thinking for instance about adding fail2ban to the mix.

Signature of digital documents is definitely not as safe as we would like. All the serious formats have known flaws at this point.

This is an excellent and needed work of contextualization. Ten years after, looking back at how the Snowden Revelations impacted the internet and the work done by the IETF. It also shows there is plenty more to do...

Indeed, the story of integrating C and C++ with Rust isn't a simple one right now. It might introduce larger attack surfaces. Some improvements are proposed in this paper.

Interesting list. Definitely to keep in mind when developing and deploying a web application.

It points out the security risk but it's mainly a good explanation on how Python loads modules.

Interesting experiment even though it's still early days for this kind of research and we'd need more such evaluations. They found that it produces mostly insecure code. This is not really surprising in the end, this manipulates language but has not execution model. It can be fixed only by coupling to some outside system.

This is definitely something to keep in mind and check if you have any LUKS encrypted storage. The key might be less protected than you think.

Good milestone for this project I've been using for a long while now.

This is an incredibly informative deep dive regarding a new attack on CAN buses. Also proposes potential fixes. Let's see how car makers deal with it.

This looks like an interesting new authorization scheme.

This is actually an interesting feature to know when a key changes.