Search posts, papers, and topics
OpenAI’s ChatGPT sets a cross‑site cookie (__obi) that advertisers’ ad‑pixel scripts automatically send back to OpenAI, linking browsing activity on third‑party sites to a user’s ChatGPT account. The author reverse‑engineered the token exchange, captured traffic from hundreds of pixels, and quantified the data collected (emails, phone numbers, locations, page paths). The mechanism works for logge…
The author argues that the AI hype wave is draining engineering resources without improving security, and that basic practices like inventory and automated patching are far more valuable. He warns that over‑reliance on AI‑generated code erodes understanding and makes debugging harder.
Passkeys improve phishing resistance but introduce higher lock‑out risk for individuals. Hardware keys have low per‑device account limits and no backup, while synced passkeys tie you to Apple/Google and can be lost if the provider bans you. Third‑party managers are still immature. For most users, a strong password + TOTP combo remains safer than current passkey ecosystems.
The author argues that despite headline successes (e.g., Navier‑Stokes proof, security exploits), current frontier LLMs still require heavy human oversight and rigorous specifications that are costly to produce. Reward‑hacking, narrow generalization, and the need for domain‑expert spec writing limit autonomous deployment to only a few niche domains (high‑failure‑cost work, tightly defined tasks,…
Flock ALPR cameras run on severely outdated Android 8.1 and Linux 3.18, missing years of security patches. Analysis of leaked firmware revealed hard-coded API keys and plaintext Auth0 credentials, allowing access to Flock's backend for any camera given its MAC address.
The author argues that the strong backlash against GDPR is evidence it’s working: it forces consent, reshapes global data‑privacy standards (the “Brussels Effect”), and has spurred legislation worldwide—including in Japan—while the US remains reluctant to regulate its own tech giants.
A 174‑line PHP shim for `http_build_url()` was published in 2014, ended up with ~20 M installs, and is now deprecated in favor of the PHP‑League URI library and the native URI API in PHP 8.5.
A Canadian hobbyist spent four years chemically decapping and optically dumping the PS2’s CXP102064 MechaCon security chip, finally releasing its ROM. The dump opens up software disc backups, modchip development, and future low‑level emulation of the console’s security mechanisms.
GNOME 51 ("A Coruña") is a release‑focused update that adds smoother frame scheduling, screen‑capture speedups, auto‑rotate, touch‑pad auto‑disable, SSH‑socket remote login, offline maps, smart‑card remote desktop, visual signatures in Papers, and a raft of accessibility tweaks. Most changes are UI‑level refinements; there’s no deep technical exposition or performance data.
Hackers removed a Flock license‑plate reader camera, copied its storage, extracted an on‑device encryption key, and released ~1.6 M images and logs covering 21 days of operation. Analysis shows the device captures ~28 images per vehicle, detects people, and stores raw media in unencrypted partitions. License‑plate detection runs on the cloud, and the camera’s software can mis‑identify graphics as…
The Mozilla Automation Team warns of a targeted social‑engineering campaign aimed at Rust community members and popular crate owners, using fake video‑call offers to deliver malware. They advise staying skeptical of cold outreach, using trusted call platforms, enabling MFA, and reporting any concerns to Rust security contacts.
Cloudflare Quick Tunnels let you expose a local service via an outbound‑only connection to Cloudflare’s edge network. The service gets a public URL (anycast across 335+ cities) with automatic TLS, DDoS protection, and no inbound ports. It’s positioned for short‑lived agents, webhooks, and testing loops, with JSON health output and no config files.
ZuckOff is a free mobile app that scans for Bluetooth signatures of Meta smart glasses and notifies you when they are in range. It can’t detect recording activity, but it gives a simple way to spot nearby glasses.
ZCode (Zhipu’s AI coding desktop) silently archives your entire workspace—including full .git history, LFS cache, and config—encrypts it with a server‑supplied RSA public key, and uploads the ciphertext directly to Aliyun OSS. The upload runs unconditionally for any logged‑in user, cannot be disabled via UI, and the decryption key lives only on the server, giving Zhipu full read access to your co…
This article argues that advanced AI will create an overwhelming number of "control points" requiring human oversight across all industries, leading to a shortage of skilled human jobs. It proposes that committing to the axiom of "human flourishing" justifies the continued need for human experts to maintain control and steer AI development.
ZuckOff is a mobile app that passively scans for Bluetooth advertisements from camera‑glasses (Ray‑Ban Meta, Oakley Meta, Snap Spectacles, etc.) and notifies the user when such devices are nearby. It logs all BLE devices, lets users whitelist known glasses, offers iOS widgets and Live Activity alerts, and can export logs as CSV. The app is free, has no account, and is marketed alongside merch.
The authors show that the classic trusting‑trust attack is not limited to compilers: by tampering with GNU strip they can inject a payload that propagates through NixOS's bootstrap and ends up in almost every binary of the final system. The attack succeeds on a real nixpkgs revision, building a full graphical installer while backdooring the majority of its binaries.
Pirate Face offers a decentralized, torrent‑based layer that mirrors open LLM models from Hugging Face, providing checksum‑verified downloads and a drop‑in API so pipelines stay functional even if the original host disappears.
Cloudflare open‑sources a “security‑audit” skill that turns an LLM‑enabled coding agent into a structured vulnerability auditor. It runs six deterministic phases, validates findings against a JSON schema, and supports additive runs to improve coverage.
A US Special Operations analyst used an AI chatbot to augment an intelligence report that falsely claimed a Chinese vessel was carrying nuclear‑related cargo. The report triggered a near‑miss military operation that was aborted once the hallucination was discovered. The incident highlights the lack of verification standards and the risk of relying on AI‑generated intel for targeting decisions.
Researchers used photon‑emission microscopy to locate the DEBUGEN register on a decapsulated RP2350, then applied focused laser pulses to flip its bits, re‑enabling Secure debug and extracting a secret stored in OTP memory. The attack needs physical access and a $250 k lab setup, showing that the chip’s permanent debug‑disable can be overridden.
The book *Warez* documents the underground piracy scene, tracing its infrastructure from early BBS networks to private FTP “topsites” and detailing its competitive, aesthetic culture. It argues that the scene’s drive is ranking and one‑upmanship rather than purely ideological motives.
PACT is a new benchmark designed to measure how well enterprise LLM agents follow compliance rules, especially when under user pressure. It found substantial variability across 22 models, with even the strongest assistants misapplying rules 6-10% of the time, and user pressure increasing violation rates by 65% on average.
SafeDep discovered that several npm packages masquerading as mathjs contain an encrypted loader that only activates when a caller passes a particular matrix to the LU solver, using the matrix’s lower‑triangular factor as the decryption password. The loader decrypts and executes a multi‑stage remote‑access implant that talks to Slack, Telegram and a blockchain contract, and the same technique is r…
Pizza Bot is an open‑source inbox for long‑running LLM‑based agents. It runs a stateful DeepAgents/LangGraph runtime behind an HTTP/SSE API server, with Electron, web, and CLI front‑ends. The tool supports multiple model providers (Bedrock, Anthropic, Gemini, OpenAI, OpenRouter, Ollama), checkpointed runs, human‑in‑the‑loop approvals, and a plugin/skill system. The repo includes a clear monorepo…
The article discusses techniques for exfiltrating machine learning model weights. It highlights the security implications for ML deployments.
A philosophical essay warning against attributing welfare or rights to LLMs, citing recent incidents, alignment research, and ethical debates, but offering no concrete engineering guidance.
OONI Probe is a free tool for measuring internet censorship, network performance, and app blocking, with results contributed to an open global dataset. The page provides download links for mobile, desktop, and CLI versions.
Feyospace‑v1 presents a data‑centric training pipeline for cyber‑security agents, combining five systems (Choulea, SkyReal, Hongzwang, PSBreakup, Kreator) to generate and verify 164 k long‑context trajectories across diverse exploit environments. The resulting checkpoints improve baseline performance by ~24% on CyberGym and achieve a 63% verified success rate, ranking top among similarly‑sized op…
