Tootfinder

This week, I'm happy to welcome a new guest blogger, Peter Firmstone from Down Under 🇦🇺.
He's written a whole series about #security baked into the #JVM. Today's post answers the question: why fork @…

If you ask me, it's advertising #propaganda and not a real call for respectful #security. Above all, AI is only so "smart" to what amount it is fed with #data in which context.
«Time is runn…

Google, Microsoft and OpenAI among 100 firms calling for better cyber defences
The letter warns cyber-attacks which use AI will become more sophisticated in a matter of months.

If you are in Sweden and want to do more #dotnet #security work, Sustainsys is hiring for a Senior .NET Developer. Seems like a great opportunity. Let them know you heard about the position from Khalid. :)

We're hiring a Senior .NET Developer to join us in Huddinge. 😊🙌💫 Sustainsys builds and maintains Sustainsys.Saml2, an open source library used by organizations worldwide, and we're a certified… | Sustainsys
We're hiring a Senior .NET Developer to join us in Huddinge. 😊🙌💫 Sustainsys builds and maintains Sustainsys.Saml2, an open source library used by organizations worldwide, and we're a certified training and consulting partner to Duende Software. Our founder Anders Abel was recently re-elected Microsoft MVP for Security and Identity. We're a small team — four people today — and growing. This role means working closely with Anders on both product development and customer projects i…

Security by antiquity ftw
#security

'Security by antiquity': Why older tech is sometimes safer from hackers
The fear of hacking has made some people turn to other forms of technology ignored by new generations of cyber criminals.

"The TSA has an important job to do. Their actions at airports have been very poor. This creates lots of loss to travelers – waste. And their actions show a disrespect for people and the risks that exist. The #security theater is not what we need. We need evidence based security measure while maintaining a focus on the value stream of people flying."

Guest author Peter Firmstone continues to explore and analyze the theme of #Security Baked Into the #JVM.
Today's focus is on multi-Subject dispatch: how up to sixteen user Subjects cross a call on the #JERI…

The way #qemu handles #security bugs is changing. Routing the recent tsunami of reports through an overworked email alias has become untenable so we are switching to using our main issue tracker. More people can help with the triage but that does affect expectations of secrecy. See the updates on the …

Some more #UEFI entertainment, I'm just waiting for it. 😹
Seriously though, #firmware #security has become such a problem because many vendors just can't even get updates right, still disco…

Windows and Linux users: The deadline to update Secure Boot keys is near
What you need to know about the expiration of keys securing your machine's boot sequence.

This is what cve.org is showing when I don't allow JavaScript execution for a third party domain (mitre.org) in my LibreWolf browser: "Service is currently unavailable." 🤦‍♂️
I guess the #security community should do better than that.
And yes, when JavaScript is disabled for cve.org, I do get a helpful message that informs me that the web site can't work without JavaS…

« J'ai découvert cc-safety-net : des hooks pour sécuriser les agents IA »
#security

It's always important to have a consistent #security policy.
For example, a policy of "If somebody filed a CVE, it's an important security issue, and we will fix it as such, no matter how meaningless the fix is. If nobody did, it's just a glorified bug fix, no matter how serious the bug was."
So we've just seen a #pip security release over "installing random packages can overwrite pip's files and pip can lazy-import some of them immediately afterwards", with a fix of "pip will no longer load them until you run it again" (leaving the underlying security issue of "any #Python package can override files installed by any other Python package" as intended behavior). As Eli Schwartz beautifully put it, you are not expected to be using the virtual environment; you should create it, install packages into it (at most once!), and then frame it and put it on the wall to admire.
Now we're seeing a "bug fix" for "malicious entry point names can write outside of virtual environment". If nobody filed a CVE, it's obviously not a security issue at all. At least upstream graced us with fixing it without correcting the spec to forbid that first.
https://github.com/pypa/pip/issues/14000

Guest author Peter Firmstone continues to explore and analyze the theme of #Security Baked Into the #JVM.
Today's focus in on the Safe Codebase #Audit

Websites/apps that require you to enter a 2FA code sent by text or email that disable or impair copy-paste:
Fuck you, please go bankrupt fast and make room for companies that don't hate their users.
#Security #Rant

If you're keeping up with #oauth and #app #security, our resident specifications expert, Joe DeCock, summarizes the standards landscape as of summer 2026.

OAuth Identity Chaining, Transaction Tokens, and Human-in-the-Loop: Summer 2026 Identity Standards Recap
Joe DeCock covers three key identity standards milestones from summer 2026: OAuth Identity Chaining reaching Proposed Standard, the Transaction Authorization Challenge draft for human-in-the-loop approval, and Transaction Token chaining across trust domains.

Nancy Beers' keynote at #SecurityDays 2026 had the whole room on its feet, playing games and laughing together.
We spoke with her recently to learn more about what "Play More Today. Secure Tomorrow" means for security culture, from how a simple box of LEGO bricks can make abstact discussions come alive, to why she believes cybersecurity can't exist in silos.
🔗 Re…

"Think of a wheelchair user who must share her PIN with a stranger to use an out-of-reach payment kiosk. Or a blind person who can’t independently access their own medical records because access is lacking…
Any system designed to be used independently is a #privacy and #security risk without

In about 15 minutes we'll be kicking off the #DNSSEC & #Security Workshop at #ICANN86 in Seville, Spain. I'll be moderating the session with some great topics!
If you are onsite, we…

> Linux users: here is the tool enhancing the security of your system. It's written in Rust so it is super secure. It isolates your container via VM. So super secure.
> Also Linux users: install it via brew or dnf copr
#kvmrun #linux

0 days since provenance checks protected us from [checks notes] another project starting to upload distributions via #uv.
#Python #security

More than mildly alarmed listening to this episode on the #Arctic #Europe and #Russia #Ukraine and #HybridWar, #Security and lots of other very very interesting items. *Essential* listening for anyone concerned with European security.
Mildly Alarmed: Russian nukes and spies in the Arctic, with The Barents Observer
https://podcasters.spotify.com/pod/show/mildly-alarmed/episodes/Russian-nukes-and-spies-in-the-Arctic--with-The-Barents-Observer-e3l00hr
Media file: https://anchor.fm/s/111aff124/podcast/play/121683963/https://d3ctxlq1ktw2nl.cloudfront.net/staging/2026-5-18/426419250-44100-2-05b100b5043df.mp3

Guest author Peter Firmstone continues his brilliant series of #Security baked into the #JVM, with his third post: two Subjects, one call
This part covers the two kinds of identity a call carries, how SPIFFE manages process credentials without keystores, and how three identity layers coexist on a singl…

Signal – Don’t forget to configure for privacy
In a business or non-profit environment, there is a good chance that your management team is using Signal. And why not? It brings security and privacy to messaging, file sharing, video and phone calls. Not only can you do one-to-one communications, you can create and manage groups. Sensitive business conversations can remain secret. What’s not to like about that?
Out-of-the-Box Signal needs attention to the configuration settings to get the best privacy. If you are a CISO or IT specialist, you can help your management team configure Signal for the best privacy.
After installing Signal on a mobil phone or desktop, review the configuration settings and adjust them as needed. Here is a free guide that will get you started:
#Security #Privacy #Signal

I can't stop saying the NVRAM vars are a tough #UEFI attack surface, and if processed wrong, may undermine all #security:
https://kb.cert.org/vuls…

reason 343521562 to never use Comcast
Comcast enabling WIFI motion tracking ability on all Xfinity routers.
Free, but *supposedly* Opt-In.
#Privacy #Security #WifiMotionTracking

Dependency cooldowns are a nice idea, but I dare say they're a short-term solution.
They resemble the idea of avoiding poison by waiting for someone else to start eating first. That works, provided that someone actually eats first, and that the poison works fast. But eventually it leads to that awkward silence at the table when nobody wants to risk the first bite.
Adapting dependency cooldowns means basically waiting for "someone else" to notice the problem. At some point when large enough number of projects adapts them, we're going back to square one — except with an artificial few-day delay.
#security #FreeSoftware

Honestly, what kind of scam #Akamai / #LInode is? They give you a form to report malicious activity from their network, you file it, you get "Error message to be decided", and it turns out they've banned you in the meantime; all their websites give you "Access denied".
And they host an exploit since 2021 at least: #security #abuse

#BigTech #Billionaires #EatTheRich #Security #Win10 #TechSupport
So some press covered Zuckerberg's mega yacht not responding to a distress call and rightfully saying the Law Of the Sea requires aid to be rendered if possible.
Now, there's apparently a Win10 zero-day vulnerability in the wild. A vulnerability that Microsoft HAS A FIX FOR.
And yet they won't allow you to run it if you haven't paid up for support.
They should be REQUIRED TO RELEASE the fix to all.