Tootfinder

If you have some time spare, take a look at the #EU 🇪🇺 #cyber #security standards that are currently in a mature draft state, awaiting feedback until end of February. I have started reading through requiremen…

⚠️ Cyberattacks can trigger societal crises, scientists warn
#security

Cyberattacks can trigger societal crises, scientists warn
Cyberattacks can wreak havoc on the systems they target, yet their impact often spreads far beyond technical failures, potentially triggering crises that engulf entire communities, a new study argues.

«Security: This library has not undergone any third-party security audit. Usage is at own risk.»
If something like this is written on a code library, the confidence in your security is much higher than if commercial blenders want to advertise absolute IT security and there are the safest — especially when the commercial goals still list ratings in this way.
#security

Wenn Politiker auf die billigste Phishing-Attacke reinfallen, was ist dann die Gegenmaßnahme? #Phishing #Politik #Security

Parlamentarier fordern Gegenmaßnahmen nach Signal-Attacke
Über den Messengerdienst Signal haben Angreifer Zugriff auf die Kommunikation hochrangiger Politiker bekommen. Die Bundesregierung vermutet Russland dahinter. Parlamentarier sind alarmiert und fordern Gegenmaßnahmen.

First blog post of the year:
#Rust #Security

crepererum - Only security updates?
An analysis of how often you need to accept breaking changes so you can also consume security updates.

#OpenSource #security at Astral
https://astral.sh/blog/open-source-security-at-astral…

So you read about #CopyFail, and are like… owww, shit. But then you see that it was responsibly disclosed after being fixed in main, we had releases since, they went stable in #Gentoo (over other #security fixes), so we should be good, right?
Except that it turns out that after it has been fixed in mainline, nobody bothered actually backporting the fix to all the LTS branches. And it doesn't apply cleanly (#Gentoo #Linux

I understand #security is important and all, but getting logged out from #Teams and email frequently because MS thinks the auth cookie needs to be renewed is mighty irritating to say the least. To say more, I swear loudly every time I have to login again. Just fucking let me be.

Please help with testing a new
#Thunderbird #Security feature: Unobtrusive Signatures, a novel mechanism for digitally signing email, currently implemented for #OpenPGP.
It avoids the u…

The final keynote highlight from the GÉANT #SecurityDays 2026 this April.
Alexandre Dulaunoy, Head of CIRCL, Luxembourg's national CSIRT — on how 15 years of open-source security development has shown that sharing code, knowledge and intelligence builds networks of trust between defenders.
If you haven't got your ticket yet, this week is your last chance. Secure your place …

RE: #Gemini #GoogleCoin #security

If the browser maker you are using is able to pull off something similar than what's described in this video, then it's a safe browser to use.
https://www.youtube.com/watch?app=desktop&v=YQEq5s4SRxY

Oh wow. I guess it's "lazy and smart" in a way (and only gives you three attempts at loading, then 401)
#security

The state of #security these days: #Python #virtualenv package now includes SHA256 sums of their bundled wheels, declaring that it protects against "supply-chain compromise". Because obviously there are so many attack vectors that permit you to alter a .whl file but not the .py file in the same directory.
No, I'm not saying verifying checksum makes no sense, because indeed it can save some pain if fs is damaged somehow. However, calling this a "security" feature is a misnomer at best, and openly giving people false sense of security at worst.

The GÉANT #SecurityDays 2026 programme is live and we're highlighting the keynotes you won't want to miss.
First up is Frank Rieger!
Hacker, author and internet activist — on how agentic LLMs are changing the IT security landscape, and why mastering the fundamentals of network control matters more than ever.
Learn more & secure your place 👉

Is there a guide how to integrate #SIEM systems and #VideoSuvailance systems vor General alarming systems for having physical and Cyber #security in one Palace (if company is not that large ...…

Wow, so 1Password has increased its already expensive services. I have only used it for work/volunteer related stuff. I've been using Apple's Keychain and now Passwords App for years.
If you're on a Mac/iOS system and want to switch, 9to5 has a good run down on how to export your 1Password database and bring it into Passwords.
if you've never used a Password Manager, you really really should.
#Security #Passwords #Apple #1Password #PasswordManager
https://9to5mac.com/2026/02/25/heres-how-to-switch-from-1password-to-apple-passwords/?utm_source=dlvr.it&utm_medium=mastodon

Eens even een berichtje naar Security.nl gestuurd. Ik doe het niet snel, maar ik lees de berichten graag, maar het komt best vaak voor 'dat ok geen zin in dat gedoe heb' door die desktop pagina's op mn mobiel.
Het wordt tijd ... 😉
📸 Over Security.NL
#SecurityNL

Another keynote not to miss at the GÉANT #SecurityDays 2026 this April.
Nancy Beers, seasoned gamification expert and owner of Sanne Cyber and Happy Game Changers — on why playfulness is a scientifically-backed tool for security innovation, learning, and flexibility.
Check the full programme 👉

Noterpad user? You should read this #security

🤦🏿‍♀️ Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers
#security

On the #security issue with #AI detectors
For proper vuln research and disclosure, you need 3 parts:
1. a valid exploit, provable
2. an explanation of how it works
3. a solution to fix it and roll out an upgrade
Often enough, when the first part is done, people are like "…

Have you seen the GÉANT #SecurityDays 2026 workshop programme yet?
This year features 9 hands-on workshops across 3 days, covering everything from threat hunting and crisis simulations to open-source tooling and #DDoS defence.
All workshop participants will also receive a PCD certificate re…

RE: #ai #security

Die Schlangenölverkäufer wollen ihr Geld zurück #security https://www.golem.de/news/it-sicherheit-kaspersky-droht-bsi-mit-klage-in-millionenho…

IT-Sicherheit: Kaspersky droht BSI mit Klage in Millionenhöhe - Golem.de
Seit 2022 warnt das BSI vor Kaspersky. Nun fordert das Unternehmen die Rücknahme und droht mit einer massiven Schadenersatzklage.

Another keynote not to miss at the GÉANT #SecurityDays 2026 this April.
Valerie Aurora, open-source software engineer and co-founder of the Amsterdam Internet Resiliency Club — on why internet connectivity in Europe is more fragile than we think, and how communities can prepare together.
Secure your place 👉

Fun post pointed out by Werner Koch on the GPG "post-quantum defaults" thread:
#cryptography #QuantumCryptography #security

Proper #security nightmare time.
#LMDB is a database that's designed to operate on trusted input. Upstream has historically rejected all bug reports regarding problems with malformed input.
Py-LMDB project provides #Python bindings to LMDB that are normally built against bundled LMDB. Someone recently started mass-filing "untrusted input" vulnerabilities against py-lmdb, and py-lmdb started #slop - coding fixes to their bundled LMDB. Of course, nobody even bothered reporting most of these bugs upstream, and the one that I've seen reported was rejected as "don't do that".
Py-LMDB supports building against system LMDB, and #Gentoo was doing that so far. However, now we are facing a problem: system LMDB operates under the assumption that it is working on trusted input, while py-lmdb (and its bundled LMDB) operates under the assumption that it may be working with untrusted input. The guarantees no longer align.
If we continue to use system LMDB (and skip all the added slop tests that literally cause Python to crash), then Gentoo's py-lmdb package will now have different input expectations than upstream py-lmdb. And of course we can't just remove that crap because someone added exactly one package (TorchVision, i.e. part of the plagiarism machine suite) depending on it.
https://bugs.gentoo.org/971352

Modern use of LLMs often involves giving them access to the local system: to read and write your project files, and to execute arbitrary commands, often unsupervised. So aren't people worried about a harness just doing what a remote #LLM tells it to do?
I think a statement I've heard lately summarizes the mindset well. It went something along the lines "I can't give you 100% guarantee, but I've noticed that LLMs are very good at following instructions, and they're getting better and better, so I don't worry about that anymore".
Like, it is completely fine to introduce a humongous security hole, because the probability that a model will *accidentally* do something horrible is decreasing.
#AI #NoAI #NoLLM #security

Macht Microsoft WireGuard kaputt? #vpn #wireguard #security #windows

WireGuard, Microsoft und die Signatur-Frage: Ein Sturm im Wasserglas?
Nach VeraCrypt hat jetzt auch WireGuard Probleme mit Microsoft, wenn es um die Signatur-Frage geht. Wir klären die aktuelle Sachlage auf.