Tootfinder

Guest author Peter Firmstone continues his brilliant series of #Security baked into the #JVM, with his third post: two Subjects, one call
This part covers the two kinds of identity a call carries, how SPIFFE manages process credentials without keystores, and how three identity layers coexist on a singl…

On IoT Security and Privacy, Moving and Long-term Data (2015) - How to provide appropriate protection for small Internet-of-Things devices and their data streams, on the air and at rest. #IoT #security -

On IoT Security and Privacy, Moving and Long-term Data (2015)
How to provide appropriate protection for small Internet-of-Things devices and their data streams, on the air and at rest. #IoT #security

10 Popular #Security Practices That Do More Harm Than Good
https://medium.com/@vndpal/10-popular-security-prac…

Security by antiquity ftw
#security

'Security by antiquity': Why older tech is sometimes safer from hackers
The fear of hacking has made some people turn to other forms of technology ignored by new generations of cyber criminals.

Guest author Peter Firmstone continues his exploration of #security baked into the #JVM.
This 5th part is about what the caller is then allowed to do:
how incoming arguments are validated before they become objects,
why permissions are granted to what the code is, rather than where it came f…

If you are in Sweden and want to do more #dotnet #security work, Sustainsys is hiring for a Senior .NET Developer. Seems like a great opportunity. Let them know you heard about the position from Khalid. :)

We're hiring a Senior .NET Developer to join us in Huddinge. 😊🙌💫 Sustainsys builds and maintains Sustainsys.Saml2, an open source library used by organizations worldwide, and we're a certified… | Sustainsys
We're hiring a Senior .NET Developer to join us in Huddinge. 😊🙌💫 Sustainsys builds and maintains Sustainsys.Saml2, an open source library used by organizations worldwide, and we're a certified training and consulting partner to Duende Software. Our founder Anders Abel was recently re-elected Microsoft MVP for Security and Identity. We're a small team — four people today — and growing. This role means working closely with Anders on both product development and customer projects i…

If you ask me, it's advertising #propaganda and not a real call for respectful #security. Above all, AI is only so "smart" to what amount it is fed with #data in which context.
«Time is runn…

Google, Microsoft and OpenAI among 100 firms calling for better cyber defences
The letter warns cyber-attacks which use AI will become more sophisticated in a matter of months.

This is what cve.org is showing when I don't allow JavaScript execution for a third party domain (mitre.org) in my LibreWolf browser: "Service is currently unavailable." 🤦‍♂️
I guess the #security community should do better than that.
And yes, when JavaScript is disabled for cve.org, I do get a helpful message that informs me that the web site can't work without JavaS…

Websites/apps that require you to enter a 2FA code sent by text or email that disable or impair copy-paste:
Fuck you, please go bankrupt fast and make room for companies that don't hate their users.
#Security #Rant

Guest author Peter Firmstone continues to explore and analyze the theme of #Security Baked Into the #JVM.
Today's focus is on multi-Subject dispatch: how up to sixteen user Subjects cross a call on the #JERI…

#Security #PasswordManager
Random question for those who use a browser plugin for a dedicated manager like BitWardon or LastPass or whatever.
How does this handle security vs the built in browser manager?
I know the in browser ones are not recommended and curious how having a plug-in to the BitWarden/LastPass 3rd party is different?

From this perspective, today is a good day! Thanks to a team effort we succeeded in getting the #trivy warnings down to zero before the QS cycle starts.
#security #DevSecOps

"Think of a wheelchair user who must share her PIN with a stranger to use an out-of-reach payment kiosk. Or a blind person who can’t independently access their own medical records because access is lacking…
Any system designed to be used independently is a #privacy and #security risk without

🔐 Hermes Vault: a local-first credential broker and encrypted vault for AI agents. It scans for plaintext secrets, brokers policy-gated access and proves audit integrity.
#opensource #security #MCP

If you're keeping up with #oauth and #app #security, our resident specifications expert, Joe DeCock, summarizes the standards landscape as of summer 2026.

OAuth Identity Chaining, Transaction Tokens, and Human-in-the-Loop: Summer 2026 Identity Standards Recap
Joe DeCock covers three key identity standards milestones from summer 2026: OAuth Identity Chaining reaching Proposed Standard, the Transaction Authorization Challenge draft for human-in-the-loop approval, and Transaction Token chaining across trust domains.

Guest author Peter Firmstone continues to explore and analyze the theme of #Security Baked Into the #JVM.
Today's focus in on the Safe Codebase #Audit

Nancy Beers' keynote at #SecurityDays 2026 had the whole room on its feet, playing games and laughing together.
We spoke with her recently to learn more about what "Play More Today. Secure Tomorrow" means for security culture, from how a simple box of LEGO bricks can make abstact discussions come alive, to why she believes cybersecurity can't exist in silos.
🔗 Re…

Signal – Don’t forget to configure for privacy
In a business or non-profit environment, there is a good chance that your management team is using Signal. And why not? It brings security and privacy to messaging, file sharing, video and phone calls. Not only can you do one-to-one communications, you can create and manage groups. Sensitive business conversations can remain secret. What’s not to like about that?
Out-of-the-Box Signal needs attention to the configuration settings to get the best privacy. If you are a CISO or IT specialist, you can help your management team configure Signal for the best privacy.
After installing Signal on a mobil phone or desktop, review the configuration settings and adjust them as needed. Here is a free guide that will get you started:
#Security #Privacy #Signal

Lunch was superb as usual - time for #Linux #kernel #security stuff now!
https://kernel-recipes.org/en/2026/schedule/linux-secure-by-default-are-we-there-yet/

Voor iedereen die het nog niet kent, OWASP AI exchange, "300 pages of free, constantly-evolving, practical guidance on securing AI systems"
#AI #owasp #security

Remember the time when I took #security vulnerabilities seriously, rather than shrugged and whatever'd?
#Linux

Old MacDonald's Server Farm
A-I-A-I-O
And on that farm an LLM
A-I-A-I-O
With a breakout here and a breakout there
here a break, there a break, everywhere a breakout
Old MacDonald's Server Farm
A-I-A-I-O
#AI #LLM #Security

There's this infographic on the train. A guy's connecting to the open WiFi network on the train and then logging in to a bank, and apparently another guy sitting nearby with a laptop (and an evil grin) intercepts that password. The infographic goes on to say that you should use a #VPN to protect against that.
Do I want to point out that not only this is bullshit, but for most people a "VPN" actually means installing some spyware?
#security

reason 343521562 to never use Comcast
Comcast enabling WIFI motion tracking ability on all Xfinity routers.
Free, but *supposedly* Opt-In.
#Privacy #Security #WifiMotionTracking

#BikiniBeauty
Season 3 Episode 14 "Strangers Among Us"
#Security #RandomBaywatch #lvdlpx #Baywatch #BaywatchKittens #Gorgeous #BaywatchBabes #hot #sexy #swimsuit #BaywatchBoobs #Headlights #Bikini #Beauty #StrangersAmongUs

Reading this, people could actually think Anthropic helps them keeping their data safe. However you still have to trust Anthropic itself that has access to all your data when using their AI or am i misreading it?
#AI #Anthropic #EFS #privacy #security

Good to realize, with the current state of technology a voice can not be trusted. So when somebody calls you and wants something from you, remember voices can be perfectly cloned and faked nowadays. So maybe we should think about asking control questions when necessary?
#TTS #Voice #AI #cloning #Security

#BigTech #Billionaires #EatTheRich #Security #Win10 #TechSupport
So some press covered Zuckerberg's mega yacht not responding to a distress call and rightfully saying the Law Of the Sea requires aid to be rendered if possible.
Now, there's apparently a Win10 zero-day vulnerability in the wild. A vulnerability that Microsoft HAS A FIX FOR.
And yet they won't allow you to run it if you haven't paid up for support.
They should be REQUIRED TO RELEASE the fix to all.