Tootfinder

This is what cve.org is showing when I don't allow JavaScript execution for a third party domain (mitre.org) in my LibreWolf browser: "Service is currently unavailable." 🤦‍♂️
I guess the #security community should do better than that.
And yes, when JavaScript is disabled for cve.org, I do get a helpful message that informs me that the web site can't work without JavaS…

If you're keeping up with #oauth and #app #security, our resident specifications expert, Joe DeCock, summarizes the standards landscape as of summer 2026.

OAuth Identity Chaining, Transaction Tokens, and Human-in-the-Loop: Summer 2026 Identity Standards Recap
Joe DeCock covers three key identity standards milestones from summer 2026: OAuth Identity Chaining reaching Proposed Standard, the Transaction Authorization Challenge draft for human-in-the-loop approval, and Transaction Token chaining across trust domains.

Nancy Beers' keynote at #SecurityDays 2026 had the whole room on its feet, playing games and laughing together.
We spoke with her recently to learn more about what "Play More Today. Secure Tomorrow" means for security culture, from how a simple box of LEGO bricks can make abstact discussions come alive, to why she believes cybersecurity can't exist in silos.
🔗 Re…

From this perspective, today is a good day! Thanks to a team effort we succeeded in getting the #trivy warnings down to zero before the QS cycle starts.
#security #DevSecOps

Lunch was superb as usual - time for #Linux #kernel #security stuff now!
https://kernel-recipes.org/en/2026/schedule/linux-secure-by-default-are-we-there-yet/

"Think of a wheelchair user who must share her PIN with a stranger to use an out-of-reach payment kiosk. Or a blind person who can’t independently access their own medical records because access is lacking…
Any system designed to be used independently is a #privacy and #security risk without

Websites/apps that require you to enter a 2FA code sent by text or email that disable or impair copy-paste:
Fuck you, please go bankrupt fast and make room for companies that don't hate their users.
#Security #Rant

🔐 Hermes Vault: a local-first credential broker and encrypted vault for AI agents. It scans for plaintext secrets, brokers policy-gated access and proves audit integrity.
#opensource #security #MCP

Security by antiquity ftw
#security

'Security by antiquity': Why older tech is sometimes safer from hackers
The fear of hacking has made some people turn to other forms of technology ignored by new generations of cyber criminals.

Signal – Don’t forget to configure for privacy
In a business or non-profit environment, there is a good chance that your management team is using Signal. And why not? It brings security and privacy to messaging, file sharing, video and phone calls. Not only can you do one-to-one communications, you can create and manage groups. Sensitive business conversations can remain secret. What’s not to like about that?
Out-of-the-Box Signal needs attention to the configuration settings to get the best privacy. If you are a CISO or IT specialist, you can help your management team configure Signal for the best privacy.
After installing Signal on a mobil phone or desktop, review the configuration settings and adjust them as needed. Here is a free guide that will get you started:
#Security #Privacy #Signal

There's this infographic on the train. A guy's connecting to the open WiFi network on the train and then logging in to a bank, and apparently another guy sitting nearby with a laptop (and an evil grin) intercepts that password. The infographic goes on to say that you should use a #VPN to protect against that.
Do I want to point out that not only this is bullshit, but for most people a "VPN" actually means installing some spyware?
#security

"The TSA has an important job to do. Their actions at airports have been very poor. This creates lots of loss to travelers – waste. And their actions show a disrespect for people and the risks that exist. The #security theater is not what we need. We need evidence based security measure while maintaining a focus on the value stream of people flying."

If you ask me, it's advertising #propaganda and not a real call for respectful #security. Above all, AI is only so "smart" to what amount it is fed with #data in which context.
«Time is runn…

Google, Microsoft and OpenAI among 100 firms calling for better cyber defences
The letter warns cyber-attacks which use AI will become more sophisticated in a matter of months.

reason 343521562 to never use Comcast
Comcast enabling WIFI motion tracking ability on all Xfinity routers.
Free, but *supposedly* Opt-In.
#Privacy #Security #WifiMotionTracking

I can't stop saying the NVRAM vars are a tough #UEFI attack surface, and if processed wrong, may undermine all #security:
https://kb.cert.org/vuls…

Old MacDonald's Server Farm
A-I-A-I-O
And on that farm an LLM
A-I-A-I-O
With a breakout here and a breakout there
here a break, there a break, everywhere a breakout
Old MacDonald's Server Farm
A-I-A-I-O
#AI #LLM #Security

If you are in Sweden and want to do more #dotnet #security work, Sustainsys is hiring for a Senior .NET Developer. Seems like a great opportunity. Let them know you heard about the position from Khalid. :)

We're hiring a Senior .NET Developer to join us in Huddinge. 😊🙌💫 Sustainsys builds and maintains Sustainsys.Saml2, an open source library used by organizations worldwide, and we're a certified… | Sustainsys
We're hiring a Senior .NET Developer to join us in Huddinge. 😊🙌💫 Sustainsys builds and maintains Sustainsys.Saml2, an open source library used by organizations worldwide, and we're a certified training and consulting partner to Duende Software. Our founder Anders Abel was recently re-elected Microsoft MVP for Security and Identity. We're a small team — four people today — and growing. This role means working closely with Anders on both product development and customer projects i…

Remember the time when I took #security vulnerabilities seriously, rather than shrugged and whatever'd?
#Linux

Dependency cooldowns are a nice idea, but I dare say they're a short-term solution.
They resemble the idea of avoiding poison by waiting for someone else to start eating first. That works, provided that someone actually eats first, and that the poison works fast. But eventually it leads to that awkward silence at the table when nobody wants to risk the first bite.
Adapting dependency cooldowns means basically waiting for "someone else" to notice the problem. At some point when large enough number of projects adapts them, we're going back to square one — except with an artificial few-day delay.
#security #FreeSoftware

« J'ai découvert cc-safety-net : des hooks pour sécuriser les agents IA »
#security

#Security #PasswordManager
Random question for those who use a browser plugin for a dedicated manager like BitWardon or LastPass or whatever.
How does this handle security vs the built in browser manager?
I know the in browser ones are not recommended and curious how having a plug-in to the BitWarden/LastPass 3rd party is different?

Here is the transcript of the meat of Carney’s proposal for a deeper Canada and EU partnership in text. Full text of the speech at the second link. The 2 minute video clip got a chuckle (“better manners”).
“So let me say plainly what Canada proposes.
Canada and Europe should secure our strategic autonomy through deep cooperation in the full range of strategic capabilities, including critical minerals, defence industrial capacity, AI and compute, energy security, space, and payments.
We should move toward seamless, digital trade in non-agricultural goods and a wide range of services.
We should deepen our people-to-people ties, allowing our youth to live, work and study where they want on either side of the Atlantic.
Canadian membership of Erasmus can give your students, and ours, more opportunity to learn at some of the world’s top universities, to broaden their horizons, and to build lasting ties that will sustain our alliance for the future.
Canadian membership of the next generation of Horizon would allow us to pool resources, cooperate on frontier technologies, and leverage our world-class research institutes and universities.
Yesterday, President von der Leyen announced a “new European Corporation on Critical Raw Materials” to obtain and stockpile the material needed for electric cars, chips and batteries, clean technology, and defence. Canada has deposits of over 34 critical minerals, and we are among the top producers of the 10 most essential for the world’s energy transition. Our alliance can help fill Europe’s need for reliable supply, Canada’s need for advanced processing capabilities, and our common objective to build complete value chains.
Canada can contribute LNG and hydrogen at large scale to support Europe’s energy security including by developing and leveraging new port infrastructure in the High North and on our East Coast. We, in turn, can benefit from your leadership in many clean energy technologies.
We can pool new sovereign compute capacity and build more secure broadband connections between Europe and Asia via our common geography.
Canada and Europe can join forces to develop AI safety protocols, coordinate common standards, and strengthen transparency, all while developing applications so our governments and companies can serve our citizens better.
Canada and Europe should also consider exploring an integrated market for financial services to broaden choice and reduce costs for our citizens, improve access to capital for our companies while maintaining our world-leading financial resilience.”
Official Text of speech: #canada #eu #europe #canPoli #cdnpoli #trade #security #war #russiaUkraineWar #theAmericanFascist

Honestly, what kind of scam #Akamai / #LInode is? They give you a form to report malicious activity from their network, you file it, you get "Error message to be decided", and it turns out they've banned you in the meantime; all their websites give you "Access denied".
And they host an exploit since 2021 at least: #security #abuse

Reading this, people could actually think Anthropic helps them keeping their data safe. However you still have to trust Anthropic itself that has access to all your data when using their AI or am i misreading it?
#AI #Anthropic #EFS #privacy #security

#BigTech #Billionaires #EatTheRich #Security #Win10 #TechSupport
So some press covered Zuckerberg's mega yacht not responding to a distress call and rightfully saying the Law Of the Sea requires aid to be rendered if possible.
Now, there's apparently a Win10 zero-day vulnerability in the wild. A vulnerability that Microsoft HAS A FIX FOR.
And yet they won't allow you to run it if you haven't paid up for support.
They should be REQUIRED TO RELEASE the fix to all.