Do Users Verify SSH Keys? (2011) [pdf](usenix.org)

35 points by 8organicbits 1 year ago | 39 comments

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor(safedep.io)

582 points by abhisek 8 days ago | 192 comments

SafeDep analysis of the compromised LiteLLM 1.107.0 PyPI release, which installed a credential stealer and remote-code backdoor via .pth and sitecustomize files, with IOCs.

VeraCrypt: Free open-source disk encryption for Windows, Mac OS X, Linux(veracrypt.fr)

297 points by thunderbong 3 years ago | 145 comments

Linux Kernel Exploitation: Attack of the Vsock(hoefler.dev)

223 points by todsacerdoti 1 year ago | 65 comments

OpenSSH 9.5 released with keystroke timing obfuscation(lwn.net)

199 points by surteen 3 years ago | 41 comments

The KeePassXC Kerfuffle(lwn.net)

45 points by todsacerdoti 2 years ago | 30 comments

Your hex editor should color-code bytes(simonomi.dev)

569 points by tobr 6 months ago | 151 comments

Blog post by Alice Pellerin arguing that hex editors should color-code bytes to make binary data easier to read.

The RCE that AMD won't fix(mrbruh.com)

343 points by MrBruh 8 months ago | 144 comments

Blog post describing a remote code execution vulnerability found by decompiling AMD's AutoUpdate software, which AMD declined to fix.

Claude Code can debug low-level cryptography(words.filippo.io)

446 points by Bogdanp 1 year ago | 199 comments

Filippo Valsorda's blog post on using Claude Code to debug his new Go implementation of the ML-DSA post-quantum signature algorithm.

Spotting base64 encoded JSON, certificates, and private keys(ergaster.org)

323 points by jandeboevrie 1 year ago | 130 comments

A TIL blog post explaining how to recognize base64-encoded JSON, certificates, and private keys by their characteristic leading characters.

Encrypting private data and private communications is now an ethical duty(blog.tripu.info)

416 points by gasull 3 years ago | 200 comments

A personal blog essay arguing that end-to-end encrypting private data and communications has become an ethical duty, using a glass-walls analogy.

Data accidentally exposed by Microsoft AI researchers(wiz.io)

661 points by deepersprout 3 years ago | 212 comments

Wiz Research blog post describing how a misconfigured Azure SAS token in a Microsoft AI GitHub repository exposed 38TB of internal data, including Teams messages.