security things in Linux v5.3
5
votes
-
-
Announcing GitHub Security Lab: securing the world’s code, together
5 votes -
Bytecode Alliance: Building a secure by default, composable future for WebAssembly
9 votes -
The benefits of test-case reduction, and tools that can help do it automatically
3 votes -
Chrome 0-day exploit CVE-2019-13720 used a race condition and a Use-After-Free to install persistent malware on Windows
10 votes -
Cloudflare's implementation of the Network Time Security protocol, written in Rust
8 votes -
Certbot usability case study: Making it easier to get HTTPS certificates
12 votes -
Critical security issue identified in iTerm2 as part of Mozilla open source audit
12 votes -
How a double-free bug in WhatsApp for Android could be turned into a remote code execution vulnerability
6 votes -
New DDoS vector observed in the wild leveraging WS-Discovery for amplification, attacks hitting 35 Gbps
11 votes -
If you’re not using SSH certificates you’re doing SSH wrong
9 votes -
A very deep dive into iOS Exploit chains found in the wild
4 votes -
The researcher who published the Steam Windows privilege-escalation exploit two weeks ago has published a second zero-day
13 votes -
Report: Data Breach in Biometric Security Platform Affecting Millions of Users
8 votes -
Down the Rabbit Hole: Reverse-engineering the Windows Text Services Framework and discovering major vulnerabilities that have existed for almost 20 years
8 votes -
Recognizing basic security flaws in local password managers
19 votes -
Netflix has discovered multiple vulnerabilities in HTTP/2 implementations that can be used in denial of service attacks
14 votes -
Extended Validation Certificates are (Really, Really) Dead
8 votes -
Say cheese: Ransomware-ing a DSLR camera
11 votes -
Coinbase describes their investigation and response to a sophisticated phishing attack on their employees utilizing two Firefox zero-day vulnerabilities
10 votes -
The Fully Remote Attack Surface of the iPhone
8 votes -
Local Privilege Escalation exploit found in Steam Windows client - Valve rejected the report, and HackerOne tried to forbid disclosure
12 votes -
An Introduction to Mobile Networks, SIM Cards, and GSM.
9 votes -
How (not) to sign a JSON object
8 votes -
Slack Security Incident for Keybase CEO
20 votes -
The PGP Problem
12 votes -
Monsters in the Middleboxes: Introducing Two New Tools for Detecting HTTPS Interception
9 votes -
Introducing time.cloudflare.com, a free time service that supports both NTP and the emerging Network Time Security (NTS) protocol for securing NTP
13 votes -
Towards Post-Quantum Cryptography in TLS
8 votes -
Google Project Zero researcher releases denial-of-service vulnerability in Windows SymCrypt library
9 votes -
Project Svalbard: The Future of Have I Been Pwned
25 votes -
The Problem with SSH Agent Forwarding
4 votes -
I’m harvesting credit card numbers and passwords from your site. Here’s how.
17 votes -
Tor Browser for Android 8.5 offers mobile users privacy boost
3 votes -
Git ransom campaign incident report—Atlassian Bitbucket, GitHub, GitLab
14 votes -
CPU.fail - Multiple attacks against modern Intel CPUs disclosed (ZombieLoad, RIDL, Fallout)
43 votes -
The Trade Secret: Firms That Promised High-Tech Ransomware Solutions Almost Always Just Pay the Hackers
9 votes -
Matrix.org - Post-mortem and remediations for Apr 11 security incident
9 votes -
HTTP headers for the responsible developer
7 votes -
Buckeye (cyber espionage group linked to China) was using NSA hacking tools at least a year before the Shadow Brokers leak
5 votes -
XSS attacks on Googlebot allow search index manipulation
7 votes -
OpenBSD 6.5 Is Released!
11 votes -
Matrix.org data breach
26 votes -
AndroidHardening project (CopperheadOS successor) renamed to GrapheneOS
5 votes -
Microsoft Defender ATP investigation unearths privilege escalation flaw in Huawei PCManager
5 votes -
Why OpenBSD Rocks
16 votes -
Does anyone here work in infosec? If so, which laptops are you allowed to use?
I’ve recently gotten to speak with a few folks who work at an enterprise security company. I asked what their security researchers set as company rules for allowed laptops. My one datapoint so far...
I’ve recently gotten to speak with a few folks who work at an enterprise security company. I asked what their security researchers set as company rules for allowed laptops. My one datapoint so far is “Dell or Apple.” So for example, no Thinkpad X1 Carbon, which is arguably the best work laptop.
I am curious what other large security companies (or any of you security minded folks) set as rules for trusted laptops. Can anyone share their lists and theories as to why I heard Dell and Apple? BIOS is more trustworthy?
10 votes -
Intelligent Tracking Protection 2.1 in WebKit
4 votes -
Analysis of a Kubernetes hack — Backdooring through kubelet
3 votes -
CVE-2019-5736: runc container breakout (all versions)
11 votes