LinkedIn Is Illegally Searching Your Computer

https://browsergate.eu

#tech #technology #BigTech #IT #enshittification #microslop #microsoft #LinkedIn #social #media #SocialMedia #data #security #safety #InfoSec #internet #web

OpenSSH 10.3 released

https://lwn.net/Articles/1065991/ #LWN #Linux #security #OpenSSH

Security updates for Thursday

https://lwn.net/Articles/1066084/ #LWN #Linux #security

Last summer I looked at the Internet exposure of a few #ICS devices that have historically been the subject of attacks by Iranian threat actors. Given continued activity in the region, I refreshed that data and took another look at exposures.

Good news: all four device/software types showed at least a slight decrease in exposures since last June, even if we aren't entirely sure why.

More details + graphs here: https://censys.com/blog/ics-iran-part-2-revisiting-exposure-of-previously-targeted-ics-devices/

#security #infosec

if you like this, I'm aiming to provide at least one #foss project with an app icon every week.

honoured to have gained around 40 supporters in my first jobless month! ❤️

your sponsorship will help me keep this up. :)

https://mastodon.social/@hbons/116166139945148680

#linux #gnome #app #icon #design #security

Peter Sanchez boosted

Hylke Bons 🥜 » 🌐 2026-03-03
@hbons@mastodon.social

hey everyone,

you may have guessed reading between the lines, but I lost my job in the recent tech layoffs…

also burnt out and realised I need to go back to working on stuff I care about.

I hope to gather enough small monthly sponsors to at least cover the bills, so I can:

- 🖥️ create beautiful apps for #Linux / #GNOME

- ✏️ provide free #design support to #OpenSource projects

if you like my work, please consider $1/month to make this possible?

thank you. :)

https://github.com/sponsors/hbons

Meanwhile in the UK, government stitch ups continue unabashed

https://www.theregister.com/2026/04/01/peoples_panel_digital_id/

#DigitalID #IDCard #UKPol #Labour #LabourPOl #WetDreams #IT #Privacy #Security #Control

This article about #anthropic ‘s #claude CLI is also hysterical (in a making me want to give up #security and join a commune kind of hysterical) because of the anthropomorphising of the AI.

What is the most frustrating aspect of LLMs? Many would use the anthropomorphic term “hallucination.” Apparently #hallucinations are bad but “dreams” are good?

When a user goes idle or manually tells Anthropic to sleep at the end of a session, the AutoDream system would tell Claude Code that “you are performing a dream—a reflective pass over your memory files.”

“Why does my code say that Wonder Woman is running a taco truck downtown and I’m the only person who can save her dog?” Oh. Right. It was dreaming.

We can quit #cybersecurity and just go farm potatoes or something. After 25 years of #appsec one of the most talked-about tech companies invents a daemon process that

makes use of a file-based “memory system” designed to allow for persistent operation across user sessions.

Sure. Just store your system instructions in a random text file.

Why are we installing endpoint protection on this system?

Why do we verify cryptographic signatures on software updates to this system?

Why are we building a zero trust security environment?

Why do we do scan email to avoid social engineering emails?

Our AI-assisted users are gonna YOLO right past all that. And if they can’t get past our #security controls, this agentic Frankenstein will write itself some markdown and work quietly in the background figuring out how to bypass something the user couldn’t bypass on their own.

This is #infosec in 2026

done! drew the rest of the f***ing owl.

#linux #gnome #app #icon #design #security

Alt...

App icon for BitRitter in the GNOME icon style. A light blue shield with a thick darker blue border. Overlayed is a password field.

TLS and SSH rely on Certificate Authorities (CAs) for authentication, but they also present a vector for Man in the Middle attacks. What if you could set up your own CA to reduce your exposure?

➡️ https://fedoramagazine.org/make-a-private-ca-with-step-ca/

#WebDev #Linux #Security #InfoSec #Cybersecurity #Fedora

Security updates for Wednesday

https://lwn.net/Articles/1065814/ #LWN #Linux #security

Great distraction from the Epstein files and the thickening quagmire in Iran — but it's not going to lower gas prices nor help with the midterms:
U.S. plans a witch hunt — err... antifa summit.

Deflect and distract. 🙁
https://www.reuters.com/world/us/us-counterterror-officials-plan-antifa-summit-sources-say-2026-03-31/
h/t @Nonilex
https://masto.ai/@Nonilex/116323980616642754
#AntiFascism #antifa #resist #law #security #fascism #FarRight #authoritarianism #tyranny

Vulnerability Research Is Cooked (sockpuppet.org)

https://lwn.net/Articles/1065586/ #LWN #Linux #security

Security updates for Tuesday

https://lwn.net/Articles/1065585/ #LWN #Linux #security

Running your own identity provider is all fun and games until you're debugging OIDC token flows at 2 AM.

If you want to deploy Keycloak 26 the right way - with proper network isolation, no plaintext passwords, and systemd-native declarative configs. I just published a new deep-dive.

We're ditching compose files and building a production-ready, daemonless stack using Podman Quadlets and systemd.

Read the full guide here: https://blog.hofstede.it/keycloak-26-on-podman-with-quadlets-identity-management-the-systemd-way/

#Linux #Podman #Keycloak #systemd #DevOps #Containers #SelfHosted #RHEL #Security

Axios has been hacked...

https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

#security #javascript #frontend

#NPM #axios maintainer has lost control of their account. Malicious versions 1.14.1 and 0.30.4 have been published which include a RAT.

NPM has pulled the effected versions and the payload. Time to clean up and see if you were effected.

StepSecurity has an awesome write up on this issue with #iocs

Link follows this toot.

#CTI #infosec #node #cybersecurity #security #nodejs #js #malware

Keep in contact with colleagues without having to give your phone number

With #ArcaneChat you can also keep separated profiles, one for family and more intimate friends and other for people you don't have so close relation with

#privacy #security #family #friends #autonomy #chatapp #opensource #digitalindependence #autonomy #european #europe

Alt...

ArcaneChat: Welcome to private chatting

"Spain closes its airspace to all US aircraft involved in Iran war"

#Russia #India #China #USA #Economy #Finance #Technology #Security #Hybrid #Iraq #News #Iran #Israel #War #EU #NATO #Oil #Escalation #Spain

https://www.euronews.com/2026/03/30/spain-closes-its-airspace-to-all-us-aircraft-involved-in-iran-war

Security updates for Monday

https://lwn.net/Articles/1065419/ #LWN #Linux #security

I teach cybersecurity. And I genuinely don't know what to tell my students after this one. Federal reviewers spent years trying to get basic encryption documentation from Microsoft for its GCC High government cloud. They couldn't get it. One reviewer called the system a "pile of spaghetti pies," with data traveling from point A to point B the way you'd get from Chicago to New York: a bus to St. Louis, a ferry to Pittsburgh, and a flight to Newark. Each leg is a potential hijacking. They knew this. They said this out loud in writing. Then they approved it anyway in December 2024, because too many agencies were already using it. 🔐 That's not a security review. That's a hostage negotiation. Two things in this story should make every CISO and CIO uncomfortable:

🧩 Microsoft built its federal cloud on top of decades of legacy code that it apparently can't fully document itself
👮 "Digital escorts" often ex-military with minimal software engineering backgrounds are the firewall between Chinese engineers working on the system and classified U.S. networks 🤦🏻‍♂️

The scariest line in the whole ProPublica investigation isn't the "pile of shit" quote. It's this: FedRAMP determined that refusing authorization wasn't feasible because agencies were already using the product. Read that again. The security review process reached a conclusion based on sunk cost, not risk. Ex Post Facto Fallacy

If that logic holds, the compliance framework is just documentation theater. And right now, CISA is being hollowed out, so there are fewer people left to even run the theater.

https://arstechnica.com/information-technology/2026/03/federal-cyber-experts-called-microsofts-cloud-a-pile-of-shit-approved-it-anyway/
#Cybersecurity #Microsoft #FedRAMP #Leadership #RiskManagement #security #privacy #cloud #infosec

Oh boy. Stanford researchers scanned 10 million web pages and found API keys just sitting in the public-facing code. That's 1,748 active credentials from major providers exposed in live website code, mostly inside JavaScript files. Not in old test environments. Not in a forgotten repo. In the live, running site. Banks. Healthcare providers. "Not just small companies, but some very large companies," according to the lead researcher. And some of those credentials had been sitting there for years. Not the first time I've seen something like this. 🤦🏻‍♂️

The thing is that most orgs are scanning their source code but not their deployed sites. 😳 Those are two different things, and most leaks originate during the build process. A key gets baked in somewhere between development and production, and nobody catches it because the scan already ran upstream. Meanwhile, GitGuardian counted over 28 million new hardcoded secrets exposed in public GitHub commits in 2025 alone. This isn't a one-time research finding it's a systemic habit that needs to change.

🔍 When did your team last scan the live site, not just the codebase?
🏦 If you're in a regulated industry, that question just became a compliance question too

https://www.newscientist.com/article/2520143-security-credentials-inadvertently-leaked-on-thousands-of-websites/
#Cybersecurity #AppSec #Leadership #security #privacy #cloud #infosec

if you are looking for a messenger to use with the kids, take a look at #ArcaneChat

no SIM card needed, no phone number required for registration, easy setup, just set a name

kids can NOT be discovered by strangers

No public groups or channels, kids can NOT discover inappropriate content

just the family chat

#kidsonlinesafety #onlinesafetyforkids #kids #family #chat #messenger #privacy #security

[$] The many failures leading to the LiteLLM compromise

LiteLLM is a gateway library providing access to a number of large language models (LLMs); it is popular and widely used. On March 24, the word went out that the version of LiteLL [...]

https://lwn.net/Articles/1064693/ #LWN #Linux #security #Python #Git

The telnyx packages on PyPI have been compromised

https://lwn.net/Articles/1065059/ #LWN #Linux #security

Security updates for Friday

https://lwn.net/Articles/1065015/ #LWN #Linux #security

Security updates for Thursday

https://lwn.net/Articles/1064761/ #LWN #Linux #security

[$] Collaboration for battling security incidents

The keynote for Sun Security Con 2026 (SunSecCon) was given by Farzan Karimi on how incident handling can go awry because of a lack of collaboration between the "good guys"—which s [...]

https://lwn.net/Articles/1063459/ #LWN #Linux #security #Android

Setting up a Tor Relay at National Taiwan Normal University (Tor Blog)

https://lwn.net/Articles/1064671/ #LWN #Linux #security

Security updates for Wednesday

https://lwn.net/Articles/1064634/ #LWN #Linux #security

"The FCC notes that miscreants have exploited security flaws in routers to disrupt networks or steal intellectual property, and routers are also implicated in the Volt, Flax, and Salt Typhoon cyberattacks.

There is an element of hypocrisy in all this because American intelligence agencies were previously caught intercepting Cisco-made routers on their way to customers and updating their firmware to deploy espionage tools."

#Security

https://www.theregister.com/2026/03/24/fcc_foreign_routers/?

Heute: eBPF und Seccomp 🧑‍💻

#Linux #security

Alt...

Screenshot of C code with BPF Macros

🚨 The FCC bans all routers made outside the U.S. — So basically all routers.

Most people buy a router and never think about it again. That box in the corner that handles every password and video call you make. The FCC is now worried that some of these devices are actually open doors for foreign governments. Shocked! 🫢

Regulators are looking at TP-Link to see if they pose a threat to national security. Recent reports show hackers used these devices to build massive botnets. You might find yourself shopping for new hardware if these bans take effect.

🧠 Regulators are weighing a ban on specific foreign routers.
⚡ Security experts found flaws that allow remote access.
🎓 This move follows previous restrictions on Chinese tech firms.
🔍 Check your hardware brand before the new rules arrive.

https://mashable.com/article/us-fcc-foreign-router-ban
#FCC #Security #TechPolicy #security #privacy #cloud #infosec #cybersecurity

Learned _a lot_ about namespaces and the corresponding Linux syscalls today 😵‍💫🤯

#Linux #namespaces security #training

LiteLLM on PyPI is compromised

https://lwn.net/Articles/1064479/ #LWN #Linux #security

Security updates for Tuesday

https://lwn.net/Articles/1064474/ #LWN #Linux #security

RE: https://ec.social-network.europa.eu/@EUCommission/116277689173412114

What an effing joke.
This Cyber Resilience Act (CRA) dumps mandatory cybersecurity requirements on manufacturers using FOSS, while the @EUCommission guts and cancels even its already pathetic, support for FOSS projects.
Add the total pants-down surrender on issues like #chatcontrol, the gutting of citizen safeguards through the changes to #GDPR and #eIDAS 2.0:
An absolute disgrace

#eu #europe #foss #security

Jan Wildeboer 😷 boosted

European Commission » 🌐 2026-03-23
@EUCommission@ec.social-network.europa.eu

Europe champions digital freedom and its open source community.

We have introduced a tailored approach to boost open source development across EU countries and ensure it is safe from cyber threats.

We only apply security rules to software used in commercial activities.

We are also creating open source software stewards to support security with a light-touch regime and no administrative fines.

Find out more 👇
https://link.europa.eu/Jc7hBy

Alt...

The image features the phrase "Be open. Be bold. Be" written in white text centered against a deep blue background. Below the word "Be," there is a circle of twelve golden yellow stars, which is the iconic emblem of the European Union.

Instead of handing government contracts to predatory Big Tech, the UK should ensure we have control of our digital infrastructure.

Even secure systems are fragile if a foreign company or power can pull the plug.

Sign our petition for a digital sovereignty strategy that priorities UK open source ⬇️

https://you.38degrees.org.uk/petitions/stop-trump-s-kill-switch-secure-our-digital-sovereignty

#DigitalSovereignty #palantir #bigtech #security #ukpolitics #ukpol

The UK’s reliance on US Big Tech is a national security issue ⚠️

But the UK is giving the controversial spyware company Palantir more contracts and more access to our data.

We're increasingly vulnerable to companies that lock us in to proprietary systems, creating dependency not independence.

https://www.theguardian.com/technology/2026/mar/22/palantir-extends-reach-into-british-state-as-it-gets-access-to-sensitive-fca-data

#DigitalSovereignty #palantir #bigtech #security #ukpolitics #ukpol

Security updates for Monday

https://lwn.net/Articles/1064298/ #LWN #Linux #security

When was the last time you checked for a firmware update for your networking hardware? Is your router running up to date software?

#Security

H&R Block tax software installs a TLS root certificate with bundled private key https://lobste.rs/s/d5nvf5 #security
https://news.ycombinator.com/item?id=47457162

Exciting news. I've just pushed a collection of ports for the #OpenPGP Card ecosystem to Codeberg.

Includes:
- openpgp-card-tools (oct)
- openpgp-card-tools-git (oct-git)
- openpgp-card-ssh-agent

I'm currently polishing them for official submission to the freebsd ports tree this April!

A huge thank you to @hko for these excellent #Rust tools!

https://codeberg.org/Larvitz/freebsd-openpgp-card-ports

#freebsd #Security #Smartcard #Yubikey #Nitrokey #Infosec #RustLang