Chris

Dependabot's implementation of Go modules continues to be poor.

FWIW, I recommend Go projects just turn it off, run govulncheck in a scheduled GitHub Action for security updates, and otherwise update dependencies manually when it makes sense in their release cycle.

This thread (and the answers) are a small gem, covering an almost forgotten piece of history of the security field.

1. Three new bad practices on use of known insecure or outdated cryptographic functions, hardcoded credentials, and product support periods. 2. Additional context added to the memory safety section. 3. Added additional examples of recommended actions to prevent SQL injection vulnerabilities. 4. Added additional examples of recommended actions to prevent command injection vulnerabilities. 5. Clarified timelines for patching Known Exploited Vulnerabilities (KEVs). 6. Added language for multi-factor authentication (MFA) specific to operational technology products. 7. Added that software manufacturers should support phishing-resistant MFA. 8. Other updates to phrasing throughout.

The FBI has released version 2.0 of its Product Security Bad Practices

PDF: www.ic3.gov/CSA/2025/250...

The changes are detailed in the image below

Oui oui, when in France!

New era of slop security reports for open source I'm on the security report triage team for CPython, pip, urllib3, Requests, and a handful of other open source projects. I'm also in a trusted position such that I get "tagged in" to other open sou...

Seth Larson, the maintainer of several crucial Python projects, says he is seeing an increase in "extremely low-quality" security reports submitted by bug hunters, suggesting researchers are using AI/LLM tools to discover vulnerabilities and put together reports.

sethmlarson.dev/slop-securit...

All that’s left is Giphy integration!

If it sounds like a duck and looks like a duck, its probably not a duck

I’ve experienced similar and bsky feels to be ticking all the boxes for me at least. This feels like Twitter of 2014(in a good way)

👋👋👋👋 botb was/is something useful in this space…

Wow so is bsky really maybe potentially becoming a thing now?

Ok, where are the South African hackers at? Post handles in replies if you see this please, and I’ll attempt a starter pack.

cc
@leonjza.bsky.social
@haroonmeer.canary.love

Once you are specifically targeted, chances are very good you will continue to see attempts to breach your defenses. APTs come for a purpose and there’s a reason the Persistent part of the name was chosen.

This could be gnarly if your proxychains setup is somewhat exposed..which it shouldn’t

So everybody from Musk's site seems to be here, yet my feed feels a bit anemic. What's a good trick to synch follows?

Total blast from the past…

In January, the Bluesky app began with a few hundred users. We’ve since grown past 1 million. I’m proud of what our team has accomplished in the last 9 months: we’ve open sourced the protocol and app, introduced self-verification via custom domains, and enabled algorithmic choice with custom feeds.

Tale as old as time: hackers hack stalkerware company because stalkerware is low-quality crap.

techcrunch.com/2023/08/26/b...

Now that’s a flex to aim for

NEW: Several attendees at Def Con saw mysterious alerts on their iPhones.

A researcher claimed responsibility and said it was a research project to teach people to turn off Bluetooth and "to have a laugh."

https://techcrunch.com/2023/08/14/researcher-says-they-were-behind-iphone-popups-at-def-con/

Today in 2000, 23 years ago, we introduced libcurl into the world. curl 7.1 was the first release featuring a separate library for Internet transfers, that curl was then made to use.

Today we estimate 20 BILLION installations worldwide.

Worse than npm or pip etc?

Wait, it’s summer camp next week already? #itsbeenawhile

Code Kept Secret for Years Reveals Its Flaw—a Backdoor A secret encryption cipher baked into radio systems used by critical infrastructure workers, police, and others around the world is finally seeing sunlight. Researchers say it isn’t pretty.

For 25+ yrs police, military, intel agencies and critical infrastructure around the world relied on the TETRA radio standard to secure critical communications. But now Dutch researchers have examined secret algorithms used in TETRA and found something startling - an intentional backdoor, and more

Ask @patrick.risky.biz to go on vacation?

This is valuable insight, thanks for sharing. How are you defining downturn? And what kind of timescales would you see as not crazy?

Yeah definitely that’d be great, let me know when you’re in London again!

Howsit bru!