Least privilege, actually applied
Everyone agrees with the principle. Almost nobody has checked what their service can actually reach.
#security
22 pieces tagged security,
from February 7, 2025 to September 25, 2026.
The Cyber Resilience Act's reporting clock starts today
From today, actively exploited vulnerabilities in products sold into the EU must be reported within 24 hours. Here's what that requires.
Secrets management, practically
Not a survey of vaults. The specific practices that actually reduce risk, in order of what to do first.
The Cyber Resilience Act and the unpaid maintainer
Europe is about to regulate software security across the whole product lifecycle. Open source is mostly carved out, and mostly is doing a lot of work.
Passkeys mostly won and nobody noticed
Phishing-resistant authentication is now the default on major platforms. The remaining problem is account recovery.
Prompt injection is SQL injection without the fix
The analogy is exact except for the part that matters: there is no parameterized query for natural language.
The dependency budget
Treat added dependencies like added latency: a number you spend deliberately, with a ceiling nobody may exceed quietly.
The component model and the plugin problem
WebAssembly's most important feature isn't running fast in a browser. It's letting you run someone else's code safely.
Post-quantum migration is a 2026 project
Harvest-now-decrypt-later makes this urgent for anything with a long confidentiality horizon. The tooling is finally ready.
2025, in order
The year in one page: what happened, what mattered, and the three things that will still matter in 2030.
Log4Shell, four years on
The industry built SBOM tooling, VEX, and a lot of dashboards. Here's what actually changed and what didn't.
ChatGPT Atlas and the browser as an agent runtime
OpenAI ships a Chromium-based browser with an agent that can act on pages. The prompt injection surface is now your whole session.
everything else tagged #security 10
- Windows 10 reaches end of supportnews
- Shai-Hulud: npm gets a self-replicating wormnews
- chalk and debug get compromised, and 2 billion weekly downloads flinchnews
- The Nx compromise and the credential-stealing postinstallnews
- ToolShell: SharePoint gets exploited at scalenews
- ChatGPT Agent, and the browser sandbox as a productnews
- Chrome keeps third-party cookies after allnews
- PEP 750 lands: Python gets template stringsnews
- You did not audit that dependency and neither did Iessay
- Chrome finishes off Manifest V2news