Secrets management, practically
Not a survey of vaults. The specific practices that actually reduce risk, in order of what to do first.
#security
20 pieces tagged security,
from February 7, 2025 to July 8, 2026.
The Cyber Resilience Act and the unpaid maintainer
Europe is about to regulate software security across the whole product lifecycle. Open source is mostly carved out, and mostly is doing a lot of work.
Passkeys mostly won and nobody noticed
Phishing-resistant authentication is now the default on major platforms. The remaining problem is account recovery.
Prompt injection is SQL injection without the fix
The analogy is exact except for the part that matters: there is no parameterized query for natural language.
The dependency budget
Treat added dependencies like added latency: a number you spend deliberately, with a ceiling nobody may exceed quietly.
The component model and the plugin problem
WebAssembly's most important feature isn't running fast in a browser. It's letting you run someone else's code safely.
Post-quantum migration is a 2026 project
Harvest-now-decrypt-later makes this urgent for anything with a long confidentiality horizon. The tooling is finally ready.
2025, in order
The year in one page: what happened, what mattered, and the three things that will still matter in 2030.
Log4Shell, four years on
The industry built SBOM tooling, VEX, and a lot of dashboards. Here's what actually changed and what didn't.
ChatGPT Atlas and the browser as an agent runtime
OpenAI ships a Chromium-based browser with an agent that can act on pages. The prompt injection surface is now your whole session.
Windows 10 reaches end of support
A very large number of machines stop getting security updates. The e-waste and the enterprise scramble are both real.
Shai-Hulud: npm gets a self-replicating worm
A payload that steals credentials and then uses them to publish itself into other packages. This is the escalation everyone predicted.
everything else tagged #security 8
- chalk and debug get compromised, and 2 billion weekly downloads flinchnews
- The Nx compromise and the credential-stealing postinstallnews
- ToolShell: SharePoint gets exploited at scalenews
- ChatGPT Agent, and the browser sandbox as a productnews
- Chrome keeps third-party cookies after allnews
- PEP 750 lands: Python gets template stringsnews
- You did not audit that dependency and neither did Iessay
- Chrome finishes off Manifest V2news