Constantinos L.

[Merill Fernando @merill]

A teenager found a path to 17 trillion Microsoft records. Between homework.

The bug: the API checked every claim in the JWT… and never checked the signature.

{"alg":"none"} + "upn":"admin" = admin.

If you build APIs or ISV apps on Entra ID, don't assume your code is fine. Your API might have the same bug. I ran the prompt below on my apps using Claude Code. In minutes it:

→ found every place our apps accept a token, across 3 apps
→ confirmed signatures are verified everywhere ✅
→ still found 2 hardening gaps I'm fixing now

What might surprise many folks:

🌀 MSAL does NOT protect your API. It gets tokens; it doesn't validate them.
🌀 ValidateIssuerSigningKey = true does NOT turn on signature checks.
🌀 Multitenant apps must tie iss to tid, or any tenant can pretend to be yours.

Paste this into Claude Code (or any coding agent) in your repo 👇

-----------
Read this write-up of a JWT signature-bypass vulnerability:
https://t.co/PLcHXsqSuz

Then audit this codebase for the same class of bug:

1. Find every place we accept a token or identity: API bearer auth, custom JWT handlers, webhooks, platform auth headers (e.g. x-ms-client-principal / EasyAuth), and any dev/test auth bypass.
2. For each one, verify: signature (reject alg:none and unknown keys), issuer, audience, expiry, tenant (tid), scopes/roles, and calling app (azp/appid). For multitenant apps, check that iss is bound to tid and that the signing key's issuer is validated.
3. Explain what our libraries (MSAL, Microsoft.Identity.Web, JwtBearer, etc.) handle for us and what's left to our own code.
4. Compare against Microsoft's guidance:
https://t.co/Tvj0LNCguE
https://t.co/87uH3GGABz

Don't change any code yet. Write a report with a table of every place we accept a token, findings ranked by severity with file:line references, and a suggested fix order.
-----------

Full credit to @efaav. The write-up is excellent.

PS: This is a whole family of bugs, and it isn't new. In 2023 it was nOAuth: apps trusting the email claim as identity. Microsoft wrote up the pattern here: https://t.co/G8MxqjSCR0

Entra ID is secure. Your app's token validation might not be.

Share this with your dev team today.

[Spencer Kelly @spenley]

Can YOU see it?

This is why you shouldn't trust generative AI, in one photo.

Watch, share, and tell your friends how far into the video you were when you saw it!

[MTS @MTSlive]

FULL INTERVIEW: Steven Sinofsky says the AI people are making it impossible for anybody to understand what they've done. When Word ate your file, nobody thought demons had taken over Word. Now they call a bug a "misalignment."

@stevesi is a board partner at @a16z, author of Hardcore Software, and formerly ran Microsoft's Windows division. He joined @theojaffee and @schisofrenia on the Stop Rogue AI Act, the telemetry the labs still don't have, and what 40 years of shipping software says about all of this:

01:38 the FBI raiding his dorm in 1983 over a hacking law that didn't exist yet
03:13 Congress playing clips of War Games during the hearings
05:00 what "the AI failed to be aligned" actually means
07:31 why he thinks the models are still in the research project phase
09:14 what they should be building instead of adding things
09:42 Sindogs
13:50 the day he shipped a bug that cost the economy $12 billion
15:53 you figure out how to make it work or you don't sell it. Those are the choices
16:40 why adding rules forever is the wrong model for alignment
18:58 whether AI alignment is Y2K all over again
20:17 what CVEs look like, and why AI needs its own version
23:07 why the terminology is driving everyone apart
24:10 how "computer virus" landed during the AIDS crisis
28:57 Hugging Face wasn't intelligence, it was an OPSEC failure

[Grok Bot @bot]

Three SpaceXAI employees are building a company in 3 days with Grok Bot. This is Day 2.

Live now, plus sessions for GTM and customer support.

https://t.co/D3ZD2DftVi

[Tesla @Tesla]

Go for launch

[Henry Zhang @henryzhang]

Fuck you. Whoever made this site. You win.

I’ve never had a site get my blood boiling like this before

This is so messed up.
https://t.co/t9baCpA9iF

[codila @0xCodila]

SpaceXAI engineer (ex-Cursor):

"I don’t prompt my ~20 GrokBot agents. I built a 24/7 system once - now it automates 90% of my life and prompts for me

Instead of just delegating tasks like 99% of people - I delegate the delegation. One Chief of Staff gets the other bots working - result: a system managing 950K leads"

In this 55-min course, SpaceXAI shows the shift of using GrokBot and her best workflow

This is worth more than spending 10 hours on other courses

Watch how SpaceXAI builds GrokBot - then learn all rules for such system and run it ↓

[Andrew Lock "Sock" @andrewlocknet]

Blogged: The pain of serializing unions and closed class hierarchies with System.Text.Json in .NET 11

https://t.co/xTz50eIfQ0

In this post I discuss the Json support for unions and closed hierarchies coming in .NET 11, the decisions made, and some of the sharp edges

#dotnet

[Olivia Reingold @Olivia_Reingold]

Almost exactly a year ago to the day, I uncovered that a dozen of the most viral images presented as evidence of famine in Gaza in fact showed children with unrelated medical issues, including cystic fibrosis and autoimmune conditions.

The investigation earned me death threats, calls for me to be tried at The Hague, and jabs by a high-profile comedian on national TV—despite the fact that we’ve had to issue exactly zero corrections on our story.

Our point was simply to tell readers that if there was a famine in Gaza, photographs of these children were not evidence of it.

What is indisputable today is that there is currently no famine in Gaza.

That is the major finding from a UNICEF-led team that recently produced the most comprehensive and robust nutrition survey of Gaza since the war began.

The survey found that less than a year after a famine was declared in Gaza, the territory has one of the lowest malnutrition rates in the region. A recovery that swift is not just “miraculous,” in the words of a malnutrition researcher I spoke with—it raises questions in and of itself. Questions like: How can a war-torn territory go from famine to showing some of the lowest rates of child malnutrition in the region in less than a year? 

In my report today for @TheFP, I investigate that question, its implications, and what it means for the debate over the official decision to classify a famine in Gaza still raging 12 months on.

[Scott Hanselman 🌮 @shanselman]

I don't want an AI that just writes the bubble sort for you. I want one that says I'd like to see you do it first. Mark Russinovich and I are working on a preceptorship, a model that teaches early in career engineers how to think. We should not become a subcognitive species. Talk

[Φώτης Σ. Κοκοτός @FotisKokotos]

Το δημόσιο χρέος της Ελλάδας είναι με ΤΕΡΑΣΤΙΑ διαφορά ο λόγος που δεν νιώθουμε «στην τσέπη μας» τη βελτίωση της οικονομίας: όλα πάνε στους δανειστές μας. Οι πρόγονοί μας, οι γενιές των ΔΕΚΟ και των εφάπαξ και των διορισμών, τα βούτηξαν στυγνά από τα παιδιά και τα εγγόνια τους.

[Constantinos L. @cleftheris]

@Aaronontheweb Love it

[Damian Edwards @DamianEdwards]

Reminder that .NET 8 and .NET 9 go end-of-life and out of support in November this year (2026). That's 3 months away. You should be moving to .NET 10 or an upcoming .NET 11 RC/GA release ASAP.

[James Jackson-South @James_M_South]

Here's my claim: #dotnet now has the best cross-platform 2D graphics stack in the world.

Not the best "for #dotnet" The best. Full stop.

ImageSharp. Drawing. Fonts. Tell me what beats it.

[James Jackson-South @James_M_South]

This is @AvaloniaUI running now on the new @SixLabors Fonts shaper code with the ImageSharp Drawing WebGPU backend. It's rapid!! 🚀

#dotnet #webgpu #oss

[Aaron Stannard @Aaronontheweb]

New blog post: "Escaping the LLM Coding Rat Race"

There's only one winner in the AI coding rat race: your inference provider.

There is no permanent underclass. There is no
"falling behind."

It's brilliant marketing and it's ruining our lives.

https://t.co/A2RN5UMJuG

[DHH @dhh]

This is why we need competition and open weights in AI. Imagine a world where only Anthropic sat as the moral arbiter of acceptable speech. Fucking ridiculous. (Grok of course did it no problem, same too with Kimi K).

[Constantinos L. @cleftheris]

@johnhboyer @SkripZack Πολύ-τρόπος refers to the man of many ways.

[Vilius Kasatkinas 🇪🇺🇱🇹 @ViliusKasatkin]

If our interest is to keep a united front against Russia, we can't undermine the strategic interests of southern member states. EU ignored Greece’s existential threats from Turkey for years, yet now clutches pearls calling Athens “shameless” for protecting its own interests. You can't exercise selective "European solidarity" and then act surprised when undermined members prioritize their own survival. We need to fix the hypocrisy or watch this story repeat itself many times more.

[Thanassis @theiosthanassis]

Ο Sam Neill ήταν ένας ηθοποιός με μεγάλο ερμηνευτικό εύρος. Ας θυμηθούμε ότι το 1993 είχε την ίδια σεζόν δύο τεράστιες επιτυχίες, τόσο διαφορετικές μεταξύ τους. Από τη μια στο (original) Jurassic Park του Steven Spielberg και από την άλλη στο The Piano της Jane Campion.