There are some nice RNG changes in the pipeline for Linux 5.18, addressing a long standing crypto quasi-vuln in the RNG, going back to Linux 1.3.35. Gory details and some fun PoC code are in this commit: https://t.co/pvRbMAs9bb [1/3]
Fred and Amaury just committed an amazing work on #QUIC+HTTP/3 in #HAProxy 2.5! They're far too humble to admit it in part due to many remaining limitations and bugs, but here you can already see curl-7.80 ->HAProxy-cde911231 ->Apache-2.4 at work with H3 translated to H2! Kudos!
Ever curious about HTTP Smuggling? Check out HTB's Sink video, it abuses a bug between HAPROXY and GUNICORN to trick the server into writing someone else's HTTP Headers into your POST Request. Allowing you to steal the cookies! https://t.co/O1hLPJWxvz
Between the 3 Sept and 10 Sept, secure env vars of *all* public @travisci repositories were injected into PR builds. Signing keys, access creds, API tokens.
Anyone could exfiltrate these and gain lateral movement into 1000s of orgs. #security 1/4
https://t.co/i23jFzAjjH
It's finally ready:
Prodfiler, a continuous profiler that "just works" -- for C/C++/Rust/Go/JVM/Python/Perl/PHP -- no code change required, no symbols on the machine required, no service restart required.
Check out: https://t.co/EL2DHpoLkl or the blog post below.
I'm glad the @NSAGov "Quantum Computing and Post-Quantum Cryptography" FAQ dismisses quantum key distribution (QKD) as impractical.
There are several companies out there trying to push their QKD solutions, which aren't useful for anything.
https://t.co/ORjakFmjcp
@jjcarett2 my favorites have broken pseudocode and a note from the author on their website asking you to email them for the source.
Never have received a reply.
github copilot has, by their own admission, been trained on mountains of gpl code, so i'm unclear on how it's not a form of laundering open source code into commercial works. the handwave of "it usually doesn't reproduce exact chunks" is not very satisfying
This is an amazing paper. It implies (with strong statistical evidence) that the design of a major mobile-data encryption algorithm — used in GPRS data — was deliberately backdoored by its designer. https://t.co/kC4DUpceXN
This is bonkers:
At a large enough scale, you will have CPUs that develop silent corrupt execution errors. Manufacturing and burn-in tests miss these:
https://t.co/uUyW8RPR8w
The QUIC transport is now RFC9000 https://t.co/jw4aBbqYXP. Amazing work by everyone. Like recent protocols like TLS 1.3 its already deployed to a huge % of the internet traffic even before RFC which is a testament to the success of the IETF process.