eikendev

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

OpenAI updated their partnership agreement with Microsoft: they can now serve all their products to customers across any cloud provider. openai.com/index/next-p...

Wrote up some thoughts on Anthropic's Project Glassing, where their latest Opus-beating model is available to partnered security research organizations only. Given the recent alarm bells raised by credible security voices I think this is a justified decision. simonwillison.net/2026/Apr/7/p...

Hearing about the urgency from serious cryptographers is worrying. A solid PQC migration will take years for normal enterprises. It’s a good idea to start now with mapping out potentially affected services, resolving maintainership, and ensuring budget & expertise is in place when needed.

“Using go fix to modernize Go code” by Alan Donovan — https://go.dev/blog/gofix #golang

Plasma 6.6 is now live! Spectacle can read texts from screenshots; we got our own on-screen keyboard; and we have a new first-time wizard that let's users configure their passwords, timezones, keyboard and networks, on preinstalled systems; among many, many more things. kde.org/announcement...

I always assumed that #passwordmanagers were simple objects -- create a database, encrypt it, send it to the server, done. I could not have been more wrong! At zkae.io, we take a look at all the hidden complexity in cloud password managers, and the #attacks that result from that. (ia.cr/2026/058)

Do you use a cloud-based password manager? So what's your threat model? Vendors like Bitwarden, Dashlane, LastPass and 1Password offer you "Zero Knowledge Encryption", with statements like: "Not even the team at Bitwarden can read your data (even if we wanted to)." We decided to test this… 1/n

A $100B funding round is nuts. This is after raising $40B last year. $20B ARR sounds impressive until you realize they are losing money faster than they’re making it and need massive infusions of cash every few months to keep going.

The conversation is corrupt. Business as usual in 2026. #chatgpt #openai

DaVita says ransomware gang stole data of nearly 2.7 million people ift.tt/d4oxbZg

I wrote up some notes on Google Security's new OSS Rebuild project, which increases supply chain security for popular packages on PyPI, NPM and Crates through offering independent build attestations simonwillison.net/2025/Jul/23/...

Yikes. Turns out you can send a plaintext radio signal to cause any train in the USA to do an emergency break. The original 'security' was just a checksum, no encryption or authentication. Reporting this took them 12 years (!) because the vendor dismissed it initially www.cisa.gov/news-events/...

Wrote up some notes on that recent paper from METR "Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity" simonwillison.net/2025/Jul/12/...

It has officially begun. The CRA info request counter is no longer at zero.

Some notes on Grok 4: excellent benchmark scores, a mid-quality pelican and a launch that was overshadowed by this week's disastrous Grok 3 system prompt update simonwillison.net/2025/Jul/10/...

Cloudflare has launched Orange Me2eets, an open-source end-to-end encrypted video calling demo! Built on top of our OpenMLS implementation, this project showcases secure, private real-time communication. buff.ly/eEdJdnf #Cloudflare #E2EE #VideoCalling #OpenSource #OpenMLS

June treasury data came in today, and Americans paid a record $27B in tariffs & related DHS excise taxes this month—for an annualized pace of more than $300B/year The graph of intense pain & suffering keeps getting worse

What a great way to put it: "When an agent struggles, so does a human."

Good Monday morning tech nerds. One of my devs wrote *another* blog post about kerberos (I'm creating an army of crazy bloggers). This one you might consider bookmarking.

Another prompt injection paper review! This time it's "An Introduction to Google’s Approach to AI Agent Security" by Santiago Díaz, Christoph Kern, and Kara Olive Some interesting ideas in here, particularly around Google's three core principles for agent security simonwillison.net/2025/Jun/15/...

"Design Patterns for Securing LLM Agents against Prompt Injections" is an excellent new paper that provides six design patterns to help protect LLM tool-using systems (call them "agents" if you like) against prompt injection attacks Here are my notes on the paper simonwillison.net/2025/Jun/13/...

I can see how that whole “AI shifts the bottleneck from skill to judgment” idea makes a lot of sense. Especially so with coding agents. Writing code is easy now. The hard part is breaking things down and knowing what good output looks like.

This story is just wild. The TeleMessage backend was implemented using Spring Boot, and exposed a heapdump endpoint that allowed *anyone* to dump the heap memory of the web server. Anyone! 😳 Unauthenticated! 😱 In 2025! 🤯 www.wired.com/story/how-th...

Very excited to submit the Tuscolo Certificate Transparency logs for inclusion today! 🧾🪵☀️ These logs are Sunlight-based, and operated by Geomys and Port 179 LTD on bare metal. They cost 50 times less than RFC 6962 logs in the cloud. https://groups.google.com/a/chromium.org/g/ct-policy/c/KCzYEIIZSx

TeleMessage, the Israeli company that makes the modified Signal app used by Trump officials, was hacked. “I would say the whole process took about 15-20 minutes,” the hacker said micahflee.com/the-signal-c...

We're proud to announce the release of Binary Ninja 5.0. Here's some highlights: Union Support, Dyld Share Cache & Kernel Cache, Firmware Ninja, Auto Stack Arrays, Stack Structure Type Propagation, and so much more. Check out the blog post for more information: binary.ninja/2025/04/23/5...

Interesting talk about the plans for a digital identity system for EU citizens, and some of the cryptographic thinking going on behind the scenes media.ccc.de/v/38c3-eu-s-...

China fires up the world's first thorium-fueled nuclear reactor, a 2 megawatt research reactor located in the Gobi Desert cooled and fueled by molten salt futurism.com/china-thoriu... Thorium is much more abundant than uranium & thorium fueled reactors are poor choice for making an illicit weapon 🔌💡

BREAKING. From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

Meta just dropped Llama 4 on a weekend! Two new open weight models (Scout and Maverick) and a preview of a model called Behemoth - Scout has a 10 million token context Best information right now appears to be this blog post: ai.meta.com/blog/llama-4...

🦀 Hello World! The Rust project now has an official presence on Bluesky! ✨ We'll be posting the same on our Mastodon and Bluesky accounts, so you won't miss anything on either platform.

Paged Out! #6 has arrived! And it's jam-packed with content! You can download it here: pagedout.institute?page=issues....

ChatGPT now has 20 million paid subscribers which is approximately $415M/month and $5B/year. It’s truly a remarkable feat to go from zero to $5B In annual revenue in 2.5 years. It’s also remarkable that it’s still so unprofitable that OpenAI needed to raise an additional $40B this week. 🤯

Trump/Musk just laid off the entire VA info security team, in the middle off the night, this weekend.

Once again I am leaving the Munich Security Conference in a low mood. Amongst all the noise, the US signalled their plans for Europe, so things are becoming clearer. But things are clearly not good. This is what we now know, and what we have to do about it:🧵1/17

Hey @parrotsec.bsky.social, it looks like the "current" symlink at deb.parrot.sh/parrot/iso/c... is returning a 404. Could you check what's wrong with it? Thanks for all your hard work!

The farcical "reciprocal tariff" memo Trump signed today explicitly promises tariffs in retaliation for a value-added-tax (VATs), which notably aren't a tariff/trade barrier It gives a pretext to "retaliate" against almost any country on earth—basically all of them have VATs

Very cool work from the team at Meta. A more comprehensive and valuable approach than purely asking an LLM to write a test. engineering.fb.com/2025/02/05/s...

🚨Trump’s first major tariff hike has officially gone into effect—a 10% tax increase on all imports from China, including the suspension of the “de minimis” exemption for small packages (like from Temu/Shein) is effective as of 12:01 am. That hits roughly $430B in US imports

Finally! Grats! datatracker.ietf.org/doc/rfc9700/

Good graphic from Pew on what the federal workforce actually looks like. “insurance company with an army” indeed

New attacks on load address prediction, affects Apple Silicon. predictors.fail

Curious what Kim Vorrath can do for Siri, now that she’s joined the AI team. Siri has always been underwhelming; maybe she’s the one to change that.