security
It's a fantastic look at early incident response, code auditing, and how OpenBSD handled one of the first major software supply-chain attacks.
Definitely worth a read:
http://miod.online.fr/software/openbsd/stories/trojan.html
#openbsd #openssh #security
ITScape: Guest-to-Host Escape in KVM/arm64 https://lobste.rs/s/jst2wq #linux #security
https://github.com/V4bel/ITScape
LG to Ban Residential Proxies from Smart TV Apps https://lobste.rs/s/ny0yzm #security
https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/
Lets Encrypt June ToS Update: no more for US sanctioned people https://lobste.rs/s/xo62fe #pdf #security
https://letsencrypt.org/documents/LE-SA-v1.7-June-04-2026-diff.pdf
Securing agentic identity https://lobste.rs/s/ssdcnh #security
https://codon.org.uk/~mjg59/blog/p/securing-agentic-identity/
TrustZone Intermezzo: Broken OP-TEE Memory Isolation on i.MX 8M https://lobste.rs/s/uz1fle #linux #security
https://sigma-star.at/blog/2026/06/trustzone-intermezzo/
CVE-2026-45257: LPE in FreeBSD via kTLS-RX https://lobste.rs/s/bdyu6l #security
https://bumsrake.de
Newly discovered PamStealer isn't your typical macOS malware https://lobste.rs/s/q4m3fa #mac #security
https://arstechnica.com/security/2026/07/new-pamstealer-macos-malware-uses-clever-tradecraft-to-remain-stealthy/
EC2’s formally verified “isolation engine” provides mathematical assurance of virtual-machine isolation https://lobste.rs/s/efnxre #formalmethods #osdev #security #virtualization
https://www.amazon.science/blog/ec2s-formally-verified-isolation-engine-provides-mathematical-assurance-of-virtual-machine-isolation
Hacking Google with A.I. for $500,000 https://lobste.rs/s/qxaqdd #security #vibecoding
https://brutecat.com/articles/hacking-google-with-ai/
Reuse Less Software https://lobste.rs/s/3mg7xo #programming #security
https://wiki.alopex.li/ReuseLessSoftware
Connecting The Meta Privacy Dots
As dangerous as it is, I find it somewhat humorous to watch the reactions to some of the actions Meta is taking to gather up and reprocess what we see and hear. Especially from the always hungry for some new cool tech crowd. On the one hand you can’t blame someone from wanting the next new thing to play with. On the other you also can’t blame tech companies for taking advantage of hobbyists’ hunger.
Every where you turn on the Internet, everyone is posting about Meta changing its Instagram policy so that unless Instagram users opted out, any of their content on that platform was now free for the grabbing by anyone using Meta’s AI tools to create and distribute. You can imagine the possible nasty outcomes of what that would be like. Certainly if you’ve been paying even a smidgen of attention to the goings on with Grok.
It’s also been interesting to watch the small avalanche of users on other social media announcing that they are taking their Instagram accounts private, opting out by flipping the designated switches, or just bailing on Instagram altogether.
Almost parallel to this policy change happening word spread from Joanna Stern, among others, about a trend (and apparent underground business opportunity) of users of Meta’s smart glasses who were disabling the mechanism that displayed the warning light when the camera was recording. Talk about a poke in the eye with a sharp stick.
Meta quickly moved to put the kibosh on that with a software update that disabled the cameras if the warning light was tampered with. (I wonder if it works if you just taped over the camera?)
Privacy focused tech geeks were all over that, praising Meta for moving so swiftly to counter the hack.
But hold on a minute. These stories don’t end there. According to a report from The Financial Times, Meta is testing ‘super sensing’ AI glasses that can record video and audio continuously.
Here’s a quote:
The $1.5tn social media platform has been advancing a new hardware line of smart glasses that would continuously record audio while taking photos every few seconds, according to multiple people familiar with the matter. A user could then use AI to help query what they saw or heard, or recall their day.
And the worm continues to turn:
With Meta’s current AI smart glasses, an LED in the corner of the frame lights up to signal to others when a wearer is taking photographs or filming.
However, executives are currently planning not to activate the LED when the super-sensing features are being used, according to multiple people familiar with the matter. That would make it harder for bystanders to know when they were being recorded, potentially intensifying the privacy concerns surrounding the technology. Those plans could still change, however, several people said.
It’s pretty easy to connect the dots between these two stories. Mark Zuckerberg wants anything and everything he can on you, and he doesn’t care how it’s used once he has his paws on it and his data centers crunching it. The privacy implications are certainly real, even if you don’t use a Meta product but fall within camera or microphone range of someone who does.
We’ve heard all of this before in different contexts. Microsoft caught all kinds of hell for Windows Recall, a feature that continually monitored and recorded what was on your screen. I’m old enough to remember the hue and cry about Google Glasses back in the day.
It’s a bit eerie how those at the time very visceral reactions seem to have softened in this new era of folks rushing to turn over their data to the AI crunchers in order to better plan a party. Should be quite interesting to watch party videos if this prototype Meta is testing ever comes to reality and becomes accepted.
I predict we’re going to keep hearing about this kind of thing again and again as the tech companies keep thirsting after any morsel of data about you, what you do, and where you do it. For their purposes that thirst will never be quenched.
It used to be “their purposes” was simply defined as selling or brokering your data for advertising purposes, because despite all of the grand promises of how this can help users, it’s always been about making a buck hustling your data for advertisting. Add AI into the mix, and it’s also about continuing to feed and train that beast to help them with that same ultimate goal.
Apple is rumored to be working on a version of AirPods Pro that contains cameras, apparently for AI purposes. All the talk you hear about Apple and others creating pendants, pins, other wearables, and counter top robots all follow the track to the same end point regardless of how the user benefits are packaged and hyped. Even if some follow Apple’s announced approach of keeping your data on whatever device is recording your every moment, those that don’t, like Meta, will spoil any potential benefit. Heck, in the long run, that’s type of spoilage is probably going to be a good thing in this era of overreaching.
It’s a damn shame really. Because there are certainly legitimate accessibilty uses for this kind of technology. But I have to say, it sure feels like that’s going to be just another hyped up smokescreen to try and mask the real purposes behind all of this.
Thanks for reading. You can subscribe to this blog if you care to. You can also find more of my writings on a variety of topics on Medium at this link, including in the publications Ellemeno and Rome. I can also be found on social media under my name as above. This site does not use affilate links.
#ai #airpods #Apple #ArtificialIntelligence #cameras #Internet #Meta #privacy #security #Smartglasses #SocialMedia #technology
Hundreds of AUR packages attacked by infostealer via @vv https://lobste.rs/s/ta0sem #linux #security
https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
Arbitrary code execution breaking sandboxes in KDE Plasma https://lobste.rs/s/ovcwkm #security
https://blog.kimiblock.top/2026/07/01/arbitrary-code-execution-in-kde-plasma/
Unicode composition for filenames via @RunxiYu https://lobste.rs/s/g3jf3e #security #vcs
https://svn.apache.org/repos/asf/subversion/trunk/notes/unicode-composition-for-filenames
The Arch Linux AUR had over 400 packages compromised with malware https://www.gamingonlinux.com/2026/06/the-arch-linux-aur-had-over-400-packages-compromised-with-malware/
#NATO weighs options to defend #Europe as the #US plans for conflicts elsewhere
European countries & Canada had waited impatiently for over a year for the #Trump administration to detail its plans after it warned that Europe is no longer a top US #security priority. They knew cuts were coming, but not how big, fast or what kind.
#warmonger #geopolitics #allies
https://apnews.com/live/trump-administration-updates-06-12-2026
How OpenSSH implements privilege separation https://lobste.rs/s/kfavsp #security #unix
https://github.com/openssh/openssh-portable/blob/master/README.privsep
Fedora 45 Considering x86_64 Shadow Stack Usage By Default https://lobste.rs/s/pgxaog #linux #security
https://www.phoronix.com/news/Fedora-45-Consider-Shadow-Stack
I wrote a small blog post about some Best Practices for the Webserver Caddy. Although the header part applies basically to all webservers.
Kinda new to this whole blog thing (started on 25.), so let me know what you think :)
https://catinashell.de/posts/secure-a-caddy-server-and-best-practices/
What We Talk About When We Talk About Malware https://lobste.rs/s/ltsgnw #android #security
https://f-droid.org/2026/07/01/adv-malware.html
Bad Epoll (CVE-2026-46242) https://lobste.rs/s/drf6my #linux #security
https://github.com/J-jaeyoung/bad-epoll
TFTP Honey pot Results https://lobste.rs/s/048t8w #security
https://bruceediger.com/posts/tftp-honeypot-results/