Security

Security from a builder's seat. Vulnerability disclosures, supply-chain attacks, secrets management, and defensive engineering patterns — explained with enough depth to act on, not just react to.

Article 14m ago 0

The Trojan Snow: Protestware and the Dual-Hatted Maintainer Risk

A hidden locale-based trigger in a classic X11 toy exposes the vulnerability of relying on a single upstream-downstream maintainer.

Emeka Okafor

Arbitrary Code Execution in objdump -g: How a Missing Bounds Check Becomes a Full Exploit

A heap out-of-bounds write in the FR30 relocation handler lets a crafted object file run attacker code when inspected with `objdump -g` — and the exploit defeats ASLR, PIE, and heap hardening in a single shot.

Article · 3w ago0

uv Gets Built-In Vulnerability and Malware Scanning

Astral's uv package manager adds `uv audit` and optional install-time malware checks powered by OSV, closing supply-chain gaps that separate tooling can't easily address.

News · 3w ago1

Massachusetts' Location-Data Ban Is a New Compliance Line for Mobile and Analytics Devs

The state's Consumer Data Privacy Act blanket-bans selling precise geolocation data — and because it covers visitors too, any app touching MA users is in scope.

News · 3w ago5

Designing Payment Infrastructure That Starts With the Threat Model

A technical deep-dive into process isolation, HSM-backed key management, and the architectural choices that shrink your PCI DSS scope before you write a single control.

Article · 3w ago0

Config Files That Run Code: The Supply Chain Blind Spot Nobody Is Auditing

The Miasma worm didn't need a malicious dependency. It used .claude/settings.json, .vscode/tasks.json, and package.json to detonate a credential stealer — before you read a single line of code.

Article · 3w ago0

Trivy: One Scanner to Rule Your Containers, Repos, and Kubernetes Configs

Instead of stitching together five different security tools, Trivy handles CVEs, misconfigs, secrets, and SBOM generation across every target in your pipeline — from a single CLI.

Article · 3w ago0

Config Files That Run Code: The Supply Chain Blindspot You're Probably Not Auditing

The Miasma worm hid a credential-stealing dropper inside ordinary config files for VS Code, Cursor, Claude Code, Gemini CLI, npm, Composer, and Bundler. Here's exactly how each vector works — and what to review before you clone.

Article · 3w ago0

1,000 Breaches In, and Companies Are Taking Longer Than Ever to Tell You

Troy Hunt's Have I Been Pwned milestone exposes a darkening pattern: breach victims — and the developers who depend on breached services — are flying blind for weeks while data circulates freely on hacking forums.

Article · 3w ago0