XZ Utils Backdoor
April 3 2024The cybersecurity world got really lucky last week. An intentionally placed backdoor in XZ Utils, an open-source compression utility, was pretty much accidentally discovered by a Microsoft engineer—weeks...
Read moreRoss Anderson
April 1 2024Ross Anderson unexpectedly passed away Thursday night in, I believe, his home in Cambridge.
I can’t remember when I first met Ross. Of course it was before 2008,...
Read moreIt’s pretty devastating:
Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is...
Read more
On Secure Voting Systems
March 26 2024Andrew Appel shepherded a public comment—signed by twenty election cybersecurity experts, including myself—on best practices for ballot marking devices and vote tabulation. It was written for the Pennsylvania...
Read moreImproving C++
March 15 2024C++ guru Herb Sutter writes about how we can improve the programming language for better security.
The immediate problem “is” that it’s Too Easy By Default™ to write security...
Read more
NIST Cybersecurity Framework 2.0
March 1 2024NIST has released version 2.0 of the Cybersecurity Framework:
The CSF 2.0, which supports implementation of the National Cybersecurity Strategy, has an expanded scope that goes beyond protecting...
Read more
On the Insecurity of Software Bloat
February 15 2024Good essay on software bloat and the insecurities it causes.
The world ships too much code, most of it by third parties, sometimes unintended, most of it uninspected. Because...
Read more
On Software Liabilities
February 8 2024Over on Lawfare, Jim Dempsey published a really interesting proposal for software liability: “Standard for Software Liability: Focus on the Product for Liability, Focus on the Process for...
Read moreFacebook Enables Messenger End-to-End Encryption by Default
December 11 2023It’s happened. Details here, and tech details here (for messages in transit) and here (for messages in storage) Rollout to everyone will take months, but it’s a good day for...
Read more
Recent Comments