Some Northern Lights tonight! Using Pixel "Night Sight" (the reds were not as visible to the naked eye) Group alt text: Reds and pale greens, sometimes around a central axis overhead. Some of the green radiating segments are quite distinct. #northernlights

Every other hardware vendor: "OMG DANGER only update your BIOS/firmware if you have a specific problem listed in the release notes. Oh, you have Linux? If you're lucky, you can initiate it from UEFi. Otherwise, run this EXE from a bootable USB." Framework: "You should always run the latest […]

Stylus prices are insane.

I feel like Chesterton's Fence could use a couple of Overton windows.

There's no way Google Alerts is going to last much longer, is there.

"CISA Strengthens Commitment". Methinks the press release doth protest too much, sadly.

Notably, CISA says it will still collaborate with the MS-ISAC on information sharing and guidance documents. But it sounds like it's ending its analysis of Albert sensor data, a major source of information about intrusions on state and local government networks.

I know I'm late to the party, but the share.google links are going to be the final straw for moving away from Chrome on mobile.

CISA will furlough 65% of its staff if the government shuts down on Wednesday, keeping about 890 people to handle mission-critical cybersecurity protection work. www.cybersecuritydive.com/news/cisa-go... As in other agencies, employees there are worried about potential RIFs of furloughed staff.

Android is now showing this in my notifications for Google's SMS/RCS app. Previously, it just showed up as the little speech bubble icon that it has now been demoted to badge status. WTH?

Switzerland just voted to create a new electronic ID card (the Swiss introduced physical ones in 1955). It's stored locally on your device, you personally approve requests for your data, and is designed to prevent profiling. Contrast to, for example, Britain's centralized proposal […]

Kali Linux rolling now has hashcat 7.1.2! #hashcat #kali

Also vis @zackwhittaker: This BBC article about the origins of the commercial at ("@"), which I have long advocated that we should call the "amphora" for the historical reasons described in this fascinating article! […]

A note of appreciation for the simple and clear alt texts for the images in @zackwhittaker 's excellent weekly security news summary email. I don't load remote images by default, but I can still follow along just fine!

RIP Jon Lasser. His 2000 book "Think UNIX" remains both one of the best treatments of the philosophy, and one of the best ways to introduce someone to it. The combination is quite a feat.

https://www.clarionwest.org/2025/09/25/in-memory-of-jon-lasser/ Jon was, at least to my newcomer's eyes, a central person in the Baltimore Linux/sysadmin community in the late 1990s and early 2000s. I have many memories of him hosting Old Bay Sage meetings. I think he was involved in organizing […]

TIL the "lid closed" sensor on some laptops can be tripped by ... stacking one laptop on top of another laptop. https://community.frame.work/t/responded-keyboard-randomly-stops-working-not-os-but-not-hardware-either/26480/16

Correct (_noun_): "Our one-year-old is doing well" Correct (_adjective before noun_): "This one-year-old horse" Incorrect (_adjective_): "Our project is one-year-old today"

Not complaining, but this product is _not_ messing around. Recommended.

I wonder how much HTTP-aware fuzzing has been done against `python -m http.server`.

Because I am a curious fool, I purchased a three hundred and fifty five millilitre can of "root beer" flavoured carbonated kombucha. Dear reader: do not do this thing that I have done. This toot is a warning and part of a system of warnings, the danger exists in your time as it did in mine […]

So it looks like NIST SP 800-88r2 (Guidelines for Media Sanitization) wanted to move away from specific techniques, and focus more on referencing standards. And I am really grooving on the clarity of language and thinking so far. But I honestly thought that it was supposed to be the other way […]

This is your reminder that on this date, in 1983, Stanislav Petrov saved the world.

Scalps and platters in the man cave. (Neatness not typical)

Breaking: CISA orders agencies to analyze and patch Cisco networking equipment following the discovery of critical vulnerabilities being exploited by "an advanced threat actor." www.cisa.gov/news-events/... Cisco alert: sec.cloudapps.cisco.com/security/cen...

Any sufficiently advanced concentration of crowd-sourced vulnerability seeking is indistinguishable from vibe hacking.

Okay, this is a new one to me: Someone sent a vulnerable user under my supervision a postal letter on PayPal letterhead, listing a non-trivial charge, with a phone number to call if the charge didn't seem valid. Next thing we know, the vulnerable person is being walked through installing remote […]

Based on the release history on GitHub, Ladybird browser intends to follow the "no binary distributions are provided and prospects are expected to build the system from source" model from its SerenityOS parent?

"There are autisms, rather than just autism. The diversity in symptoms, the severity of symptoms and the range of biological contributors are simply too large to be reduced to one uniform disorder. The neurobiology is too complex for easy explanations." www.nytimes.com/2025/09/24/o...

I see the "How One Bad Password Ended a 158-Year-Old Business" story has resurfaced (as a thinly-disguised SpecOps ad). If a single non-MFA'd password is an existential threat to your entire enterprise ... maybe the problem isn't the intern.

Reminder for Anchorage folks: the meaning may have softened over the years, but the phrase "termination dust", applied to the snow that appears on the mountains in the fall, was originally not about the termination of _fall_. It was about the termination of […] [Original post on infosec.exchange]

The things you learn from random Wikipedia articles about cat breeding. https://en.wikipedia.org/wiki/Jean_Mill > Jean Mill (née Sones; May 14, 1926 – June 6, 2018) was an American cat breeder, owner of Millwood cattery. She is best known as the founder of the Bengal cat breed, and also made […]

And as HBR expounds at length: "workslop uniquely uses machines to offload cognitive work to another human being. When coworkers receive workslop, they are often required to take on the burden of decoding the content, inferring missed or false context. A cascade of effortful and complex […]

How many stories of "get popped, _then_ do an emergency FIDO2 deployment" does your leadership need to read before you decide to deploy FIDO2 proactively?

I don't want it to be lost to the sands of time that Chrome’s auto-updating functionality was extremely impressive. At a time when browser updates happened infrequently and required manual installations, Chrome pioneered regular, lightweight, automated patches, and normalizing that did a world […]

A hearty shout out of approval and admiration for Repology maintainer @AMDmi3 for taking a seemingly low-complexity issue, asking insightful questions, digging up no less than three different root causes, and driving fixes to Repology. These fixes make the order of strings appearing in HTML-side […]

This is beautiful; pure poetry: https://obsidian.md/blog/less-is-safer/ (Obsidian’s dependency-management philosophy.) I have a suggestion: If you have a project or repo that's getting popular, stop writing features for a few months and implement this instead. #softwaredevelopment […]

Great, thorough list of qualities and what to do, and what _not_ to do, as a CISO (but also good advice for security professionals at other levels). From @philvenables and Mike Aiello. https://www.philvenables.com/post/good-ciso---bad-ciso

Interesting dive into how food gets to Alaska. I've lived here close to 50 years, and didn't know a good bit of this. https://alaskabeacon.com/2025/09/18/the-messy-reality-of-feeding-alaska/

Refreshing a different retro (Dell) laptop, admiring the ports / options: Left: USB2, VGA, 3.5mm audio Right: eSATA, USB2x2, DVD Back: Ethernet, HDMI, Kensington lock This is what they took from us.

Trying to log into my Apple account from Chrome on Android, with security keys enabled, I'm completely unable to log in to complete the transaction ("find another way") after presenting known-good security keys. "Take my money" should be an iron-clad workflow -- WTAF?

Like conference social preference badges, except "yes I will always say hi to your dog"

Apparently lost to history is that there was a Chocolate Marshmallow flavor of these. And if you put them in the freezer, and then put it in your lunch box that morning, it semi-thawed to this amazingly smooth yet al-dente gelato consistency. It turns out […] [Original post on infosec.exchange]

_Problems worthy of attack prove their worth by hitting back._ -- Piet Hein, "Grooks"

Every once in a while, one of the disjoint belief spheres created by compartmentalized influence campaigns overflow their boundaries into the common public awareness. This produces surprise in one segment of the population, as the sentiments programmed into the other segment surge to the surface […]

If the spammers know your political views, so does your government. And other governments.

Yesterday I nuked the Windows partition on another of my Thinkpads & replaced it with Windows 10 IoT LTSC. Now I have a clean Win10 system, no Modern apps, no Windows store, no OneDrive, & it'll get updates until 2032. The download & the tools to activate it are here: https://massgrave.dev/ […]

If you have a yellow or orange YubiKey that you're willing to part with, please reach out. #yubikey

Am I correctly concluding that there isn't a centralized, wiki-style list of major websites known to block Tor? Seems like an obvious enough thing, even if it changed regularly, that I must just be missing something important and it is a deliberate omission?

For smaller-sized efforts, LLMs are this, as a service. The art is in prompting the LLM to a minimum viable 90% solution, and then engaging the SME. And then paying very close attention to what the SME thinks the LLM got wrong.