Experimental News Clipping Site

Tag: secure coding practices

  • Hacker News: Python’s official documentation contains textbook example of insecure code (XSS)

    —

    by

    Kurt Seifried
    in

    Source URL: https://seclists.org/fulldisclosure/2025/Feb/15 Source: Hacker News Title: Python’s official documentation contains textbook example of insecure code (XSS) Feedly Summary: Comments AI Summary and Description: Yes Summary: The text highlights a critical security issue within Python’s documentation related to Cross-Site Scripting (XSS) vulnerabilities stemming from examples in the CGI module. This poses significant risks for web…

  • The Register: The Feds want developers to stop coding ‘unforgivable’ buffer overflow vulns

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/02/13/fbi_cisa_unforgivable_buffer_overflow/ Source: The Register Title: The Feds want developers to stop coding ‘unforgivable’ buffer overflow vulns Feedly Summary: FBI, CISA harrumph at Microsoft and VMware in call for coders to quit baking avoidable defects into stuff US authorities have labelled buffer overflow vulnerabilities “unforgivable defects”, pointed to the presence of the holes in…

  • CSA: Ensure Secure Software with CCM Application Security

    —

    by

    Kurt Seifried
    in

    Source URL: https://cloudsecurityalliance.org/blog/2025/02/05/implementing-ccm-ensure-secure-software-with-the-application-and-interface-security-domain Source: CSA Title: Ensure Secure Software with CCM Application Security Feedly Summary: AI Summary and Description: Yes **Summary:** The text discusses the Cloud Security Alliance’s (CSA) Cloud Controls Matrix (CCM), specifically focusing on the Application & Interface Security (AIS) domain. It outlines the importance of securing applications and interfaces in cloud environments…

  • Cloud Blog: CVE-2023-6080: A Case Study on Third-Party Installer Abuse

    —

    by

    Kurt Seifried
    in

    Source URL: https://cloud.google.com/blog/topics/threat-intelligence/cve-2023-6080-third-party-installer-abuse/ Source: Cloud Blog Title: CVE-2023-6080: A Case Study on Third-Party Installer Abuse Feedly Summary: Written By: Jacob Paullus, Daniel McNamara, Jake Rawlins, Steven Karschnia Executive Summary Mandiant exploited flaws in the Microsoft Software Installer (MSI) repair action of Lakeside Software’s SysTrack installer to obtain arbitrary code execution. An attacker with low-privilege access…

  • Hacker News: Official DeepSeek R1 Now on Ollama

    —

    by

    Kurt Seifried
    in

    Source URL: https://ollama.com/library/deepseek-r1 Source: Hacker News Title: Official DeepSeek R1 Now on Ollama Feedly Summary: Comments AI Summary and Description: Yes Summary: The text provides an overview of DeepSeek’s first-generation reasoning models that exhibit performance comparable to OpenAI’s offerings across math, code, and reasoning tasks. This information is highly relevant for practitioners in AI and…

  • Hacker News: Fun with Timing Attacks

    —

    by

    Kurt Seifried
    in

    Source URL: https://ostro.ws/post-timing-attacks Source: Hacker News Title: Fun with Timing Attacks Feedly Summary: Comments AI Summary and Description: Yes Summary: The text provides an in-depth examination of a potential vulnerability within a simple JavaScript function used to compare user input against a secret value. It emphasizes how timing attacks can exploit non-constant-time comparison functions like…

  • The Register: Ransomware crew abuses AWS native encryption, sets data-destruct timer for 7 days

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/01/13/ransomware_crew_abuses_compromised_aws/ Source: The Register Title: Ransomware crew abuses AWS native encryption, sets data-destruct timer for 7 days Feedly Summary: ‘Codefinger’ crims on the hunt for compromised keys A new ransomware crew dubbed Codefinger targets AWS S3 buckets and uses the cloud giant’s own server-side encryption with customer provided keys (SSE-C) to lock up…

  • Hacker News: GPON FTTH networks (in)security (2016)

    —

    by

    system automation
    in

    Source URL: https://pierrekim.github.io/blog/2016-11-01-gpon-ftth-networks-insecurity.html#introduction Source: Hacker News Title: GPON FTTH networks (in)security (2016) Feedly Summary: Comments AI Summary and Description: Yes Summary: The text delves into the (in)security of GPON FTTH networks, particularly focusing on vulnerabilities inherent in devices like the Optical Network Terminal (ONT) used by major ISPs in France. It uncovers significant threats, including…

  • Cloud Blog: Reach beyond the IDE with tools for Gemini Code Assist

    —

    by

    system automation
    in

    Source URL: https://cloud.google.com/blog/products/application-development/gemini-code-assist-launches-developer-early-access-for-tools/ Source: Cloud Blog Title: Reach beyond the IDE with tools for Gemini Code Assist Feedly Summary: One of the biggest areas of promise for generative AI is coding assistance — leveraging the power of large language models to help developers create or update application code with amazing speed and accuracy, dramatically boosting…