293 private links
Dans ce cas, séparer directement la commande curl de bash afin d'auditer le script téléchargé. Le serveur peut être malhonnête et renvoyer différent contenu selon le User Agent de Curl ou d'un navigateur web.
Il est possible de détecter le curl | bash via une commande sleep.
L'auteur à une démo locale.
Faire confiance au projet pour livrer un script bash honnête revient aussi à faire confiance:
- au domaine
- au DNS
- à l’hébergement
- au CDN
- au compte GitHub
- aux secrets de CI/CD
- au pipeline de release
- aux dépendances
- aux mainteneurs actuels et futurs
- à l’absence de compromission au moment précis où vous exécutez la commande
Another supply-chain attack.
According to new reports by Aikido and Socket, the compromised packages were modified to include a malicious 'preinstall' script that executes automatically when the npm package is installed.
That's why it's pertinent that https://npmx.dev lists these postinstall scripts
GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.
La Deutsche Telekom Red Team vient en effet de publier Pack2theRoot (CVE-2026-41651), une faille notée 8.8/10 qui permet à n'importe quel utilisateur local de devenir root sans mot de passe.
Source:
C'est clairement une mauvaise idée
hashing: SHA-512
Password or one time code hashing: Argo2id
Key derivation: SHAKE256 or HKDF-SHA512
Api key: prefix + version + Base32LowerCase.encode(UUID || 32-byte secret); hash function: SHAKE256 with a 512 bit output, or SHA3-512 or SHA-512
Encryption: AES-256 has too short nonces, jey / nonce reuse is catastrophic and it's also lacking context commitment. XChaCha20-Poly1305 lacks context commitment, that's why ChaCha20-BLAKE3 is recommended.
Encrypting secrets: use a Key Management Service
Symmetric Key signature: HMAC-SHA512
Asymmetric key signature: ML-DSA-65, or ML-DSA-87
JSON Web TOkens: ML-DSA-65 for asymmetric signatures or HMAC-SHA512 for symmetric signatures
End-to-end encryption
While you probably need more advanced protocols for your specific use case (e.g. The Messaging Layer Security (MLS) Protocol, RFC 9420, for messaging), basic end-to-end encryption to a public key has been standardized in RFC 9180 - Hybrid Public Key Encryption (HPKE). In this context hybrid means that we combine both symmetric and asymmetric cryptography.
Therefore, I recommend the following algorithms for use with HPKE to encrypt data to a public key:
- KEM: X-Wing
- AEAD: AES-256-GCM
- KDF: HKDF-SHA512
TLS
Today, the only quantum-resistant key exchange algorithm available for TLS is the hybrid X25519MLKEM768. Ensure that your load balancers / reverse proxies support it.
« Les attaquants bénéficient d’un avantage asymétrique, puisqu’il leur suffit d’exploiter une seule brèche», alors que les défenseurs doivent couvrir une surface d’attaque qui n’est certes pas infinie, mais suffisamment étendue pour laisser des trous dans la raquette. Les développeurs de Firefox ne peuvent pas se permettre de « réécrire des décennies de code en C++ ».
De l'autre côté, l'IA peut détecter ces failles rapidement. Il est probable que ce genre de détection de faille soit inclus dans les processus avant la livraison d'une nouvelle version par exemple.
l’éditeur PDF intégré, qui permet de réorganiser, copier, coller, supprimer et exporter des pages dans un document PDF.
Oh pas mal
I did not install any Anthropic browser extension. I have never installed a Claude browser extension due to privacy and security concerns. I did install Claude Desktop, the Mac app, a while back. That is the only thing on this machine which could have written the file. Claude Desktop reached into Brave, a browser from a completely separate vendor, and registered a back door for a browser extension I do not have.
and the security risks involved is concerning.
"stateless" authentication simply is not feasible in a secure way. You must have some state to handle tokens securely, and if you must have a data store, it's better to just store all the data.
The reason to avoid JWTs comes down to a couple different points:
- The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). Sessions need to have longer lifespans than that.
- "stateless" authentication simply is not feasible in a secure way. You must have some state to handle tokens securely, and if you must have a data store, it's better to just store all the data. Most of this article and the followup it links to describes the specific issues: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/
- (Yes, people are doing it, and yes, their applications are flawed, and you should not repeat that mistake.)
- JWTs which just store a simple session token are inefficient and less flexible than a regular session cookie, and don't gain you any advantage.
- The JWT specification itself is not trusted by security experts. This should preclude all usage of them for anything related to security and authentication. The original spec specifically made it possible to create fake tokens, and is likely to contain other mistakes. This article delves deeper into the problems with the JWT (family) specification.
Typo-squatting: using URLs is a false solution. "By making crate IDs longer, whether by namespacing within crates.io, GitHub organizations, or via domains, you only make it harder for users to remember them precisely, and thus harder to recognize typo-squatting."
Sandboxing can not be handled by the language itself.
It's the developer responsability to use crates on crates.io. It's an audit to make. Rust provides tool for it: cargo-vet, crates.io 90 day download plot, cargo chef or Nix to build isolation.
Also Rust itself does not have the resources for it at the moment. They simply can't. The compiler and std are primarily developed by volunteers, who don’t get anything out of it except for rare donations from other members of the community. The Rust project is not the same as GitHub or Linux. They don't have the same support.
We’re not nearly close to the level of security a centralized registry can provide. On the software side, in 2025 Rust teams made or piloted tools for typo squatting detection, dynamic build script analysis, and real-time code scanning. On the personal side, Rust Foundation hired on-call engineers in 2025 and a second infrastructure engineer in 2026. If that sounds overdue, well, they had net loss in 2023 – software isn’t cheap.
le FBI a réussi à extraire et lire des messages Signal d’un iphone à l’aide de techniques de forensic.
car l'aperçu des notifications est stocké en clair dans une base de données locale du système.
Signal est ici pas en cause, mais bien le stockage des aperçus de notifications.
Si vous utilisez un iPhone, quelques réglages simples peuvent limiter les dégâts :
- Dans Signal → Notifications → “Ni le nom ni le message”
- Dans iOS → Notifications → Signal → désactiver les aperçus ou les limiter à “Quand déverrouillé”
Et surtout, il faut déconstruire une idée reçue tenace : celle de “l’application magique” qui réglerait tous les problèmes de sécurité. C’est une illusion dangereuse.
Le même overflow du bug de l'an 2038 sur Linux.
La seule solution pour le moment est de redémarrer la machine.
Le FBI, la CISA, la NSA, l'EPA, le département de l'Énergie et le Cyber Command américain ont publié un avis conjoint. [...] Six agences fédérales qui publient un avis commun, ça donne une idée de la gravité du truc. Le fait que des hackers puissent encore trouver des automates industriels directement accessibles depuis internet en 2026, c'est quand même assez idiot. Surtout quand ils contrôlent des stations d'eau ou des centrales énergétiques.
Source: https://edition.cnn.com/2026/04/07/politics/iran-linked-hackers-disrupt-us-industrial-sites
In a recent analysis, Adam Harvey found that among the 999 most popular crates on crates.io, around 17% contained code that do not match their code repository.
How?
- buy compromised cookies or credentials
- typosquatting or misleading create names
- macros
How to solve?
Again, like Go: having a comprehensive standard library.
It should have: base32, base64, bytes, crc32 and crc64, crypto, gzip, hex, http, json, net, rand, regex, tar, tls, uuid, zip, zstd.
How to fix now?
- Use Dev Containers!
- Password manager for the SSH keys and secrets
- fetch the dependencies from source
- audit the dependencies: cargo-audit and cargo-vet
The post landed today on Lobsters
à suivre
It detects ssh_bruteforce, credential_stuffing, port_scan, sudo_abuse, execution_guard, web_scan, user_agent_scanner, suricata_alert, docker_anomaly; integrity_alert, osquery_anomaly, distributed_ssh
Le broker MQTT de Meari était ouvert depuis 1 041 jours sans mot de passe !
En entrant par cette porte laissée ouverte, Sammy s'est retrouvé face à un tableau de bord EMQX qui liste en temps réel tous les babyphones connectés dans le monde. On sait ainsi qui est en ligne, depuis quand, et surtout ce que filme chaque caméra. Pour le démontrer concrètement, il a développé un petit outil (CloudEdge Babyphone PoC) capable de cibler n'importe lequel de ces appareils.
Liste des marques impliquées: https://drive.google.com/file/d/1tg_Piq13wNyH5niZe_WwuoeAOvZ0sgPR/view