It's hard to set zero in the RAM actually

This add-on shows with a colored icon, whether the SSL/TLS certificate currently used by the website for is classified as trustworthy by Mozilla or only by the local computer. Helps to identify proxies.

green shield for Mozilla certificates
bleu shield for other certificates

(via https://sebsauvage.net/links/?jrQ5jA)

Create obvious malicious links

Cet article suit la nouvelle de thehackernews.com https://shaarli.lyokolux.space/shaare/KY-ycA

(via https://sebsauvage.net/links/?V_U4DA)

The problem is annoying and difficult. Also secrets can be easy to rotate, can not rotate or ones that attackers use.

You could be doing so many good data security practices, like secure-by-design frameworks, database and field-level encryption, zero-touch production, access control… but logging bypasses all of that… and ultimately degrades trust, in your systems and in your company.

It happens to companies of all sizes: X, Google Cloud, Facebook

Causes:

1. Direct logging
2. Kitchen sinks: objects that contain or hold secrets, often in opaque or unexpected ways. Errors of requests are examples.
3. Configuration changes: turning logging level to debug.
4. Embedded secrets: a token shared by URL
5. Telemetry: error monitoring and analytics are logs. They often provide the local variable context.
6. User Input: the user provides wrong but PII data in a wrong field for example.

Fixes:

1. Data architecture:part of the solution is reducing the number of data flows and shrinking the problem space so you simply have less things to worry about and protect. One logging utility!
2. Data transformation: minimization, redaction, tokenization (and the trolls: hashing, encryption, masking)
3. Domain primitives: “combines secure constructs and value objects to define the smallest building block of a domain”. new Secret("..."). They provide security invariants and guarantees that basic string primitives simply cannot.
4. Compile-time: a logging function that never accepts secrets (TS branded types helps!)
5. Run-time classes (extends String): it identifies the secrets. Overwrite the toString() method in JS to return [redacted] but an explicit unwrap() method for example.
6. Read-once objects: they throw an error or [redacted] in case of second read.
7. Taint checking: the general idea here is that you add taint to various sources (like database objects), and yell loudly if the data flows into certain sinks (like logs). Demo: https://semgrep.dev/playground/s/4bq5L It's awesome and not awesome as the same time.
8. Log formatters: redact known dangerous property names
9. Unit tests
10. Sensitive data scanner
11. Sampling (every cases instead of proportions)
12. Log pre-processors such as Vector
13. People

Strategy:

1. Lay the foundation: Developing expectations, culture, and support is a must-have. Define what a secret is. Use structured logs to allow operations on them.
2. Understand the data flow: with the foundation laid, the next best thing to do is to understand and chart out how secrets flow through your system.
3. Protect at chokepoints: CI/CD and App code first, before relying on the loggging library and other operation services.
4. Apply defense-in-depth: data transformation, read-once objects, log formatters in the library, log pre-processors, sensitive scanners, people
5. Plan for response and recovery

(via https://sebsauvage.net/links/?LscYqg)

About ?page=1 that can become /?page=1 OR 1=1

A phishing attack is running on crates.io

Ce qui étonne vraiment les chercheurs, c’est la cohérence de l’ensemble car tous les composants utilisent les mêmes techniques : DLL sideloading, chiffrement RC4/XOR, exécution exclusivement en mémoire. Ça sent la team de développeurs bien rodée avec des process industriels, et pas des amateurs qui bricolent dans leur garage.

It's a team work.

Source: "EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company " https://www.bitdefender.com/en-us/blog/businessinsights/eggstreme-fileless-malware-cyberattack-apac

My honest assessment is that the Rust / Cargo leadership need to be bold, deprecate packages publishing to crates.io and move to a decentralized package distribution architecture.

There is no other way around. Rust needs to copy Go, it's as simple as that.

The second part of the solution, way harder and more expensive to implement is to release an extended standard library. We need to reduce the amount of third-party developers that we need to trust to release our software.

A workaround from now is to import rust crates from git itself, such as ring = { git = "https://github.com/briansmith/ring", version = "0.12" }

17 apps installed over 19 million times

The information is relayed on different news website:

• https://cybernews.com/security/password-managers-autofill-credentials-for-attackers
• [#todo]

It was unveiled with a presentation at the DEFCON 2025 https://marektoth.com/blog/dom-based-extension-clickjacking/

The unpaid work of volunteers for core libraries is unsustainable. We can all agree on that.

There is few comments suggesting sustainable models.

Securam ProLogic ne réglera pas cette porte dérobée.

Source: https://archive.is/20250808202909/https://www.wired.com/story/securam-prologic-safe-lock-backdoor-exploits/

Les raccourcisseurs d'URLs sont une fausse bonne idée dans la plupart des cas:

1. Les URLs raccourcies ne sont pas toujours générées aléatoirement
2. Le phishing rendu possible
3. La dépendance au service, qui peut fermer, comme ici avec goo.gl

Here we go again. A small package is is abused.

The transcription makes it clear how it works:

1. Expose node's require with a get "switch"() { return require; }
2. Load os and ws modules from this['switch']
3. Connect to the websocket
4. new Function(data)(); // remote code execution of a WebSocket message.