Security

Cybersecurity 6 min The DMARC tag that meant 10% of the time now means all the time RFC 9989 removed the pct tag in May 2026, and the same document says receivers must ignore tags that are not r... KE Kenji Tanaka 4 Sep Cybersecurity 7 min The lookalike domain that is blocked on .com and shown on .ru The famous all-Cyrillic apple.com impersonation was patched in 2017 and the matter filed as closed. Both major... KE Kenji Tanaka 1 Sep Developer Tools 4 min How to Self-Host Gitea or Forgejo with Docker The environment variable that closes public registration was renamed, so copying an older tutorial leaves your... KE Kenji Tanaka 31 Aug Privacy & Data 6 min What an ID number's check digit actually proves The last character of most identity numbers is computed from the ones before it, using a published formula any... PR Priya Nair 31 Aug Developer Tools 4 min How to Set Up Caddy as a Reverse Proxy with Docker Caddy gets certificates without being asked, which is why it is the right first reverse proxy. The confusion s... KE Kenji Tanaka 31 Aug Developer Tools 5 min How to Self-Host Vaultwarden with Docker The compose file is trivial. The admin token is not: it wants an Argon2 hash rather than a password, and the h... KE Kenji Tanaka 30 Aug Privacy & Data 5 min How to Stop ChatGPT, Claude, Gemini and Grok Training on Your Chats (2026) Four switches with almost the same name, doing four different things. Three are on by default. One also sets y... PR Priya Nair 29 Aug Business 5 min Why CSV Libraries Do Not Stop Formula Injection The same six values written by Python, by PHP, and by joining strings with commas. The libraries fix the comma... EV Eva Chin 25 Aug Privacy & Data 5 min Which Image Operations Strip Metadata A source image with six identifying tags and GPS coordinates, put through eight operations. Pillow drops every... PR Priya Nair 25 Aug Developer Tools 6 min What Your Rate Limit Actually Limits A route limited to 30 a minute and one limited to 60 turned out to share a single counter, because the framewo... KE Kenji Tanaka 22 Aug Privacy & Data 6 min How to Stop an Agent Returning Documents the User Should Not See A vector search scoped three ways, and measured each time. Unfiltered, four in five results belonged to anothe... PR Priya Nair 21 Aug Developer Tools 6 min How Old Is the Code You Installed? The median package in this site's tree was published 286 days ago — but one in five has seen no release in two... KE Kenji Tanaka 20 Aug AI & ML 6 min What Installing an Agent Toolkit Actually Grants Giving an agent tools is one line of configuration, and that line does not say what any of them can do. We rea... KE Kenji Tanaka 20 Aug Cybersecurity 5 min Three DNS Records Almost Nobody Publishes DNSSEC, CAA and MTA-STS each protect people who will never know they exist. Across 18 major ASEAN banks, gover... KE Kenji Tanaka 19 Aug Cyber Threat Intel 6 min Can You Prove an Attack Was Prevented? Early warning is what threat intelligence is sold on, and prevention is the least verifiable claim in security... PR Priya Nair 19 Aug Cyber Threat Intel 5 min Who Sells Threat Intelligence Four quite different businesses use the same phrase, which is most of why the market is confusing. A map of th... PR Priya Nair 19 Aug Cybersecurity 6 min What Your Own Domain Tells a Stranger OSINT needs no budget and no access. We ran it against our own domain and found 26 robots.txt rules naming /ad... KE Kenji Tanaka 19 Aug Cyber Threat Intel 5 min What a Threat Actor Name Buys You Reporting names adversaries with real confidence — APT29, Lazarus, Sandworm — and it is worth asking how much... KE Kenji Tanaka 19 Aug Cyber Threat Intel 5 min From Feed to Decision Buying a threat feed is the easy part. We work through the filtering that free public data already does to a s... PR Priya Nair 19 Aug Cyber Threat Intel 6 min What Threat Intelligence Actually Is 380,235 vulnerabilities have been published. 1,670 are confirmed to be exploited in the wild — about one in 22... PR Priya Nair 19 Aug Cybersecurity 6 min Many Security Policies Permit the Attacks They Are Meant to Block Eighteen ASEAN banks, government portals and telcos send a mean of 3.7 of 5 browser-protection headers, which... KE Kenji Tanaka 19 Aug Cybersecurity 6 min Signed Is Not the Same as Traceable Every package npm serves carries a registry signature, so 100% of our dependencies look verified. Only 10.8% o... PR Priya Nair 19 Aug Developer Tools 6 min Your Bank Is Still on IPv4 We asked DNS whether 18 institutions across six ASEAN economies — the largest bank, the government portal and... MA Maya Lin 19 Aug Cybersecurity 6 min Most of an AI Attack Is an Ordinary Attack MITRE's AI threat matrix, ATLAS, shares 13 of its 16 tactics with classical ATT&CK. Only two are genuinely new... PR Priya Nair 19 Aug