Security

Cyber Threat Intel 6 min The CVSS score was never meant to be your patch queue Patch everything above 9.0 is the most common vulnerability rule there is, and FIRST — who publish CVSS — writ... PR Priya Nair 16 Sep Cybersecurity 7 min Nobody has required a seven-pass disk wipe since 2006 Disk utilities still offer a seven-pass erase labelled "DoD 5220.22-M". The Department of Defense removed over... KE Kenji Tanaka 16 Sep Cybersecurity 4 min NIST forbids the password rules most companies still enforce Character-mix requirements and ninety-day expiry are not NIST recommendations that have gone out of fashion. T... KE Kenji Tanaka 13 Sep Cybersecurity 5 min Sixteen different base64 strings decode to the same byte Base64 leaves four bits free when it encodes a single byte, and RFC 4648 binds encoders with MUST while granti... KE Kenji Tanaka 12 Sep Cybersecurity 6 min WebAuthn tells your server to ignore the bit that proves two factors One flag distinguishes a passkey login that used only the device from one that also took a PIN or fingerprint.... KE Kenji Tanaka 11 Sep Cybersecurity 6 min The DMARC tag that meant 10% of the time now means all the time RFC 9989 removed the pct tag in May 2026, and the same document says receivers must ignore tags that are not r... KE Kenji Tanaka 4 Sep Cybersecurity 7 min The lookalike domain that is blocked on .com and shown on .ru The famous all-Cyrillic apple.com impersonation was patched in 2017 and the matter filed as closed. Both major... KE Kenji Tanaka 1 Sep Developer Tools 4 min How to Self-Host Gitea or Forgejo with Docker The environment variable that closes public registration was renamed, so copying an older tutorial leaves your... KE Kenji Tanaka 31 Aug Privacy & Data 6 min What an ID number's check digit actually proves The last character of most identity numbers is computed from the ones before it, using a published formula any... PR Priya Nair 31 Aug Developer Tools 4 min How to Set Up Caddy as a Reverse Proxy with Docker Caddy gets certificates without being asked, which is why it is the right first reverse proxy. The confusion s... KE Kenji Tanaka 31 Aug Developer Tools 5 min How to Self-Host Vaultwarden with Docker The compose file is trivial. The admin token is not: it wants an Argon2 hash rather than a password, and the h... KE Kenji Tanaka 31 Aug Privacy & Data 5 min How to Stop ChatGPT, Claude, Gemini and Grok Training on Your Chats (2026) Four switches with almost the same name, doing four different things. Three are on by default. One also sets y... PR Priya Nair 29 Aug Business 5 min Why CSV Libraries Do Not Stop Formula Injection The same six values written by Python, by PHP, and by joining strings with commas. The libraries fix the comma... EV Eva Chin 25 Aug Privacy & Data 5 min Which Image Operations Strip Metadata A source image with six identifying tags and GPS coordinates, put through eight operations. Pillow drops every... PR Priya Nair 25 Aug Developer Tools 6 min What Your Rate Limit Actually Limits A route limited to 30 a minute and one limited to 60 turned out to share a single counter, because the framewo... KE Kenji Tanaka 22 Aug Privacy & Data 6 min How to Stop an Agent Returning Documents the User Should Not See A vector search scoped three ways, and measured each time. Unfiltered, four in five results belonged to anothe... PR Priya Nair 22 Aug Developer Tools 6 min How Old Is the Code You Installed? The median package in this site's tree was published 286 days ago — but one in five has seen no release in two... KE Kenji Tanaka 20 Aug AI & ML 6 min What Installing an Agent Toolkit Actually Grants Giving an agent tools is one line of configuration, and that line does not say what any of them can do. We rea... KE Kenji Tanaka 20 Aug Cybersecurity 5 min Three DNS Records Almost Nobody Publishes DNSSEC, CAA and MTA-STS each protect people who will never know they exist. Across 18 major ASEAN banks, gover... KE Kenji Tanaka 19 Aug Cyber Threat Intel 6 min Can You Prove an Attack Was Prevented? Early warning is what threat intelligence is sold on, and prevention is the least verifiable claim in security... PR Priya Nair 19 Aug Cyber Threat Intel 5 min Who Sells Threat Intelligence Four quite different businesses use the same phrase, which is most of why the market is confusing. A map of th... PR Priya Nair 19 Aug Cybersecurity 6 min What Your Own Domain Tells a Stranger OSINT needs no budget and no access. We ran it against our own domain and found 26 robots.txt rules naming /ad... KE Kenji Tanaka 19 Aug Cyber Threat Intel 5 min What a Threat Actor Name Buys You Reporting names adversaries with real confidence — APT29, Lazarus, Sandworm — and it is worth asking how much... KE Kenji Tanaka 19 Aug Cyber Threat Intel 5 min From Feed to Decision Buying a threat feed is the easy part. We work through the filtering that free public data already does to a s... PR Priya Nair 19 Aug