Is there a #logging library that provides nice interfaces (not N config variables) for both:

- "Reliable" logging, when you want to e.g. flush every message immediately because you are debugging
- "Performant" logging, when you don't want to waste time on I/O?

(what's the proper terminology here?)

There must be of course middle-ground, e.g. I imagine errors should always be recorded reliably in many situations, but I imagine that e.g. auto-tweaking performance on debug log level would be reasonable.

[RSS] Windows Exploitation Techniques: Winning Race Conditions with Path Lookups

https://projectzero.google/2025/12/windows-exploitation-techniques.html

[RSS] Thinking Outside The Box [dusted off draft from 2017]

https://projectzero.google/2025/12/thinking-outside-the-box.html

#VirtualBox

@wolf480pl @bagder do you have a link about this? :)

New Project Zero issue:

Adobe DNG SDK: areaSpec overlap miscalculation lead to integer overflow, leading to OOB read/write

https://project-zero.issues.chromium.org/issues/445575206

CVE-2025-64783

🚨 noyb has filed complaints against #TikTok and #Grindr. As it turns out, TikTok even tracks you while you're using other apps. For example, TikTok was able to track a person’s Grindr usage - which allows it to draw conclusions about his sexual orientation and sex life

👉 https://noyb.eu/en/tiktok-unlawfully-tracks-your-shopping-habits-and-your-use-dating-apps

Mitre has just published their top 25 most dangerous software vulnerabilities of 2025

How does #CHERIoT stack up against this list?

5, 7, 8, 11, 14, and 16 are deterministically mitigated with just a recompile.

13 will trap, but is recoverable on a per-compartment basis.

15 is trivial to mitigate with compartmentalisation. Phil Day wrote about this 18 months ago.

6 is mitigated by good capability-based filesystem APIs.

25 is mitigated by our software capability model in the RTOS.

1, 2, 3, 9, 10, 12, 22, and 23 and are not normally applicable on embedded platforms.

That leaves you with a lot more spare brainpower to think about avoiding the remaining seven (4, 17, 18, 19, 20, 21, and 24). The impact of many of these is limited in an environment where there is a programmer model that makes implementing the principles of least privilege and intentional use trivial.

Attempting Cross Translation Unit Taint Analysis for Firefox

https://attackanddefense.dev/2025/12/16/attempting-cross-translation-unit-static-analysis.html

I've never felt one with any other movie character like this. RIP, legend!

https://www.youtube.com/watch?v=VO4XYoB49Lg

@joxean Don't give them ideas please!

Public preview of synced passkeys brings the security benefits of MFA with simpler usability, while avoiding the security risks of weaker MFA options like SMS. However, even the simplest MFA can fail when credentials are lost, making account recovery a critical part of the user experience. To improve usability in such cases, we are introducing public preview for account recovery with AI-powered biometric match against government issued IDs across 192 countries.

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/synced-passkeys-and-high-assurance-account-recovery/3627343

@mumblegrepper I wouldn't be surprised if this was the actual strategy...

[RSS] Don't judge an audiobook by its cover: taking over your Amazon account with a Kindle

https://blog.thalium.re/posts/dont-judge-an-audiobook-by-its-cover-taking-over-your-amazon-account-with-a-kindle/

[CVE-2025-14282] dropbear: privilege escalation via unix domain socket forwardings

https://github.com/turistu/odds-n-ends/blob/main/CVE-2025-14282.md

It's 2025, and I have to prompt an LLM no less than 5 times to figure out how to add a new keyboard layout to Windows Server 2025, becase 1) the UI turned absolutely shit 2) the built-in search is optimized for ads instead of discovering functionality.

Also, Disk Management is gone, and you get no meaningful results for "disk" in the Start Menu. But when you *right click* the Start icon it's there. Why would it be so hard to make this discoverable by search (or leaving a shortcut with the original name)??

Rust is is not a "silver bullet" that can solve all security problems, but it sure helps out a lot and will cut out huge swatches of Linux kernel vulnerabilities as it gets used more widely in our codebase.

That being said, we just assigned our first CVE for some Rust code in the kernel: https://lore.kernel.org/all/2025121614-CVE-2025-68260-558d@gregkh/ where the offending issue just causes a crash, not the ability to take advantage of the memory corruption, a much better thing overall.

Note the other 159 kernel CVEs issued today for fixes in the C portion of the codebase, so as always, everyone should be upgrading to newer kernels to remain secure overall.

RE: https://infosec.exchange/@BleepingComputer/115730066370654236

Apparently CVE-2025-59718 and CVE-2025-59719 are now EITW.

@gsuberland Be true to the name: write a script to change to a random number periodically to increase Chaos

@fwaggle on my Ubuntu 22.0 and 24.0 the ed25519 host public key is not in PEM but in the <type> <key> format (no <comment> section).

What distro uses PEM? I can try to convert it to the type-format and see if the daemon blindly accepts it.

../ in FreshRSS. How did no one recommend that one to me yesterday? A new ../ would have been fun.

https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-6c8h-w3j5-j293