New blog post: Perfect types with `setHTML()` - https://frederikbraun.de/perfect-types-with-sethtml.html - TLDR: Use require-trusted-types-for 'script'; trusted-types 'none'; in your CSP and nothing besides setHTML() works, essentially removing all DOM-XSS risks....

Composing Sanitizer configurations (https://frederikbraun.de/composable-sanitizers.html): The HTML Sanitizer API allows multiple ways to customize the default allow list and this blog post aims to describe a few variations and tricks we came up with while writing the specification.

Building a Super-Compact Cistercian Numerals Clock

https://hackaday.com/2026/03/08/building-a-super-compact-cistercian-numerals-clock/

@Sempf I used this model for years, but somehow the keyboard became terrible (didn't register presses or registered double-triple) after a while and it was even worse in brand new phones. How's yours doing?

Darknet Diaries 170: Phrack

"Phrack is legendary. It is the oldest, and arguably the most prestigious, underground hacking magazine in the world..."

🔗 https://darknetdiaries.com/episode/170/

#Phrack #Hacking #CyberSecurity

Watching pro developers discussing how stupid some of the exploits of widely used software are is pretty entertaining:

https://www.youtube.com/watch?v=OgfdyH4iaps

Good to see the "other side" gets it!

I wrote a not very serious thing about #3Dprinter and #warhammer

https://matduggan.com/the-year-of-the-3d-printed-miniature-and-other-lies-we-tell-ourselves/

@algernon Hearing this from someone who produces non-trivial Rust software restores my self-esteem a tiny bit

Phrack 73 CFP

https://phrack.org/

With a demo!

The perfect headline doesn’t exi…

https://www.engadget.com/big-tech/google-pledges-roughly-three-hours-of-its-annual-profit-to-fight-climate-change-164808010.html

[RSS] Reverse-engineered the WiFi transfer protocol for HeyCyan smart glasses (BLE + USR-W630 WiFi module) -- first iOS implementation

https://alexschar.dev/HeyCyanCaseStudy

[RSS] A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets

https://blog.calif.io/p/a-race-within-a-race-exploiting-cve

[RSS] Reviving a 20-year-old puzzle game Chromatron with Ghidra and AI

https://quesma.com/blog/chromatron-recompiled/

@matdevdug I laughed so hard that my family started to get worried. Thank you!

If you have not seen Wargames, you absolutely should. Holds up well (as a movie; maybe not the technology so much), all these years later. Currently free on YouTube. https://www.ozbargain.com.au/node/950868

[RSS] U-Boot security improvements using Arm memory permissions

https://www.linaro.org/blog/undefined/

[RSS] Coercing machine accounts through MsSense.exe -- MDE becomes the attack vector

https://medium.com/@Sniffler/stuck-without-coercion-options-why-not-just-coerce-mde-aecc23b43b66

[RSS] Getting a Shell on the Tapo C260 Camera (CVE-2026-0651, CVE-2026-0652, CVE-2026-0653)

https://spaceraccoon.dev/getting-shell-tapo-c260-webcam/

"Besides, they are good company, my sheep."

A new page of my comic Ekphrasis, which you can read for free at https://ekphrasiscomic.neocities.org/.