I’m excited to finally open-source a project I’ve been heavily refining: the #encryption #crate.

This is a 100% strict, #![no_std] generic #Rust implementation of the Ouroboros #cryptographic engine. I designed it to maintain absolute parity with the security guarantees and constant-time execution of my original #AVR assembly implementation, now brought to the Rust ecosystem.

When teaching #Embedded Systems Reverse Engineering, the vulnerabilities in standard #cryptographic libraries become glaringly obvious at the silicon level. I needed an engine that didn't just look good mathematically, but could actually survive physical and side-channel attacks on bare-metal hardware.

Whether you're targeting an ATmega328P, an RP2350, or testing natively on your host machine, this crate is built for hostile environments.

Here is what is happening under the hood:

1. Speck-128/256 & Davies-Meyer KDF: We are running 24,576 iterations of Speck-256 wrapped in a Davies-Meyer construction. This creates a ~10-second cryptographic "tar pit" that makes brute-forcing a high-entropy key over UART impossible, while crippling the theoretical quadratic speed-up of Grover's algorithm.

2. Constant-Time MAC Verification: The engine uses a branchless 2's-complement mask (derived from the AVR NEG, SBC, COM trick) to verify the payload. No data-dependent branches mean no timing oracles.

3. Hardware-Hacking Resistant: Because the key is stretched and mixed into the CTR stream, even if an attacker uses EMFI/voltage glitching to bypass the MAC validation branch, the payload decrypts to randomized garbage. Cold-boot RAM extraction is useless because the memory wipe executes in constant time.

The repository includes a host-based mock hardware demo that runs the exact same engine directly in your terminal, plus a full RP2350 hardware implementation via USB CDC ACM.

If you're building secure bootloaders, dealing with bare-metal authentication, or running hardware hacking labs, pull the crate and test it out.

Source and full cryptographic design breakdown here: https://github.com/mytechnotalent/encryption

Also available natively on Crates.io: https://crates.io/crates/encryption

Hey, quick question for the #infosec folks: are you still using securelist.com (the Kaspersky blog)? And if yes, have you looked at your traffic when you browse it?

I just added support for websocket traffic on #lookyloo and it is pretty insane. They use yandex webvisor and afaict, the WS session calls home and sends enough data to replay your whole session (mouse movment, scrolling, ...), on top of everything they can get about your browser.

Example: https://lookyloo.circl.lu/tree/7849cb0d-ae4f-4711-9b88-0bded5ca7159

OpenSSH 10.4 has just been released

This release includes a number of security and bug fixes, as well as a handful of new features - most notable experimental support for a hybrid post-quantum signature scheme (ML-DSA 44 with Ed25519).

https://www.openssh.org/releasenotes.html#10.4

Speaking of missed opportunities and bad design in development: why do we still have this ritual of updating hardcoded absolute include paths in VS project files in 2026?

Happy 10 year anniversary to the Microsoft bae intern email. 🥳

HELL YES TO GETTING LIT ON A MONDAY NIGHT WITH HELLA NOMS AND YAMMER BEER PONG TABLES

Yes, I set a reminder for this.

We've completed our work on Web Security documentation on @mdn !

The entire MDN content tree has been reworked and now features in-depth information on:
- Attacks
- Defenses
- Authentication
- Threat Modeling

↪️ Blog post https://openwebdocs.org/content/posts/security-docs-sovereign-tech-agency/

I am going to need security bloggers who clearly understand why the AI-in-everything push is a problem to stop using diffuser-generated images to illustrate their every single fucking article.

Go and use woodcuts by 15th century printmaker and all-round pretty boy about town Albrecht Dürer instead if you're running out of ideas.

https://picryl.com/collections/albrecht-durer-woodcut-prints

https://en.wikipedia.org/wiki/Albrecht_D%C3%BCrer

[RSS] If you're a button, you have one job

https://unsung.aresluna.org/if-youre-a-button-you-have-one-job

TIL about situational disability, it explains so many annoyances!

[RSS] Automating binary diffing: Bridging IDA Pro (Diaphora) and LLMs via Model Context Protocol

https://github.com/xTeardx/diaphora-mcp

WITHOUT ROWID is a very useful tool to have in the bag for sqlite. didn't know this was a thing.

I've got a very large many-many map table with a composite PK of two integers, like left_id, right_id.

turns out by default sqlite adds a rowid meta-column to tables. when the PK is a single integer it's a direct alias (no additional storage) but in other cases, like my table, it ends up as a separate stored value. for small row sizes this is rather space inefficient. it can also be slower to query

[RSS] When Dragons Misplace Elves: Fixing Ghidra's Broken ELF Export

https://binaryru.in/posts/building-functional-elf-exporter-for-ghidra/

#Ghidra

Dissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503):

https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/

#cve #linux #cybersecurity #informationsecurity #exploitation #vulnerability

HyperDbg v0.21 is released! 🪐💫

This release includes numerous bug fixes, improved stability, and significant progress toward integrating Intel PT (Processor Trace) into HyperDbg.

Check it out:
https://github.com/HyperDbg/HyperDbg/releases/tag/v0.21

personally i'm ok with AI techniques being less well known but there's a deeper thing going on here which is far more important IMO, because it's also partially why LLMs have taken over

== this thread is in response to this tweet: ==

https://x.com/krismicinski/status/2072303376629444764

RE: https://kolektiva.social/@beka_valentine/116845902133405690

An excellent thread here. So much of what I see people pointing to as LLM's benefits for coding relates to long-standing problems in software engineering that the field just hasn't addressed. And LLMs don't solve these problems, at best the just paper them over and make dealing with them less tedious -- while reinforcing the problematic dynamics.

So yes it's great that people with no programming skills can create software to solve their prolems. But if we had collectively spent a chunk of the literally billions of dollars that are going to "AI" building on the early approaches to this from 25+ years ago (Hyperscript, Logo) that don't have the same downsides, we'd be in a much better place today.

For decades, the KKK marched and protested wearing masks, and Dem lawmakers said, "It's free speech! We have to let them talk!"

Then for a few summers, some Black kids said, "We need a ceasefire in Palestine." And Dem lawmakers passed laws against masked protest.🤡

Now those Dems are quiet again.🤷🏿‍♂️

This is a hell of a picture

Blog post: Inspired by the video I just boosted - some honest thoughts on my AI remorse from my experiments earlier in the year.

It was bad, and I have SERIOUS regrets.

https://goodnameforablog.com/posts/very-average-prototypes/

#GUI framework idea: instead of messing around with grids, layers and other demons of Hell, what if the developer just declared things like:

* These things belong together
* This group of things is the most important
* This group of things is only required sometimes
* ...

Edit: Since smart people talk about "visual hierarchy" may the dev would define a graph of elements?

Not saying this would build great GUIs, but there will be *a* GUI composed based on some generally not too bad practices.

#Programming