TLDR Index
Daily Editions
Contents
  1. Page 1: Today’s IndexTLDR, TLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Crypto · 9 stories
  2. Page 2: TLDRTLDR · 9 stories
  3. Page 3: TLDR AITLDR AI · 10 stories
  4. Page 4: TLDR Web DevTLDR Web Dev · 10 stories
  5. Page 5: TLDR InfoSecTLDR InfoSec · 12 stories
  6. Page 6: TLDR CryptoTLDR Crypto · 12 stories
  7. Page 7: TLDR ProductTLDR Product · 10 stories
  8. Page 8: TLDR DesignTLDR Design · 12 stories
  9. Page 9: TLDR FoundersTLDR Founders · 11 stories
  10. Page 10: TLDR MarketingTLDR Marketing · 12 stories
  11. Page 11: Resources & ToolsTLDR AI, TLDR Web Dev, TLDR InfoSec, TLDR Design, TLDR Founders, TLDR Marketing · 18 stories
  12. Page 12: SponsoredTLDR, TLDR AI, TLDR InfoSec, TLDR Founders, TLDR Marketing · 9 stories
?
Keyboard shortcuts
← / →
Previous / next page
↑ / ↓
Scroll while full screen
PgUp / PgDn
Scroll by viewport
Space
Scroll down by viewport
Shift+Space
Scroll up by viewport
Home
First page
End
Last page
F
Full screen
Escape
Exit immersive mode

Daily Edition · Page 5

THE DAILY INDEX

Technology, AI, software, security, crypto and business

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

THREAT MODELING AUTOMATION: OPPORTUNITIES, CHALLENGES, AND THE ROLE OF AI

Traditional threat modeling struggles with scalability due to needing dedicated security resources as well as engineering resources to understand both the security aspects and application components. Recent innovations in the threat modeling process are meant to integrate threat modeling throughout the SDLC as well as offering tools for diagramming or threat models as code. With the advent of LLMs, it could be possible to generate threat models directly from source code. Current efforts such as STRIDE GPT can generate threat models from a natural language description.

devarmor.com · 8 min

TLDR InfoSec

AVOIDING SECURITY INCIDENTS DUE TO REQUEST COALESCING

Web caching is often utilized to speed up costly calculations or decrease response times by maintaining a copy of data closer to users. Request coalescing is when Amazon CloudFront is used as a CDN and sees requests for the same cache key come in simultaneously and the CDN waits for the first response to be cached and then uses the cached copy for the following responses. Wiz found an unexpected behavior where Amazon CloudFront was ignoring the Cache-Control: no-cache header and sending sensitive cached content to users via request coalescing. To prevent this behavior, users must configure the managed cache policy CachingDisabled for those cache keys or set the minimum TTL for the cache behavior to 0 AND configure the origin to send the Cache-Control: no-cache header.

wiz.io · 4 min

TLDR InfoSec

ANNOUNCING AWS KMS ECDH SUPPORT

AWS has announced support in KMS for asymmetric keys using ECDH. Each party generates a key using the same key spec and selects KEY_AGGREEMENT for the usage. The parties then retrieve and exchange their public key from KMS. Each party can then utilize the other party's public key and their KEY_AGREEMENT key to call the new DeriveSharedSecret API to derive an asymmetric key that can be utilized for secure communication. This post provides a walkthrough for a sample use case of end-to-end encryption using the new DeriveSharedSecret API.

aws.amazon.com · 5 min

TLDR IndexPage 5