Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The EternalHush Framework is an open-source advanced C2 framework designed for Windows machines. The framework includes an extensible Python API and plugin ecosystem. It also includes a GUI to simplify controlling and collecting data from infected machines
tartufo searches through git repositories for secrets, digging deep into commit history and branches. Effective at finding accidentally committed secrets, tartufo also can be used by git pre-commit scripts to screen changes for secrets before they are committed to the repository.
ThreatIngestor can be configured to watch X, RSS feeds, sitemap (XML) feeds, and other sources, extract meaningful information, such as malicious IPs/domains and YARA signatures, and send that information to another system for analysis.
The *Privacy Not Included team at Mozilla has released its review of privacy features of major car brands and concluded that every single one of the 25 car brands failed to meet their privacy standards. All of the brands collect too much data, 92% give little to no control over data collection to users, and 84% admit to selling that data. Tesla and Nissan scored the worst on the privacy tests and Renault and Dacia scored the best.
Android 14 tightens control of trusted certificates, blocking modification even on rooted devices, continuing the shift from openness towards locked-down vendor control. This creates challenges for developers, testers, and reverse engineers by requiring direct certificate authority control.
The State of the Virtual CISO Survey Report provides insights on vCISO adoption trends and challenges among 200 MSP/MSSP security leaders. It reveals drivers and blockers for the growing vCISO model, helping MSPs/MSSPs evaluate and overcome hurdles to offering security leadership services.
A thought piece that compares defensive security to a glacier in the sense that it is a colossal, slow-moving machine. The article gives some examples of major milestones in security and argues that they were all done by large corporations/governments and could not have happened sooner no matter what individuals did. It concludes that in defensive security, individuals must focus on smaller changes and wins than on large scale change.
The UK dropped mandatory messaging scanning from its Online Safety Bill after tech industry backlash, but clauses remain, passing the issue to future governments when "technically feasible." A bare minimum concession, the core controversy continues unresolved.
China's 2021 law mandates that tech companies operating in the country disclose hackable flaws in their products to the government. Some foreign firms with operations in China appear to be complying, potentially giving Chinese state-sponsored hackers an advantage in exploiting these vulnerabilities, raising cybersecurity concerns.
Google has confirmed as of September 7 that the second Core update this year has completed rolling out. Website owners should review ranking changes and make improvements if pages experience significant declines.
YouTube is planning to run extended ads in the middle of videos instead of short ads throughout to improve the experience and increase the engagement of non-premium users. The change will help advertisers to connect with their audiences, but the trade-off would be a reduced reach due to fewer ads.
Following the steps of Facebook and Instagram, Snapchat is adding a series of safeguards, including restricting strangers from contacting teens and removing accounts marketing inappropriate content.
Businesses with more reviews gain more trust from potential customers. This guide breaks down how to get the most value from reviews, with tips including how to deal with negative reviews, encourage new reviews, and use alternative platforms.
Restaurant chains have been revamping their loyalty programs to look more like programs seen at hotels and airlines. Subway MyWay Rewards is being replaced with MVP Rewards. The change aims to reduce friction during onboarding and promises “exclusive” benefits to certain customers.
Candy Crush Soda Saga is running a limited-time in-game tournament to promote the Rip Curl World Surf League Finals. The League is the latest to use the mobile game franchise to tap into popular culture. The campaign includes social media content from creators, giveaways, in-person activations, and more.
With recent privacy restrictions hampering measurement, major ad platforms are investing in Media Mix Modeling (MMMs) to demonstrate the effectiveness of ad campaigns to advertisers. However, there are concerns about how accurate and unbiased these models are, considering the conflict of interest with platforms trying to claim they perform better.
According to its former head of brand safety, X's moderation policies are the reason advertisers are flocking away from the platform. Offensive content is limited, but not fully removed, following orders from Elon Musk. This approach created concerns about ads being shown close to unsuitable content.
TikTok is partnering with TransUnion to enable its “TruAudience” framework, which uses privacy-first data collection processes to provide omnichannel insight.
A case study on how Wynter, a B2B message testing platform, uses intelligence surveys and preference tests to create the exact content their customers want.
Sponsored
Are your users facing embarrassingly slow page loads and rendering?
Shopify published a blog post to explain the three biggest performance problems on their sites that impact Core Web Vitals metrics. The three issues are lazy loading of images visible on the first visit, asynchronous loading of CSS of elements visible upon the first visit, and not prioritizing the fetch of the largest image, affecting Largest Contentful Paint (LCP) load times. LCP is a factor in Core Web Vitals metrics, and this can affect how a website ranks on search engines like Google. This blog post explains how Shopify is combating these problems, providing code examples along the way.
Automated testing helps both the development and product teams. Both teams benefit from the efficiency, consistency, and quality assurance that testing provides. There are three types of testing: unit tests, integration tests, and end-to-end tests. This article dives into how to implement each type of test in a React app. Furthermore, it covers what to test, such as visual elements, component behavior, global utils, custom hooks, and more.
Raylene Yung became an engineering manager at Facebook in 2011. She then moved to Stripe and watched it grow from 200 to over 1,500 employees over the next four years. Yung built Stripe’s product management team, defined career growth and recruiting frameworks, ran the core Payments business, and spun up the company’s global engineering hub in Singapore. This article features an interview with Yung where she discusses career growth for engineers. In the interview, Yung shares career lessons and covers roadblocks that can appear at every stage of an engineering career. She also provides guiding questions to help readers make the right decisions.
Most software systems will eventually fail. It’s non-trivial to maintain software, especially as it grows in both code size and user base. As a result, there are some guidelines to help software systems scale, such as documenting domain knowledge as much as possible, having an organizational focus on maintenance, and thoroughly estimating the expected value of a new initiative.
This is a React component for a currency input field that can handle many edge cases. It allows abbreviations, has prefix and suffix operations, and automatically inserts group separators.
LotusDB is an advanced key-value store written in Go. It is extremely fast and compatible with LSM and B+ trees. LotusDB combines the advantages of LSM and B+ trees to allow fast read/write performance while also beating those respective data structures at space usage.
Threads had more than 100M installs in its first 5 days - the highest number of installs in history. How did the engineering team build the app to handle an unexpectedly intense launch? What challenges and technical decisions did they make? How were they able to build an app people liked in such tight deadlines? This article answers these questions through an interview with the server engineering lead and engineering manager of Threads.
This is an investor’s take on building full-stack companies to capture value in AI. It considers some of the polarizing views on AI and startup value capture, for example, AI investing will not be useful as startups are destroyed by every new iteration of more powerful models, and AI will be similar to mobile in that it will eventually create startups that capture value.
This article explains how concurrent mode in React works using React’s useTransition hook. It also walks through the author's reasoning process whenever they’re trying to figure out how something works.
NASA writes space-proof code by focusing on testability, readability, and predictability.
Sponsored
The integration of Artificial Intelligence with Smart Home devices opens up a world of possibilities. We’ve recently seen ROOMBA - the AI powered vacuum cleaner - get
Apple is reportedly spending millions of dollars a day on AI product research with the goal of creating a Siri that can automate tasks involving multiple steps. Most of the budget is dedicated to model training, which requires a lot of expensive hardware. The company has been working on large language models for four years, but it is unclear what it has achieved with its multi-year lead. Apple's internal chatbot apparently boasts greater capabilities than OpenAI's GPT-3.5 model, but is less intelligent than GPT-4.
This article tells the inside story of the transition between CEOs for Disney over the last few years. Bob Iger announced that he would step down as Disney's CEO in February 2020, picking Bob Chapek as his successor. Iger's plan would have him stay at the company as an executive chairman for 22 months. Chapek was fired in November 2022 and Iger became CEO again, with an extended contract through to 2026. Chapek says that his tenure at Disney was 'three years of hell'.
LK-99 is a complicated chemical. While it isn't a room-temperature superconductor, it has many interesting properties. This article takes a look at some of these properties to explain why LK-99 behaves the way it does. The nature of LK-99 made it difficult for scientists to determine the source of its behaviors.
Semiglutide was originally developed to treat type 2 diabetes. It may also reduce heart failure and provide more general cardiovascular benefits. Weekly injections of the drug can reduce the risk of stroke and heart attack by 20%. While scientists don't entirely know how the drug works, studies show that it may have many other uses, such as in reducing alcohol consumption. The manufacturer that produces the drug plans to seek regulatory approval in the US and Europe for more uses.
This article discusses how to build and scale applications that use large language models. It took GitHub three years to develop GitHub Copilot from idea to production. The team used a three-stage plan for development: they identified an impactful problem space for their LLM application, created a smooth AI product experience, and then got the application ready and usable for general availability. Further resources on developing LLM applications are provided at the end of the article.
Commit Mono is a neutral programming typeface designed to create a better reading experience. It is designed to be quietly useful without an eye-catching design or any confusing ligatures. Commit Mono is inspired by common fonts. It uses an innovative technique that creates better spacing positions while preserving monospacing to improve kerning, creating a superior reading experience compared to other monospaced fonts.
This article looks at the evolution of the tunneling industry and current opportunities for disruption. Instead of complaining when stuck in LA traffic, Elon Musk thought downwards and wondered why the hundreds of meters of real estate underground were unused. A lot of infrastructure for public transport globally is already built underground. Building underground could help humans deal with weather issues and provide much-needed room for human population growth.
Cory Doctorow's latest book, The Internet Con: How to Seize the Means of Computation, presents a case for disrupting Big Tech, arguing that Big Tech's walled gardens are fenced in by legal structures, not feats of engineering. Forcing interoperability could break down these walls and make the Internet freer and more democratic. This article features an interview with Doctorow, where he discusses how interoperability could break up monopolies in Big Tech and beyond.
Modern cars, which are outfitted with all sorts of data collection devices, are terrible at privacy and security.
This article looks at statistics, anecdotes, and other evidence to make the case that the internet runs on PHP.
A transcript of a podcast where Arun Gupta, Intel's general manager of Open Ecosystem Initiatives, talks about making software greener and safer.
The trick is to refine some of the time spent doing other tasks into learning time - for example, listen to podcasts while commuting to work.
SpaceX is still waiting for FAA license approval for the second test launch.
Google is under investigation for monopolistic practices, with accusers alleging the company gained dominance in the search engine market through business partnerships.
Sponsored
AI is moving so fast that it can feel impossible to keep up. There’s so much news, so many new tools and techniques, and only so many hours a day 😩 The AI Infrastructure Alliance’s upcoming livestream event
Apple has boosted its budget for developing artificial intelligence, emphasizing creating conversational chatbot features for Siri — allegedly spending millions of dollars daily on research and development.
The Falcon models from the UAE have long been the best open models available. The newest 180B parameter model slightly outperforms Llama 2 70B and has a 2k context window. The models have historically been quite tunable. However, given the resource requirements, it's not clear whether the community will adopt this newest model.
OpenAI will hold its inaugural DevDay conference in San Francisco on November 6, 2023. This event will preview new tools and foster idea exchange, attracting hundreds globally. Currently, over 2 million developers use tools like GPT-4 and DALL·E through OpenAI's continuously updated API.
PPO is a pain in RLHF because you need to have 3 models floating around. However, they all stay close and only require small updates from one another. Enter LoRA. If you instead use adapters you can dramatically reduce memory costs without losing performance. Beautiful idea in its simplicity.