The blog post, in which the author discusses designing malware for macOS, covering its architecture, security features, Mach API, kernel internals, and shellcode injection, was originally written in 2022 and updated for macOS X Catalina. It emphasizes the importance of understanding system calls, memory protection mechanisms, and code injection techniques using Mach APIs on macOS. The author recommends further reading on the topic and highlights the importance of understanding the environment, features, and security of macOS through practical examples.
This project consists of an open source library that allows software to connect to data repositories using STIX Patterning and return results as STIX Observations.
secureCodeBox is a Kubernetes-based modularized toolchain for continuous security scans on software projects. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box.
A repository containing a list of tools that different ransomware gangs utilize to aid defenders in threat hunting.
Uber faces a €290 million fine from Dutch regulators for improperly transferring EU driver data to the US, violating GDPR. The investigation, prompted by French drivers' complaints, found sensitive information stored on US servers without adequate protection.
The American Radio Relay League (ARRL) paid a $1 million ransom following a May ransomware attack. The attack affected 150 employees but they were able to obtain a decryptor to restore the encrypted systems.
An AWS customer began to notice connectivity issues with Let's Encrypt renewals in a VPS that they used that they were not able to resolve with support from the VPS provider. After debugging with AWS, they discovered that the traffic was being routed to a third party that was advertising a typoed BGP route through Direct Connect that unintentionally overlapped with the original AWS customer's IP range. AWS support confirmed that its BGP route verification process failed in this circumstance and has added process improvements to prevent possible malicious traffic hijacking through this vector in the future.
The U.S. Marshals Service denies being breached by the ransomware gang Hunters International despite claims made on the dark web.
A China-linked APT group exploited a zero-day vulnerability in Versa Director to deploy a custom webshell in target networks.
Notion is leaving the Russian market and will shut down accounts linked to users in Russia by September 9 due to U.S. government restrictions.
Sponsored
Can you afford to ignore a channel with over 500 million active users during the holiday season?
It's almost impossible to scroll through your For You Page without coming across a live video where you're being directly sold to — akin to the '90s shopping channel QVC. These streams give users community interaction, advising each other in the comments, as well as a celebration moment when someone makes a purchase in front of hundreds of other users. Many businesses in China, the UK, and the US have turned to this sales format via TikTok Shop, as social media users are increasingly willing to make purchases directly through the app.
This deck highlights how younger audiences (18-25 years old) are reducing social media usage, shifting the focus to niche, interest-driven interactions. It discusses TikTok's growing role as a search engine for Gen Z and the rising importance of longer content formats. The deck also emphasizes the need for brands to create serialized, scalable content across multiple channels and the power of "weak ties" in niche communities to build loyalty.
To convert subscribers into customers, start with a Welcome Email to introduce your brand and deliver the opt-in offer. Then create a Story Email sharing your brand's background. Next, send a Problem Email to highlight the issue your product solves and follow up with a Social Proof Email showcasing testimonials or case studies. An Incentive Email with a discount can then encourage purchases, and wrap up with an Urgency Email to create a sense of urgency. This sequence works for both eCommerce and personal brands.
When embedding videos natively in emails, ensure your video file is under 10MB. Choose a thumbnail with a clear focal point and a prominent play button to entice clicks. Optimize your email for various clients by setting up fallbacks, particularly for platforms like Outlook that have limited video support. Include strong visuals and concise storytelling to capture attention quickly, and always test how your video performs across different email clients.
Links with hashtags represent jump links, which will appear in Google Search Console reports when they are displayed on the search result page. Only use the count of search impressions for the main URL, as the impressions for these jump links are essentially double counted. This reporting is helpful though to see how often the jump links are displayed and clicked.
HubSpot's AI Search Grader analyzes how visible your brand is in AI-powered search engines. Enter 4 fields describing your company to see a brand sentiment score and share-of-voice score. An optional email form unlocks additional reporting, including more detailed sentiment scoring, brand strengths and weaknesses, and competitor analysis.
Searches for “how to humanize AI content” have grown 943% over the last 12 months, but doing so is an inherently flawed process. By the time you've researched and added in the human element, you may as well have created the content from scratch yourself. This type of request is also demoralizing for writers, especially when paired with an unrealistic deadline. Companies should use AI models to ideate, plan, and outline content — not ghostwrite it.
This article discusses an A/B test on CTA anchor text that initially failed, but eventually led to a 4% increase in leads. The test compared 3 variations: a control, a version with "free" added, and a more descriptive option. The best practice of adding "free" caused a drop in conversion rates, likely due to users associating it with spam. However, the descriptive option that included the product name in the CTA improved conversions, especially among new visitors.
Don't write headlines that read like orders - instead, make a specific promise that takes the work off your prospect and puts it on your product.
Inbox providers use bots to verify email links, which give a false measure of engagement - enable the "bot clicks" feature in Klaviyo email settings to get more accurate data.
Memory usage is tracked in Node.js (V8) with metrics like RSS, Heap Total, Heap Used, External, and Array Buffers. There are various causes of memory leaks, such as improperly managed variables, persistent global objects, unremoved event listeners, closures capturing variables, and circular references. Developers can profile memory usage by using the `--prof` flag and analyzing the resulting profile file to identify areas of potential memory leak.
Meta's Privacy Aware Infrastructure (PAI) is a large-scale initiative designed to enforce purpose limitation. PAI's key component, Policy Zones, provides a comprehensive mechanism for encapsulating, evaluating, and propagating privacy constraints for data in transit and at rest. Its integration across various Meta systems, including function-based and batch-processing systems, makes sure that data is only used for its intended purpose.
Reddit users debate whether Tailwind is too redundant or not. Some people find the class names to be repetitive and difficult to maintain. Others find Tailwind CSS to be helpful and time-saving.
People often prefer complex solutions over simple ones, even though they claim to want simplicity. This is because complex solutions make people feel special and superior. Basic problems are often turned into insurmountable challenges during development, requiring expensive subscriptions for "sophisticated" solutions.
Sponsored
Authentication is one of the main building blocks of any software product, and you want to be really sure you're making the right choice. The only reliable way to do that is to run it in your actual code [9], in your actual application logic. If there's no free trial,
Simulacrum allows you to write code to build interactive diagrams for complex software flows. It's a React component with an IDE, a compiler, and a runtime all working together. The compiler converts your code into something that can emit the program's custom instructions.
A collection of 224 free public APIs for developers that have been verified and tested.
This is a free background remover that uses WebGPU to remove backgrounds locally in-browser.
This developer was able to optimize CRDTs (Conflict-Free Replicated Data types) for collaborative editing by 5,000x. They started with a simple data structure change using a flat list instead of a tree. Then they adopted a bidirectional linked list and run-length encoding, leading to a 30x speedup compared to the original Automerge implementation. Finally, by using Rust's memory control capabilities and a range tree data structure, the developer achieved a 5,000x speedup, demonstrating that CRDTs can achieve performance comparable to native strings.
Using LLMs for root cause analysis (RCA) for cloud incidents is probably not a great idea. LLMs, while capable of automating some aspects of RCA, lack the depth and nuance of human experts. Furthermore, there's the "automation surprise" problem, where unexpected LLM behavior could lead to dangerous situations due to user misunderstanding.
2024.08.28·muratbuffalo.blogspot.com·7 min read·TLDR Web Dev Netflix researchers developed methods to analyze historical A/B test data to understand the relationship between proxy metrics and long-term business outcomes. They propose three estimators that offer more robust solutions for understanding the true relationship between proxy metrics and north star metrics: Total Covariance (TC), Jackknife Instrumental Variables Estimation (JIVE), and Limited Information Maximum Likelihood (LIML).
TaskWarrior is free, open-source software that helps you manage your TODOs from the command-line.
Monospace fonts and grid systems can be used to create readable, consistent, and visually appealing web pages.
Anthropic has published the system prompts used to guide its Claude AI models and plans to continue being transparent moving forward.
This article describes how to use Docker to host applications on a VPS, which is cheaper and often easier to maintain than using traditional cloud providers.
* Easy ways to measure research-backed engineering metrics [4] like DORA and SPACE * Automated feedback loops on Slack [4], faster PR reviews, and working agreements * Developer experience surveys [4] that tell you exactly what to improve
Sponsored
If you want your startup to make it, you need to ship better software faster than your competitors. That means becoming great at identifying and eliminating the bottlenecks that are slowing you down.
Apple is reportedly developing an AI personality entirely separate from Siri for future Apple robotics devices. The company's first robotics projects are not expected to debut until 2026 or 2027. Apple will ship a brand new Apple Intelligence-fused Siri in iOS 18.1 later this fall. However, many of Siri's most powerful new capabilities aren't scheduled to arrive until sometime in 2025.
2024.08.27·9to5mac.com·2 min read·TLDR Apple's next big event will be on September 9 at 1 PM ET at the Steve Jobs Theater at Apple Park. The company is expected to launch the iPhone 16 lineup during the show, which has the tagline 'It's Glowtime'. Apple Intelligence features will likely be a big part of the event. The company is also rumored to launch the Apple Watch Series 10 and two versions of AirPods.
2024.08.27·theverge.com·2 min read·TLDR Billionaire entrepreneur Jared Isaacman is scheduled to head into space for the second time later this week. The itinerary for the trip includes the first ever spacewalk by private astronauts. The mission will travel farther than anyone has traveled since the Apollo 17 mission went to the Moon in 1972. It will pass through regions of intense radiation while testing new technologies and gathering data on the effects space has on the human body.
2024.08.27·links.tldrnewsletter.com·14 min read·TLDR Researchers at the University of Notre Dame in Indiana are working to adapt artisan glass-blowing techniques to a robotic platform. They have developed a technique that uses a laser to heat the surface of a glass rod so it can be deformed to create 3D shapes. It is able to create the transparent solid structures needed in optical, microfluidic, and photonic devices. The method can deposit glass at 15 cubic millimeters per second. A picture of the glass 3D printer is available.
2024.08.27·spectrum.ieee.org·4 min read·TLDR Sponsored
You can't launch an app in 2024 if you're not keeping customer data secure. Why spend your limited time building auth from scratch when eligible startups can use Auth0 for $0 [10]? Get your applications up and running quickly with the leading customer identity platform. Start
This post presents an overview of the process of submitting a bug fix to Chromium/Google Chrome from beginning to end. It aims to give some perspective for developers looking to try it. The post covers how the bug was discovered and fixed, testing and code review, and more. The process can take a while and a good bit of effort, but it is a valuable experience in seeing how software gets built at Chromium's scale.
2024.08.27·cprimozic.net·19 min read·TLDR Sparrow enables efficient data extraction and processing from various documents and images. It can handle forms, invoices, receipts, and other unstructured data sources. Sparrow has a pluggable architecture, so users can easily integrate and run data extraction pipelines using other tools and frameworks. Sparrow can be used to build independent LLM agents for various use cases.
2024.08.27·github.com·GitHub repository·TLDR