Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
A new Android trojan called BlankBot, aimed at Turkish users, offers attackers extensive malicious capabilities. It poses as utility apps and tricks users into granting permissions. BlankBot can log device information, steal sensitive data, and perform custom injections.
This post breaks down the pros and cons of storing JWT tokens in cookies vs Session/Local Storage. Neither option is completely secure. Cookies used with HttpOnly are protected from JavaScript but they are vulnerable to CSRF and can be used in XSS attacks because the browser will send them on every request. Session and Local Storage are not vulnerable to CSRF but are designed to be accessed from JavaScript and are also vulnerable to XSS. Session Storage is per-tab, so users that open a link in a new tab will be logged out in that tab.
This article begins with discussing some dark patterns in cloud pentesting before offering a 7 stage roadmap to ramp up in AWS pentesting. The first couple of stages begin with solving Red Team labs with official and community walkthroughs before beginning to do CTFs independently. The next couple of stages involve automating exploits for CTFs and learning to build a secure AWS environment with CloudSLAW. The final stages focus on filling in knowledge gaps, synthesizing knowledge, and continuous learning.
Use secure guardrails instead of traditional “shift-left” gates. Secure guardrails integrate directly into developer workflow, should offer autofixes or advice that aligns with organization policies, and should empower developers to write more secure code and use secure-by-default libraries while also allowing developers to adjust or override guardrails when needed. Semgrep can be used to implement secure guardrails and provides a scorecard to grade your implementation of secure guardrails.
Prompt Airlines is an AI Security CTF that contains 5 levels of increasingly difficult challenges. The ultimate goal is to manipulate an AI chatbot to get a free airline ticket.
Dioptra is a software test platform for assessing the trustworthy characteristics of AI. Trustworthy AI is valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair - with harmful bias managed.
urlhunter is a recon tool that enables search on URLs exposed via shortener services such as bit.ly and goo.gl.
Since 2018, 138 legal firms globally have confirmed ransomware attacks affecting 2.9 million records. 2023 saw the most attacks (45) and records impacted (1.6 million). Average ransom demands are $2.47 million, with $1.65 million typically paid.
Researchers have uncovered a new DDoS campaign called Panamorfi targeting misconfigured Jupyter Notebooks. It uses a Java-based tool, mineping, to launch TCP flood attacks. The attack exploits exposed Jupyter instances to download malicious files, which then connect to a Discord channel and execute the DDoS tool, overwhelming target servers.
This post discusses leveraging vulnerabilities in iOS to achieve full Remote Code Execution (RCE) in WebRTC based protocols. It covers topics like breaking Address Space Layout Randomization (ASLR) and exploiting shared libraries like SignalServiceKit. By chaining together various leaks and utilizing ARM64 ROP chains, the researchers successfully achieved their goal of leaking Signal-iOS's database.
A Chinese hacking group named StormBamboo compromised an ISP to inject malware into software updates by exploiting insecure update mechanisms.
A Russia-linked group used car-for-sale phishing lure to target diplomats with a Windows backdoor called HeadLace.
CISA appointed Lisa Einstein as its first Chief Artificial Intelligence Officer to advance cybersecurity efforts in using AI responsibly.
Almost 85% of ecommerce site visitors remain unidentified, which hinders retailers' ability to engage them effectively. Identifying visitors is key, as businesses with the highest identification rates experience 53% higher repeat purchases. The lack of information prevents retailers from personalizing their communication and retargeting customers which is critical to compete with discount marketplaces like Amazon.
Brands with higher creator retention rates, where at least 25% of creators post about the brand in consecutive 12-month periods, perform better. User engagement on TikTok is high, with users 1.2X more likely to watch brand content and message brands compared to other platforms. Authenticity is crucial - 41% of users find creator content authentic and 55% trust brands more when endorsed by creators. Ads featuring creators related to a brand's vertical are 1.5X more effective.
Amazon advertising services grew 20% YoY in Q2 to $12.77 billion, a deceleration from prior quarters. Most ad revenue still comes from sponsored product formats, but the retail media category has become more competitive and mature. Forecasts suggest retail media's growth rate could slow next year as budgets are exhausted. Amazon introduced commercials to Prime Video and in May hosted its first upfront event pitching for larger TV ad budgets, though these deals can take time to materialize.
Take a break when stuck to allow for incubation — our brain's ability to subconsciously process information and make connections. Use contrast and opposing elements in your copy to create intrigue and make your writing more engaging and memorable. If your copy feels generic and flat, use the “So what?” exercise until you arrive at what the prospect truly desires, consciously or otherwise.
Decision paralysis leads to inaction or significant delays in making a choice. It often happens when there are too many choices available. Instead, provide front end offers — they're easy to understand, low-priced, and deliver quick results. After the initial sale is made, upsell customers to higher-tier products. This approach focuses on lifetime customer value, makes the first sale easier, and builds trust gradually.
Insights from recent redesigns at Spotify, Nextdoor, Ring, and AllTrails indicate that boring, functional sign-up screens drive more conversions. Removing distracting visuals and focusing on a streamlined experience can enhance usability and download rates.
GA4 will always experience data loss due to cookies and ad blockers. It's important to look at the data directionally to get actionable insights from it. For example, look at the percentage of sessions and key events per page rather than the raw counts of each metric. Show year-over-year dashboards with rounded totals and the percentage change. These types of visualizations can help others understand that GA4 will never be perfectly accurate but can be useful directionally.
AI now handles 60-70% of marketing workflows, enabling smaller teams to achieve higher productivity. The rise of AI in marketing has also led to faster product launches, reducing time by 50-60%. Key tools include MarketMuse for white papers, Grammarly for content refinement, and Substack and Convertkit for thematic newsletters. Hootsuite, Taplio, and Buffer manage social media engagement, while Knotch or Chartbeat track user interactions and sentiment. Lately and Circleboom facilitate content distribution across platforms and communities.
Your brand's everyday activities can be extraordinary to your audience, much like reality TV shows about niche jobs captivate viewers. By showcasing behind-the-scenes content, such as Getty Museum's earthquake-proofing process or Wild Rivers Waterpark's slide checks, brands can engage their audience with seemingly ordinary moments. This approach makes your audience feel like insiders, fostering a deeper connection and appreciation for your work.
Nike's focus on digital marketing and broad product categories has diminished its cool factor. In this article, former executive Massimo Giunco highlights the company's shift from niche collaborations, like the Flyknit series, to generic offerings, reducing innovation and cultural impact. Despite being a market leader, Nike has seen many new competitors stealing market share and is struggling to maintain its cultural appeal.
Vice President Kamala Harris's campaign uses memes and TikTok trends to engage young voters.
LinkedIn is rolling out verification badges for company pages on a limited basis.
Notion recently improved its browser performance by using SQLite for client-side caching. This led to a 20% increase in page navigation speeds through a SharedWorker architecture to manage concurrency and prevent database corruption. SQLite was implemented using WebAssembly for local data storage and offline functionality. In this post, the team at Notion goes through challenges they faced with slow disk reads and initial page load times.
This author recounts his experience working with a messy, yet strangely enjoyable legacy codebase. The system was riddled with quirks like a table with only one row used for generating IDs, a manually-updated calendar that controlled logins, and a daily data refresh process that could crash the system. The codebase itself was a chaotic mix of technologies, including outdated frameworks and a haphazardly built shipping application. Despite its flaws, the lack of overarching design allowed for independent development and quick fixes, which gave developers a sense of creative freedom.
The creator of the Impact JavaScript game engine rebuilt it in C and called it high_impact. This new engine is designed for 2D action games and runs on Windows, Mac, Linux, and the web. high_impact utilizes a simple framework with minimal code and is highly extensible, offering support for tile-maps, entities, collision detection, and rendering through OpenGL or a software renderer. The developer ported two of his original Impact games, Biolab Disaster and Drop, to high_impact to demonstrate the engine's functionality.
“Outline speedrunning” is a technique for accelerating the building process of any project. It involves recursively outlining a project into smaller and smaller components, then filling in these components as quickly as possible without focusing on perfection. Only after completing all components does one go back and refine the work, resulting in a faster and less stressful process. This approach is significantly faster than the traditional "loading bar" style of building, which involves working through the project sequentially.
Promotions to Staff Engineer focus on sustained, measurable impact aligned with company goals, often demonstrated over at least six months. Leveraging people, writing, and high-quality code multiplies your influence, differentiating higher-level ICs from others. Building a strong internal brand through quality work, collaboration, and effective communication is necessary.
LLMs are already providing tangible value, contrary to the claims of many who consider them just hype. This post details how the author uses LLMs to simplify code, automate boring tasks, provide API references, search for things difficult to find, explain concepts, solve one-off tasks, and various other tasks. While LLMs might not be able to solve complex or novel problems, their ability to handle mundane tasks can significantly improve productivity and allow developers to focus on the interesting aspects of their work.
Sponsored
Over 2/3rd of dev teams test less than 50% of their workflows, causing bugs to sneak out. QA Wolf [11] gets your organization to 80% automated E2E test coverage in weeks, not years.
Ell is a command-line interface for LLMs written in Bash. You can chat with LLMs and have them call functions through your terminal.
Plain Vanilla is an explainer for doing web development using only vanilla techniques. This means no tools and no frameworks — just HTML, CSS, and JavaScript.
Morphic is an AI-powered search engine with a generative UI.
This developer jailbroke their Kindle Paperwhite to use as an e-ink monitor. The process involved jailbreaking the Kindle, setting up a listener server on it to receive image files, and using screen capture and image manipulation tools to send images from a computer to the Kindle.
Avoiding barrel files can prevent issues like circular imports and improve development speed by reducing unnecessary module loading. Consistency in file organization can be enforced by lint rules like `import/no-cycle`. A single casing format for filenames is useful for team style guides. While barrel files may be necessary for libraries, they often complicate application code and should be avoided.
Deno's initial HTTP imports aimed to simplify JavaScript development by using distributed URLs instead of a centralized registry, but this approach faced issues like long URLs, cumbersome dependency management, and reliability concerns. Deno introduced Import Maps and JSR to address these problems, offering better version management and reliability while maintaining the benefits of granular, HTTP-based module loading.
Get your GitHub profile roasted by AI.
A free ebook on WebGPU programming.
C++17, C++20, and C++23 have introduced improvements to enum classes, enhancing their type safety and usability through features like direct initialization from underlying types, the 'using enum' keyword, and the std::to_underlying utility.
This project uses breadth-first search to identify connections between a GitHub user and Linus Torvalds.
Microsoft added OpenAI to its list of competitors in its latest annual report. OpenAI is listed as a competitor in AI offerings, search, and news advertising. The companies have a long-term partnership, with Microsoft being OpenAI's biggest investor. OpenAI says that nothing about the relationship between the two companies has changed as their partnership was established with the understanding that they would compete.
Intel is downsizing its workforce by over 15 percent as part of a new cost savings plan for 2025. The $10 billion cost saving plan will mean a headcount reduction of greater than 15,000 roles. Intel plans to reduce its R&D and marketing spending by billions each year through 2026, reduce capital expenditures by more than 20 percent this year, restructure to stop non-essential work, and review all active projects and equipment to make sure it's not spending too much. The company recently reported a loss of $1.6 billion for Q2, which is substantially more than the $437 million it lost the previous quarter.
An AI-controlled autonomous robot has performed an entire dental procedure on a human patient for the first time. The system uses a hand-held 3D volumetric scanner that builds a detailed 3D model of the mouth using optical coherence tomography, cutting X-ray radiation out of the process. The robot surgeon plans out the operation after the human dentist and patient agree on what needs to be done. It can prepare a tooth for a dental crown in 15 minutes, a procedure that usually takes two hours split into two visits. Video of the robot is available in the article.
A key protein called Reelin appears to protect the brain from Alzheimer's and other diseases of aging. Studies suggest that the protein helps maintain thinking and memory in ailing brains. The research has inspired efforts to develop a drug that boosts Reelin or helps it function better. The discovery of Reelin was aided by the cooperation of about 1,500 members of an extended Colombian family that carries a gene that almost guarantees the development of Alzheimer's in middle age.
Sponsored
Reach your target audience while they are actively engaged and reading content. TLDR offers 10 newsletters and has over 4 million tech professional subscribers including software developers, AI enthusiasts, product managers, marketers, and executives to help you reach your audience effectively. Learn more [8] about running your first campaign with us.
CSV is simple, resilient, and seemingly impossible to kill off. The standard developed naturally as a simple way to store data in tables when storage was very limited. It has become crucial for business data - companies use it to share financial data, import customer information, and exchange data between different systems. While it has its problems, the format will likely remain king, as its core simplicity will keep it relevant for years to come.
Limbo is an in-process OLTP database engine library. It started as a research project to build an SQLite-compatible in-process database in Rust with native async support. Limbo is compatible with SQLite and the developers are working on JavaScript/WebAssembly bindings.