Search the archive

THREAT ACTOR COMPROMISING SNOWFLAKE DATABASE CUSTOMERS

A campaign by threat actors to use stolen credentials to breach Snowflake databases that do not have MFA or 2FA enabled has been reported. The threat actor is using custom tooling for the Snowflake environment to carry out theft and extortion operations. It is believed that there hasn't been any compromise of Snowflake's internal systems.

LIVE NATION TOOK 11 DAYS TO CONFIRM THE MASSIVE TICKETMASTER DATA BREACH

Live Nation Entertainment acknowledged a data breach in a regulatory filing after an individual claimed to be selling data on 560 million Ticketmaster customers on hacking forums for $500,000. The breach involved unauthorized access to a third-party cloud database containing customer data like names, addresses, and credit card details.

HUGGING FACE SAYS IT DETECTED ‘UNAUTHORIZED ACCESS' TO ITS AI MODEL HOSTING PLATFORM

Hugging Face disclosed late Friday that its security team detected unauthorized access to Spaces, its platform for sharing and hosting AI models, earlier in the week. The intrusion involved potential access to private "secrets" used as keys to protected resources. As a precaution, Hugging Face revoked numerous tokens and recommended users refresh keys and switch to more secure access tokens.

SERVER-SIDE REQUEST FORGERY (SSRF) LAB

This post explains what server-side request forgery (SSRF) is and describes some common examples while walking through a PortSwigger Lab. It also demonstrates how to identify and exploit SSRF vulnerabilities.

CREDENTIALS LEAKING WITH SUBDOMAIN TAKEOVER

Truffle Security's team provides a deep dive into how localStorage can be abused in a subdomain takeover. They discovered a subdomain takeover vulnerability on Readme.io that could allow an attacker to compromise any credentials entered in the original or compromised page. The Readme team originally did not intend to fix the issue so Truffle Security created custom domains for 600 vulnerable companies and contacted them directly.

NON-PRODUCTION ENDPOINTS AS AN ATTACK SURFACE IN AWS

The Datadog Security team discovered a new method for AWS privilege enumeration that can bypass CloudTrail logging. The method involves querying ce:GetCostAndUsage and route53resolver:ListFirewallConfigs for access to various other resources. The AWS team has fixed the specific bypasses and worked with the Datadog team to identify additional potential attack vectors.

the webinar here!

SECRETGEN-CONTROLLER

secretgen-controller provides Custom Resource Definitions (CRDs) to specify which secrets need to be generated on a Kubernetes cluster. It supports generating secrets, exporting and importing secrets, registry secrets across namespaces, and generating secrets from data residing in other Kubernetes resources.

STORMSPOTTER

Stormspotter is a red team tool for graphing and visualizing Azure and Azure AD objects.

C/SIDE (PRODUCT LAUNCH)

C/side provides tools for monitoring, optimizing, and securing third-party scripts in browsers to keep users safe from vulnerabilities and zero-day attacks.

JAPANESE CRYPTO EXCHANGE DMM BITCOIN SUFFERS $305M HACK

Japanese cryptocurrency exchange DMM Bitcoin disclosed a major hack resulting in the loss of 48 billion yen ($305 million) worth of bitcoin, with 4,502.9 BTC stolen. The hacker split the funds across 10 wallets. DMM halted spot buys and warned of delayed yen withdrawals. It vowed to compensate the lost bitcoin with group company support to guarantee the full amount.

NETFLIX PAID OUT OVER $1 MILLION VIA BUG BOUNTY PROGRAM

Netflix announced that it has paid out over $1 million in bug bounties since launching its program in 2016. Over 5,600 researchers have contributed nearly 8,000 vulnerability reports, with 845 rewarded, including over 25% critical or high severity.

INTRODUCING ARTIFACT ATTESTATION

The OpenSSF and GitHub have launched Artifact Attestations to allow for generating SigStore artifact attestations but adding a GitHub action to configure the signature without the need to manage a PKI infrastructure. The signatures utilize the OpenSSF's PKI infrastructure and can be verified using the GitHub CLI. Integrations with Kubernetes and other providers are planned.

BEWARE: FAKE BROWSER UPDATES DELIVER BITRAT AND LUMMA STEALER MALWARE

Fake browser updates are being used to spread malware like BitRAT and Lumma Stealer.

THE NSA ADVISES YOU TO TURN YOUR PHONE OFF AND BACK ON ONCE A WEEK - HERE'S WHY

The NSA recommends turning your phone off and back on weekly to protect against security threats like malware and spyware.

POLICE DISMANTLE PIRATED TV STREAMING NETWORK THAT MADE $5.7 MILLION

Spanish police dismantled a network that made $5.7 million from illegal TV streaming by arresting 8 individuals and taking the servers offline.

TIKTOK PREPARING A US COPY OF THE APP'S CORE ALGORITHM, SOURCES SAY

TikTok is working on a clone of its recommendation algorithm for its US users. This may result in a version that operates independently of its Chinese parent that might be more palatable to American lawmakers who want to ban it. Once the code is split, it could lay the groundwork for a divestiture of the company's US assets.

META SAYS THE FUTURE OF FACEBOOK IS YOUNG ADULTS

Meta is refocusing Facebook to appeal to young adults by shifting the platform towards recommendations rather than posts from friends. It is focusing on attracting the next generation of social media consumers. The company is using AI to improve recommendations for Reels and the feed.

SNAPCHAT'S USER BASE IS GROWING UP

Snapchat isn't just for kids - close to 25% of its users are 35+. The company recently reported 422M daily active users. Its new ad features aim to differentiate it from other platforms and attract more advertisers. These include enhanced Dynamic Ads, generative AI and AR tools, state-level targeting, and easier app installation.

12 FIELD-TESTED CONTENT MARKETING TACTICS

Targeting low-competition keywords allows sites to rank faster as backlinks aren't required. Creating an SEO content hub builds topical authority, link authority, and perceived value. Repurposing content, such as creating a video from a blog post, allows you to reach a wider audience across platforms.

5 TYPES OF PROOF IN COPYWRITING THAT CONVERT

Adding proof elements to copy is one of the best ways to strengthen messaging. Use specific statements, such as quantified numbers, to make it believable. Point to the opinions of others, such as reviews or social media. Show how the product or service is used so visitors can imagine how it might work for their situation. Display authority with logos of the companies that work with you, awards and industry certifications, or proof of industry involvement.

HOW TO USE LINKEDIN AS A PRIMARY “PR” CHANNEL

If you run marketing at a B2B startup, ensure the founder, head of marketing, sales, and customer success share content on LinkedIn 3-5X a week. Share quick write-ups after customer calls, learnings from pain points, and content from the life or job of the person they're trying to sell to. It doesn't have to be polished, but it should contain real tactical examples, experiences, and lessons. Create a list of target customers and connect with everyone on LinkedIn, as over 50% of people will accept connections. Consistently comment on posts for 6+ months from people in your industry to boost your visibility and engagement.

STACKPOINTER: EXPLORE THE TECH STACK OF COMPETITORS, CLIENTS, AND MORE

Stackpointer is a search engine that provides insights into businesses by analyzing their tech stacks. Users can search for businesses using keywords or criteria like name, domain, or specific technologies.

BRAVE LAUNCHES SEARCH ADS

Brave has launched Search Ads after 18 months of testing, allowing brands in the US, Canada, UK, France, and Germany to run CPC-based ad campaigns on its independent search platform. Brands like Amazon and Dell successfully trialed the service, which offers up to 14 days of complimentary advertising for eligible participants. Brave's new offering is pitched as a way to reach highly qualified, otherwise unreachable audiences.

MINDSHARE MATTERS. NOW MARKETERS CAN MEASURE IT

Mindshare measurement offers marketers a way to directly link brand investment to sales and shareholder returns by focusing on high-demand, low-competition areas. By targeting specific demand spaces and understanding the S-curve of mindshare growth, brands can increase their visibility and customer receptivity, leading to higher conversion rates. This strategy involves sustained investment, strategic targeting, and leveraging both paid and organic channels to create lasting impressions and build a competitive advantage.

HOW LONG DOES ADVERTISING LAST?

The advertising industry is divided between advocates of long-term brand building and short-term performance. Studies indicate that if an ad campaign doesn't perform well initially, it likely won't improve over time. Financial returns from advertising can start as early as 61 weeks, but often take up to 150 weeks. Advertising has a significant carryover effect, decaying at about 30% per year. While traditional media is often seen as superior, newer research indicates that online, content-integrated ads are far more effective.

TOGGLES FOR YOUR HOMEPAGE

Dedicate a section on your homepage to list your features, and place a toggle next to each one. On the other side of the screen, display a product mockup that changes based on the user's toggle selections.

INSIDE CANVA: COACHES NOT MANAGERS, GIVING AWAY YOUR LEGOS, AND RUNNING PROFITABLY

Cameron Adams, CPO and co-founder of Canva, shares insights into the company's SEO growth strategy, 3-pillar framework for integrating AI into its product, and why it has no managers.

WANT TO UNLOCK PERFORMANCE AND CLARITY? USE STRONG TYPES!

Strong types in programming languages like C++ and Rust, which enforce specific data types and rules for variables, lead to fewer bugs, more expressive APIs, and potentially better performance. They prevent invalid input, improve code clarity, and reduce the need for repetitive error checking (like in JavaScript with undefined).

THINGS YOU WISH YOU DIDN'T NEED TO KNOW ABOUT S3

GEOGRAPHICALLY DISTRIBUTED POSTGRES FOR MULTI-TENANT APPLICATIONS

This article describes a pattern for geographically distributing PostgreSQL databases for multi-tenant applications using only standard PostgreSQL functionality. The pattern involves separating per-tenant data from control plane data, placing tenant data in the nearest region, creating a global view using Foreign Data Wrappers, and partitioning, while keeping authentication and control plane data centralized. This approach lowers latencies, complies with data residency laws, and allows edge computing while maintaining most PostgreSQL features and ACID guarantees within tenants.

SOME THOUGHTS AS I SIT HERE IN ANOTHER STANDUP

Agile and Scrum are too rigid and bureaucratic as implemented in the industry right now. Daily standup is a prime example of a pointless and unproductive ceremony that wastes developers' time and fails to actually foster progress.

SPEND 2 HOURS DISCUSSING, MAKE THE WRONG DECISION ANYWAY

Meetings are timesuck for devs. To be useful and effective, meetings should have an authoritative document to guide discussions. This makes sure that everyone is on the same page about the project's goals and complexities.

MY 3-STEP PROCESS FOR WRITING CLEAN CODE

A three-step process for writing clean code: first, prioritize making the code work, then add testing for correctness, and finally, refactor and clean up the code while relying on the tests.

🆕 Learn how you can self-host PowerSync

>> Check out PowerSync in 100 seconds

TWINNY

Twinny is a free private AI extension for VS Code. It comes with fill-in-the-middle code completion, AI chat, customizable prompt templates, and more. Twinny supports both API endpoints and local LLMs.

MESH SPREADSHEET

Mesh is a data and code editor that feels like a spreadsheet.

SANDBOX

Sandbox is an open-source cloud-based code editing environment with custom AI code autocompletion and real-time collaboration.

WHAT DO I THINK ABOUT LUA AFTER SHIPPING A PROJECT WITH 60,000 LINES OF CODE?

Ivan Trusov, the lead programmer for a project, shares his experience using Lua for game development within the Defold engine. Trusov encountered some surprises with Lua's syntax and quirks, particularly with table handling. Despite these challenges, he found Lua's simplicity and speed very useful. Trusov also discusses the limitations of Lua's lack of strict typing and modules.

HTMX: SIMPLICITY IN AN AGE OF COMPLICATED SOLUTIONS

htmx offers a simpler alternative to frameworks in frontend development by enhancing HTML with attributes that enable AJAX-like functionality, utilizing the hypermedia concept to create RESTful applications without excessive JavaScript.

LESSONS LEARNED FROM 6 MONTHS OF OPERATING A TEENSY-TINY NEWS ARCHIVE

A developer shares lessons learned from running a simple static news archive website for learning Finnish. He enjoys using cronjobs and Git together as they complement each other nicely. He also thinks simplicity and working locally are severely underrated.

CSS GRID GARDEN

Learn CSS Grid with a virtual garden game.

MAKING A TIC-TAC-TOE GAME WITH 'RANDOMNESS' USING PURE HTML AND CSS

A developer created a tic-tac-toe game using only HTML and CSS, adding a "random" button to simulate a computer player and incorporating an audio easter egg.