After discovering a vulnerability on BlackLock's data leak site, Resecurity researchers have been covertly acquiring information since late 2024. The researchers exploited a Local File Inclusion vulnerability to retrieve server-side configuration details and credentials along with plain text server logs, SSH credentials, and command-line histories. Resecurity researchers utilized their position to warn law enforcement and potential victims before leaks occurred.
Researchers at Qualys have discovered three new vulnerabilities in Ubuntu 23.10 and 24.04 that could allow a local attacker to create user namespaces with full administrative privileges. The bypass mechanisms utilize aa-exec, busybox, or LD_PRELOAD. Canonical has shared that they will be treating these vulnerabilities as limitations of a defense-in-depth mechanism and shared recommended hardening steps to address them.
Apple has added a new feature called Endpoint Security events for TCC modifications in MacOS 15.4. Exposed with ES_EVENT_TYPE_NOTIFY_TCC_MODIFY flag, this feature allows security tools to detect and possibly override user decisions on granting access to protected resources. The events will provide information on when a TCC permission is granted or revoked, helping users monitor and control access to their system.
Many threat actors utilize Telegram bots as a method of establishing C2 communication. In this technique, a threat actor creates a new Telegram bot, embeds a token for the bot in their malware and deploys it, then malware then periodically polls Telegram's servers to check for new commands sent to the bot and executes any commands that are sent while relaying the results back to the Telegram server. This post deep dives into a case study in which a malware that was discovered on VirusTotal was hijacked by the author, who discovered data from the malware developer's system which they used for testing.
Use Linux Landlock to run any Linux process in a secure, unprivileged sandbox. This tool is like firejail, but lightweight, user-friendly, and baked into the kernel.
Brutespray serves as a utility for executing password spraying attacks by utilizing outputs from scanners like nmap or Nexpose.
goLAPS is a tool to retrieve LAPS passwords from an Active Directory domain.
Browser-native ransomware could target data stored in browsers, bypassing traditional security measures. This type of ransomware is hard to detect and can lead to severe consequences, such as compromising email services and stealing sensitive company files.
Malicious actors can track Android, Windows, or Linux devices through an Apple Find My network vulnerability using malware that mimics AirTag signals. They can monitor movements remotely, affecting smartphones, computers, smart TVs, etc. Apple has issued patches, and users should disable Bluetooth when not in use and keep devices updated.
Zhou Shuai is a Chinese hacker that first started hacking in his senior year of high school in 1996. Shuai's early motivations as a founding member of Green Army were idealistic as he sought to be a hacktivist vigilante. Shuai eventually ended up becoming more commercial and less idealistic and is now designated as APT27 and sanctioned by the U.S. Department of the Treasury.
2025.03.31·nattothoughts.substack.com·6 min read·TLDR InfoSec The Rust project has announced that it will adopt the Ferrocene Language Specification (FLS) developed by Ferrous Systems and maintain it as part of the core project.
North Korea has opened a new research center to focus on AI-powered hacking.
Sponsored
Advertising in TLDR puts your brand directly in front of tech leaders when they're most engaged. With 10 interest-based newsletters, you can easily reach a targeted audience of developers, PMs, marketers, and executives. Learn more about advertising with us [4].
xAI has acquired X in a transaction that happened in an all-stock deal, valuing the AI startup at $80 billion and the social platform at $33 billion. The merger brings together xAI's models and compute power with X's data and distribution. Investors in both companies include Andreessen Horowitz, Sequoia Capital, and Saudi Arabia's Kingdom Holding Co.
Driven by increased digital content consumption and the mainstreaming of online culture, the creator economy is currently valued at $250 billion and is projected to hit $500 billion by 2027. Influencer marketing has proven highly effective, with 92% of marketers reporting that creator-led content outperforms organic brand content. Platforms like Instagram and TikTok dominate creator partnerships, while LinkedIn and Snapchat offer growing opportunities for niche audiences. AI is streamlining influencer discovery and content creation, making it easier for brands to manage partnerships and improve content quality. Moving forward, brands are shifting toward co-creating products with creators, expanding beyond social media content to build deeper, long-term consumer trust.
A 4-year study of 150,000 A/B tests showed that most optimizations fail, with clarity consistently outperforming conventional best practices. Companies like Brex improved conversion by removing trust-building elements like customer logos, which unintentionally caused doubt or distraction. Direct copy, single-message layouts, and simpler user journeys were more effective than emotional appeals or social proof. The study found that eliminating or reducing carousels and using neutral phrasing on CTAs drove better results.
Creative marketing can be effective without large budgets. Examples of this include wrapping a nearby train station instead of renting an expensive conference booth, using real social proof on websites, and renting a Times Square billboard for a short period to capture social media content. The focus is on being quick, creative, and executing in ways that capture attention while keeping costs low.
Granola transcribes meeting audio and refines the notes. It offers customizable templates for different meeting types, helps with email follow-up tasks, and integrates with Zoom and Slack.
Sales often gets more budget because it is directly tied to revenue, but overspending on sales without enough marketing support can hurt pipeline growth. The general rule is to allocate 30% of the combined sales and marketing budget to marketing, though this varies based on company size, contract value, and growth rates. Smaller companies and fast-growing companies often spend more on marketing, while companies with higher contract values allocate more to sales. It's important to use the 30% rule as a starting point but adjust the ratio based on company-specific factors.
Figma's pricing evolved to balance simplicity and growth while staying true to its vision of making design accessible. Initially, it charged only Editors and kept Viewers free to encourage adoption, later introducing FigJam and Dev Mode with separate pricing. By 2025, it streamlined its model into 3 paid seat types: Collab, Dev, and Full, bundling access to all products and aligning pricing with user needs. This update raised Full Seat prices by 20%-35% and reduced complexity, making it easier for customers to choose the right plan.
Gen X marketers and creatives are facing a career meltdown as industries shrink, devalue expertise, and replace them with younger talent, AI, and social media creators. Once essential in journalism, design, and advertising, many now struggle to stay relevant as marketing shifts toward automation and influencer-driven trends. Job cuts, outsourcing, and declining pay are forcing them to rethink their careers in middle age.
Beyond Bluesky, there are dozens of apps built on the AT Protocol that are redefining the social web. New tools like Pinksky (a classic Instagram clone), SkyFeed (a no-code feed builder), and Smoke Signal (an Eventbrite alternative) demonstrate a shift toward modular, user-driven platforms. The movement prioritizes open standards, discoverability, and creator control over content and data.
Captions, dubbing, and translation are the top AI video features, with caption usage alone increasing 6x since 2021.
Studio Ghibli founder Hayao Miyazaki has condemned AI-generated art, calling it “an insult to life itself”.
In March, Roni Carta (Lupin) and team disclosed they hacked Google's AI, Gemini, during the 2024 LLM bugSWAT event, winning the Most Valuable Hacker award. They discovered a vulnerability within Gemini's Python sandbox that allowed them to rewrite Python code and map the filesystem, enabling them to extract a 579MB binary file. Analyzing this binary revealed internal source code, including sensitive Google proto files containing metadata descriptions used to classify user data and internal security proto definitions.
2025.03.31·links.tldrnewsletter.com·21 min read·TLDR Web Dev Components and hooks are closely related in React. Components are a subtype of hooks since they inherit the Rules of Hooks and must return a ReactNode. By converting a component into a hook, there is more flexibility in managing state and behaviors separately from UI rendering, allowing for patterns like headless components.
Vercel has published a postmortem on CVE-2025-29927, a critical vulnerability in Next.js related to Middleware bypass. The timeline outlines the vulnerability's disclosure, investigation, patching, and public announcement. The vulnerability involved an internal `x-middleware-subrequest` header and impacted self-hosted Next.js applications, but not Vercel, Netlify, or Cloudflare Workers.
Andrej Karpathy's "vibe coding" advocates relying on AI tools without fully understanding the generated code. However, this approach leads to technical debt, security vulnerabilities, and a loss of intellectual ownership over systems. It's better to have a balanced approach of using AI assistance while maintaining engineering quality through architectural vision, focused code generation, thorough review, and comprehensive testing.
Compilers currently lack the concept of time, treating code as if it always existed in its current state, which leads to unnecessary breaking changes when dependencies are updated. Instead, we should focus on preserving the behavior of existing code rather than strictly following the old syntax during updates. This means having automatic code migrations, similar to database migrations, that apply transformations to call sites when dependencies are updated.
2025.03.31·welltypedwitch.bearblog.dev·6 min read·TLDR Web Dev Good blog posts for devs get straight to the point, expand the target audience, strategically plan how readers will discover the post, use visuals, and accommodate skimmers to maximize engagement.
Json-edit-react is a highly configurable React component for editing and viewing JSON/object data, with features like inline editing, granular control over edits, JSON Schema validation, customizable UI, and search/filtering. The component is self-contained with no external UI library dependencies and supports custom components, localization, drag-n-drop reordering, and keyboard customization.
PG-MCP is a PostgreSQL Model Context Protocol server for better AI agent interaction with databases. It extends the reference Postgres MCP implementation with features like multi-database support, rich catalog information, extension context, and query explanation. The server has connection management and query tools, along with schema discovery and data access resources.
Apple's promotional video for "Severance" inadvertently revealed a flawed workflow for professional video editors. The video showed editors using Macs for remote editing via Jump Desktop, a screen-sharing tool. This means that the Mac's local horsepower is not as important as a fast internet connection and a powerful remote server.
React and Next.js are highly sought after, along with Javascript and Typescript. AWS is the dominant cloud provider and PostgreSQL remains a popular database. Despite some technologies correlating with higher compensation, there are minimal salary increases with experience. Education beyond a bachelor's degree is rarely required.
Indian Android apps have privacy issues as many apps circumvent Google's privacy policies to collect data on installed apps. Swiggy and Zepto were found to have extensive lists of apps they query, while personal loan apps like KreditBee and Moneyview query an excessive number of apps. A significant privacy loophole exists through the "ACTION_MAIN" filter, allowing apps to see all installed apps with a user interface. Zepto's READ_SMS permission request shows how apps access personal data, potentially sharing it with brokers and affecting user pricing.
Creating valuable and original things is necessary, as it's uniquely human to be able to think deeply and clearly, which results in the best products, ideas, companies, and art made.
Malware authors are increasingly using less common programming languages like Delphi, Haskell, and Rust, along with less popular compilers, to evade detection by traditional static analysis methods.
37signals' upcoming exit from AWS S3 to its own Pure Storage hardware will save millions over five years, but it will have to pay $5,000 per day if the data migration isn't completed by June 30.
This developer built their website with C to have fast, dependency-free, and long-lasting static site generation using the md4c markdown parser after being frustrated with the complexity and maintenance burden of previous attempts using Django and Nuxt.js.
Sponsored
InfraHub Compute is now allowing the public to buy a range of GPU-accelerated servers. These servers are plugged into the InfraHub Compute cloud API network supporting over 45 cloud resellers and distributors globally.
2025.03.28·infrahubcompute.com·Sponsor·TLDR iPhone users on WhatsApp version 25.8.74 have the option to choose WhatsApp as their default app for calls and text messages. The setting can be changed in Settings > Apps > Default Apps and then selecting the Messaging and Calling options. The feature was introduced in iOS 18.2. A screenshot of the options menu to enable the feature is available in the article.
2025.03.28·theverge.com·1 min read·TLDR Meta has introduced a Friends tab on Facebook to revive the original spirit of the social networking app. The Facebook Friends tab is designed to show users the latest posts from their friends instead of recommended content. It is now available in the US and Canada - there is no word on when it will debut in other countries.
Scientists at Keio University in Tokyo injected neural stem cells into four patients to treat spinal cord injuries - one patient, who was previously paralyzed, can now stand on his own. Another patient can move their arms and legs, but the remaining two did not show substantial improvements. While trials have shown that the therapy is safe, it has so far had mixed results. Preliminary analysis of the data suggests that the treatment works, but larger trials will be needed.
2025.03.28·nature.com·4 min read·TLDR A Chinese team has successfully implanted a genetically modified pig liver into a human. The organ remained functional until the end of the experiment 10 days later - there were no signs of rejection or inflammation. The pig liver is designed to be a stop-gap measure rather than a full replacement. It can keep patients temporarily alive until a human donor organ becomes available or the patient's own liver recovers.
2025.03.28·singularityhub.com·7 min read·TLDR Sponsored
As an IT expert, you're no stranger to solving cross-departmental technical difficulties. But how many problems can be resolved by simply moving from siloed to centralized project management? This Atlassian playbook [9] offers strategies to identify + address inefficiencies, foster lasting cross-departmental alignment, and
2025.03.28·atlassian.com·Sponsor·TLDR Sites hosting free and open source projects share most of their infrastructure publicly, so they tend to have fewer resources than commercial products. Many AI bots don't honor the Robots Exclusion Protocol robot.txt file, hide behind other IP addresses, and pretend to be other users, making it difficult to block them. Anubis is a reverse proxy proof-of-work check that must be passed before requests are allowed to hit a server - it blocks bots but lets through browsers operated by humans. It has been popular among the FOSS community as many projects are experiencing the same issue.
2025.03.28·techcrunch.com·6 min read·TLDR The biggest mistake software bloggers make is meandering - Internet attention spans are short. Readers are looking for relevant material that benefits them, so try to show readers you're writing for them and make it clear how your article will benefit them within the first three sentences. This article teaches techniques that help blog posts succeed and discusses pitfalls that cause some blogs to languish in obscurity. Many errors, once recognized, are easy to fix.
2025.03.28·refactoringenglish.com·14 min read·TLDR