Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Verizon filed a data breach notification after a company employee obtained a file of 63,206 employees’ personal data. The data includes social security numbers, gender, union affiliation, date of birth, and compensation information. Verizon stated that it has no evidence that the data was used maliciously or shared outside of Verizon.
An employee at a multinational financial firm fell for a social engineer attack that led them to remit $200 million Hong Kong dollars. The employee was suspicious when they originally received the communication from the UK-based CFO but was convinced after a call with the CFO and several colleagues, who all turned out to be deepfakes.
This post evaluates the risks of a leaked Stripe API key. It proposes 5 attack paths: disclosing PII, generating promo codes, changing prices, defacing websites, and making unauthorized wire transfers. The post ends with some best practices for protecting Stripe API keys.
This blog post talks about utilizing the control and security stack mappings created by the Center for Threat-Informed Defense (Center). These mappings, like NIST 800-53 Control Mappings and Security Stack Mappings for Google Cloud Platform and Amazon Web Services, enable defenders to connect threat information to actionable guidance, making it easier to detect and mitigate threats. Center is also working on expanding its collection of mappings and making them more accessible.
This framework generates fuzz targets for real-world C/C++ projects with various Large Language Models and benchmarks them via the OSS-Fuzz platform.
Secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters and security researchers.
ThievingFox is a collection of post-exploitation tools for harvesting credentials from various password managers and Windows utilities. Each module utilizes a different method of injection into a process to harvest credentials.
ResumeLooters have used SQL injection and XSS since early 2023 to hit Asia-Pacific recruitment/retail sites, stealing 500K+ user records from 65 sites. The group focuses on India, Taiwan, Thailand, and Vietnam, leveraging penetration testing tools like sqlmap. It injects XSS scripts into job sites to display phishing forms and steal admin creds.
Google announced a grant of $1 million to the Rust Foundation to improve interoperability between legacy C++ codebases and Rust. Google said that Rust has proactively prevented hundreds of vulnerabilities from affecting the Android operating system. Google will also begin to publish audits of some of the crates used in open source Google projects.
This analysis of the vulnerabilities from CISA's Known Exploited Vulnerabilities (KEVs) attempts to analyze whether the current efforts in the information security industry match the current threat vectors being abused. The analysis provides recommendations for vendors, developers, defenders, and researchers to address these vulnerabilities.
Dozens of countries including France, the UK, and the US, along with tech giants such as Google, Meta, and Microsoft, have signed a joint agreement to combat the use of commercial spyware in ways that violate human rights.
This report dives into how commercial surveillance vendors are enabling the proliferation of dangerous hacking tools.
Caesars canceled DEFCON 32’s contract, so DEFCON will be moving to the Las Vegas Convention Center.
Meta has announced plans to label AI-generated content from OpenAI and Google with the aim of enhancing transparency, especially during the contentious US election year. It will do so by utilizing invisible watermarks and metadata embedded in files. Meta will inform users when the content they see is digitally synthesized rather than authentic. This initiative expands Meta's existing practice of labeling content generated by its own AI tools to include images created by services from other companies.
Bluesky, an open-source, decentralized social networking platform, recently opened to the public. It will face the challenge of competing with established platforms like Threads and Mastodon. Bluesky distinguishes itself through a transparent, open-source codebase, empowering users with control over their social media experience. It also offers features like open federation and customizable moderation services.
Giveaways are a potent mechanism for generating excitement, building brand awareness, and fostering a sense of community among audiences. The way you run giveaways depends on your objectives. Objectives could be increasing brand awareness, driving traffic to your website, or gathering customer data. The product to be given away should resonate with your target audience while also reflecting the quality and ethos of your brand. Timing it to coincide with significant events, such as the launch of a new product line, a major outdoor event, or a seasonal change, can also increase its impact.
This article discusses the 3 growth phases for a subscription business: early stage, freemium model, and expansion to other platforms and channels. It provides concrete tips and best practices based on experience with other SaaS startups. It also covers related topics such as A/B testing and strategies to enter a new market.
Shopify has released its Winter ’24 Edition, which includes roughly 100 new and updated tools across conversion, channels, marketing, and operations. The new features include a web performance dashboard, a subscription app, smarter retargeting algorithms, and Shopify Line of Credit.
Mailmodo put together an edutainment chat show covering how 5 industry experts onboarded AI into their marketing workflow. There are 5 videos that cover master prompt writing and using AI for copywriting, image generation, content, and email marketing. Each video ranges from 35-50 minutes long.
CRED is a fintech platform that rewards individuals for their timely credit card and bill payments. It carved out a unique niche using brand building and influencer marketing. CRED established 3 brand pillars—trust, exclusivity, and innovation—which all of the company’s marketing tactics link back to. These themes are apparent across the user experience, from its social media content to its product policies. This presents the brand as cohesive and reliable. CRED’s Instagram content makes the company look like a lifestyle brand. It features contests for its followers while still focusing its messaging around its core pillars.
Synthesia is an AI video generation tool that produces professional videos with 150+ AI avatars and 120+ different AI voices across various languages, accents, and tones. It uses AI video templates to rank in the SERPs. Synthesia lets people apply its products to specific use cases, familiarizing them with the platform before moving them closer to becoming paying customers. These templates contain a CTA module that prompts users to accelerate their video creation capabilities with a Synthesia account.
Data from low code/no code tools suggests that marketers are increasingly building their own solutions instead of relying on IT.
Amazon secured a deal with Reach, the UK’s largest publisher, to obtain customer data for targeted advertising in response to Google’s impending third-party cookie deprecation.
An interactive game where you try to find 50 iconic brand logos in an image in 5 minutes.
Sponsored
API developer? This year’s POST/CON [5] conference in San Francisco is the place to be. Hear from industry leaders, gain new skills, and engage with the community. There’s a 50% discount if you sign up early [5]! A small taste of what you can expect from this two-day event:
Urb-it uses Kubernetes to leverage container orchestration capabilities for its microservices architecture. Some of the lessons learned after using Kubernetes in production for over eight years include the importance of keeping Kubernetes and Helm up to date, backing up secrets, planning for disaster recovery, keeping certificates up to date to prevent cluster crashes, and going all-in with a cloud provider. Kubernetes allowed Urb-it to scale in a cost-efficient manner and develop new products and services faster.
Engineering for 99.5% uptime is much more cost-effective than 99.99% for most startups. This is because in order to achieve that level of reliability, you will need specialized architecture, redundant infrastructure, and streamlined operational and organizational procedures. The cost comes in terms of system complexity, the number of engineers required and their specializations, experience levels, and corresponding salaries, as well as significantly increased operational costs and arrangements. 99.99% guaranteed uptime must be 50 times as reliable as one with "only" 99.5%.
BuildKit is Docker's new default build engine. It improves Docker builds by parallelizing build steps, optimizing multi-stage builds, and utilizing layer caching for enhanced performance. BuildKit uses a directed acyclic graph (DAG) data structure called LLB to represent dependencies and has frontends and backends to convert Dockerfiles into LLB and build Docker images efficiently.
Aiming for 100% code coverage can lead to unintended consequences, such as having engineers write unrelated tests or "cheating" the system to reach 100% at all costs. Teams should be deliberate in deciding how much risk to take on when writing tests. Measure the cost of writing tests versus the cost of bugs to make informed decisions. In certain contexts, it’s the ethical thing to do to write extensive tests, such as for critical software like pacemakers.
A significant air conditioning failure in a machine room led to the need to power off machines to prevent overheating. Deciding which machines to turn off was not straightforward. Maintaining documentation on the importance of each machine and its dependencies is helpful for situations like these. While this documentation takes a lot of effort, it also helps engineers understand the system's connections and dependencies, making it a valuable resource in case of future failures.
There’s a paradox of software being too powerful and efficient, which makes it challenging to maintain profitability and often causes unnecessary software churn. Software today often is never completed due to the need for yearly growth by companies. Old software “rots” and is then replaced by new and supposedly better software. The endless quest for growth means that today’s software often never gets to reach a state of perfect completion.
Geppetto is a Slack bot that lets teams easily interact with ChatGPT. It integrates with OpenAI's ChatGPT-4 and DALL-E-3 models. Each message generates a conversation thread. The application uses the message history to formulate coherent responses.
Bouncy Ball compares web animation techniques by showing how to bounce a ball with each one. Multiple code examples in different languages are shown, including vanilla JavaScript, pure CSS, jQuery, Anime.js, and more.
Servor is a dependency-free file server for modern web app development. It supports HTTPS, live reloading, gzip, hot reload, frontend routing, and more.
The mouse and mouse cursor was invented by Douglas Engelbart. It was initially an arrow pointing up. However, screens back in the day had a low resolution, so having a tilted cursor was more recognizable. This was first seen in the XEROX PARC machine.
"SELECT *" SQL queries fetch all columns from a row-store database. This is often quite slow due to issues like index-only scans, deserialization cost, external storage for large columns, network cost, client deserialization, and unpredictability. Selecting only the necessary columns avoids unnecessary overhead and leads to faster, more efficient queries.
The Web Monetization API simplifies online payments for website users and owners by allowing visitors to pay a chosen amount directly to websites using a browser extension or native browser support. With the API, website owners no longer need to integrate multiple payment methods and currencies. Instead, they can merely signal their acceptance of payments in code, and browsers would facilitate the payment process.
A list of GitHub repositories that demonstrate how PostgreSQL can be used for everything, including access control, audit logs, authorization, time-series data, graph data, data visualization, and more.
Notes and working examples of common SQL queries.
An open-source guide to help you write better command-line programs, taking traditional UNIX principles and updating them for the modern day.
In Windows, "hard errors" are error messages generated from within the I/O system, below the user interface level. Hard errors of this type disappeared in 32-bit Windows - the term "hard error" has been repurposed to describe other critical low-level error messages.
From 0.5B to 72B parameters. These are an impressive suite of multilingual models. Interestingly, the smallest model is the first serious sub 1B parameter language model.
In May 2023, Colin Megill met with OpenAI, including co-founder Wojciech Zaremba, to discuss integrating his public deliberation platform, Polis, which used AI to enhance democratic engagement. The collaboration aimed to align AI with human values through broad public input. It sparked OpenAI's "Democratic Inputs to AI" initiative to explore AI governance with a $1 million grant program.
Video synthesis is notoriously hard to control. This work proposes using boxes and arrows to guide the generation over time, which improves human preference judgment but still doesn’t give perfect guidance to the user.
Kahneman-Tversky Optimization (KTO) is a new approach for training AI models to align better with human thinking. By utilizing concepts from Kahneman & Tversky's prospect theory, KTO focuses on maximizing utility rather than just preference likelihood.