Cisco has disclosed a new critical CVE that allows for RCE on Ultra-Reliable Wireless Backhaul (URWB) access points. Attackers can exploit improper input validation on the web-based management interface of vulnerable devices by sending crafted requests to execute arbitrary commands. The vulnerability only affects URWB devices running vulnerable software with the URWB operating mode enabled which can be checked by seeing if the show mpls-config CLI command is available.
The CISA warned that attackers are actively exploiting a critical missing authentication vulnerability in Palo Alto Networks Expedition, a tool for migrating firewall configurations from other vendors to PanOS. The vulnerability allows attackers with network access to takeover Expedition admin accounts and potentially access configuration secrets, credentials, and other data. All Expedition usernames, passwords, API keys, and any firewalls processed by Expedition should be rotated after upgrading. Various proof-of-concept attack chains that exploit the vulnerability to obtain admin access to Palo Alto Networks firewalls are available in the article.
Researchers have discovered multiple vulnerabilities in macOS sandbox escapes that allow attackers to bypass app sandbox restrictions and execute arbitrary system commands. Exploiting overlooked XPC services in system frameworks can lead to full sandbox escapes where dropped files are not quarantined, enabling attackers to escape sandbox restrictions. Apple addressed some of these vulnerabilities in macOS Ventura 13.3 by implementing checks on incoming XPC clients to prevent unauthorized sandbox escapes.
Anthropic's Computer Use is a new feature of Claude that allows Claude to use a virtual environment to complete tasks on the user's computer. Claude can be deceived into running malicious web content in computer use mode. The model does include some protections against hijacking as well as some protections against running some malicious commands but can still be “phished” to execute arbitrary commands. Claude can be convinced to curl an arbitrary file and pipe it to bash by a document telling it that it was a necessary codec. The model can be fooled into opening the calculator application by a remote PDF.
Slack interactions come in four categories: remind, alert, delegate, and respond. Remind and alert actions are more commonplace. Remind interactions remind users to take an action (such as mandatory training) and alert actions alert the security team to various alerts from other sources. There are two new categories in SlackSecOps called delegate and respond. Delegate actions involve an alert asking a user if a behavior was intentional (adding a contractor to a sensitive permission, sharing documents, etc) and only alerts the security team based on the response. Respond interactions are when a security team receives a request and can respond to it directly via Slack such as approving an access request and granting the access directly in Slack.
Flask-Vault is a robust library that empowers Flask applications to securely store and manage sensitive credentials.
AcSecurity is a Python module designed to scan applications for common security vulnerabilities. It checks for hardcoded secrets, dependency vulnerabilities, and code quality issues.
safe-httpx is a small Python library that helps developers protect their applications from SSRF by implementing a wrapper around httpx.AsynchronousClient.get(), which performs DNS validation on the supplied URL and protects against DNS rebinding attacks.
Richard Densmore was sentenced to 30 years for running online chat rooms that targeted children through gaming sites. As part of terrorist network 764, he coerced minors into self-harm, sexual acts, and violence.
Apple's iOS 18 reportedly includes a new security feature that automatically reboots inactive iPhones after four days, resetting them to a more secure "Before First Unlock" state. This makes it harder for law enforcement to break into locked devices.
OpenAI's VP of research and safety, Lilian Weng, is leaving the company after 7 years. She will leave on November 15, joining several other AI safety researchers and executives who have left the company recently. This continues a pattern of departures amid concerns about OpenAI's prioritization of commercial products over safety.
A crimeware bundle called SteelFox, active since early 2023, impersonates legitimate software like Foxit PDF Editor and AutoCAD.
AWS offers a suite of security tools to boost any company's security.
Hackers are stealing tickets from Ticketmaster accounts, causing concertgoers to lose access to their purchased tickets.
Free shipping impacts 75% of consumer decisions. 64% of shoppers aged 18-24 plan to shop on Black Friday. Mobile optimization is vital, as 79% of 2023 purchases were made on smartphones. While e-commerce is growing, brick-and-mortar sales are expected to hit $22.6 trillion by 2026. Cyber Monday may surpass Black Friday with over $13 billion in revenue. Timely text campaigns can boost engagement - 80% of people check texts within five minutes.
Brand safety concerns are predicted to decline in 2025 as 53% of U.S. B2C marketers become less focused on brand safety. 10 major brands are shifting away from DoubleVerify. SEO spending is set to triple, driven by AI integration in search engines. TikTok will continue to see investment, with 10% of performance media budgets directed toward social commerce. 46% of CMOs plan to integrate performance and brand media, while 35% aim to combine creative and media assignments.
Brands can benefit from "owning" holidays that align with their products or values. Successful campaigns require creativity and long-term commitment. For example, Nathan's Famous solidified the company's association with the Fourth of July through a hot dog eating contest now linked with summer and patriotism. Domino's capitalized on Super Bowl Sunday for increased orders but competes with Little Caesar's, the NFL's "official pizza."
Skims leverages brand collaborations as a key tactic, aligning with cultural events to elevate its presence in fashion and sports. Partnerships with high-profile figures like Charli XCX and Team USA athletes showcase the brand's commitment to inclusivity and diverse representation. Skims' influencer marketing program also amplifies its brand reach, utilizing social media whitelisting to drive relatability and authenticity.
When creating CTAs, add social proof, such as "Join 70,000+ creators." Address objections by saying, "Try X in 5 minutes." Offer something free, like "Get the first chapter free." Clarify the value, for example, "Get a free 15-min consult." Specify the next action, such as "Take a 2-min tour." Avoid generic CTAs to boost conversions.
SEOFOMO News is a real-time news community for SEO and digital marketing professionals that provides updates without the distractions of social media. The platform prioritizes high-quality content and fosters insightful discussions. Users can contribute news, updates, and resources while engaging in positive, moderated conversations.
Circular economies are based on three principles: eliminating waste and pollution, circulating products and materials, and regenerating nature. For marketers, circular business models offer a way to build brand differentiation, especially in mature markets where brand growth is currently fought for, often via small incremental additions to products. Marketers should move from one-off pilots towards core circular revenue generation models, from transactional towards long-lasting customer-brand relationships, from niche towards mass-market appeal, and from sales-driven KPIs towards value-focused outcomes.
With a 1% success rate in cold email outreach and high LinkedIn ad costs, the new “pay-per-pitch” trend - where companies pay prospects for meetings - promises a nearly 100% engagement rate. Yotpo's viral $1,000 intro offer exemplifies this approach, trading ad budgets for guaranteed attention and stronger trust. This method is reshaping B2B sales as companies prioritize direct compensation for engagement over traditional, less effective channels.
TV advertising remains valuable for driving web traffic. Research by the Video Advertising Bureau (VAB) showed that 931 first-time advertisers collectively invested over $4 billion since 2021, with brands seeing an average 12% increase in website traffic during their debut month and sustained growth of 20%. Direct-to-consumer brands stood out, achieving an average increase of 622K unique monthly visitors, and brands spending over $10 million saw a 36% initial boost and 42% sustained growth. Although first-time advertisers typically increased their spending after initial campaigns, the rate of growth in investments decreased each year.
Social creative now drives reach in marketing, marking a shift where it leads campaigns instead of being an afterthought.
Psychology-backed mental models like authority bias, confirmation bias, and price anchoring can enhance how well content resonates with target audiences.
A guide on how to access and set up TikTok Shop for your business.
JavaScript generator functions provide a way to create lazy iterators, allowing on-demand data processing for tasks like handling large datasets or infinite sequences. They allow for the creation of custom iterators without loading all elements into memory, which is helpful for complex operations such as generating prime numbers or managing unique identifiers. Generators support two-way message passing, which can be used to mimic async/await syntax in JavaScript.
2024.11.11·links.tldrnewsletter.com·18 min read·TLDR Web Dev NoSQL database schemas evolve over time. Evolving them in an efficient manner requires a good understanding of keys, indexes, and queries. For example, knowing how to set and use composite primary keys and secondary indexes is necessary for handling various search and sort requirements. This article goes into how to evolve NoSQL schemas, with a deep dive into both concepts and also advanced issues like getting around the issue of partition limits by using shard keys.
2024.11.11·links.tldrnewsletter.com·25 min read·TLDR Web Dev This developer discusses an interesting software development methodology where developers start a feature each day and delete it if not completed, repeating the process until success. This encourages frequent rewrites, leading to cleaner code and a deeper understanding of the problem.
Starting new projects has a cost of maintenance due to framework versions and dependencies going out of date. Using solutions like plain PHP and considering commitment levels beforehand can make sure a new project survives to see long-term usage.
This article provides a comprehensive guide on how to navigate salary expectations questions during job interviews. For example, disclosing your current salary or expected salary can reduce your negotiation power.
2024.11.11·fearlesssalarynegotiation.com·34 min read·TLDR Web Dev Mergiraf is a tool designed to resolve Git merge conflicts by understanding the structure of files in various programming languages. It can be configured to automatically resolve conflicts during common Git operations like merging, rebasing, and cherry-picking.
Jawsm is an experimental JavaScript to WebAssembly compiler written in Rust that aims to achieve 100% JavaScript language support without requiring a compiled interpreter.
skellyCSS is a lightweight CSS framework for quickly implementing skeleton loaders in web projects. It offers various customization options like line width, alignment, and image shapes.
In this post, the CTO of Roots, a mindfulness app, goes through his approach to leading a remote team. Leading a remote team requires having a strong vision and hiring highly independent people. In terms of team culture, Roots' team focuses on investing in the right features before hiring more people and prioritizing thoughtful product development over rapid releases.
2024.11.11·zaidesanton.substack.com·11 min read·TLDR Web Dev There are various typesetting engines available, and they can be evaluated on some key criteria: Knuth Plass line breaking algorithm, CJK typesetting support, pagination, and instant preview. This article goes over HTML and CSS, LaTeX.js, Typst, and React-pdf. Only LaTeX consistently meets all the requirements.
Exponential distributions come into play in various fields like queueing theory, control theory, and performance modeling. The "memoryless" property of the exponential distribution makes it useful for simulating systems involving events occurring independently at random intervals. This post explains how to simulate such events using the exponential distribution and provides an example of how to model a queuing system with code.
Best practices for creating accessible and user-friendly login and sign-up forms include setting autocomplete attributes, using appropriate input types, and handling network latency and errors.
Procrastination can stem from a fear of not being good enough and the anxiety of others' opinions.
The ??= operator can be used to handle null and undefined values in JavaScript by only assigning a new value if the current is null or undefined.
A curated list of open-source boilerplates and starter templates for web dev, mobile dev, and Chrome extensions.
Sponsored
Vanta's State of Trust Report [4] uncovers key trends in security, compliance, and the future of trust based on a survey of 2,500 business and IT leaders.
iOS 18.1 can display emoji reactions from Android users correctly. iOS was unable to display message reactions correctly when RCS first launched on the platform in September. Apple has been ignoring Google's campaign to adopt RCS for years, only complying after pressure from both China and the EU. The company will likely keep as many exclusive features as possible for its iMessage service as long as it isn't forced to change.
2024.11.08·theverge.com·2 min read·TLDR Meta Lab, a pop-up experiential retail space for Ray-Ban Meta Smart Glasses, will open on November 8 in Los Angeles. The temporary store will allow customers to try out the glasses and customize glasses cases. There will be events with various creators, live podcasts, and cooking classes. The store will close on December 31. Another Meta Lab experience is planned for Phoenix at the end of January.
2024.11.08·theverge.com·2 min read·TLDR Scientists have successfully stirred a supersolid, a strange type of matter that is both rigid and fluid, for the first time. Supersolids have the properties of both solids and superfluids - a fraction of atoms flow friction-free through a lattice of a rigid crystal structure. Stirring the supersolid resulted in tiny whirlpools called quantized vortices, an indication of superfluidity. The breakthrough will make it possible to simulate phenomena in the lab that normally occur under truly extreme conditions, like in the hearts of neutron stars.
2024.11.08·sciencealert.com·4 min read·TLDR New research suggests that microplastics in the air could affect weather and climate by producing clouds in conditions where they would not form otherwise. Clouds form when water vapor sticks to tiny floating particles in the atmosphere. Water droplets with microplastic particles can produce ice crystals at temperatures 5 to 10 degrees Celsius warmer than droplets without microplastics. Precipitation typically starts as ice particles. More information about microplastic concentrations at the altitudes where clouds form is needed before scientists can make theories on how exactly microplastics affect weather and climate.
2024.11.08·arstechnica.com·5 min read·TLDR Sponsored
All of today's popular AI chatbots censor the responses. Venice uses leading open-source AI technology to deliver uncensored, unbiased machine intelligence, while preserving your privacy. Try uncensored AI for free [9], or use code TLDR20 for 20% off the Pro version [9].
Deploying modern web apps has become so hard that many developers have become reliant on Platform-as-a-Service. Rails 8 includes tools to make the process more simple. These include Kamal 2, a tool that turns fresh Linux boxes into application or accessory servers with just a single command, and Thruster, a proxy that provides X-Sendfile acceleration, asset caching, and asset compression. This blog post covers the highlights of the new Rails release.
2024.11.08·rubyonrails.org·10 min read·TLDR BemiDB is a simple and cost-effective cloud analytics platform. It connects and automatically synchronizes data from existing PostgreSQL databases and other data sources, storing data in a columnar format that's ready for querying. BemiDB makes data accessible for analysis in near real-time without additional pipelines or transformations.
2024.11.08·github.com·GitHub repository·TLDR