About 21 results
https://octet-stream.net/b/scb/2026-04-11-promoting-use-of-fine-grained-pats.html · 11 Apr 2026
HOME BLOGS PROJECTS GITHUB 11 April 2026 Software development is becoming an increasingly risky business. Supply chain attacks are more frequent than ever, and those of us using agentic LLMs run the risk that it will add a dependency automatically...
https://anil.recoil.org/notes/internet-immune-system · 8 Apr 2026 · 🦋 Bluesky
Anthropic's Mythos makes autonomous vulnerability chaining across devices a sudden reality, so I've been thinking about how digital 'antibotty' inoculation networks may be needed far sooner than I expected.
https://quasigod.xyz/blog/xss-via-indirect-prompt-injection · 31 Mar 2026
A short writeup of how I found a stored XSS vulnerability in an AI-powered writing app
https://unceman.leaflet.pub/3mhga62qyn224 · 19 Mar 2026
Find an insecure configuration and prevent it from happening again.
https://octet-stream.net/b/scb/2026-01-30-mie-soft-mode.html · 29 Jan 2026 · 🦋 Bluesky
HOME BLOGS PROJECTS GITHUB 30 January 2026 I wrote previously that I was having difficulty making Apple's Memory Integrity Enforcement feature do what it says on the tin. After getting some help from Eskimo on the developer forums I'm pleased to r...
https://octet-stream.net/b/scb/2026-01-14-difficulties-enabling-apples-mie.html · 14 Jan 2026 · 🦋 Bluesky
14 January 2026 I previously blogged a demo in which I activated Apple's new hardware memory tagging feature, part of Memory Integrity Enforcement. This could accurately detect at runtime when I had overflowed a buffer or caused a use-after-free. Very ne...
https://octet-stream.net/b/scb/2026-01-12-progress-in-standard-site-validation.html · 12 Jan 2026 · 🦋 Bluesky
12 January 2026 A few days ago I published a simple validation tool for standard.site, which is a proposed standard for announcing long-form content on the ATProto network. (I explained what this is about in a previous post.) My tool is relatively sim...
https://octet-stream.net/b/scb/2026-01-03-including-rust-in-an-xcode-project-with-pointer-auth-arm64e.html · 3 Jan 2026 · 🦋 Bluesky
3 January 2026 When you add the "Enhanced Security" Capability to an iOS app in Xcode, one of the options is "Authenticate Pointers" (ENABLE_POINTER_AUTHENTICATION). This is checked by default. Therefore somebody who is adding this Capability in order to...
https://octet-stream.net/b/scb/2025-12-16-experiments-with-memory-integrity-enforcement.html · 16 Dec 2025 · 🦋 Bluesky
16 December 2025 Imagine if you could write C code and the computer would detect and abort immediately if you wrote one byte past the end of your heap allocation—or if you tried to access it after it was freed. It sounds like AddressSanitizer, right? I...
https://octet-stream.net/b/scb/2025-09-16-protect-your-keys-with-the-secure-enclave.html · 20 Sep 2025 · 🦋 Bluesky
20 September 2025 This is the transcript and slides from a presentation I gave at /dev/world in Melbourne on September 4, 2025, describing how the Secure Enclave works to protect cryptographic keys in Apple devices, building up to a demo where we perform...